ML16207A570

From kanterella
Jump to navigation Jump to search
Revision 18 to Updated Safety Analysis Report, Chapter 15, Accident Analysis
ML16207A570
Person / Time
Site: South Texas  STP Nuclear Operating Company icon.png
Issue date: 04/28/2016
From:
South Texas
To:
Office of Nuclear Reactor Regulation
Shared Package
ML16207A547 List: ... further results
References
NOC-AE-16003371
Download: ML16207A570 (277)
v • d • e


Text

STPEGS UFSAR 15.0-1 Revision 1 8 15.0 ACCIDENT ANALYSIS This chapter addresses the representative initiating events listed on pages 15

-10, 15-11, and 15

-16 of Regulatory Guide (RG) 1.70, Rev. 2, as they apply to the South Texas Project Electric Generating Station (STPEGS).

Certain items in the guide warrant comment, as follows:

Items 1.3 and 2.1

- There are no pressure regulators in the Nuclear Steam Supply System (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.

Item 6.2 - No instrument lines from the Reactor Coolant System (RCS) boundary in the NSSS PWR design penetrate the Containment (Ref. 15.0

-11).

15.0.1 Classification of Plant Conditions

Since 1970 the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are:

1. Condition I:

Normal Operation and Operational Transients

2. Condition II:

Faults of Moderate Frequency

3. Condition III:

Infrequent Faults

4. Condition IV:

Limiting Faults

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur.

Where applicable, Reactor Trip System (RTS) and Engineered Safety Features (ESFs) functioning is assumed to the extent allowed by considerations, such as the single failure criterion, in fulfilling this principle.

15.0.1.1 Condition I

- Normal Operation and Operational Transients. Conditional I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III, and IV). In this regard, analysis of each fault condition described is generally based upon a conservative set of initial conditions corresponding to adverse conditions which can occur during Condition I operation.

A typical list of Condition I events is as follows:

1. Steady state and shutdown operations

STPEGS UFSAR 15.0-2 Revision 1 8 a. Power operation (>5 to 100 percent of rated thermal power)

b. Startup (Keff 0.99, 5 percent of rated thermal power)
c. Hot standby (subcritical, Residual Heat Removal System (RHRS isolated)
d. Hot shutdown (subcritical, RHRS in operation)
e. Cold shutdown (subcritical, RHRS in operation)
f. Refueling
2. Operation with permissible deviations

Various deviations which may occur during continued operation, as permitted by the plant Technical Specifications, must be considered in conjunction with other operational modes. These include:

a. Operation with components or systems out of service
b. Leakage from fuel with clad defects
c. Radioactivity in the reactor coolant
1) Fission products
2) Corrosion products
3) Tritium d. Operation with steam generator (SG) leaks up to the maximum allowed by the Technical Specifications
e. Testing as allowed by the Technical Specifications
3. Operational transients
a. Plant heatup and cooldown (up to 100F/hour for the RCS, 200F/hour for the pressurizer during cooldown, and 100F/hour for the pressurizer during heatup)
b. Step load changes (up to 10 percent)
c. Ramp load changes (up to 5 percent/minute
d. Load rejection up to and including design full load rejection transient

STPEGS UFSAR 15.0-3 Revision 1 8 15.0.1.2 Condition II

- Faults of Moderate Frequency

. These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or RCS or secondary system overpressurization.

For the purposes of this report, the following faults are included in this category:

1. Feedwater (FW) system malfunctions that result in a decrease in FW temperature (Section 15.1.1)
2. FW system malfunctions that result in an increase in FW flow (Section 15.1.2)
3. Excessive increase in secondary steam flow (Section 15

.1.3)

4. Inadvertent opening of an SG relief or safety valve (Section 15.1.4)
5. Loss of external electrical load (Section 15.2.2)
6. Turbine trip (Section 15.2.3)
7. Inadvertent closure of main steam isolation valves (MSIVs) (Section 15.2.4)
8. Loss of condenser vacuum and other events resulting in turbine trip (Section 15.2.5)
9. Loss of nonemergency AC power to the station auxiliaries (Section 15.2.6)
10. Loss of normal FW flow (Section 15.2.7)
11. Partial loss of forced reactor coolant flow (Section 15.3.1)
12. Uncontrolled rod cluster control assembly (RCCA) bank withdrawal from a subcritical or low power startup condition (Section 15.4.1)
13. Uncontrolled RCCA bank withdrawal at power (Section 15.4.2)
14. RCCA misalignment (dropped assembly, dropped assembly bank, or statically misaligned assembly) (Section 15.4.3)
15. Startup of an inactive reactor coolant pump (RCP) at an incorrect temperature (Section 15.4.4)
16. Chemical and Volume Control System (CVCS) malfunction that results in a decrease in the boron concentration in the reactor coolant (Section 15.4.6)
17. Inadvertent operation of the Emergency Core Cooling System (ECCS) during power operation (Section 15.5.1)
18. CVCS malfunction that increases reactor coolant inventory (Section 15.5.2)

STPEGS UFSAR 15.0-4 Revision 1 8 19. Inadvertent opening of a pressurizer safety or relief valve (Section 15.6.1)

20. Break in instrument line or other lines from reactor coolant pressure boundary (RCPB) that penetrate Containment (Section 15.6.2)

15.0.1.3 Condition III

- Infrequent Faults

. By definition, Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods, although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the RCS or Containment barriers. For the purposes of this report, the following faults are included in this category:

1. Steam system piping failure (minor) (Section 15.1.5)
2. Complete loss of forced reactor coolant flow (Section 15.3.2)
3. RCCA misalignment (single rod cluster control assembly withdrawal at full power) (Section

15.4.3)

4. Inadvertent loading and operation of a fuel assembly in an improper position (Section 15.4.7)
5. Loss of coolant accidents (LOCAs) resulting from a spectrum of postulated piping breaks within the RCPB (small break) (Section 15.6.5)
6. Postulated radioactive ground releases due to liquid tank failures (Section 15.7.3)
7. Spent fuel cask drop accidents (Section 15.7.5)

15.0.1.4 Condition IV

- Limiting Faults

. Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10CFR100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault, including those of the ECCS and the Containment. For the purposes of this report the following faults have been classified in this category:

1. Steam system piping failure (major) (Section 15.1.5)
2. FW system pipe break (Section 15.2.8)
3. RCP shaft seizure (locked rotor) (Section 15.3.3)
4. RCP shaft break (section 15.3.4)
5. Spectrum of RCCA ejection accidents (Section 15.4.8)

STPEGS UFSAR 15.0-5 Revision 1 8 6. SG tube failure (Section 15.6.3)

7. LOCAs resulting from the spectrum of postulated piping breaks within the RCPB (large break) (Section 15.6.5)
8. Design basis fuel handling accidents (Section 15.7.4) 15.0.2 Optimization of Control Systems A control system setpoint study has been performed in order to simulate performance of the reactor control and protection systems. In this study, emphasis is placed upon the development of a control system which will automatically maintain prescribed conditions in the plant, even under a conservative set of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints is determined. In areas where the resultant setpoints are different, compromises based upon optimum overall performance are made and verified. A consistent set of control system parameters is derived satisfying plant operational requirements throughout the core life and for various levels of power operation.

The study comprises an analysis of the following control systems:

RCCA, steam dump, SG water level, pressurizer pressure, and pressurizer water level.

15.0.3 Plant Characteristics and Initial Conditions Assumed in the Accident Analyses Many non-LOCA events presented in this section have been analyzed in support of the replacement steam generator program using the RETRAN code. Several other events were simply evaluated because explicit reanalysis to account for the new steam generator type was deemed unnecessary.

This was either because the analysis of the event does not employ a detailed steam generator model or the transient results are not sensitive to changes in the steam generator model. The UFSAR sections of those events that were evaluated continue to reflect results of analyses performed to support the upgrade to Vantage 5H fuel with the original steam generators. It should be noted that these analyses, aside from not modeling the replacement steam generators, could also have assumptions that differ slightly from the values presented in this section. However, all such differences have been addressed as part of the evaluations discussed above. As such, all analysis parameter values presented in this section of the UFSAR are those currently supported for the STP units either directly (via explicit analysis) or indirectly (via evaluation). The non

-LOCA events not explicitly reanalyzed for the replacement steam generator program are as follows:

UFSAR Section 15.1.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature UFSAR Section 15.1.3 Excessive Increase in Secondary Steam Flow UFSAR Section 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a Depressurization of the Main Steam System UFSAR Section 15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow UFSAR Section 15.2.2 Loss of External Electrical Load

STPEGS UFSAR 15.0-6 Revision 1 8 UFSAR Section 15.2.4 Inadvertent Closure of Main Steam Isolation Valves UFSAR Section 15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip UFSAR Section 15.3.1 Partial Loss of Forced Reactor Coolant Flow UFSAR Section 15.3.2 Complete Loss of Forced Reactor Coolant Flow UFSAR Section 1

5.3.3 Reactor

Coolant Pump Shaft Seizure (Locked Rotor)

UFSAR Section 15.3.4 Reactor Coolant Pump Shaft Break UFSAR Section 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition UFSAR Section 15.

4.2 Uncontrolled

Rod Cluster Control Assembly Bank Withdrawal at Power UFSAR Section 15.4.3 Rod Cluster Control Assembly Misoperation UFSAR Section 15.4.4 Startup of an Inactive Reactor Coolant Loop at an Incorrect Temperature UFSAR Section 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents UFSAR Section 15.5.1 Inadvertent Operation of ECCS During Power Operation UFSAR Section 15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory UFSAR Section 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve

15.0.3.1 Design Plant Conditions

. Table 15.0

-1 lists the power rating value which is assumed in analyses performed in this UFSAR. The guaranteed NSSS thermal power output includes the thermal power generated by the RCPs.

Where initial power operating conditions are assumed in accident analyses, the guaranteed NSSS thermal power output, plus allowance for errors in steady

-state power determination, is assumed. The thermal power values used for each transient analyzed are given in Table 15.0

-2. The values of other pertinent plant parameters utilized in the accident analyses are given in Table 15.0

-3. 15.0.3.2 Initial Conditions

. For accident evaluation, appropriately conservative initial conditions are obtained by considering bounding steady

-state errors in conjunction with rated values. The following steady

-state errors are covered:

Core power

+0.6% allowance for calorimetric error Average RCS temperature

+5.1 oF allowance for controller deadband and measurement error (unless otherwise specified in the text) Pressurizer pressure

+46 psi allowance for steady

-state fluctuations and measurement error (unless otherwise specified in the text)

STPEGS UFSAR 15.0-7 Revision 1 8 Initial values for core power, average RCS temperature, and pressurizer pressure are selected to minimize the initial departure from nucleate boiling ratio (DNBR) unless otherwise stated in the sections describing specific accidents. The range of programmed average RCS temperature supported by the accident analysis is illustrated on Figure 15.0

-1A. The nominal pressurizer water level control program supported by the accident analysis is illustrated on Figure 15.0

-1B. Table 15.0-2 summarizes the initial conditions and computer codes used in the accident analyses. Section 15.6.5 describes the specific initial conditions used to conduct the LOCA analyses.

15.0.3.3 Power Distribution

. The transient response of the reactor system is dependent upon the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of control rods and operating restrictions. Power distribution may be characterized by the radial peaking factor (FH) and the total peaking factor (F Q). The peaking factor limits are given in the Technical Specifications.

The radial peaking factor is of importance for transients which may be departure from nucleate boiling (DNB) limited. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated on Figure 15.0

-1C. All transients that may be DNB limited are assumed to begin with a FH consistent with the initial power level defined in the Technical Specifications.

The axial power shape used in the DNB calculation is discussed in Section 4.4.

The radial and axial power distributions described above are input to the THINC code or VIPRE code as described in Section 4.4.

The total peaking factor (F Q) is of importance for transients which may be overpower limited. All transients that may be overpower limited are assumed to begin with plant conditions, including power distributions, which are consistent with reactor operation as defined in the Technical Specifications.

For overpower transients which are slow with respect to the fuel rod thermal time constant, the fuel rod thermal evaluations are performed as discussed in Section 4.4. Examples are the CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant inventor y, which lasts many minutes, and the excessive increase in secondary steam flow incident which may reach equilibrium without causing a reactor trip.

For overpower transients which are fast with respect to the fuel rod thermal time constant, a detailed fuel heat transfer calculation must be performed. Examples are the uncontrolled RCCA bank withdrawal from subcritical or low power startup and RCCA ejection incidents which result in a large power rise over a few seconds. Although the fuel rod thermal time constant is a function of system conditions, fuel burnup and rod power, a typical value at beginning

-of-life for high power rods is approximately 5 seconds.

15.0.4 Reactivity Coefficients Assumed in the Accident Analyses The transient response of the reactor system is dependent upon reactivity feedback effects, in particular, the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.

STPEGS UFSAR 15.0-8 Revision 1 8 In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some analyses, such as loss of reactor coolant from cracks or ruptures in the RCS, do not depend upon reactivity feedback effects. The values used are given in Table 15.0

-2. Reference is made in that table to Figure 15.0

-2, which shows the upper and lower bound Doppler power coefficients, as a function of power, used in the transient analysis. The justifications for use of conservatively large versus small reactivity coefficient values are treated on an event

-by-event basis. In some cases, conservative combinations of parameters are used to bound the effects of core life. For example, in a load increase transient, it is conservative to use a small Doppler defect and a small moderator coefficient.

15.0.5 Rod Cluster Control Assembly Insertion Characteristics

The negative reactivity insertion following a reactor trip is a function of the acceleration of the RCCAs and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry, or approximately 85 percent of the rod cluster travel. The RCCA position versus time assumed in accident analyses is shown on Figure 15.0

-3. Both the rod position and the rod insertion time are normalized to the dashpot. The RCCA insertion time to dashpot entry is taken as 2.8 seconds, unless otherwise noted in the discussion.

Figure 15.0

-4 shows the fraction of total negative reactivity insertion versus rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve is used to compute the negative reactivity insertion versus time following a reactor trip which is input to all point kinetics core models used in transient analyses. The bottom skewed power distribution itself is not an input into the point kinetics core model.

There is inherent conservatism in the use of Figure 15.0

-4 in that it is based upon a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized RCCA negative reactivity insertion versus time is shown on Figure 15.0

-5. The curve shown in this figure was obtained from Figures 15.0

-3 and 15.0

-4. A total negative reactivity insertion of 4 percent k following a trip, equivalent to that of the most reactive rod in the withdrawn stuck position, is assumed in the transient analyses except where specifically noted. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4.3

-3. For Figures 15.0

-3 and 15.0

-5, the RCCA drop time is normalized to 2.8 seconds, unless otherwise noted for a particular event. The plant is assumed to be in manual rod control unless automatic control worsens the event. Insertion of control rods is neglected in the large break LOCA analysis.

The control rods are assumed to be fully inserted in the small break LOCA analysis.

The normalized RCCA negative reactivity insertion versus time curve (Figure 15.0

-5) for an axial power distribution skewed to the bottom is used in those transient analyses for which a point kinetics core model is used. Where special analyses require use of three

-dimensional or axial one

-dimensional core models, the negative reactivity insertion resulting from the reactor trip is calculated directly by the reactor kinetics code and is not separable from the other reactivity feedback effects. In this case, the RCCA position versus time of Figure 15.0

-3 is used as code input. All accident

STPEGS UFSAR 15.0-9 Revision 1 8 analysis results contained herein are applicable to hafnium or silver

-indium-cadmium type control rods. 15.0.6 Trip Points and Time Delays to Trip Assumed in Accident Analyses A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms (CRDMs). The loss of power to the CRDM coils causes the CRDM to release the RCCAs, which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the CRDMs. The total delay to trip is defined as the time delay from the time trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0

-4. Reference is made in that table to the overtemperature and overpower T trips shown on Figure 15.0

-1C. This figure was developed using the methodology in Reference 15.0

-14 and are discussed in Section 7.2.2.2.1 The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and setpoint error. Nominal trip setpoints are specified in the Technical Specifications. During plant startup tests, it will be demonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system channels will be calibrated and instrument response times determined periodically in accordance with the Technical Specifications. 15.0.7 Instrumentation Drift and Calorimetric Errors

The instrumentation drift and calorimetric errors used in establishing the protection system setpoints are presented in Reference 15.0

-10, Tables 1

-1, 1-2, and 1-3. The calorimetric error is the error assumed in the determination of core thermal power. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis. Core thermal power is obtained from measurement of FW flow, FW inlet temperature to the SGs, and steam pressure using high accuracy instrumentation when power is greater than approximately 30% of rated thermal power.

15.0.8 Plant Systems and Components Available for Mitigation of Accident Effects The NSSS is designed to afford proper protection against the possible effects of natural phenomena, postulated environmental conditions, and dynamic effects of the postulated accidents. In addition, the design incorporates features which minimize the probability and effects of fires and explosions. Reference 15.0

-9 discusses the quality assurance program which has been implemented to assure that the NSSS will satisfactorily perform its assigned safety functions. The incorporation of these features in the NSSS, coupled with the reliability of the design, ensures that the normally operating systems and components listed in Table 15.0

-6 will be available for mitigation of the events discussed in Chapter 15. In determining which systems are necessary to mitigate the effects of these postulated events, the classification system of ANSI N18.2

-1973 is utilized. The design of safety

-related systems (including protection systems) is consistent with Institute of Electrical and Electronics Engineers (IEEE) 379

-1972 and RG 1.53 in the application of the single failure criterion.

STPEGS UFSAR 15.0-10 Revision 1 8 In the analysis of the Chapter 15 events, control system action is considered only if that action results in more severe accident results. No credit is taken for control system operation if that operatio n mitigates the results of an accident. For some accidents, the analysis is performed both with and without control system operation to determine the worst case. The pressurizer heaters are modeled for events where precluding pressurizer overfill is an acceptance criterion. These events include Loss of Normal Feedwater, Loss of Non

-emergency A/C Power to the Station Auxiliaries, Inadvertent ECCS Actuation at Power, and CVCS malfunction that Increases Reactor Coolant Inventory. The transient response for these items is potentially more limiting than without modeling heaters since the backup heaters contribute to the thermal expansion of the water in the pressurizer. Both the proportional and backup heaters actuate on low pressurizer pressure. The backup heaters also actuate on high level water deviation.

15.0.8.1 Limiting Single Failures Assumed in Accident Analysis.

The most limiting single failure for each Chapter 15 event is listed in Table 15.0

-7. In certain instances, no single failure has been identified. In such cases, redundancy in protection equipment prevented a single failure from adversely affecting the consequences of the transient.

15.0.8.2 Charging Pumps Assumed in Accident Analysis.

The charging pumps continue to operate following the two CVCS malfunction events. As discussed in Section 15.5.2, the increase in reactor coolant inventory occurs when the pressurizer level channel used for charging in automatic control fails in the low direction. The letdown line is isolated while

maximum charging (one centrifugal and the positive displacement charging pumps) is delivered to the RCS. As discussed in Section 15.4.6, the boron dilution accident assumes unborated makeup water is delivered to the RCS by the two centrifugal charging pumps

. The steam generator tube rupture (Section 15.6.3) models operator actions required to recover from the event. During RCS depressurization, the charging pumps may be aligned to the pressurizer auxiliary spray. Following depressurization, the pumps are aligned for charging.

No credit is taken for the charging pumps during all other transients presented in Chapter 15. Depending on the transient, this assumption may have no effect or may be conservative in the evaluation of DNBR.

The operation of the charging pumps, in combination with the pressurizer power operated relief valves (PORVs), cannot result in an over

-pressurization of the RCS. Over

-pressurization of the RCS can only occur if the sum of the charging pump flow and expansion of the RCS fluid exceeds the capacity of the relief valve. Safety charging flow capacity is 53.1 lbm/sec at the PORV setpoint (2,350 psia). The total relief capacity for the two PORVs at 2,350 psia is 1,167 lbm/sec for steam and 171.8 lbm/sec for water. The relief flow due to thermal expansion from transients that could potentially overfill the pressurizer, such as the feedwater line break event, in combination with the charging flow will not result in relief flows exceeding the capacity of the PORVs. Therefore, operation of the charging pumps will not result in over

-pressurization of the RCS.

15.0.8.3 Operator Actions Assumed in Accident Analysis.

Automatic reactor trip will place the plant in a stable hot standby condition for most of the events analyzed in Chapter 15. If required, manual actions depend on the available safety and non

-safety systems, and strategies to mitigate and stabilize plant conditions provided in the emergency operating procedures (EOPs).

STPEGS UFSAR 15.0-11 Revision 1 8 In addition to event

-specific operator actions that are delineated in the EOPs, six safety functions are monitored and maintained by plant operators to ensure barriers to the release of radioactivity remain intact. The six safety functions in order of priority are subcriticality, core cooling, heat sink, RCS (pressure/temperature) integrity, containment integrity, and reactor coolant inventory. Status trees are provided to diagnose each safety function and restoration procedures referenced in the status trees direct operators to take certain actions to return the function(s) to within acceptable limits.

The safety analyses presented in Chapter 15 assume only safety

-related equipment is available to mitigate the consequences of the accidents. However, the operator may choose to use other available equipment in order to minimize plant challenges or environmental releases. As a minimum, decay heat must be removed via the steam generators (SGs) to maintain the hot standby condition. The main feedwater system and the turbine bypass system could be used for this purpose. The Auxiliary Feedwater System (AFWS) and the SG safety valves or PORVs are safety grade systems which could be used for this function. Operator action to refill the auxiliary feedwater storage tank (AFST) or to borate the RCS (for xenon decay) may be required if the unit remains at hot standby for extended periods. The AFST may be refilled from one of two nonsafety systems (Demineralized Water or Secondary Make

-up Storage Tank) or from the Essential Cooling Pond (ECP), while boric acid is added to the RCS via the safety grade Chemical and Volume Control System (CVCS).

Manual operator actions have been identified for (1) breaks in the RCS or secondary systems (Loss of Coolant Accident [Section 15.6.5], Main Steam Line Break [Section 6.2A.1.4], and Feedwater Line Break [Section 15.2.8]), Steam Generator Tube Rupture [Section 15.6.3], and (2) CVCS malfunctions (Boron Dilution [Section 15.4.6] and an Increase in Reactor Coolant Inventory [Section 15.5.2]).

Manual actions have also been identified for the Locked Rotor Event (Section 15.3.3), Failure of a Small Line Carrying Primary Coolant Outside Containment (Section 15.6.2), and Fuel Handling Accidents (Section 15.7.4). Manual operator actions have been included in the event sections.

15.0.8.4 Loss of Offsite Power

. The effects of a loss of offsite power are considered for Condition IV events. Condition II events are analyzed assuming offsite power is available with the exception of the Loss of Nonemergency AC Power to the Station Auxiliaries. This event is the Loss of Normal Feedwater transient without offsite power.

Grid stability analyses have shown that the grid will remain stable and that offsite power will not be lost because of a unit trip from 100 percent power. In the unlikely event a turbine trip resulted in a LOOP, a two second time delay can be assumed between the reactor trip resulting from the Condition II event and a LOOP. The two second delay is a conservative assumption based on grid stability analyses.

The minimum DNBR and rod motion for most of the Condition II events occur in less than two seconds after reactor trip. Should a LOOP occur two seconds after reactor trip, the RCPs would coast down at the same rate as the complete loss of flow analysis (Section 15.3.2). Since the coastdown is occurring after the time of minimum DNBR and the reactor power is decreasing rapidly due to rod motion, the minimum DNBR is not adversely affected. For the cases where the minimum DNBR occurs after the conservatively assumed two second delay, it is easy to show that should a loss of offsite power occur two seconds after reactor trip, the results would be bounded by the complete loss of flow. 15.0.9 Residual Decay Heat

STPEGS UFSAR 15.0-12 Revision 1 8 Residual heat in a subcritical core is calculated for the loss of coolant accident (LOCA) per the requirements of Appendix K of 10CFR50.46 (Ref. 15.0

-1), as described in References 15.0

-2 and 15.0-3. These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For all other accidents, unless otherwise noted in the text, the same models are used except that fission product decay energy is based upon core average exposure at the end of the equilibrium cycle.

15.0.10 Computer Codes Utilized

Summaries of some of the principal computer codes used in transient analyses are given below. Other codes, in particular very specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the RCS pipe rupture. (Section 15.6), are summarized in their respective accident analysis sections. The codes used in the analyses of each transient have been listed in Table 15.0

-2. 15.0.10.1 FACTRAN. FACTRAN calculates the transient temperature distribution in a cross section of a metal

-clad, uranium dioxide fuel rod and the transient heat flux at the surface of the clad, using the nuclear power and the time

-dependent coolant parameters (pressure, flow, temperature, and density) as inputs. The code uses a fuel model which exhibits the following features simultaneously:

1. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.
2. Material properties which are functions of temperature and a sophisticated fuel

-to-clad gap heat transfer calculation.

3. The necessary calculations to handle post

-DNB transients:

film boiling heat transfer correlations, zircaloy

-water reaction, and partial melting of the materials.

FACTRAN is further discussed in Reference 15.0

-4. 15.0.10.2 LOFTRAN. The LOFTRAN program is used for studies of transient response of a PWR system to specified perturbations in process parameters. LOFTRAN simulates a

multiloop system by a model containing reactor vessel, hot and cold leg piping, SG (tube and shell sides), and the pressurizer. The pressurizer heaters, spray, relief and safety valves are also considered in the program. Point model neutron kinetics and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary side of the SG utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The RTS is simulated to include reactor trips on high neutron flux, overtemperature T, overpower T, high and low pressurizer pressure, low reactor coolant flow, and high pressurizer level. Control systems are also simulated including rod control, steam dump, FW control, and pressurizer pressure control. The ECCS, including the accumulators, is also modeled.

LOFTRAN is a versatile program which is suited to both accident evaluation and control studies, as well as parameter sizing.

LOFTRAN also has the capability of calculating the transient value of DNBR based upon the input from the core limits illustrated on Figure 15.0-1C. The core limits represent the minimum value of DNBR as calculated for typical or thimble cell.

STPEGS UFSAR 15.0-13 Revision 1 8 LOFTRAN is further discussed in Reference 15.0

-5. 15.0.10.3 TWINKLE. The TWINKLE program is a multidimensional, spatial neutron kinetics code, which was patterned after steady

-state codes presently used for reactor core design. The code uses an implicit finite

-difference method to solve the two

-group transient neutron diffusion equations in one, two, and three dimensions. The code uses six delayed neutron groups and contains a detailed multiregion fuel

-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 2,000 spatial points and performs its own steady-state initialization. Aside from basic cross section data and thermal

-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits are provided such as channel wise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.

The TWINKLE code is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is further described in Reference 15.0

-8.

15.0.10.4 THINC. The THINC code is described in Section 4.4.

15.0.10.5 RETRAN. The RETRAN computer program is used for studies of transient response of a pressurized water reactor system to specified perturbations in process parameters.

RETRAN simulates a multi

-loop system by a lumped parameter model containing the reactor vessel, hot and cold leg piping, steam generator (tube and shell sides), and the pressurizer. The pressurizer heaters, spray, relief, and safety valves may also be modeled by the program. Point model neutron kinetics and reactivity effects of the moderator, fuel, boron, and control rods are also included.

The secondary side of the steam generator uses a detailed nodalization. The reactor protection system is simulated to include reactor trips on high pressurizer pressure, high pressurizer water level, overtemperature T, low-low steam generator water level, etc. Control systems are also simulated including rod control and pressurizer pressure control. Portions of the emergency core cooling system (i.e., safety injection flow), including the accumulators, are also capable of being modeled.

In RETRAN, a conservative evaluation of the effect on fuel cladding is performed. Using the RETRAN code, the transient value of DNBR, based on the input from the core thermal limits, is calculated. The DNB portion of the core thermal limits define the locus of conditions where the DNBR value is equal to the safety analysis limit for the appropriate DNB correlation. The DNBR calculation performed is a partial derivative approximation of the DNB core limits lines.

RETRAN does not perform direct calculations of the critical heat flux ratio. Rather, the partial derivative values are applied to the limit value input to RETRAN and are intended to approximate the change in DNBR with respect to the process parameters of power, pressure, and temperature. The nominal DNBR value input is the lesser value calculated at nominal conditions for a typical fuel cell

or a thimble fuel cell. Consistent with the Westinghouse licensing approach, the application of the partial derivative values has been shown to yield both a conservative means of confirming that the DNB design basis is met and a reliable indicator of the relative trend of DNBR with time, although this method yields only approximate values of the absolute DNBR.

STPEGS UFSAR 15.0-14 Revision 1 8 Note that for limiting DNB events (e.g., loss of flow and locked rotor) and for DNB events analyzed at or near zero power (e.g., steamline break), statepoints are generated and transmitted to the thermal-hydraulic designer for a detailed DNBR analysis and confirmation that the DNBR limit is met. A more detailed description of the RETRAN code is available in References 15.0

-12 and 15.0

-13. 15.0.10.6 VIP RE . The VIPRE code is described in Section 4.4 15.0.11 Summary of Accident Results

For all Condition II transients analyzed in the UFSAR, the calculated minimum DNBR is greater than the safety analysis limit value (Section 4.4). For each of these transients, the peak RCS pressure is less than the safety limit of 110 percent of design pressure (2,750 psia) and there is no failed fuel as a result of the transient. For all of the applicable Condition III transients, the minimum DNBR is greater than the safety analysis limit value and there is no failed fuel, except a single RCCA withdrawal at full power. For this transient, the upper bound of the number of fuel rods experiencing DNBR less than the safety analysis limit value is 5 percent of the total rods in the core. All of the applicable Condition III transients experience a peak RCS pressure less than 2,750 psia.

All the applicable Condition IV transients analyzed in the UFSAR have a minimum DNBR greater than or equal to the safety analysis limit value except LOCA, locked RCP rotor, and rod ejection. For these three transients, the amount of failed fuel is 100 percent, 10 percent, and 10 percent, respectively. Major rupture of a steam line experiences 5 percent failed fuel. All other applicable transients have no failed fuel. All of the applicable Condition IV transients experience a peak RCS pressure less than 2,750 psia.

Block diagrams identifying various protection sequences for Chapter 15 events are provided in Figures 15.0-7 through 15.

0-31.

STPEGS UFSAR 15.0-15 Revision 1 8 REFERENCES Section 15.0:

15.0-1 "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors," 10CFR50.46 and Appendix K of 10CFR50.

15.0-2 Bordelon, F. M., et al., "SATAN

-VI Program: Comprehensive Space

-Time Dependent Analysis of Loss of Coolant," WCAP

-8302 (Proprietary) and WCAP-8306 (Nonproprietary), June 1974.

15.0-3 Bordelon, F.M., et al., "LOCTA

-IV Program: Loss of Coolant Transient Analysis," WCAP-8301 (Proprietary) and WCAP

-8305 (Nonproprietary), June 1974.

15.0-4 Hargrove, H.G., "FACTRAN

- A Fortran-IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP

-7908-A, December 1989.

15.0-5 Burnett, T. W., et al., "LOFTRAN Code Description," WCAP

-7907-P-A, (Proprietary Class 2), WCAP

-7907-A, (Proprietary Class 3), April 1984.

15.0-6 Barry, R. F., "LEOPARD

- A Spectrum Dependent Non

-Spatial Depletion Code for the IBM-7094," WCAP

-3269-26, September 1963.

15.0-7 Barry, R. F. and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code," WCAP-7213-P-A (Proprietary) and WCAP

-7758-A (Nonproprietary), January 1975.

15.0-8 Risher, D. H., Jr. and Barry, R. F., "TWINKLE

- A Multi-Dimensional Neutron Kinetics Computer Code," WCAP

-7979-P-A (Proprietary) and WCAP

-8028-A (Nonproprietary), January 1975.

15.0-9 "Westinghouse Electric Corporation Energy Systems Business Unit Quality Management System," Rev. 2 approved by the NRC April 10, 1997.

15.0-10 STPNOC Design Specification 5Z010ZS1101, "Precautions, Limitations, and Setpoints," Rev. 3 15.0-11 American National Standards Institute (ANSI) N18.2, "Nuclear Safety Criteria for the Design of Stationary PWR Plants," Section 5, 1973.

15.0-12 C. E. Peterson, et al., "RETRAN A Program for Transient Thermal

-Hydraulic Analysis of Complex Fluid Flow Systems," EPRI NP

-1850-CCM, Rev. 6, December 1995.

15.0-13 D. S. Huegel, et al., "RETRAN

-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non

-LOCA Safety Analyses," WCAP

-14882-P-A (Proprietary), April 1999.

15.0-14 WCAP-8745-P-A, "Design Bases for the Thermal Overpower T and the Thermal Overtemperature T Trip Functions," September 1986.

STPEGS UFSAR 15.0-16 Revision 1 8 REFERENCES (Continued)

Section 15.0:

15.0-15 ST-HL-AE-3236, dated October 12, 1989, "Steam Generator Tube Rupture Analysis" 15.0-16 Deleted STPEGS UFSAR 15.0-17 Revision 1 8 TABLE 15.0

-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS Guaranteed NSSS thermal power output, MWt 3,874 Thermal power generated by the reactor coolant pumps, MWt 21 Guaranteed core thermal power, MWt 3,853

15.0-18 Revision 1 8 STPEGS UFSAR TABLE 15.0

-2

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES Reactivity Coefficients Assumed

Faults Computer Codes Utilized Moderator Temperature (pcm/ F) Moderator Density

( k/gm/cm 3)

Doppler Thermal Design Procedure Thermal Power Output Assumed (b, c, g) (MWt) 15.1 Increase in Heat Removal by the Secondary System Feedwater system malfunctions causing an increase in feedwater flow LOFTRAN, RETRAN - upper (d) lower(a) RTDP 0 and 3,874 Excessive increase in secondary steam flow (No explicit analysis performed, see Section 15.1.3)

Inadvertent opening of a steam generator relief or safety valve (Bounded by steam system piping failure) - Function of moderator density (see Section 15.1.4, Figure 15.1

-11) See Section 15.1.4 STDP 0 (Subcritical)

Steam system piping failure RETRAN, THINC, VIPRE - Function of moderator density (see Section 15.1.5, Figure 15.1

-11) See Section 15.1.5 STDP 0 (Subcritical) 15.2 Decrease in Heat Removal by the Secondary System Loss of external electrical load and/or turbine trip (DNB cases)

RETRAN - lower(d) lower RTDP 3,874 (Peak pressure cases) RETRAN (e) lower STDP 3,821 a. See Figure 15.0

-2. b. A minimum of 0.6 percent margin is added to the values shown for analysis purposes, when appropriate.

c. Values of 0 and 3800 represent core power rather than NSSS power (See Table 15.0

-1). d. See Figure 15.0

-6. e. Part-power sensitivity demonstrated the acceptability of +5pcm/F to 70% power and ramping down to 0 pcm/F at 100% rated thermal power.

f. RTDP methodology is used to calculate fraction of rods in DNB while STDP methodology is used for evaluation of the pressure and temperature transient.
g. Although several analyses are based on a core power of 3800 MWt (NSSS powers of 3817 MWt or 3821 MWt), an updated core power of 3853 MWt (NSSS power of 3874 MWt) is supported via an evaluation that addresses a reduction in power uncertainty from 2% to 0.6%.
h. RTDP methodology is used for the DNB analysis while STDP methodology is used for the RCS pressure analysis.

15.0-19 Revision 1 8 STPEGS UFSAR TABLE 15.0

-2 (Continued)

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES Reactivity Coefficients Assumed Faults Computer Codes Utilized Moderator Temperat ure (pcm/ F) Moderator Density

( k/gm/cm 3) Doppler Thermal Design Procedure Thermal Power Output Assumed (b, c, g) (MWt) Loss of nonemergency AC power to the station auxiliaries (Results bounded by the complete loss of forced reactor coolant flow and loss of normal feedwater with loss of AC power)

Loss of normal feedwater flow RETRAN (e) - upper(a) STDP 3821 Feedwater system pipe break RETRAN - upper(d) upper STDP 3821 15.3 Decrease in Reactor Coolant System Flow Rate Partial and complete loss of forced reactor coolant flow LOFTRAN, FACTRAN, THINC, VIPRE - lower (d) upper(a) RTDP 3824 Reactor coolant pump shaft seizure (locked rotor) LOFTRAN, FACTRAN, THINC, VIPRE (e) upper(a) RTDP (f) 3824 15.4 Reactivity and Power Distribution Anomalies Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or lower power startup condition TWINKLE, FACTRAN, THINC, VIPRE Refer to Section 15.4.1.2 - Refer to Section 15.4.1.2 STDP 0 a. See Figure 15.0

-2. b. A minimum of 0.6 percent margin is added to the values shown for analysis purposes, when appropriate.

c. Values of 0 and 3800 represent core power rather than NSSS power (See Table 15.0

-1). d. See Figure 15.0

-6. e. Part-power sensitivity demonstrated the acceptability of +5pcm/F to 70% power and ramping down to 0 pcm/F at 100% rated thermal power. f. RTDP methodology is used to calculate fraction of rods in DNB while STDP methodology is used for evaluation of the pressure and temperature transient.

g. Although several analyses are based on a core power of 3800 MWt (NSSS powers of 3817 MWt or 3821 MWt), an updated core power of 3853 MWt (NSSS power of 3874 MWt) is supported via an evaluation that addresses a reduction in power uncertainty from 2% to 0.6%.
h. RTDP methodology is used for the DNB analysis while STDP methodology is used for the RCS pressure analysis.

15.0-20 Revision 1 8 STPEGS UFSAR TABLE 15.0

-2 (Continued)

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES Reactivity Coefficients Assumed Faults Computer Codes Utilized Moderator Temperature (pcm/ F) Moderator Density

( k/gm/cm 3) Doppler Thermal Design Procedure Thermal Power Output Assumed (b, c, g) (MWt) Uncontrolled rod cluster control assembly bank withdrawal at power LOFTRAN, RETRAN lower and upper(e) lower and upper(d) lower and upper(a) RTDP(h) 387.4 to 3,874 Rod cluster control assembly misalignment LOFTRAN, THINC VIPRE, RETRAN 0 ~ -35 N/A lower(a) RTDP 3,874 Startup of an inactive reactor coolant loop at an incorrect temperature LOFTRAN, FACTRAN, THINC

- upper(d) lower (a) STDP 2,672 Chemical and Volume Control System malfunction that results in a decrease in the boron concentration in the reactor coolant N/A N/A N/A N/A N/A 0 and 3,817 Inadvertent loading and operation of a fuel assembly in an improper position PHOENIX-P, ANC - N/A N/A - 3,800 a. See Figure 15.0

-2. b. A minimum of 0.6 percent margin is added.

c. Values of 0 and 3800 represent core power rather than NSSS power (See Table 15.0

-1). d. See Figure 15.0

-6. e. Part-power sensitivity demonstrated the acceptability of +5pcm/F to 70% power and ramping down to 0 pcm/F at 100% rated thermal power.

f. RTDP methodology is used to calculate fraction of rods in DNB while STDP methodology is used for evaluation of the pressure and temperature transient.
g. Although several analyses are based on a core power of 3800 MWt (NSSS powers of 3817 MWt or 3821 MWt), an updated core power of 3853 MWt (NSSS power of 3874 MWt) is supported via an evaluation that addresses a reduction in power uncertainty from 2% to 0.6%.
h. RTDP methodology is used for the DNB analysis while STDP methodology is used for the RCS pressure analysis.

15.0-21 Revision 1 8 STPEGS UFSAR TABLE 15.0

-2 (Continued)

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES Reactivity Coefficients Assumed

Faults Computer Codes Utilized Moderator Temperature (pcm/ F) Moderator Density

( k/gm/cm 3)

Doppler Thermal Design Procedure Thermal Power Output Assumed (b, c, g) (MWt) Spectrum of rod cluster control assembly ejection accidents TWINKLE, FACTRAN, THINC, LOFTRAN Refer to Section 15.4.8 - Dopper defect consistent with lower limit shown on Figure 15.0

-2 N/A 0 and 3,800 15.5 Increase in Reactor Coolant Inventory CVCS Malfunction LOFTRAN - upper and lower(d) upper and lower (a) STDP 3,824 15.6 Decrease in React or Coolant Inventory Inadvertent opening of a pressurizer safety or relief valve RETRAN - lower(d) lower(a) RTDP 3,874 Steam Generator Tube Rupture RETRAN 0.0 at full power - lower(a) 3,821 Loss of Coolant Accident Resulting from Spectrum of Postulated Piping Breaks within the Reactor Coolant System SATAN-VI, NOTRUMP WREFLOOD, COCO, BASH, LOCBART (LOCBART is a LOCTA & BART Code) See Section 15.6.5, References N/A See Section 15.6.5, References 3,800

a. See Figure 15.0-2. b. A minimum of 0.6 percent margin is added to the values shown for analysis purposes, when appropriate.
c. Values of 0 and 3800 represent core power rather than NSSS power (See Table 15.0

-1). d. See Figure 15.0

-6. e. Part-power sensitivity demonstrated the acceptability of +5pcm/F to 70% power and ramping down to 0 pcm/F at 100% rated thermal power.

f. RTDP methodology is used to calculate fraction of rods in DNB while STDP methodology is used for evaluation of the pressure and temperature transient g. Although several analyses are based on a core power of 3800 MWt (NSSS powers of 3817 MWt or 3821 MWt), an updated core power of 3853 MWt (NSSS power of 3874 MWt) is supported via an evaluation that addresses a reduction in power uncertainty from 2%

to 0.6%. h. RTDP methodology is used for the DNB analysis while STDP methodology is used for the RCS pressure analysis.

15.0-22 Revision 1 8 STPEGS UFSAR TABLE 15.0

-3 NOMINAL VALUES OF PERTINENT PLANT PARAMETERS SUPPORTED BY THE ACCIDENT ANALYSES(a) Thermal output of NSSS, MWt See Table 15.0

-2 Core inlet temperature, F 560.3/549.8 Vessel average temperature, F 592.6/582.7 Reactor coolant system pressure, psia 2,250 Reactor coolant flow per loop, gal/min 98,000(b) Steam flow from NSSS, 10 6 lb/hr 17.19/15.99 (c) Steam pressure at steam generator outlet, psia 1,045/957(d) Maximum steam moisture content, %

0.10 Assumed feedwater temperature at steam generator inlet, F 441.8/390 Average core heat flux, Btu/hr

-ft 2 183,705

a. Corresponds to 10% steam generator tube plugging
b. Thermal design flow
c. Corresponds to 441.8 oF/390 oF main feedwater temperature, respectively.
d. Corresponds to 592.6 oF/582.7 oF vessel average temperature, respectively.

15.0-23 Revision 1 8 STPEGS UFSAR TABLE 15.0

-4 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Trip Function Limiting Trip Point Assumed In Analysis Time Delay (seconds) Power range high neutron flux, high setting 118% 0.5 Power range high neutron flux, low setting 35% 0.5 Power range, neutron flux high positive rate 9% of RTP with a time constant of 2.0 seconds

0.5 Neutron

flux reactor trip interlock P-8, reset for 3

-loop operation (coincident with low reactor coolant flow) 85% 0.5 Overtemperature T Variable, see Figure 15.0

-1 10.0(a) Overpowe r T Variable, see Figure 15.0

-1 10.0(a) High pressurizer pressure 2,420 psig 2.0 Low pressurizer pressure 1,830 psig 2.0 Low reactor coolant flow (from loop flow detectors) 87% loop flow

1.0 Undervoltage

trip 68% nominal

1.5 Turbine

trip Not applicable 2.5 Low-low steam generator water level:(b) 0% of narrow range level span (NRS) for feedwater line break 2.0 11% of NRS for loss of normal feedwater/loss of offsite power CN-3130 15.0-24 Revision 1 8 STPEGS UFSAR TABLE 15.0

-4 (Continued)

TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Trip Function Limiting Trip Point Assumed In Analysis Time Delay (seconds) High-high steam generator water level: (c) 98.3% of NRS for feedwater malfunction causing an increase in FW flow 2.5 High-high steam generator water level signal to trip the SG feed pumps, close feedwater control and isolation valves, and initiate turbine trip 98.3% of NRS 2.5(d) 13.0(e) High pressurizer water level 99.1% of NRS 2.0

a. Total time delay (including RTD and thermowell time response, trip circuit and channel electronics delay) from the time the temperature difference in the coolant loops exceeds the trip setpoint until the rods are free to fall.
b. The difference between the two analysis assumptions is necessary to accommodate increased setpoint uncertainty due to a harsh containment environment potentially caused by a feedline break.
c. High-high SG water level setpoint reached results in turbine trip which results in reactor trip. d. From time setpoint is reached to turbine trip.
e. From time setpoint is reached to feedwater isolation.

15.0-25 Revision 18 STPEGS UFSAR TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment 15.1 Increase in Heat Removal by the Secondary Systems Feedwater system malfunctions causing an increase in feedwater flow Power range high flux, overtemperature T, overpower T, manual High-high steam generator water level-produced feedwater isolation and turbine trip Feedwater isolation valves, steam generator safety valves, steam generator PORVs Auxiliary Feedwater System Excessive increase in secondary steam flow Power range high flux, overtemperature T, overpower T, low pressurizer pressure, manual - Pressurizer safety valves, pressurizer PORVs, main steam isolation valves Inadvertent opening of a steam generator relief or safety valve Low pressurizer pressure, safety injection signal, overtemperature T, overpower T, power range high flux, manual Low pressurizer pressure, low compensated steam line pressure, manual Feedwater isolation valves, main steam isolation valves Auxiliary Feedwater System, Safety Injection System Steam system piping failure Low pressurizer pressure, safety injection signal, power range high flux, overpower T, manual Low pressurizer pressure, low compensated steam line pressure, HI-1 and HI-2 containment pressure, manual Feedwater isolation valves, main steam isolation valves Auxiliary Feedwater System, Safety Injection System 15.2 Decrease in Heat Removal by the Secondary System

Loss of external electrical

load/ turbine trip

High pressurizer pressure, overtemperature T, manual, high pressurizer water level, turbine trip, steam generator low-low water level

Steam generator low-low water level

Pressurizer safety valves, pressurizer PORVs, steam generator safety valves, steam generator PORVs

Auxiliary Feedwater System 1 5.0-26 Revision 1 8 STPEGS UFSAR TABLE 15.0

-6 (Continued)

PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Loss of non

-emergency AC power to the plant auxiliaries Steam generator low

-low water level, manual, low reactor coolant flow, turbine trip Steam generator low

-low water level Steam generator safety valves, steam generator PORVs, pressurizer safety valves, pressurizer PORVs Auxiliary Feedwater System Loss of normal feedwater flow Steam generator low

-low water level, manual Steam generator low

-low water level Steam generator safety valves, steam generator PORVs, pressurizer safety valves, pressurizer PORVs Auxiliary Feedwater System Feedwater system pipe break Steam generator low

-low water level, high pressurizer pressure, manual, overtemperature T, safety injection signal HI-1 containment pressure, HI

-2 containment pressure steam generator low

-low water level, low compensated steam line pressure Main steam isolation valves, feedwater isolation valves, pressurizer safety valves, pressurizer PORVs, steam generator safety valves, steam generator PORVs Auxiliary Feedwater System 15.3 Decrease in Reactor Coolant System Flow Rate Partial and complete loss of forced reactor coolant flow Low reactor coolant flow, RCP undervoltage RCP underfrequency, manual - Steam generator safety valves, steam generator PORVs - Reactor coolant pump shaft seizure (locked rotor)

Low reactor coolant flow, manual

- Pressurizer safety valves, pressurizer PORVs, steam generator safety valves, steam generator PORVs -

15.0-27 Revision 1 8 STPEGS UFSAR TABLE 15.0-6 (Continued)

PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment 15.4 Reactivity and Power Distribution Anomalies Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition Power range high flux, manual, intermediate range high flux, source range high flux, power range high positive flux rate - - - Uncontrolled rod cluster control assembly bank withdrawal at power Power range high flux, overtemperature T, high pressurizer pressure, manual, overpower T, pressurizer high water level, power range high positive flux rate

- Pressurizer safety valves, pressurizer PORVs, steam generator safety valves, steam generator PORVs - Rod cluster control assembly misalignment Overtemperature T, manual - Steam generator safety valves, steam generator PORVs - Startup of an inactive reactor coolant loop at an incorrect temperature Power range high flux, reactor trip permissive P-8*, manual

- - - Chemical and volume control system malfunction that results in a decrease in boron concentration in the reactor coolant Power range high flux, overtemperature T, manual - Rod insertion limit annunciators, high flux at shutdown alarm, audible source range count rate, neutron flux multiplication

-

15.0-28 Revision 1 8 STPEGS UFSAR TABLE 15.0

-6 (Continued)

PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Spectrum of rod cluster control assembly ejection accidents Power range high flux, power range high positive flux rate, manual, intermediate range high flux, source range high flux

- - - 15.5 Increase in Reactor Coolant Inventory Inadvertent operation of the ECCS during power operation Manual, safety injection signal - - Safety Injection System CVCS Malfunction that increases reactor coolant inventory Manual, pressurizer high water level, safety injection signal, Low Pressurizer Pressure

- Pressurizer PORVs, pressurizer safety valves

- 15.6 Decrease in Reactor Coolant Inventory Inadvertent opening of a pressurizer safety or relief valve Pressurizer low pressure, overtemperature T, manual - - -

  • Safety-grade classification of the components and instrumentation necessary to complete operator actions is provided in ST-HL-AE-3236.

15.0-29 Revision 1 8 STPEGS UFSAR TABLE 15.0

-6 (Continued)

PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment ESF Equipment Loss-Of-Coolant Accident a) Large Break Containment Pressure (HI

-1) Containment pressure (HI-1, HI-2 and HI-3), Low pressurizer pressure Main steam isolation valves, feedwater isolation valves, steam generator safety valves Safety Injection System, Reactor Containment Fan Coolers, Containment Spray System b) Small Break Low Pressurizer Pressure Low pressurizer pressure Main steam isolation valves, feedwater isolation valves, steam generator safety valves, SG PORV Safety Injection System, Auxiliary Feedwater System STPEGS UFSAR 15.0-30 Revision 1 8 TABLE 15.0

-7 SINGLE FAILURES ASSUMED IN ACCIDENT ANALYSES Event Description Worst Failure Assumed Feedwater temperature reduction Note 1 Excessive feedwater flow One Logic Train Excessive steam flow Note 1 Inadvertent secondary depressurization One SI Train Steam system piping failure (HZP)

One SI Train Decrease in steam Note 2 Loss of external electrical load One Logic Train Turbine trip One Logic Train Inadvertent closure of MSIV One Logic Train Loss of condenser vacuum One Logic Train Loss of AC power One Train AFW Actuation (2 AFW pumps fail to start)

Loss of normal feedwater One Train AFW Actuation (2 AFW pumps fail to start)

Feedwater system pipe break One Train AFW Actuation (2 AFW pumps fail to start)

Partial loss of forced reactor coolant flow One Logic Train Complete loss of forced reactor coolant flow One Logic Train RCP locked rotor One Logic Train RCP shaft break One Logic Train

1. No protection action required
2. Not applicable to South Texas Project Electric Generating Station
3. No transient analysis involved

STPEGS UFSAR 15.0-31 Revision 1 8 TABLE 15.0

-7 (Continued)

SINGLE FAILURES ASSUMED IN ACCIDENT ANALYSES Event Description Worst Failure Assumed RCCA bank withdrawal for subcritical condition One Logic Train RCCA bank withdrawal at power One Logic Train Dropped RCCA, dropped RCCA bank One Logic Train Statically misaligned RCCA Note 3 Single RCCA withdrawal One Logic Train Inactive loop startup One Logic Train Flow controller malfunction Note 2 Uncontrolled boron dilution One Logic Train Improper fuel loading Note 3 RCCA ejection One Logic Train Inadvertent ECCS operation at power Note 1 Increase in RCS inventory One Logic Train Inadvertent RCS depressurization One Logic Train Failure of small lines carrying coolant outside containment Note 3 Steam generator tube rupture Margin to overfill analysis Offsite radiation dose analysis AFW Control Valve Fails Open Steam Generator PORV Fails Open BWR piping failure Note 2 Spectra of LOCA Small Breaks Large Breaks One ESF Train One SI Train

1. No protection action required
2. Not applicable to South Texas Project Electric Generating Station
3. No transient analysis involved

STPEGS UFSAR 15.1-1 Revision 17 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated which could result in an increase in heat removal from the Reactor Coolant System (RCS) by the secondary system. Analyses are presented for several such events which have been identified as limiting cases.

Discussions of the following RCS cooldown events are presented:

1. Feedwater (FW) system malfunction causing a reduction in FW temp erature (Section 15.1.1)
2. FW system malfunction causing an increase in FW flow (Section 15.1.2)
3. Excessive increase in secondary steam flow (Section 15.1.3)
4. Inadvertent opening of a steam generator (SG) relief or safety valve causing a depressurization of the Main Steam (MS) System (Section 15.1.4)
5. Spectrum of steam system piping failures insi de and outside Containment (Section 15.1.5) The above are considered to be American Nucl ear Society (ANS) Condition II events, with the exception of a major steam system pipe break, which is considered to be ANS Condition IV event (Section 15.0.1). 15.1.1 Feedwater System Malfunctions Causing a Reduction in Feedwater Temperature 15.1.1.1 Identification of Causes and Accident Description. Reductions in FW temperature will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary system of the RCS. The overpower-overtemperature prot ection (neutron overpower, and overtemperature and overpower T trips) prevents any power increa se which could lead to a departure from nucleate boiling ratio (DNBR) less than the safety analysis limit value. A reduction in FW temperature could be caused by the accidental opening of a FW bypass valve which diverts flow around one of the high pressure FW heaters, or by the acci dental closing of the extraction steam block valves or nonreturn valves to the high pressure FW heaters. (The deaerator will attenuate any upstream disturbances, i.e., low pressure heaters out of service, loss of extraction, steam, etc.) In the event of an accidental opening of a bypass valve, there is a sudden reduction in FW inlet temperature to the SGs. If the extraction steam valves are accidentally closed, a more gradual, though greater, reduction in FW inlet temperature to the SG s will occur. At power, this increased subcooling will create a greater load demand on the RCS.

With the plant at no-load conditions, the addition of cold FW may cause a decrease in RCS temperature and, thus, a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity. However, the rate of energy change is reduced as load and FW flow decrease so the transient is less severe than the full power case.

The net effect on the RCS due to a reduction in FW temperature is similar to the effect of increasing secondary steam flow, i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new SG T.

STPEGS UFSAR 15.1-2 Revision 17 A decrease in normal FW temperature is classified as an ANS Condition II event, fault of moderate frequency (Section 15.0.1). The protection available to mitigate the consequences of a decrease in FW temperature is the same as that for an excessive steam flow increas

e. Section 15.0.8 and Table 15.0-6 discusses the protection available to mitigate the consequences of the excessive steam flow accident. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-7.

15.1.1.2 Analysis of Effects and Consequences. This transient is analyzed by computing conditions at the SG inlet following ope ning of a heater bypass valve, or closing the extraction steam valves.

The following assumptions are made:

1. Plant initial power leve l corresponding to guaranteed Nuclear Steam Supply System (NSSS) thermal output.
2. High pressure heater bypass valve opens resulting in FW flow splitting between the bypass line and the high pressure heaters; the flow through each path is proportional to the pressure drop. 3. The extraction steam block valves (2) to the high pressure FW heaters are inadvertently closed. In the analysis, the transient is terminated without safety or protection systems. No single active failure is defined for this event.

Plant characteristics and initial conditi ons are further disc ussed in Section 15.0.3.

Results Opening of a high pressure heater bypass valve causes a reduction in FW temperature which increases the thermal load on the primary system. The calculated reduction in FW temperature is approximately 33F, resulting in an increase in heat load on the primary system of less than 10 percent of full power. The loss of extraction (heating) steam to the high pressure FW heater causes a reduction in FW temperature, which increases the thermal load on the primary system. The calculated reduction in FW temperature is approximately 66F, resulting in an increase in heat load on the primary system of less th an 10 percent of full power. The increased thermal load due to opening of the high pressure heat er bypass valve, or the closing of the extraction valves, would result in a transient very similar, but of reduced magnitude, to that presented in Section 15.1.3 for an excessive increase in secondary steam flow incident, which evaluates the consequences of a 10 percent step load increase. Therefore, the results of this analysis are not presented.

STPEGS UFSAR 15.1-3 Revision 17 15.1.1.3 Radiological Consequences. There are no radiological consequences associated with a decrease in FW temperature event and activity is contained within the fuel rods and RCS within design limits.

15.1.1.4 Conclusions. The decrease in FW temperature transient is less severe than the increase in FW flow event (Section 15.1.2) and the increase in secondary steam flow event (Section 15.1.3). Based upon results presented in Sections 15.1.2 and 15.1.3, the applicable acceptance criteria for the decrease in FW temperature event have been met. There are no radiological consequences of this event. Evaluations of this event have been performed as part of the replacement steam generator program and the power uprate program. The evaluations determined that this event is bounded by the increase in feedwater flow event presented in UFSAR Section 15.1.2. 15.1.2 Feedwater System Malfunctions Caus ing an Increase in Feedwater Flow 15.1.2.1 Identification of Causes and Accident Description. Additions of excessive FW will cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary system and of the RCS. The overpower-overtemperature protection (neutron overpow er, and overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the safety analysis limit value.

An example of excessive FW flow would be full opening of one or more FW control valves due to FW control system malfunction or an operator error.

At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the SG. With the plant at no-load conditions, the addition of cold FW may cause a decrease in RCS temperatur e and, thus, a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity. Continuous addition of excessive FW is prevented by the SG high-high water level signal, which initiates FW isolation. The high-high SG water le vel signal initiates a tu rbine trip which then initiates a reactor trip. An increase in normal FW flow is classified as an ANS Condition II event, a fault of moderate frequency (Section 15.0.1).

Plant systems and equipment, which are available to mitigate the effects of the accident, are discussed in Section 15.0.8 a nd listed in Table 15.0-6. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-7.

15.1.2.2 Analysis of Effects and Consequences Method of Analysis The excessive heat removal due to FW system ma lfunction with a single va lve failing open at hot zero power is analyzed using the LOFTRAN code (Reference 15.1-1). All other hot zero and hot full power cases are analyzed using the RETRAN computer code (Reference 15.1-5). The codes simulate multi-loop systems with neutron kinetics, pressurizer, pr essurizer relief and safety valves, STPEGS UFSAR 15.1-4 Revision 17 pressurizer spray, steam generators, and steam generator safety valves. The codes compute pertinent variables including temperat ures, pressures, and power level.

A control system malfunction or operator error is assumed to cause one or more FW control valves to open fully. The following cases are analyzed:

1. Accidental opening of one FW control valve at hot zero power conditi ons, resulting in an increase of 225% of nominal fl ow to one SG with conservatively low FW temperature of 70° F. 2. Accidental opening of all four FW control valv es at hot zero power conditions. One turbine driven feed pump is at run-out flow with a conservatively low FW temperature of 70° F. 3. Accidental opening of one FW control valve at hot full power conditions, resulting in a step increase to 200% of nominal FW flow to one SG. The rod control system is either in automatic or manual mode. 4. Accidental opening of all FW control valves at hot full power conditions, resulting in a step increase to 150% of nominal FW flow to all SGs. A 25 Btu/lbm FW enthalpy reduction is assumed. The rod control system is in manual mode. No credit is taken for the heat capacity of the RCS and SG thick metal in attenuating the resulting plant cooldown. The FW flow resulting from a fully open control valve is terminated by an SG high-high water level signal which closes all FW isolation valves (including the FW control valves), trips the SG feed pumps, and trips the turbine. The analyses assume reactor trip on turbine trip.

Plant characteristics and initial conditions are further discussed in Section 15.0.3. No single active failure will adversely affect the consequences of an accident. As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is defined as malfunction of one train of the Reactor Protection System. In the analysis, the transient is terminated by the operable train of turbine trip and feedwater isolation (including reactor trip on turb ine trip) when high-high water level is detected in the steam generator.

A discussion of anticipated transients without trip (ATWT) considerations is pr esented in Reference 15.1-2.

Results For the accidental full opening of one or more FW control valves, with the reactor at zero power and the above-mentioned assumptions, the result s are bounded by the hot full power analysis. The hot zero power case is not limiting; therefore, the results of the analysis are not presented here. Of the full-power cases examined, the case that yields the lowest minimum DNBR assumed one FW control valve fails full open, with maximum reactivity feedback and manual rod control. This case also yields the highest peak heat flux. The rod control system is not required to function. Assuming the reactor to be in automatic rod control mode results in a similar, but slightly less limiting, transient.

STPEGS UFSAR 15.1-5 Revision 17 The case with one FW control valve failing open at hot full power shows a more limiting DNBR than the case with all four FW control valves failing open at hot full power. The analysis was performed with T avg = 593°F to bound the allowable operating temperature range. The feedwater temperature is conservatively assumed to be at th e low end of the allowable range of 390°F at hot full power. The calculated sequence of events for the transient assuming that the reactor is in manual rod control mode is shown in Table 15.1-1.

When the SG water level in the faulted loop reache s the high-high level setpoint, all FW isolation valves and FW control valves are automatically closed and the SG feed pum ps are tripped. This prevents continued addition of FW. In addition, a turbine trip is initiated. Following turbine trip, the reactor will be automatically tripped directly due to turbine trip. If no credit is taken for reactor trip on turbine trip, the ensuing transient would then be similar to a turbine trip event as analyzed in Section 15.2.3, resulting in an overtemperature T signal. If the reactor were in the automatic control mode with no credit taken for reactor trip on turbine trip, the control rods would be inserted at the maximum rate following turbine trip.

Transient results for the limiting case, which is at hot full power, (Figures 15.1-1 and 15.1-2) show the core power, pressurizer pressure, T avg and DNBR associated with the increased thermal load on the reactor. The DNBR does not drop below the safety analysis limit value. Following the reactor trip, the plant approaches a stabilized condition; standard plan t shutdown procedures may then be followed to further cool down the plant.

Since the power level rises during the excessive FW flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behi nd the neutron flux response due to the fuel rod thermal time constant, hence the peak value does not exceed 118 percent of its nominal value (i.e., the assumed high neutron flux trip setpoint). The peak fuel temperature will thus remain below the fuel melting temperature.

The transient results show that the DNBR does not go below the limit value at any time during the excessive FW flow incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature, therefore, doe s not rise significantly above its initial value during the transient. 15.1.2.3 Radiological Consequences. There are only minimal radiological consequences from this event. The turbine tr ip causes a reactor trip and heat is removed from the secondary system through the SG power-operated relief valves (PORVs) or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological consequences are less severe than the steam line break analyzed in Section 15.1.5.3. 15.1.2.4 Conclusion. The results of the analysis s how that the DNBRs encountered for excessive FW addition events are at all times above the safety analysis limit value; hence, the DNB design basis as described in Section 4.4 is met.

The radiological consequences of this event are not limiting. 15.1.3 Excessive Increase in Secondary Steam Flow 15.1.3.1 Identification of Causes and Accident Description. An excessive increase in secondary system steam flow (excessive load incr ease incident) is defined as a rapid increase in STPEGS UFSAR 15.1-6 Revision 17 steam flow that causes a power mismatch between the reactor core power and the SG load demand. The reactor control system is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the RTS. Steam flow increases greater than l0 percen t are analyzed in Sections 15.

1.4 and 15.1.5 (there are no pressure regulators whose malfunction could cause a steam flow transient).

This accident could result from either an administ rative violation, such as excessive loading by the operator, or an equipment malfunction in the steam dump control or turbine speed control. During power operation, steam dump to the conden ser is controlled by reactor coolant condition signals, e.g., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred. Protection for an excessive load increase accident is provided by the following reactor protection system signals: Overpower T Overtemperature T Power range high neutron flux Low pressurizer pressure A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-8. Section 15.0.8 and Table 15.0-6 briefly discuss the plant systems and equipment available to mitigate the consequences of this event. An excessive load increase inci dent is considered to be an ANS Condition II event, a fault of moderate frequency (Section 15.0.1.). 15.1.3.2 Analysis of Effects and Consequences.

Based on historical precedence, this event does not lead to a serious challe nge to the acceptance criteria and a reactor trip is not typically generated. As such, it has been determined that a detailed reanalysis of this event was not necessary to support the replacement steam generator program. A simplified statepoint evaluation was performed and its results confirmed that core DNB limits are

not challenged following this ev ent. The discussion below corres ponds to the analysis previously performed for this event and is retained for historical purposes.

Method of Analysis This accident is analyzed using LOFTRAN Code (Ref. 15.1-1). The code simulates neutron kinetics, RCS, pressurizer, pressu rizer relief and safety valves, pressurizer spray, SG, SG safety valves, and FW system. The code computes pertinent plant variables, including temperatures, pressures, and power level.

STPEGS UFSAR 15.1-7 Revision 17 Four cases are analyzed to demonstrate the plant be havior following a 10 percent step load increase from rated load. These cases are as follows: 1. Reactor control in manual with minimum moderator reactivity feedback 2. Reactor control in manual with maximum moderator reactivity feedback 3. Reactor control in automatic with minimum moderator reactivity feedback 4. Reactor control in automatic with maximum moderator reactivity feedback For the minimum moderator feedback cases, the core has the least negative moderator temperature coefficient of reactivity and, therefore, the least inherent transient capability. Since a positive moderator temperature coefficient would provide a transient benefit, a zero moderator temperature coefficient was assumed in the minimum feedback cases. For the maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value. This results in the largest amount of reactivity feedback due to changes in coolan t temperature. For all cases, a small (absolute value) Doppler coefficient of reactivity is assumed (Figure 15.0-2). A conservative limit on the turbine valve opening is assumed and all cases are studied without credit being taken for pressurizer heaters. Initial operating conditions are assumed at extreme values consistent with the stead y-state full power operation, allowing for calibration and instrument errors. This assumption results in minimum margin to core DNB at the start of the accident.

Plant characteristics and initial conditions are further discussed in Section 15.0.3. Normal reactor control systems and ESF systems are not required to function. The RTS is assumed not to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints. Because the transient is terminated without safety or protection systems, no single active failure will prevent the RTS from performing its intended function when required. The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. The automatic function is not required as a safety feature.

Results The calculated sequence of events fo r the excessive load increase inci dent is shown in Table 15.1-1. Figures 15.1-3 through 15.1-6 illustrate the transient with the reactor in the manual control mode. For the minimum moderator feedback case, there is a slight power increase, the average core temperature decreases, and the DNBR increases slightly. For the maximum moderator feedback, manually controlled case, there is a much larger increase in reactor power due to the moderator feedback. A reduction in DNBR is experienced, but DNBR remains above the safety analysis limit value. Figures 15.1-7 through 15.1-10 illustrate the transient assuming the reactor is in the automatic control mode. Both the minimum and maximum moderator feedback cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure so that there are only small changes in these parameters, as is also the case for the STPEGS UFSAR 15.1-8 Revision 17 maximum moderator feedback case with manual control. For both cases, the minimum DNBR remains above the safety analysis limit value. For all cases, the plant rapidly reaches a stabilized condition at the higher power level. Normal plant operating procedures would th en be followed to reduce power. The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. A reactor trip is not generated for any of the cases analyzed. The plant reaches a new equilibrium condition at a higher power level corresponding to the increased steam flow. Since the DNBR does not go below the limit value at any time during the excessive load increase transients, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

15.1.3.3 Conclusions. The analysis presented above show s that for a 10 percent step load increase, the DNBR remains above the safety analysis limit value; thus, the DNB design basis as described in Section 4.4 is met. The plant reaches a stabilized condition rapidly following the load increase.

The results of the analysis pres ented above indicate that no app licable acceptance criteria are challenged during this event. Furthermore, th e results of a simplified statepoint evaluation performed for this event in support of the replacement steam generator program confirm that the core thermal limit lines are not challenged, and that the minimum DNBR during this transient will remain above the safety analysis limit value.

Evaluations of this event have been performed as part of the replacement steam generator program and the 1.4% power uprate program. These evaluations determined that the DNB design basis continues to be met; hence the conclusions for the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate. 15.1.4 Inadvertent Opening of a Steam Genera tor Relief or Safety Valve Causing a Depressurization of the Main Steam System 15.1.4.1 Identification of Causes and Accident Description. The most severe core conditions for an accidental depressurization of the MS system result from an inadvertent opening of a single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a MS line are given in Section 15.1.5.

The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure decreases. The increased energy removal from the RCS causes a reduction in coolant temperatur e and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity. The analysis is performed to demonstrate that the following criterion is satisfied: assuming a stuck rod cluster control assembly (RCCA), with offsite power available, and assuming a single failure in the ESF, there is no consequential damage to the core or reactor coolant system after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.

STPEGS UFSAR 15.1-9 Revision 17 Accidental depressurization of the secondary system is classified as an ANS Condition II event (Section 15.0.1). The following systems provide the necessary protection for an accidental depressurization of the MS system:

1. Safety injection actuation from either:
a. Two out of four low pressu rizer pressure signals
b. Two out of three low compensated steam line pressure signals from any SG
2. Reactor trip will occur from either:
a. High neutron flux
b. Overpower T c. Two out of four low pres surizer pressure signals
d. Receipt of a safety injection (SI) signal
3. Redundant isolation of the main FW lines: sustained high FW flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main FW valves following a reactor trip, an SI signal will rapidly close all FW control valves and FW isolation valves and trip the main FW pumps.
4. Closure of the fast-acting main steam isolation valves (MSIVs) (designed to close in less than 8 seconds including sensor, logic, and valve stroke time) from either:
a. Low compensated steam line pressure signal (two out of three in any SG) above the

P-11 setpoint; or

b. High negative steam line pressure rate signal (two out of three in any loop) below the P-11 setpoint. A block diagram summarizing various protection sequences for safety actions required to mitigate

the consequences of this event is provided in Figure 15.0-9. Systems and equipment which are available to mitigate the effects of the accident are also discussed in Section 15.0.8 and listed in Table 15.0-6. 15.1.4.2 Analysis of Effects and Consequences.

Method of Analysis No explicit calculations are performed for this event. The calculated thermal and hydraulic results would be less limiting than those calculated for the hot zero power double-ended steam line rupture with offsite power available pr esented in UFSAR Section 15.1.5.

Results STPEGS UFSAR 15.1-10 Revision 17 Historical precedence has shown that the results of this transient are less lim iting than the results of the hot zero power double-ended st eam line rupture transient detailed in Section 15.1.5. As such, there are no results to present for this transient.

15.1.4.3 Radiological Consequences. There are only minimal ra diological consequences from this event. The inadvertent opening of a single steam dump, relief, or safety valve can result in steam release from the secondary system. Since no fuel damage is postulated to occur from this transient, the radiological consequences are less severe than the steam line break analyzed in Section 15.1.5.3.

15.1.4.4 Conclusions. The consequences of this event are bounded by those detailed in Section 15.1.5. During plant start-up, the above MSIV seat drain line valves are opened for removal of accumulated condensate to protect the turbine from water induction damage and to prevent water hammer in the steam lines. During normal operations, manual valves isolate the above MSIV seat drain lines. Specific analyses for simultaneous steam releases from all four steam generators via opened above MSIV seat drain lines concurrent with a steam generator tube rupture (SGTR) event or a main steam line break with a design primary to secondary system leak demonstrates that radiological doses will not exceed 10CFR 50.67 limits and the additional steam demand will not result in exceeding applicable reactor safety acceptance criteria. Due to the use of restricting orifices, flow from the lines will be limited and no operator action is required to close the above MSIV seat drain isolation valves. 15.1.5 Spectrum of Steam System Piping Failures Inside and Outside Containment 15.1.5.1 Identification of Causes and Accident Description. The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow, which decreases during the accident as the steam pressure decreases. The increased energy removal from the RCS causes a reduction of coolant temperatur e and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity. If the most reactive RCCA is assumed stuck in its fully withdrawn position after reac tor trip, there is an increased possibility that the core will become critical and return to power. The core is ultimately shut down by the boric acid delivered by the SIS.

The analysis of a MS line rupture is performed to demonstrate that the following criterion is satisfied: Assuming a stuck RCCA, with or without offsite power, and assuming a single failure in the SIS, the core remains in place and intact.

Although DNB and possible clad perforation followi ng a steam pipe rupture are not necessarily unacceptable, the analysis shows that no DNB occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position.

A major steam line rupture is classified as an ANS Condition IV event (Section 15.0.1). The major rupture of a steam line is the most limiti ng cooldown transient and, thus, is analyzed at zero power with no decay heat. Decay heat would retard the cooldown ther eby reducing the return STPEGS UFSAR 15.1-11 Revision 17 to power. A detailed analysis of this transient with the most limiting break size, a double-ended rupture, is presented here.

The following functions provide the necessary protection for a steam line rupture:

1. SI actuation from either:
a. Two out of four low pressu rizer pressure signals, or
b. Two out of three low compensated steam line pressure signals from any SG, or
c. Two out of three High-1 containment pressure signals
2. The overpower reactor trips (neutron flux and overpower T) and the reactor trip occurring in conjunction with receipt of the SI signal.
3. Redundant isolation of the main FW lines: sustained high FW flow would cause additional cooldown. Therefore, in addition to the normal control action which will close the main FW valves following a reactor trip, an SI signal will rapidly close all FW control valves and FW isolation valves, as well as trip the main FW pumps.
4. Closure of the fast-acting MSIV s (designed to close in less than 8 seconds including sensor, logic, and valve stroke time) from either a
a. High-2 Containment pressure si gnal (two out of three), or
b. Low compensated steam line pressure signal (two out of three in any SG) above the

P-11 setpoint, or

c. High negative steam line pressure rate signal (two out of three in any loop) below the P-11 setpoint For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. A description of steam line is olation is included in Chapter 10. Design criteria and methods of pr otection of safety related equipment from the dynamic effects of postulated piping ruptures are provided in Section 3.6.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-9. Section 15.0.8 and Table 15.0-6 briefly discuss plant systems and equipment available to mitigate the consequences of the event. 15.1.5.2 Analysis of Effects and Consequences.

Method of Analysis

The analysis of the steam pipe rupture has been performed to determine:

STPEGS UFSAR 15.1-12 Revision 17 1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN code (Ref. 15.1-9) has been us ed for the analysis of the steam pipe rupture.

2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital computer code, THINC or VIPRE, has been used to determine if DNB occurs for the core conditions computed in Item 1 above. The methodology used in the analysis including assumptions, initial conditions, and plant parameters is consistent with that used in the steam line rupture to pical report (Ref 15.1-4). The analysis of the steam line break is performe d at both hot full power and hot zero power. The steam line break at hot full power case is limiting with respect to the linear heat generation rate (kW/ft). With regards to DNB, conditions at ei ther hot full power or hot zero power may be limiting. A cycle-specific evaluation is performed as part of the fuel reload process and the results are documented in the reload safety evaluation. Hi storically, only details of the zero power steam line break event are presented in the UFSAR. Therefore, the following only discusses the zero power steam line break analysis. The following conditions were assumed to exist at the time of a main steam line break accident:
1. End-of-life shutdown margin at no-load, equilibrium xenon conditions and with the most reactive RCCA stuck in its fully withdrawn pos ition. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.
2. A negative moderator coefficient corresponding to the en d-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. To illustrate the expected change in reactivity due to the cooldown, the keff versus temperature at 1,200 ps i and 1,800 psi corresponding to the negative moderator temperature coefficient used is shown on Figure 15.1-11. The effect of power generation in the core on overall reactivity with the most reactive RCCA in the fully withdrawn position as modeled in the RETRAN code is shown on Figure 15.1-14 for nominal reactor coolant flow. The core properties associated with the sector nearest the affected SG and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These tw o conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity, as well as the power distribution, was checked for the limiting conditions for the cases analyzed. This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution, and nonuniform core inlet temperature effects. For cases in which steam generation oc curs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was al ways larger then the reactivity calculated including the above local effects for the conditions. These results verify conservatism, i.

e., underprediction of STPEGS UFSAR 15.1-13 Revision 17 negative reactivity feedback from power generation.

3. Minimum capability for injection of high concentration (2,800 ppm) boric acid solution corresponding to the most restrictive single failure in the SIS. The flow corresponds to that delivered by two high-head safety injection (HHSI) pumps, each delivering its full flow to separate cold legs. No credit has been taken for the low concentrati on borated water, which must be swept from the lines downstream of th e refueling water storage tank isolation valves prior to the delivery of high c oncentration boric acid to the reactor coolant loops (RCLs).

The sequence of events in the SIS is the following: after the genera tion of the SI signal (appropriate delays for instrumentation, logic, and signal transport incl uded), the appropriate valves begin to operate and the HHSI pump starts. In 12 seconds the pump is assumed to be at full speed. No credit has been taken for the low concentration borated water which must be swept into the core before the 2,800 ppm borated water reaches th e core. This delay, described above, is inherently included in the modeling.

If cases where offsite power is not available were considered, a 10-second delay would need to be assumed to account for starting the standby diesel generators (SDGs) and the additional time necessary to start SI equipment (mentioned above) is included.

4. Design value of the SG heat transfer coeffi cient including allowance for fouling factor.
5. Since the SGs are provided with inte gral flow restrictors with a 1.4 ft 2 throat area, any rupture with a break ar ea greater than 1.4 ft 2 regardless of location would have the same effect on the NSSS as the 1.4 ft 2 break. The following cases have typically been considered in determining the core power and RCS transients:
a. Complete severance of a pipe, with the pl ant initially at no-load conditions, full reactor coolant flow with offsite power available.
b. Case with loss of offsite power (LOOP) simultaneous with the steam line break and initiation of the SI signal. LOOP results in reactor coolant pump (RCP) coastdown.

Based on historical precedence and the results of previous plant-specific analyses that considered this case, the transient resulting from a steam line break coincident with a LOOP is bounded by the case where offsite power is retained. As such, LOOP is not explicitly modeled for this event.

6. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuc k rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break.

This void, in conjunction with the large negative moderator coefficient, partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temp erature, pressure, and flow, and, thus, are different for each case studied.

The core parameters correspond to values determined from the respectiv e transient analysis.

STPEGS UFSAR 15.1-14 Revision 17 Initial hot shutdown conditions at time zero are assumed since this represents the most pessimistic initial condition. Should the reactor be just critical or opera ting at power at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load, and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analysis are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis, which assumes no-load condition at time zero. 7. The Moody Curve (Ref. 15.1-3) for f(L/D) = 0 is used in computing the steam flow during a steam line break.

8. Perfect moisture separation in the SG is assumed.
9. Initial upper head fluid temperature consistent with hot zero power conditions. No single active failure will adversely affect the consequences of an accident. As summarized Table 15.0-7, the limiting single failure assumed in the analysis is failure of one SI train. The two operating SI trains are capable of mitigating the event and are actuated by the ESFAS on low compensated steamline pressure.

Results The calculated sequence of even ts is shown in Table 15.1-1.

The results presented are a cons ervative indication of the events which would occur assuming a steam line rupture since it is postulated that all of the conditions described above occur simultaneously. Core Power and Reactor Coolant System Transient Figures 15.1-15 through 15.1-17 show the RCS transient and core heat flux following a main steam line rupture (complete severance of a pipe) at initial no-load condition. Offsite power is assumed available such that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one SG. Should the core be critical at near zero power when the rupture occurs, the initiation of SI by low steam line pressure will trip the reactor. Steam release from more than one SG will be prevented by automatic closure of the fast-acting main steam isolation valves via the low steam line pressure signal. Even with the failure of one valve, release is limited to no more than 10 seconds from the other SGs while one generator blows down. The steam line isolation valves are designed to be fully closed in 5 seconds from receipt of a closure signal.

As shown in Figure 15.1-17, the co re attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) shortly before boron solution at 2,800 ppm enters the RCS.

A peak core power less than the nominal full power value is attained.

STPEGS UFSAR 15.1-15 Revision 17 The calculation assumes the boric acid is mixed w ith and diluted by the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and in the SIS. The variation of mass flow rate in the RCS due to water density changes is included in the calculation, as is the vari ation of flow rate in th e SIS due to changes in the RCS pressure. The SIS flow calculation includes the line losses in the system, as well as the pump head curve. It should be noted that, following a steam line break only, one SG blows down completely. Thus, the remaining SGs are still available for dissipation of decay heat after the initial transient is over. In the case of LOOP, this heat is removed to the atmosphere via the steam line safety valves. Main Steam Line Break Analysis for Above MSIV Seat Drain Line Flow Restriction Orifices A MSLB analysis was performed to determine the effect of replacing the above seat main steam line SOVs with 3/8" orifices. The design change has negligible affect on the RCS response. The design change also has negligible affect on the additional mass/energy releas e to the RCB and IVC. For the duration from MSLB initiation to cold shutdown, the plant is assumed to be at hot standby

for 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> with instantaneous cold shutdown at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This is conservative in evaluating the additional mass release through the orifice since cooldown occurs quickly after a MSLB, and hot shutdown can be achieved within three hours. After 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, no further steam releases are assumed. Margin to Critical Heat Flux A DNB analysis found that the DNB design ba sis as stated in Section 4.4 was met.

Results In support of steam generator replacement, the limiting steam line break transient, which consists of a double-ended rupture with offs ite power available, was anal yzed using the RETRAN code (Ref. 15.1-9). This analysis holds all assumptions consistent with those of previous analyses performed for the STP units. However, the use of the RETRAN code and associated methods have resulted in a maximum core heat flux value that is less limiting than those previously calculated using the LOFTRAN code and methods. Some of the RETRAN-related cha nges include: reverse heat transfer from the intact steam generators, an explicit secondary-side piping model, and a multi-node steam generator model. Also, a more real istic reference RCS pressure is taken for the calculation of the safety injection flow rate. These modeling improvements result in thermal and hydraulic calculations that are less limiting than those previously calculated and lead to less severe DNB consequences for this event.

15.1.5.3 Radiological Consequences. The postulated accident s involving release of steam from the secondary system do not result in a releas e of radioactiv ity unless there is leakage from the RCS to the secondary system in the SGs. A conservative analysis of the potential offsite doses resulting from a steamline break outside Containment upstream of the MSIV is presented using the Technical Specification limit secondary coolant concentrations. Parameters used in the analysis are listed in Table 15.1-2.

The Alternative Radiological Source Terms, as described in Regulatory Guide 1.183 (Reference 15.1-10), are used in this analysis.

STPEGS UFSAR 15.1-16 Revision 17 The conservative assumptions and parameters used to calculate the activity released and offsite doses for a steam line break, assuming no iodine spike, are the following:

1. The source term is based upon a power level of 4100 MW thermal, 5 w/o enrichment, and a three region core with equilibrium cycle core at end of life. The three regions have operated at a specific power of 39.3 MW/MTU for 509, 1018, and 1527 EFPD, respectively. The assumed power level is greater than the Rated Thermal Power of 3853 MWth plus a 0.6% measurement uncertainty.
2. The equilibrium secondary activity before the accident is based upon a pre-accident primary-to-secondary leakage of 1 gpm. This is conservative since the Technical Specifications limit the pre-accident leakage to 150 gpd per steam generator or 600 gpd (0.42 gpm) total. The secondary coolant activ ity is based on the Technical Specification limit of 0.1 Ci/gm of dose equivalent I-131 (Table 15.C-7). N oble gas activity in the secondary coolant is ba sed on 1% failed fuel.
3. Primary-to-secondary leakage through the steam gene rator tubes prior to the accident and during the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the transient is 1 gpm. Eight hours after the accident, the residual heat removal system starts and primary-to-secondary leakage is stopped. Primary-to-secondary leakage is modeled as 0.65 gpm for the three intact steam generators and at 0.35 gpm for the faulted steam generator.
4. No fuel failures are assumed to be caused by the main steam line break.
5. For a pre-accident iodine spik e, the activity in th e reactor coolant is based upon an iodine spike which has raised the reactor coolant concentration to 60 Ci/gm of dose equivalent I-131. Noble gas activity is based on 1% failed fuel.
6. For an accident-induced iodine spike, the accident initiates an iodine spike in the RCS which increases the iodine release rate from the fuel to a value 500 times greater than the release rate corresponding to a RCS concentration of 1 Ci/gm dose equivalent I-131. Iodine is assumed to be released at this rate for 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> s into the RCS. The i odine activity released from the fuel to the RCS is conservatively assumed to mix instantaneously and uniformly in the RCS. The accident-induced spike is modeled as an instantaneous release at t=0 of the 0-

8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> integrated iodine release.

Since Regulatory Guide 1.183 specifies that the chemical form of pa rticulate iodine is cesium iodide (CsI), the spike is also assumed to increase the Alkali metal (Cs and Rb) in the RCS in relative amounts. Noble gas activit y is conservatively based on 1% failed fuel.

7. Following the rupture, auxiliary feedwater to the faulted loop is isolated and the steam generator is allowed to steam dry. Thus, the iodine partition factor for the faulted steam generator is 1.
8. The activity released from the fuel from the gap is assumed to be instantaneously mixed with the reactor coolant within the pressure vesse l per Regulatory Guide 1.183.

STPEGS UFSAR 15.1-17 Revision 17 9. Tube uncovery does not occur in the three intact SGs. Primary-to-secondary leakage in these SGs is added to the bulk fluid in th e SGs and does not flash directly to the environment.

10. A partition coefficient of 100 is assumed for elemental iodine released from the intact steam generators (Regulatory Guide 1.183, Appendix E, Section 5.5.4). Organic iodine is not partitioned. Organic iodine is assumed to migrate directly to the steam space and become immediately available for release.
11. Operator action is taken to is olate feedwater to the faulted SG within 30 minutes of the event. The total release from the faulted SG is 214,000 lbm initially plus a subsequent release of 385,000 lbm from the Main Feedwater System and the Auxiliary Feedwater System, for a total of 599,000 lbm.
12. Steam releases from the faulted and the intact SGs are assumed to occur at a constant rate for the time period of interest.
13. Eight hours after the accident, the residual heat removal system is in operation and no further steam containing radionuclides is released from steam generators to the environment except the leakage through the MSIV above seat orifices. The release from the orifices continues until 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after the start of the accident. This is conservative since all releases would terminate in less than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when the RHR system is in operation.
14. The break and the above-seat drain releases occur in the Isolation Valve Cubicle next to the steam generator PORVs. Therefore, the PORV-to-Control Room /Qs are used for the Control Room and TSC dose analyses.
15. Offsite Power is lost. The condensers are unavailable for steam dump.
16. The Control Room ventilation system is assumed to automatically transfer to the emergency mode of operation after the in itiation of safety injection.
17. All activity is released to the environment with no considerat ion given to cloud depletion by ground deposition during transport to the Exclusion Area Boundary (EAB) and Low Population Zone (LPZ).
18. Reactor coolant density is 8.33 lbs/gal. CN-3062 19. Presence of actual PORV leakage is encompassed by the steam releases necessary to cool the plant to a point where cooling is performed by the RHR system (RCS at 350 psia, 350F). Therefore, the presence of PORV leakage has no impact on steam releases and dose consequences for the 0-8hr time period. Presence of actual PORV seat leakage after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> has a negligible effect on the doses at the site boundary and control room. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the pressure in the secondary side has been reduced from operating pressure (about 1050 psia) to the saturation pressure at 350F (about 135 psia). Assuming flow from the PORV is choke flow, the reduction in pressure would cause a proportional reduction in leak flow. A small leakage at the beginning of the event would be reduced by a factor of 10 after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. When the plant reaches 212F, the release would stop. This additional release would have a negligible effect on doses at the site boundary and control room.

STPEGS UFSAR 15.1-18 Revision 17 If the postulated accident is assumed to occur co incident with an existi ng iodine spike caused by a previous power transient, the assumptions and parameters used to evaluate the activity releases and offsite doses are unchanged, with two exceptions. The primary coolant concentrations are assumed to be equal to the Technical Specification limit for full power operation followi ng an iodine spike. These concentrations are presented in Table 15.C-7. The secondary coolant specific activity is equal to the Technical Specification limit of 0.1 Ci/g dose equivalent I-131. This dose equivalent activity is presented in Table 15.C-7. Fuel failures due to the accident are not assumed to occur coincident with an iodine spike. If the postulated accident is assumed to result in an iodine spike caused by the power transient of reactor trip, the assumptions and parameters used to evaluate the activity releases and the offsite doses are again unchanged, with two exceptions. The primary coolant iodine concentrations are assumed to be functions of time.

The spike is accounted for by increasing the source term or release rate from the fuel by a factor of 500. Further di scussion of this iodine spiking is contained in Appendix 15.C.3. Fuel failures are not assumed to o ccur during the accident.

Prior to the accident, the secondary coolant concentr ations are based upon the Technical Specification limit of 0.1 Ci/g dose equivalent I-131. These concentra tions are presented in Table 15.C -7.

A scenario considering fuel clad damage is not considered since the fuel does not experience DNB. The analysis assumes the primary-to-secondary le akage in the faulted st eam generator instantly flashes to steam and is released to the environment. Also, as per the Standard Review Plan, the initial iodine concentration in the secondary side is assumed to be at the Technical Specification limit of 0.1µci/gm dose equivalent Iodine-131.

Control Room and Technical Support Center (TSC) doses are determined using the HVAC models discussed in Section 15D. The TEDE doses for the steamline break for the va rious cases analyzed ar e given in Table 15.1-3 for the Exclusion Zone Boundary (EZB) of 1,430 meters and the Low Population Zone (LPZ) of 4,800 meters.

15.1.5.4 Conclusions. The analysis has shown that the criteria stated in Section 15.1.5.1 are satisfied. Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and are not preclude d by the criteria, the above analysis shows that no DNB occurs for any rupture, assuming the most reactive RCCA stuck in its fully withdrawn position. The radiological consequences of this event are within the guidelines of 10CFR50.67.

STPEGS UFSA R 15.2-1 Revision 18 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the Reactor Coolant System (RCS). These events are discussed in this section. Detailed analyses are presented for several such events which have been identified as more limiting than the others.

Discussions of the following RCS coolant heatup events are presented in this section:

1. Steam pressure regulator malfunction or failure that results in decreasing steam flow (not applicable to South Texas Project Electric Generating Station [STPEGS])
2. Loss of external electrical load (Section 15.2.2)
3. Turbine trip (Section 15.2.3)
4. Inadvertent closure of main steam isolation valves (MSIVs) (Section 15.2.4)
5. Loss of condenser vacuum and other events causing a turbine trip (Section 15.2.5)
6. Loss of nonemergency AC power to the plant auxiliaries (Section 15.2.6)
7. Loss of normal feedwater (FW) flow (Section 15.2.7)
8. Feedwater system pipe break (Section 15.2.8)

The above items are considered to be American Nuclear Society (ANS) Condition II events, with the exception of a FW system pipe break, which is considered to be an ANS Condition IV event. 15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow There are no pressure regulators whose malfunction or failure could cause a steam flow transient.

15.2.2 Loss of External Electrical Load 15.2.2.1 Identification of Causes and Accident Description. A loss of external electrical load may occur due to some electrical system disturbance. Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator (SG) shell. As a result, the heat transfer rate in the SG is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.

For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal is generated. The plant would be expected to trip from a signal generated by the Reactor Trip System (RTS). A continued steam load of approximately five percent exists after total loss of external electrical load because of the steam demand of plant auxiliaries.

In the event that a safety limit is approached, protection would be provided by high pressurizer pressure and overtemperature T trips. Voltage and frequency sensors associated with the reactor STPEGS UFSA R 15.2-2 Revision 18 coolant pumps (RCPs) provide no additional safety function of this event. Following a complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an over frequency of less that six Hertz. This resulting overfrequency is not expected to damage the voltage or frequency sensors in any way. However, it is noted that frequent testing of this equipment will be required by the Technical Specifications. Any degradation in their performance would be ascertained at that time. Any increased frequency to the RCP motors would result in slightly increased flow rate and subsequent additional margin to safety limits. For postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition does not affect any safety

-related pump motors, or other safeguards loads. Upon generator, reactor, or turbine trip, the generator output breaker opens disconnecting the generator from the bus and preventing overfrequency conditions (Section 8.2).

In the event the steam dump valves fail to open following a large loss of load, the SG safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, or the overtemperature T signal. The SG shell side pressure and reactor coolant temperatures will increase rapidly. The pressurizer safety valves and SG safety valves are, however, sized to protect the RCS and SGs against overpressure for all load losses without assuming the operation of the Turbine Bypass System, pressurizer spray, pressurizer power

-operated relief valves (PORVs), automatic rod cluster control assembly (RCCA) control or direct reactor trip on turbine trip. The SG safety valve capacity is sized to remove the steam flow at 105 percent of rated power from the SG without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the SG safety valves. The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure with 110 percent of the RCS design pressure.

A more complete discussion of overpressure protection can be found in Reference 15.2

-1. A loss of external load is classified as an ANS Condition II event, a fault of moderate frequency (Section 15.0.1).

A loss of external load event results in a Nuclear Steam Supply System (NSSS) transient that is less severe than a turbine trip event (Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load.

In addition, evaluations of this event have been performed as part of the replacement steam generator program and the 1.4% power uprate program. The evaluations determined that this event is bounded by the turbine trip event presented in UFSAR section 15.2.3.

The primary

-side transient is caused by a decrease in the heat transfer capability from the primary to secondary system due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of FW flow. Should FW flow not be reduced, a larger heat sink would be available and the transient would be less severe. Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in approximately 0.3 seconds. Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in approximately 0.1 seconds. Therefore, the transient in primary pressure, temperature, and water volume will be less severe for the loss of external load tha n

for the turbine trip due to a slightly slower loss of heat transfer capability.

STPEGS UFSA R 15.2-3 Revision 18 A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-10. The protection available to mitigate the consequences of a loss of external load is the same as that for a turbine trip, as listed in Table 15.0

-6. 15.2.2.2 Analysis of Effects and Consequences.

Method of Analysis Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more severe than those expected for the loss of external load as discussed in Section 15.2.2.1.

Normal reactor control systems and engineered safety feature (ESF) systems are not required to function. The Auxiliary Feedwater System (AFWS) may, however, be automatically actuated following a loss of main feedwater; this will further mitigate the effects of the transient.

The RTS may be required to function following a complete loss of external load to terminate core heat input and prevent departure from nucleate boiling (DNB). Depending on the magnitude of the load loss, pressurizer safety valves and/or SG safety valves may be required to open to maintain system pressure below allowable limits. No single active failure will prevent operation of any system required to operate. Refer to Reference 15.2

-2 for a discussion of anticipated transients without trip (ATWT) consideration.

15.2.2.3 Radiological Consequences.

There are only minimal radiological consequences associated with this event, therefore, this event is not limiting. The radiological consequences resulting from atmospheric steam dump are less severe than the steam line break event discussed in Section 15.1.5.

15.2.2.4 Conclusions. Based on results obtained for the turbine trip event (Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.

15.2.3 Turbine Trip 15.2.3.1 Identification of Causes and Accident Description. For a turbine trip event, the reactor would be tripped directly (unless below 50 percent power) by a signal derived from the emergency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly (typically 0.1 second) on loss of trip fluid pressure actuated by one of a number of turbine trip signals. Turbine trip initiation signals are discussed in Section 10.2. A turbine trip analysis from 50% power without reactor trip is discussed in Section 7A, Item II.K.3.10.

Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and initiate turbine bypass and, if above 50 percent power, a reactor trip.

The loss of steam flow results in a rapid rise in secondary system temperature and pressure with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external electrical load event. The turbine trip event is analyzed because it results in the most rapid reduction in steam flow.

STPEGS UFSA R 15.2-4 Revision 18 The automatic Turbine Bypass System would normally accommodate the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump control system and pressureizer pressure control system are functioning properly. If the condenser is not available, the excess steam generation would be dumped to the atmosphere and main FW flow would be lost (since the condenser is used for SG feed pump turbine exhaust). For this situation, SG level would be maintained by the AFWS to ensure adequate residual and decay heat removal capability. Should the Turbine Bypass System fail to operate, the SG safety valves may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the transient.

A turbine trip is classified as an ANS Condition II event, fault of moderate frequency (Section 15.0.1). The plant systems and equipment which are available to mitigate the consequences of a turbine trip are discussed in Section 15.0.8 and listed in Table 15.0

-6. 15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from full power without direct reactor trip primarily to show the adequacy of the pressure relieving devices and also to demonstrate core protection margins. That is, the turbine is assumed to trip without actuating all the sensors for reactor trip on the turbine stop valves. This assumption delays reactor trip until conditions in the RCS result in a trip due to other signals. Thus, the analysis assumes a worst case transient. In addition, no credit is taken for turbine bypass. Main FW flow is terminated at the time of turbine trip, with no credit taken for auxiliary feedwater (AFW) to mitigate the consequences of the transient. The turbine trip transients are analyzed by employing the detailed digital computer program RETRAN (Ref. 15.2

-7). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, SGs, and SG safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.

Major assumptions are summarized below:

1. Initial Operating Conditions For the case where the minimum departure from nucleate boiling ratio (DNBR) is the parameter of interest, i.e., where pressurizer pressure control (sprays and PORVs) is assumed to be operable, the RTDP methodology is utilized. Initial reactor power and RCS pressure are assumed to be at the nominal values consistent with steady state full

-power operation. The initial RCS temperature is assumed to be consistent with steady state full

-power operation at the maximum reactor vessel average temperature allowed in the Technical Specifications (Tavg = 593.0 oF). This assumption results in the minimum margin to the DNB limit at the initiation of the accident. The RCS flow rate is assumed to be at the minimum measured flow value. For the cases where peak RCS and main steam system (MSS) pressures are the parameters of interest, i.e., where pressurizer pressure control (sprays and PORVs) is assumed to not be available, the instrument uncertainties are directly applied to the initial values. The initial reactor power is at a level equivalent to 100.6% of the uprated NSSS power and the RCS average temperature is 5.1 oF higher than the nominal value (i.e., Tavg = 593.0 oF + 5.1 oF). The STPEGS UFSA R 15.2-5 Revision 18 initial pressurizer pressure is assumed to be 46 psi lower than the nominal value to delay the time of reactor trip on the high pressurizer pressure function. The RCS flow rate is assumed to be at the thermal design flow value.

2. Moderator and Doppler Coefficients of Reactivity, Temperature, and Power The turbine trip event is analyzed to bound the Technical Specification positive moderator temperature coefficient limit and assumes a small (absolute value) Doppler coefficient of reactivity (Figure 15.0

-2), which corresponds to minimum reactivity feedback conditions. Cases which would assume maximum reactivity feedback are always bounded by those that assume minimum reactivity feedback, since maximum reactivity feedback conditions for a heat-up transient result in a power reduction, which would yield less limiting results.

3. Reactor Control From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
4. Steam Release No credit is taken for operation of the Turbine Bypass System or SG PORVs. The SG pressure rises to the safety valve setpoint where steam release through safety valves limits secondary steam pressure to the setpoint value.
5. Pressurizer Spray and Power

-Operated Relief Valves Two cases are analyzed.

a. Full credit is taken for the effect of pressurizer spray and PORVs in reducing or limiting the coolant pressure. Safety valves are also available.
b. No credit is taken for the effect of pressurizer spray and PORVs in reducing or limiting the coolant pressure. Safety valves are operable.
6. Feedwater Flow Main FW flow to the SGs is assumed to be lost at the time of turbine trip. No credit is taken for AFW flow since a stabilized plant condition will be reached before AFW initiation is normally assumed to occur. The AFW flow would remove core decay heat following plant stabilization.
7. Reactor Trip Reactor trip is actuated by the first RTS trip setpoint reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressureizer water level, and low

-low SG water level.

8. Pressurizer Safety Valves

STPEGS UFSA R 15.2-6 Revision 18 The pressurizer safety valve setpoint includes an uncertainty of

-2% and -1% set-pressure shift for the case which is analyzed primarily for DNBR and peak MSS pressure (pressurizer control case), the uncertainty and set

-pressure shift are applied in the negative direction which reduces the setpoint.

For the case that is analyzed primarily for peak RCS pressure, the pressurizer safety valve setpoint includes an uncertainty of +1% and +1% set

-pressure shift, applied in the positive direction, that increases the setpoint. The pressurizer safety valve model also includes the effects of pressurizer safety valve loop seals.

9. Main Feedwater Temperature The case for peak RCS pressure was analyzed twice, once assuming that the initial feedwater temperature was at 441.8 oF and once at 390 oF. The case for minimum DNBR was analyzed at the limiting initial feedwater temperature of 441.8 o F. Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Except as discussed above, normal reactor control systems and ESF systems are not required t o function. Several cases are presented in which pressuizer spray and power

-operated relief valves are assumed, but the more limiting cases where these functions are not assumed are also presented.

No single active failure will adversely affect the consequences of an accident. As summarized in Table 15.0

-7, the limiting single failure assumed in the analysis is malfunction of one train of the Reactor Protection System (see discussion of reactor trip). In the analysis, the transient is terminated by the operable train on high pressurizer pressure or low

-low steam generator water level A discussion of ATWT considerations is presented in Reference 15.2

-2. Results The transient responses for a turbine trip from full

-power operation are shown for two cases: one case for minimum DNBR concerns, and a second case for peak RCS pressure. Both of these cases assume minimum reactivity feedback. For minimum reactivity feedback, the most

-positive moderator temperature coefficient value is assumed. The actual most

-positive MTC limit applies for power levels from 0 to 70%, then ramping linearly to 0 pcm/

oF at 100% power. Thus, it is conservative to assume the most

-positive MTC value for full

-power conditions, as was the assumption for the minimum DNBR case. However, the full-power case performed for peak RCS pressure assumed a zero moderator temperature coefficient, and a confirmatory analysis case was performed assuming an initial power level of slightly greater than 70% of rated thermal power with the most-positive MTC value. The calculated sequence of events for these cases initiated from full

-power conditions for the turbine trip event is presented in Table 15.2

-1. Figures 15.2

-1 through 15.2

-3 show the transient response for the turbine trip with the pressurizer spray and pressurizer power

-operated relief valves assumed to be operable (i.e., the minimum DNBR case). The reactor is tripped on the overtemperature T signal. The minimum DNBR remains above the safety analysis value. The analysis performed for the Steam Generator Replacement Program showed that a higher initial feedwater temperature resulted in a slightly more limiting minimum DNBR. For the 1.4% uprating analysis, an initial feedwater temperature of 441.8 oF was assumed. The peak RCS pressure for this case is not a parameter of interest, since the assumptions for this case have been pessimistically chosen with respect to minimizing the DNBR (i.e., pressurizer pressure control assumed to be operable). The peak RCS pressure transient response for the peak pressure STPEGS UFSA R 15.2-7 Revision 18 case, which is described below, bounds the primary system pressure response of this case. The main steam safety valves maintain secondary steam pressure below 110% of the SG shell design pressure.

Figures 15.2

-4 through 15.2

-6 show the transient response for the turbine trip with no credit taken for the pressurizer spray, pressurizer power

-operated relief valves, or turbine bypass (i.e., the peak RCS pressure case). The reactor is tripped on the high pressurizer pressure signal. The pressurizer safety valves are actuated and maintain primary system pressure below 110 percent of the design value.

The SG safety valves maintain secondary steam pressure below 110% of the SG shell design pressure. The DNBR response for this case is not a parameter of interest, since the assumptions for this case have been pessimistically chosen with respect to peak RCS pressure. Furthermore, since the RTDP methodology has not been used for this case, the RTDP

-based partial derivative approximations for DNBR used within the RETRAN code are not directly applicable. Thus, the plot of DNBR as a function of time is not presented. An initial feedwater temperature of 441.8 oF proved to yield a slightly more limiting peak RCS pressure value than the case in which a feedwater temperature of 390 oF was assumed.

Reference 15.2

-4 presents additional results of the analysis for a complete loss of heat sink, including loss of main FW. This analysis shows the overpressure protection that is afforded by the pressurizer and SG safety valves.

15.2.3.3 Radiological Consequences. There are only minimal radiological consequences associated with this event. Therefore, this event is not limiting. The radiological consequences resulting from atmospheric steam dump are less severe than the steam line break event discussed in Section 15.1.5.

15.2.3.4 Conclusions. Results of the analyses, including those in Reference 15.2

-4, show that the plant design is such that a turbine trip without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits. The DNBR remains above the safety analysis limit value for this event; thus, the DNB design basis as described in Section 4.4 is met. The above analysis demonstrates the ability of the NSSS to safely withstand a full load rejection.

15.2.4 Inadvertent Closure of Main Steam Isolation Valves The inadvertent closure of MSIVs would cause a turbine trip and other consequences as described in Section 15.2.5 below.

15.2.5 Loss of Condenser Vacuum and Other Events Causing a Turbine Trip Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 10.2. A loss of condenser vacuum would preclude the use of turbine bypass to the condenser; however, since turbine bypass is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as STPEGS UFSA R 15.2-8 Revision 18 listed in Section 10.2, are covered by Section 15.2.3. Possible overfrequency effects due to a turbine overspeed condition are discussed in Section 15.2.2.1 and are not a concern for this type of event.

In addition, evaluations of this event have been performed as part of the replacement steam generator program and the 1.4% power uprate program. The conclusions discussed in the previous paragraph apply to the replacement steam generators and the 1.4% power uprate evaluations.

15.2.6 Loss of Nonemergency AC Power to the Plant Auxiliaries (Loss of Offsite Power) 15.2.6.1 Identification of Causes and Accident Description. A complete loss of nonemergency AC power may result in the loss of all power to the plant auxiliaries, i.e., the RCPs, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the plant or by a loss of the onsite AC distribution system.

The DNB transient is more severe than the turbine trip event analyzed in Section 15.2.3 because the decrease in heat removal by the secondary system is accompanied by a reactor coolant pump coastdown, which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip due to: 1) turbine trip; 2) reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or 3) loss of power to the control rod drive mechanisms (CRDMs) as a result of the loss of power to the plant. However, the DNB transient for this event is bounded by the complete loss of forced reactor coolant flow event described in Section 15.3.2. Therefore, an explicit analysis for DNB is not perform ed for this event. Three motor

-driven and one turbine-driven AFW trains deliver water to their respective SGs on any of the following:

Low-low water level in any steam generator Safety injection signal Manual actuation AMSAC actuation signal (Section 7.8)

The motor-driven AFW pumps are supplied power by the diesel generators. The turbine

-driven AFW pump utilizes steam from the secondary system. Both types of pumps are designed to start within one minute of the actuating signal. The turbine

-driven AFW pump exhausts the secondary steam to the atmosphere. The AFW pumps take suction from the auxiliary feedwater storage tank (AFST) for delivery to the SGs.

No single active failure will prevent operation of a reactor protective system required to mitigate this transient. As summarized in Table 15.0

-7, the limiting single failure is malfunction of one train (Train A) of the ESF actuation logic which initiates the auxiliary feedwater flow on low

-low steam generator water level. Failure of Train A to actuate would prevent one motor

-driven AFW pump and the turbine-driven AFW pump from starting.

Upon the loss of power to the RCPs, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops.

CN-3009 STPEGS UFSA R 15.2-9 Revision 18 A loss of nonemergency AC power event, as described above, is a more limiting event than the turbine-trip-initiated decrease in secondary heat removal without loss of AC power analyzed in Section 15.2.3. However, a loss of AC power to the plant auxiliaries as postulated above also results in a loss of normal FW since the FW booster pumps lose their power supply. Plant specific analysis has shown that a loss of normal FW with a subsequent loss of AC power is the most limiting Condition II event in the decrease in secondary heat removal category with respect to the pressurizer overfill criterion and is analyzed in Section 15.2.7. Therefore, detailed analytical results for a loss of AC power transient will not be presented here. The results of the analysis in Section 15.2.7 bound the loss of AC power event.

Following the RCP coastdown caused by the loss of AC power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by AFW in the secondary system. The loss of normal FW with subsequent loss of AC power analysis is presented in Section 15.2.7 to show that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-11. The plant systems and equipment available to mitigate the consequences of a loss of AC power event are discussed in Section 15.0.8 and listed in Table 15.0

-6. 15.2.6.2 Analysis of Effects and Consequences.

Method of Analysis As documented in Section 15.2.6.1, the loss of offsite power event is less limiting with regard to DNB than the complete loss of forced reactor coolant flow event described in Section 15.3.2, which demonstrates that the DNB limits are satisfied. The loss of offsite power event is also less limiting than a loss of normal feedwater with subsequent loss of offsite power with regards to pressurizer overfill. The loss of normal feedwater with subsequent loss of offsite power analysis, presented in Section 15.2.7, conservatively demonstrates that the pressurizer overfill criterion is met for the loss of AC power event

.

Results The first few seconds of the transient will closely resemble and is bounde d by the complete loss of forced reactor coolant flow incident (Section 15.3.2); i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. Results for the bounding loss of forced reactor coolant flow are presented in Section 15.3.2. After the reactor trip, stored and residual decay heat must be removed to prevent damage to either the RCS or the core. Detailed results for the bounding loss of normal feedwater with subsequent loss of offsite power analysis are presented in Section 15.2.7.

15.2.6.3 Radiological Consequences. A loss of nonessential AC power to plant auxiliaries would result in a turbine and reactor trip and loss of condenser vacuum. Heat removal from the secondary system would occur through the SG PORVs or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological consequences are less severe than the steam line break accident.

CN-3009 CN-3009 STPEGS UFSA R 15.2-10 Revision 18 15.2.6.4 Conclusions. Analysis of the natural circulation capability of the RCS has demonstrated that sufficient heat removal capability exists following RCP coastdown to prevent fuel or clad damage. This is presented in Section 15.2.7.

15.2.7 Loss of Normal Feedwater Flow 15.2.7.1 Identification of Cause and Accident Description. A loss of normal FW (from pump failures, valve malfunctions, or LOOP) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of FW were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the SG heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The worst postulated loss of normal feedwater event is one in which a LOOP occurs coincident with reactor trip as described in Section 15.2.6. This is due to the decreased capability of the reactor coolant to remove residual core heat as a result of the RCP coastdown.

A loss of normal FW is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

Reactor trip on low

-low water level in any SG provides protection for a loss of normal FW.

The AFWS is started automatically as discussed in Section 15.2.6.1. The turbine

-driven AFW pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor

-driven AFW pumps are supplied power from the SGBDs. The pumps take suction directly from the AFST for delivery to the SGs.

The limiting loss of normal feedwater scenario assumes loss of AC power at the time of reactor trip. Upon loss of power to the RCPs, coolant flow necessary for core cooling and removal of residual heat is maintained by natural circulation in the reactor coolant loops. The analysis presented herein demonstrates the natural circulation capability of the RCS.

A loss of normal FW with a subsequent loss of power to the RCPs is the most limiting Condition II event in the decrease in secondary heat removal category. A full analysis of the system transient with and without RCPs in operation has been done for the loss of normal FW event. The more limiting of the two transients, without RCPs in operation, is presented below to show that following a loss of normal FW, the AFWS is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or water release from the pressurizer, and returning the plant to a safe condition.

15.2.7.2 Analysis of Effects and Consequences.

Method of Analysis A detailed analysis using the RETRAN code (References 15.2

-7 and 15.2

-8) is performed in order to obtain the plant transient following a loss of normal FW. The simulation describes the plant thermal kinetics, RCS including natural circulation, pressurizer, SG and FW system. The digital program computes pertinent variables including the SG water level, pressurizer water level, and reactor coolant average temperature.

CN-3009 STPEGS UFSA R 15.2-11 Revision 18 Assumptions made in the analysis are:

1. The plant is initially operating at a power equivalent to 100.6% of the uprated NSSS power.
2. Core residual heat generation is based on the 1979 version of ANS 5.1 (Ref. 15.2

-6). ANSI/ANS 5.1-1979 is a conservative representation of the decay energy release rates.

3. A heat transfer coefficient in the SG is associated with RCS natural circulation.
4. Reactor trip occurs on SG low

-low water level. No credit is taken for immediate release of the control rod drive mechanisms caused by a LOOP.

5. The worst single failure in the AFWS occurs (a single train of AFW actuation logic fails causing failure to automatically start two AFW pumps).
6. AFW is delivered automatically by two AFW pumps to two SGs. Operator action is required fifteen minutes after reactor trip to start a third AFW pump, delivering flow to a third SG.
7. Secondary system steam relief is achieved through the SG PORVs and safety valves.
8. The initial reactor coolant average temperature is 5.1F below the nominal value (i.e., Tavg = 593.0 o F - 5.1 oF) since this assumption results in a greater expansion of the RCS water during the transient and, thus, in a higher water level in the pressurizer at the time of maximum insurge. The initial pressurizer pressure uncertainty is 46 psi.

The loss of normal FW analysis is performed to demonstrate the adequacy of the RCS and ESF (e.g.,

the AFW) in removing long

-term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

One such assumption is the LOOP. This assumption results in coolant flow decay down to natural circulation conditions and a corresponding reduction in the steam generator heat transfer coefficient. Following a LOOP, the first few seconds of a loss of normal FW transient will be virtually identical to the transient response (including DNBR and neutron flux versus time) presented in Section 15.3.2 for the complete loss of forced reactor coolant flow. Section 15.2.6 provides further details on this assumption.

An additional assumption made for the loss of normal FW evaluation is that the pressurizer PORVs are assumed to function normally. Operation of the PORVs maintains peak RCS pressure below the actuation setpoint of the pressurizer safety valves (2,500 psia) throughout the transient.

If the PORVs were assumed not to function, the coolant system pressure during the transient would rise to the actuation setpoint of the pressurizer safety valves. The increased RCS pressure, however, results in less expansion of the coolant and, hence, more margin to the point where water relief from the pressurizer would occur. Plant characteristics and initial conditions are further discussed in

Section 15.0.3.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-12.

STPEGS UFSA R 15.2-12 Revision 18 Plant systems and equipment which are available to mitigate the effects of a loss of normal FW accident are discussed in Section 15.0.8 and listed in Table 15.0

-6. Normal reactor control systems are not required to function. Pressurizer PORVs are assumed to function in order to provide a more limiting transient, as described above.

The RTS is required to function following a loss of normal FW as analyzed here. The AFWS is required to deliver a minimum AFW flow rate. In the long term, after automatic actuation of the AFWS, FW addition is manually controlled to maintain proper SG

water level. No single active failure will prevent operation of any system required to function.

A discussion of ATWT considerations is presented in Reference 15.2

-2. Results Figures 15.2

-9A through 15.2

-10 show the significant plant parameters following a loss of normal FW with a subsequent LOOP.

Following the reactor and turbine trip from full load, the water level in the SGs will decrease due to the reduction of the SG void fraction and because steam flow through the PORVs and safety valves continues to dissipate the stored and generated heat. Within one minute following the low

-low steam generator water level signal, at least two AFW trains are delivering flow automatically, reducing the rate of water level decrease. Fifteen minutes after reactor trip, an additional AFW train, initiated by operator action, delivers flow to a third SG (required for additional heat transfer capacity).

The AFW system provides a sufficient supply of backup feedwater such that the capability of the SGs to dissipate core residual heat without water relief from the RCS relief or safety valves is maintained. From Figure 15.2

-10 it can be seen that at no time is the tubesheet uncovered in the SGs receiving AFW flow automatically. The analysis also indicates that at no time is there water relief from the pressurizer. Figure 15.2

-9D shows that the peak water volume in the pressurizer is less than 2100 ft 3 which is the filled pressurizer volume.

The calculated sequence of events for this accident is listed in Table 15.2

-1. As shown on Figures 15.2-9A through 15.2

-10, the plant approaches a stabilized condition following reactor trip and AFW initiation. Plant procedures may be followed to further cool down the plant.

15.2.7.3 Radiological Consequences. The steam release and resulting radiological consequences from this transient would be the same as that for the LOOP. The radiological consequences resulting from this transient are less severe than the steam line break accident.

15.2.7.4 Conclusions. Results of the analysis show that a loss of normal FW does not adversely affect the core, the RCS, or the steam system since the AFW capacity is such that reactor coolant water is not relieved from the pressurizer relief or safety valves, and the water level in all SGs receiving AFW is maintained above the tubesheet. The radiological consequences of this event are not limiting.

15.2.8 Feedwater System Pipe Break 15.2.8.1 Identification of Causes and Accident Description. A major FW line rupture is defined as a break in a FW line large enough to prevent the addition of sufficient FW to the SGs to maintain shell

-side fluid inventory in the SGs. If the break is postulated in a FW line between the check valve and the SG, fluid from the SG may also be discharged through the break. A break STPEGS UFSA R 15.2-13 Revision 18 upstream of the FW line check valve would affect the NSSS only as a loss of FW. This case is covered by the evaluation in Section 15.2.7.

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown by excessive energy discharge through the break or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a FW line rupture.

A FW line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:

1. FW flow to the SGs is reduced. Since FW is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip 2. Fluid in the SG may be discharged through the break and would not be available for decay heat removal after trip
3. The break may be large enough to prevent the addition of any main FW after trip The AFWS (Section 10.4.9) is provided to assure that adequate FW will be available such that:
1. No substantial overpressurization of the RCS shall occur
2. Sufficient liquid in the RCS shall be maintained in order to provide adequate decay heat removal A major FW line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a discussion of Condition IV events.

The severity of the FW line rupture transient depends upon a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. A number of cases of FW line break have been analyzed. Based on these analyses, it has been shown that the most limiting FW line rupture is a double

-ended rupture of the largest FW line. Analyses have been performed at full power with and without LOOP. These cases are discussed below. The following provide protection for a main FW rupture:

1. A reactor trip on any of the following conditions:
a. High pressurizer pressure
b. Overtemperature T c. Low-low SG water level in any SG
d. Safety injection signals from any of the following:
1) 2/3 low steam line pressure in any loop
2) 2/3 high containment pressure (HI

-1)

STPEGS UFSA R 15.2-14 Revision 18 (Refer to Chapter 7 for a description of the actuation system.)

2. An AFW system to provide an assured source of FW to the SGs for decay heat removal (Section 10.4.9). 15.2.8.2 Analysis of Effects and Consequences.

Method of Analysis A detailed analysis using the RETRAN code (Ref. 15.2

-7) is performed in order to determine the plant transient following a FW line rupture. The code describes the plant thermal kinetics, RCS including natural circulation, pressurizer, SGs, and FW system and computes pertinent variables, including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature.

The case analyzed assumes a double-ended rupture of the largest FW pipe at full power. Major assumptions made in the analysis are as follows:

1. The plant is initially operating at a power equivalent to 100.6% of the uprated NSSS power.
2. Initial reactor coolant average temperature is 5.1F above the nominal value and the initial pressurizer pressure is 46 psi below its nominal value.
3. No credit is taken for the pressurizer spray control system.
4. The initial pressurizer water level is assumed to be at the nominal level. The initial steam generator water level was assumed to be at the nominal level minus 8.5% narrow range span (NRS) for the intact steam generators and nominal level plus 5.9% NRS for the faulted steam generator. The initial level in the faulted steam generator conservatively delays the reactor trip. The initial level in the intact steam generators minimizes the water available to act as a heat sink and increases the severity of the break.
5. No credit is taken for the high pressurizer pressure reactor trip.
6. Main FW to all SGs is assumed to stop at the time the break occurs (all main FW spills out through the break).
7. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip which maximizes the resultant heatup of the reactor coolant. 8. A conservative break discharge quality is calculated by the RETRAN code. The quality changes as a function of the conditions in the steam generator.
9. Reactor trip is assumed to be actuated when the low

-low SG water level trip setpoint in the affected SG is reached. The trip setpoint is conservatively assumed to be 0% NRS.

10. The AFW is actuated by the low

-low SG water level signal. The AFW is assumed to supply a total of 500 gal/min to one intact SG. A 60

-second delay was assumed following the low

-low steam generator water level signal to allow time for startup of the SBDGs and the AFW pumps. An additional delay of approximately 37 seconds was assumed before the FW line was purged and the relatively cold (120F) AFW entered the intact SG.

STPEGS UFSA R 15.2-15 Revision 18

11. The analysis was performed at Tavg = 593.0F to bound the allowable operating temperature range. The higher RCS average temperature results in limiting conditions with respect to the minimum margin to saturation. The results presented in this section (Table 15.2

-1 and Figures 15.2

-11 through 15.2.18) are for Tavg = 593.0 F. 12. No credit is taken for heat energy deposited in RCS metal during the RCS heatup.

13. No credit is taken for charging or letdown.
14. SG heat transfer area is assumed to decrease as the shell

-side liquid inventory decreases.

15. Core residual heat generation is based on the 1979 version of ANS 5.1 (Ref. 15.2

-6). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

16. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:
a. High pressurizer pressure
b. Overtemperature T c. High pressurizer level
d. High containment pressure
17. Maximum reactivity feedback is assumed. This includes maximum positive moderator density coefficient, maximum (absolute value) negative Doppler power and temperature coefficients and minimum delayed neutron fractions.

Receipt of a low

-low SG water level signal in at least one SG starts the motor

-driven and turbine

-driven AFW pumps, which in turn initiate AFW flow to the SGs. Similarly, receipt of a low steam line pressure signal in at least one steam line initiates the closure of all MSIVs.

Emergency operating procedures following a main FW line rupture require the operator to isolate FW flow spilling from the ruptured FW line and to control the RCS temperature which also prevents the pressurizer from filling. The analysis assumes the following manual actions occur after 30 minutes of the break: (1) identify the affected SG and isolate AFW to that SG, (2) control AFW to the unaffected steam generators to facilitate cooldown, and (3) manually control pressurizer level and pressure with normal control systems.

A block diagram summarizing various protection sequences for safety actions required to mitigate the

consequences of this event is provided in Figure 15.0

-13. Plant characteristics and initial conditions are further discussed in Section 15.0.3.

No control systems, with the exception of the pressurizer PORVs, are assumed to function. The operation of the PORVs serves to worsen the transient via minimizing the saturation temperature and therefore minimizing the margin to subcooling. It also allows a greater discharge of mass from the primary system, thus maximizing the liquid volume in the pressurizer. The RPS is required to function following a FW line rupture as analyzed here.

No single active failure will prevent operation of a reactor protective system required to mitigate this transient. As summarized in Table 15.0

-7, the limiting single failure is malfunction of one train (Train A) of the ESF actuation logic which initiates the auxiliary feedwater flow. Failure of Train A to actuate would prevent one motor

-driven AFW pump and the turbine

-driven AFW pump from CN-3161 STPEGS UFSA R 15.2-16 Revision 18 starting automatically. Flow from a third auxiliary feedwater pump is assumed lost through the break. Therefore, only one AFW pump is assumed to function following receipt of an initiating signal. Following initiation, the auxiliary pump is assumed to deliver 500 gal/min of AFW to one intact S G. Results Calculated plant parameters following a major FW line rupture are shown on Figures 15.2

-11 through 15.2-18 for an RCS average temperature of 593.0F. Results for the case with offsite power available are presented on Figures 15.2

-11 through 15.

2-14. Results for the case where offsite power is lost are presented on Figures 15.2

-15 through 15.2

-18. The calculated sequence of events for both cases analyzed is listed in Table 15.2

-1. The results show that the pressurizer does not go water solid prior to 30 minutes from the time of event initiation.

The system response following the FW line rupture is similar for both cases analyzed. Results presented on Figures 15.2

-12 and 15.2

-13 (with offsite power available) and Figures 15.2

-16 and 15.2-17 (without offsite power) show that pressures in the RCS and MS system remain below 110 percent of the respective design pressures. Pressurizer pressure doesn't change appreciably until the reactor trip on low

-low SG water level occurs. Pressure then decreases due to the loss of heat input. Coolant expansion occurs due to reduced heat transfer capability in the SGs. The pressurizer PORVs open to maintain RCS pressure at an acceptable value.

The reactor core remains covered with water throughout the transient, as water relief due to thermal expansion is limited by the heat removal capability of the AFW system.

The major difference between the two cases analyzed can be seen in the plots of hot and cold leg temperatures in Figure 15.2

-14 (with offsite power available) and Figure 15.2

-18 (without offsite power). It is apparent that for the duration of the transient, the case without offsite power results in slightly higher temperatures in the hot leg, but also results in a slightly higher saturation pressure.

The case with offsite power results in the minimum margin to hot leg saturation.

15.2.8.3 Radiological Consequences. The FW line break with the most significant consequences would be one that occurred inside the Containment between a SG and the FW check

valve. In this case, the contents of the SG would be released to the Containment. Since no fuel failures are postulated, the radioactivity released is less than that for the steam line break.

Furthermore, automatic isolation of the Containment would further reduce any radiological consequences from this postulated event.

15.2.8.4 Conclusions. Results of the analyses show that for the postulated feedwater line rupture, the assumed AFW capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. Adequate time for operator action is available to preclude filling of the pressurizer. Appropriate operator actions are to preclude filling of the pressurizer. Radiological doses from the postulated feedwater line rupture are less than those previously presented for the postulated steam line break. All applicable acceptance criteria are thus met. The radiological consequences of this event are not limiting.

CN-3173 STPEGS UFSA R 15.2-17 Revision 18 REFERENCES Section 15.2

15.2-1 Mangan, M. A., et al., "Overpressure Protection for Westinghouse Pressurized Water Reactors," WCAP

-7769, Rev. 1, June 1972.

15.2-2 "Westinghouse Anticipated Transients Without Trip Analysis," WCAP

-8330, August 1974. 15.2-3 Burnett, T. W. T., et al., "LOFTRAN Code Description," WCA P-7907-P-A (Proprietary Class 2), WCAP

-7907-A (Proprietary Class 3), April 1984.

15.2-4 Baldwin, M. S., Merrian, M. M., Schenken, H. S., and VandeWalle, D. J., "An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in Westinghouse PWRs," WCAP-8424, Revision 1, May 1975.

15.2-5 Hargrove, H. G., "FACTRAN

- A Fortran IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP

-7908-A, December 1989.

15.2-6 "American National Standard for Decay Heat Power in Light Water Reactors," ANSI/ANS-5.1-1979, August 1979. 15.2-7 Huegel, D. S., et al., "RETRAN

-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non

-LOCA Safety Analyses," WCAP

-14882-P-A (Proprietary), April 1999.

15.2-8 "RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non

-LOCA Safety Analyses Supplement 1

- Thick Metal Mass Heat Transfer Model and NOTRUMP

-Based Steam Generator Mass Calculation Method," WCAP

-14882-S1-P (Proprietary), December 2002.

STPEGS UFSA R 15.2-18 Revision 18 TABLE 15.2

-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)

Turbine Trip With pressurizer pressure control (minimum moderator feedback)

Turbine trip, loss of main feedwater flow 10.0 Peak pressurizer pressure occurs 19.9 Initiation of steam release from steam generator safety valves 20.5 Overtemperature T reactor trip point is reached 2 5.4 Rods begin to drop 26.7 Minimum DNBR occurs 28.0 Without pressurizer pressure control (minimum moderator feedback)

Turbine trip, loss of main feedwater flow 1.0 High pressurizer pressure reactor trip point reached 7.1 Rods begin to drop

9.1 Initiation

of steam release from steam generator safety valves 9.2 Peak pressurizer pressure occurs 9.9 STPEGS UFSA R 15.2-19 Revision 18 TABLE 15.2

-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)

Loss of Normal Feedwater Flow Main feedwater flow stops 20.0 Low-low steam generator water level trip 73.8 Rods begin to drop 75.8 Reactor coolant pumps begin to coastdown(1) 77.8 Two auxiliary feedwater pumps start automatically and supply two steam generators 133.8 A third AFW pump is started manually and supplies AFW to a third steam generator 975.8 Peak water volume in pressurizer occurs 1382.5 Core decay heat decreases to auxiliary feedwater heat removal capacity

~1820 STPEGS UFSA R 15.2-20 Revision 18 TABLE 15.2

-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)

Feedwater System Pipe Break With Offsite Power Available Main feedline rupture occurs 20.0 Low-low steam generator water level reactor trip setpoint reached in affected steam generator 28.6 Rods begin to drop 30.6 Low pressurizer pressure SI setpoint reached 84.8 One auxiliary feedwater pump starts and supplies one intact steam generator 88.6 Cold auxiliary feedwater is delivered to intact steam generator ~125 Low steamline pressure setpoint reached in affected steam generator 219.2 All main steam isolation valves close 227.2 Pressurizer water relief begins (2) (3)

STPEGS UFSA R 15.2-21 Revision 18 TABLE 15.2-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)

Without Offsite Power Main feedline rupture occurs 20.0 Low-low steam generator water level reactor trip setpoint reached in affected steam generator 28.6 Rods begin to drop(1) 30.6 Power lost to the reactor coolant pumps 32.6 Low steamline pressure setpoint reached in affected steam generator All main steam isolation valves close 65.5 73.5 One auxiliary feedwater pump starts and supplies one intact generator 88.6 Cold auxiliary feedwater is delivered to intact steam generator ~125 Pressurizer water relief begins (2) (3) 1. Loss of offsite power assumed to occur at reactor trip, a 2-second delay is assumed prior to RCP trip.

2. Operator action precludes the filling of the pressurizer.
3. For all cases analyzed, pressurizer fill was not predicted to occur prior to 30 minutes following initiation of the event.

STPEGS UFSAR 15.3-1 Revision 17 15.3 DECREASE IN REACTOR C OOLANT SYSTEM FLOW RATE A number of faults are postulated which could result in a decrease in reactor coolant system (RCS) flow. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.

Discussions of the following flow decrease events are presented:

1. Partial Loss of Forced Reactor Coolant Flow
2. Complete Loss of Forced Reactor Coolant Flow
3. Reactor Coolant Pump Shaft Seizure (Locked Rotor)
4. Reactor Coolant Pump Shaft Break Item 1 above is considered to be an American Nuclear Society (ANS) Condition II event, item 2 an ANS Condition III event, and items 3 and 4 ANS Condition IV events (Section 15.0.1).

15.3.1 Partial Loss of Forced Reactor Coolant Flow 15.3.1.1 Identification of Causes and Accident Description. A par tial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by reactor coolant pump (RCP) busses. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor is not tripped.

Normal power for the pumps is supplied through individual buses connected to the generator. When a generator, turbine, or reactor trip occurs, without an electrical fault, the generator circuit breaker automatically opens and backfeed of off-site power occurs through the ma in transformer and unit auxiliary transformer. Thus, the pumps will continue to supply coolant flow to the core. This event is classified as an ANS Condition II in cident (an incident of moderate frequency) as defined in Section 15.0.1. The necessary protection for a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip which is actuated by two out of three low flow signals in any reactor coolant loop. Above interlock P-8, low flow in any loop w ill actuate a reactor trip. Between approximately 10 percent power (interlock P-7) and the power le vel corresponding to interloc k P-8, low flow in any two loops will actuate a reactor trip. Above interlock P-7, two or more reactor coolant pump circuit breakers opening will actuate the corresponding undervoltage relays. This results in a reactor trip which serves as a backup to the low flow trip. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-14. Section 15.0.8 a nd Table 15.0-6 briefly addresses the plant systems and equipment available to mitigate the consequences of the event.

STPEGS UFSAR 15.3-2 Revision 17 As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is a malfunction of one train of the Reactor Protection System. The redundant RPS train performs the protective function. No single failure will adversely affect the consequences of this accident. 15.3.1.2 Analysis of Effects and Consequences.

Method of Analysis The case analyzed is the loss of one pump with four loops in operation. This transient is analyzed by three digital computer codes. First the LOFT RAN code (Ref. 15.3-1) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The FACTRAN code (Ref. 15.3-2) is then used to calcula te the heat flux transient based on the nuclear power and flow from LOFTRAN. Finally, the THINC code or VIPRE (Section 4.4) is used to calculate the departure from nucleate boiling ratio (DNBR) during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

Initial Conditions This accident is analyzed with the Revised Thermal Design Procedure described in Section 4.4. Initial reactor power, RCS pressure and temperature are assumed to be at their nominal values with the addition of applicable instrumentation biases.

Reactivity Coefficients The most negative Doppler-only power coefficient is us ed (Figure 15.0-2). This is the equivalent of a total integrated Doppler reactivity from 0 to 100 percent power of a -1.6 percent k. A +5 pcm/F moderator temperature coefficient is assumed since this results in the maximum core power during the initial part of the transient when the minimum DNBR is reached.

Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics and is based on high estimates of system pressure losses. Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No si ngle active failure in any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is malfunction of one train of the Reactor Protection System.

STPEGS UFSAR 15.3-3 Revision 17 Results Figures 15.3-1 through 15.3-4 show th e transient response for the loss of one RCP with four loops in operation. The results of the DNB analysis show the partial loss of flow event to be bounded by the complete loss of flow event described in Secti on 15.3.2. Although the complete loss of flow event is a Condition III event, some rods are permitted to experience DNB. However, the analysis requires "no DNB" as the acceptance limit.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not significantly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events is shown in Tabl e 15.3-1. The affected RCP will continue to coast down and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed. 15.3.1.3 Radiological Consequences. A partial loss of reactor coolant flow from full load would result in a reactor and turbine trip. Assuming, in addition, that the condenser is not available, atmospheric steam dump may be required.

There are only minimal radiological consequences associated with this event.

Therefore, this event is not limiting. The radiological consequences resulting from atmospheric steam dump are less severe than the steam line break event analyzed in Section 15.1.5 since fuel damage as a result of this transient is not postulated.

15.3.1.4 Conclusions. The analysis shows that the DNBR will not decrease below the safety analysis limit value at any time during the transient. Thus, the DNB design basis as described in Section 4.4 is met.

Evaluations of this event have been performed as part of the replacement steam generator (RSG) program and the 1.4% power uprate program. The RSG evaluation determined that because the transient is a rapid event, the resu lts are insensitive to changes to the plant's secondary system. It was concluded in the power uprate evaluation that the partial loss of reactor coolant flow transient results remain bounded by the results of the complete loss of flow event desc ribed in Section 15.3.2.

Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate.

The radiological consequences of this event are not limiting. 15.3.2 Complete Loss of Forced Reactor Coolant Flow 15.3.2.1 Identification of Causes and Accident Description. A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical power to all RCPs. If the reactor is at power at the time of the accident, the immediate effect of loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.

STPEGS UFSAR 15.3-4 Revision 17 Normal power for the RCPs is supplied through busses from a transformer connected to the generator. When a generator, turbin e, or reactor trip occurs, without an electrical fau lt, the generator circuit breaker automatically ope ns and back-feed of offsite power occurs through the main transformer and unit auxiliary transformer. Thus, the pumps will continue to supply coolant flow to the core. This event is classified as an ANS Condition III incident (an infrequent incident) as defined in Section 15.0.1. This transient was analyzed to Condition II safety acceptance criteria as part of the non-emergency ac power event. The following trips provide protection for a complete loss of flow accident:

1. RCP power supply undervolta ge or underfrequency
2. Low reactor coolant loop (RCL) flow The reactor trip on RCP undervoltage is provided to protect against conditions which can cause a loss of voltage to all RCPs; i.e., loss of offsite power (LOOP). This function is blocked below approximately 10 percent power (interlock P-7).

The reactor trip on RCP underfrequency is provid ed to trip the reactor for an underfrequency condition, resulting from frequency disturbance on the power grid. Reference 15.3-3 provides analyses of grid frequency dist urbances and the resulting Nuclear Steam Supply (NSSS) protection requirements which are generally applicable to South Texas Proj ect Electric Generating Station (STPEGS). If the maximum grid frequency decay rate is less than approximately 5 Hz/second, this underfrequency trip function will protect the core from underfrequency events. This effect is fully described in Reference 15.3-3.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one RCL. This function is generated by two out of three low flow signals per reactor coolant loop. Above interlock P-8, low flow in any loop will actuate a reactor trip. Between approximately 10 percen t power (interlock P-7) and the power level corresponding to interlock P-8, low flow in any two loops will actuate a reactor trip.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-14. Section 15.0.8 a nd Table 15.0-6 briefly discusses the plant systems and equipment available to mitigate the consequences of the event.

As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is a malfunction of one train of the Reactor Protection function. The redundant RPS train performs the protective function. No single failure will adversely affect the consequences of this accident. 15.3.2.2 Analysis of Effects and Consequences. The case analyzed is the loss of four pumps with four loops in operation.

This transient is analyzed by three digital computer codes. First, the LOFT RAN code (Ref. 15.3-1) is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The FACTRAN code (Ref. 15.3-2) is then used to calcula te the heat flux transient based on the nuclear power and flow from LOFTRAN. Finally, the THINC code or VIPRE code STPEGS UFSAR 15.3-5 Revision 17 (Section 4.4) is used to calcul ate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR transients presented represent the minimum of the typical or thimble cell. The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those di scussed in Section 15.3.1, except that following the loss of power supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency.

Results Figures 15.3-9 through 15.3-12 show the transient response for the lo ss of power to all RCPs with four loops in operation. The reactor is again assumed to be tri pped on undervoltage signal. Figure 15.3-12, a representation of the DNBR transient, s hows the DNBR to be always greater than the safety analysis limit value.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events is shown in Table 15.3-1. The RCPs will continue to coastdown, and natural circulation flow will eventually be established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition will be attained. Normal plant shutdown may then proceed. 15.3.2.3 Radiological Consequences. A complete loss of reactor coolant flow from full load results in a reactor and turbine trip. Assuming, in addition, that the condenser is not available, atmospheric steam dump would be required. The quantity of steam released would be the same as for a LOOP. There are only minimal radiological consequences associated with this event.

Therefore, this event is not limiting. Since fuel damage is not postula ted, the radiological consequences resulting from atmospheric steam dump are less severe than the steam line break, discussed in Section 15.1.5.

15.3.2.4 Conclusions. The analysis performed has demonstrated that for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the safety analysis limit value at any time during the transient. Thus, the DNB design basis as described in Section 4.4 is met.

Evaluations of this event have been performed as part of the replacement steam generator (RSG) program and the 1.4% power uprate program. The RSG evaluation determined that because the transient is a rapid event, the resu lts are insensitive to changes to the plant's secondary system. It was concluded in the power uprate evaluation that, with the exception of the initial heat flux which increased as a result of the pow er uprate, the transient response remains unchanged. Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate.

15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor) 15.3.3.1 Identification of Causes and Accident Description. The accident postulated is an instantaneous seizure of a RCP rotor such as is discussed in Section 5.4. Flow through the STPEGS UFSAR 15.3-6 Revision 17 affected RCL is rapidly reduced, leading to an initiation of a reactor trip on a low reactor coolant flow signal. Following initiation of the reactor tri p, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators (SGs) is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon turb ine trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the SGs, causes an insurge into the pressurizer and a pressure increase thr oughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens th e power-operated relief valves (PORVs), and opens the pressurizer safety valves, in that sequence. The two PORVs are designed for reliable operation and would be expe cted to function properl y during the accident.

However, for conservatism their pressure reducing effect and the pres sure reducing effect of the spray are not included in the analysis. A block diagram summarizing various protection sequences for safety actions available to mitigate the consequences of this event is provided in Figure 15.0-14. Section 15.

0.8 and Table 15.0-6 briefly addresses the plant systems and equipment available to mitigate the consequences of this event.

This event is classified as an ANS Condition IV incident (a limiting fault) as defined in Section 15.0.1. 15.3.3.2 Analysis of Effects and Consequences. Method of Analysis Three digital computer codes are us ed to analyze this transient.

The LOFTRAN code (Ref. 15.3-1) is used to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power following reactor trip, and to determine the peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the FACTRAN code (Ref. 15.3-2), using the core flow and the nuclear power calculated by LOFTRAN. The FACTRAN code incl udes the use of a film boiling heat transfer coefficient. The FACTRAN code is also used to calculate the heat flux transient based on the nuclear power and core flow from LOFTRAN.

Finally, the THINC code or VIPRE code (Section 4.4) is used to calculate the DNBR distribution in the core during the transient based on the heat flux from FACTRAN and core flow fr om LOFTRAN. The DNBR distribut ion is used to calculate the number of rods in DNB.

The case of four loops operating, one locked rotor, lo ss of power to the other reactor coolant pumps is analyzed.

At the beginning of the postulated locked rotor accident (i.e., at the time the shaft in one of the RCPs is assumed to seize) the plant is assumed to be in operation under the most adverse steady state operating condition (i.e., maximum steady state power level, maximum steady state pressure, and maximum steady state coolant average temperature).

Plant characteristics a nd initial conditions are further discussed in Section 15.0.3. The pressure uncer tainty used in these an alyses is 46 psi and the coolant average temperature uncertainty is 6.25 F.

STPEGS UFSAR 15.3-7 Revision 17 With no offsite power available, power is lost to the unaffected pump s two seconds after reactor trip. (Note: Grid stability analyses show that the grid will remain stable and that offsite power will not be lost because of a unit trip from 100 percent power. The two-second delay is a conservative assumption based on grid stability analyses.) This case is the most limiting because the RCS flow reduction is even more severe.

When the peak pressure is evalua ted, the initial pressure is conservatively estimated as 46 psi above nominal pressure (2,250 psia) to al low for errors in the pressurizer pressure measurement and control channels. To obtain the maximum pressure in the primary side, conservatively high loop pressure drops are added to the calculated pressurizer pressure. Th e pressure responses shown on Figure 15.3-18 are the responses at the point in the RCS having the maximum pressure. Evaluation of the Pressure Transient After pump seizure, the neutron fl ux is rapidly reduced by control rod insertion. Rod motion begins one second after the flow in the a ffected loop reaches 87 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer PORVs, pressurizer spray, steam dump, or controlled feedwater flow after reac tor trip. Although these are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effects.

The pressurizer safety valves are actuated at 2,600.75 psia. This incl udes a 3% set pressure tolerance over the nominal setpoint of 2,500 psia. Additionally, allowances were made for the valve loop seals by assuming a 1% set pressure shift over the nominal setpoint (i ncluding the tolerance) and by assuming no steam flow until the valve loop seals are purged. The capacity of the safety valves for steam relief is descri bed in Section 5.4.

It should be noted that due to the 3% setpoint uncertainty and the 1%

setpoint shift, th e safety valves are not actuated and, therefore, not required for accident mitigation the locked rotor event.

Evaluation of DNB in the Core During the Accident For this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the consequences with respect to fuel rod thermal transients is performed. Results obtained from analysis of this "hot spot" condition represent the upper limit with respect to clad temperature and zirconium water reaction.

In the evaluation, rod power at the hot spot is assumed to be 2.86 times the average rod power (i.e., F q = 2.86) at the initial core power level. Film Boiling Coefficient The film boiling coefficient is calculated in the FACTRAN code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at the film temperature, which is the average between wall and bulk temperatures. The program calculates the film coefficient at every time step based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass fl ow rate as a function of time are used as program input.

STPEGS UFSAR 15.3-8 Revision 17 For this analysis, the initial values of the pressure and the bul k density are used throughout the transient because they are the most conservative with respect to clad temperature response. For conservatism, DNB was assumed to start at the beginning of the accident.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with initial fuel temperature to 10,000 Btu/hr-ft 2- F at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient. Zirconium Steam Reaction The zirconium steam reaction can become significant above 1,800F (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium steam reaction.

1.986T 45,500exp10x33.3 dtwd 6 2 where: w = amount reacted, mg/cm 2 t = time, sec T = temperature, K The reaction heat is 1,510 cal/gm. The effect of zirconium steam reaction is included in the calculation of the "hot spot" clad temperature transient. Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No si ngle active failure in any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is a malfunction of one train of the Reactor Trip System. Protection is provided by the operable train on a low reactor coolant flow trip signal.

Results Locked Rotor with Four Loops Operating, Loss of Power to the Remaining Pumps The transient results for this cas e are shown on Figures 15.3-17 thr ough 15.3-20. The results of these calculations are also summarized in Table 15.3-

2. The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted allowable stress limits. Also, the peak clad surface temperature is considerably less than 2,700 F

STPEGS UFSAR 15.3-9 Revision 17 for standard ZIRLO fuel cladding and 2,375°F for Optimized ZIRLO TM 1 fuel cladding. Both the peak RCS pressure and the peak clad surface temperature for this case are similar to the four-loop transient with power available as discussed above.

The number of rods in DNB was conservatively calculated as less than 10 percent of the total rods in the core.

The calculated sequence of even ts is shown in Table 15.3-1. 15.3.3.3 Radiological Consequences. The postulated accidents involving release of steam from the secondary system do not result in a releas e of radioactivity unl ess there is leakage from the RCS to the secondary system in the SGs. A conservative analysis of the potential offsite doses resulting from a RCP shaft seizure accident is presented using the Technical Specification limit secondary coolant concentrations. Parameters used in the analysis are listed in Table 15.3-3. The conservative assumptions and parameters used to calculate the activity re leased and offsite doses for a pump shaft seizure accident are the following: The Alternative Radiological Source Terms, as described in Regulator y Guide 1.183 (Reference 15.3-4), are used in this analysis.

The conservative assumptions and parameters used to calculate the activity re leased and offsite doses for a pump shaft seizure accident are the following:

1. The source term is based upon a power level of 4100 MW thermal, 5 w/o enrichment, and a three region core with equilibrium cycle core at end of life. The three regions have operated at a specific power of 39.3 MW/MTU for 509, 1018, and 1527 EFPD, respectively. The assumed power level is greater than the Rated Thermal Power of 3853 MWth plus a 0.6% measurement uncertainty.
2. The initial activity in the reac tor coolant is based upon an iodine spike which has raised the reactor coolant concentration to 60 Ci/gm of dose equivalent I-131. Noble gas activity is based on 1% failed fuel.
3. Prior to the accident, the secondary coolant specific activity is equal to the Technical Specification limit of 0.10 Ci/gm dose equivalent I-131. This DEI activity is given in Table 15.C-7. 4. Ten percent (10%) fuel failure is assumed to occur. The activity released from the pellet-to-clad gap of the failed fuel is assumed to be instantaneously mixed with the reactor coolant system, per Regulatory Guide 1.183. No fuel melting occurs.
5. A feedwater system malfunction caused by the closure of a feedwater isolation valve is postulated, resulting in tube uncovery in that SG.
6. Primary-to-secondary leakage through the steam generator tubes prior to the accident and during the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the transient is 1 gpm. Eight hours after the accident, the residual heat removal system starts and primar y-to-secondary leakage is stopped. Primary-to-secondary leakage is conservatively modeled at 0.65 gpm for the three steam generators with

1 ZIRLO and Optimized ZIRLO are trademarks or registered trademarks in the United States of Westinghouse Electric Company LLC, its subsidiaries and/or its affiliates. These marks may be used and/or registered in other countries throughout the world. All rights reserved. Unauthorized use is strictly prohibited. Other names may be trademarks of their respective owners.

CN-3066 CN-3066 STPEGS UFSAR 15.3-10 Revision 17 covered tubes and at 0.35 gpm for the steam generator with uncovered tubes.

7. A partition coefficient of 100 is assumed for elemental iodine released from the steam generators. (Regulatory Guide 1.183, Appendix G, Position 5.5.4) Organic iodine is not partitioned. Organic iodine is assumed to migrate directly to the steam space and become immediately available for release (see also 15.C.3).
8. The Control Room and TSC ventilation systems are assumed to transfer to the emergency mode of operation immediately after the initiation of this accident. This assumption is countered by the assumption of an additional (second) single failure of a train of the Control Room Emergency HVAC system, specifically the clean-up (recirculation) filters.
9. Offsite power is lost; Main Steam condensers are not available for steam dump.
10. Eight hours after the accident, the residual heat removal system is in operation and no further steam containing radionuclides is released from steam generators to the environment except the leakage through the MSIV above seat drain orifices. The releas e through the orifices continues until 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after the start of the accident.
11. All releases occur via the steam generator PORV s or safeties and the ab ove-seat drain orifices in the Isolation Valve Cubicle next to the PO RVs. Therefore, the PORV-to-Control Room /Qs are used for the Control Room and TSC dose analyses.
12. The reactor coolant density is 8.33 lbm/gal (14.7 psia, 70 ºF). 13. Presence of actual PORV leakage is encompassed by the steam releases necessary to cool the plant to a point where cooling is performed by the RHR system (RCS at 350 psia, 350 F). Therefore, the presence of PORV leakage has no impact on steam releases and dose consequences for the 0~8hr time period. Presence of actual PORV seat leakage after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> has a negligible effect on the doses at the si te boundary and control room. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the pressure in the secondary side has been reduced from operating pressure (about 1050 psia) to the saturation pressure at 350F (about 135 psia). Assuming flow from the PORV is choke flow, the reduction in pressure would cause a proportional reduction in leak flow. A small leakage at the beginning of the event would be reduced by a fact or of 10 after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. When the plant reaches 212 F, the release would stop. This additional releas e would have a negligible effect on doses at th e site boundary and control room.

The doses for the RCP shaft seizure accident are given in Table 15.3-5 for the Exclusion Zone Boundary (EZB) of 1,430 meters and the Low Population Zone (LPZ) of 4,800 meters. 15.3.3.4 Conclusions. Since the peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than the more restrictive limit of 2,375F (associated with Optimized ZIRLO TM) and the amount of zirconium water reaction is small, the core will remain in place and intact with no loss of core cooling capability. Evaluations of this event have been performed as part of the replacement steam generator (RSG) program and the 1.4% power uprate program. The RSG evaluation determined that because the CN-3062 CN-3066 STPEGS UFSAR 15.3-11 Revision 17 transient is a rapid event, the resu lts are insensitive to changes to the plant's secondary system. It was concluded in the power uprate evaluation that, w ith the exceptions of the initial heat flux, which increased as a result of the power uprate, and the core mass flow ra te, which decreased as a result of loop flow asymmetry unrelated to the power uprate, the tr ansient results used to evaluate the DNB consequences remain unchanged. Hence, the conclusi ons of the analysis presented in this section remain valid with respect to the replacemen t steam generators and the 1.4% power uprate. 15.3.4 Reactor Coolant Pump Shaft Break 15.3.4.1 Identification of Causes and Accident Description. The accident is postulated as an instantaneous failure of an RCP shaft, su ch as discussed in Sect ion 5.4. Flow through the affected RCL is rapidly reduced, tho ugh the initial rate of reduction of coolant flow is greater for the RCP rotor seizure event. Reactor trip is initiated on a low reactor coolant flow signal in the affected loop.

Following initiation of the reactor tri p, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the SGs is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon turbine trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the SGs, causes an insurge into the pressurizer and a pressure increase throughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, open s the PORVs, and opens the pressurizer safety valves, in that sequence. The two PORVs are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism their pressure reducing effect and the pressure reducing effect of the spray, are not included in the analysis. This event is classified as an ANS Condition IV incident (a lim iting fault) as defined in Section 15.0.1. A block diagram summarizing various protection sequences for safety actions available to mitigate the consequences of this event is provided in Figure 15.0-14. Section 15.

0.8 and Table 15.0-6 briefly addresses the plant systems and equipment available to mitigate the consequences of this event. The systems and equipment available to mitigate the consequences of this event are essentially the same as those available for mitigating the consequences of a pump shaft seizure accident. The limiting single failure occurs to on e RTS train (see Table 15.0-7). 15.3.4.2 Radiological Consequences. The radiological consequences for a RCP shaft break event would be no worse than those from the locked rotor in cident (Section 15.3.3).

15.3.4.3 Conclusions. The consequences of a RCP shaft break are no worse than those calculated for the locked rotor incident (Section 15.3.3). With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position as assumed in the locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady st ate) core flow. For both the shaft break and locked rotor incidents, reactor trip occurs very early in the transient. In addition, the lock ed rotor analysis conservatively assumes that DNB occurs at th e beginning of the transient.

Evaluations of this event have been performed as part of the replacement steam generator (RSG) program and the 1.4% power uprate program. The RSG evaluation determined that because the STPEGS UFSAR 15.3-12 Revision 17 transient is a rapid event, the resu lts are insensitive to changes to the plant's secondary system. It was concluded in the power uprate evaluation that the RCP shaft break transient results remain bounded by the results of the locked rotor event described in Section 15.3.3. Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate.

STPEGS UFSAR 15.3-13 Revision 17 REFERENCES Section 15.3

15.3-1 Burnett, T.W. T., et al, "LOFTRAN C ode Description," WCAP-7907-P-A, April 1984.

15.3-2 Hargrove, H. G., "FACTRAN, a Fortran IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908-A, December 1989.

15.3-3 Baldwin, M.S., et al, "An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transient in Westinghouse PWR," WCAP-8424, Revision 1, May 1975.

15.3-4 NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," USNRC, July 2000.

STPEGS UFSAR 15.3-14 Revision 17 TABLE 15.3-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT SYSTEM FLOW Accident Event Time (sec) Partial loss of forced reactor coolant flow - four loops operating, one pump

coasting down Coastdown begins 0 Low reactor coolant flow trip 1.30 Rods begin to drop 2.30 Minimum DNBR occurs (Bounded by Complete Loss of Flow) Complete loss of forced reactor coolant flow All operating pumps lose

power and begin coasting

down 0 Reactor coolant pump undervoltage trip point

reached 0 Rods begin to drop 1.5 Minimum DNBR occurs 3.6

STPEGS UFSAR 15.3-15 Revision 17 TABLE 15.3-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT SYSTEM FLOW Accident Event Time (sec) Reactor coolant pump shaft seizure (locked rotor) (Without offsite power) Rotor on one pump locks 0 Low reactor coolant flow setpoint 0.03 Rods begin to drop 1.03 RCPs lose power, coastdown begins 3.03 Maximum clad temperature occurs 3.7 Maximum RCS pressure occurs 4.0 STPEGS UFSAR 15.3-16 Revision 17 TABLE 15.3-2

SUMMARY

OF RESULTS FOR LOCKED ROTOR TRANSIENTS WITHOUT OFFSITE POWER 4 Loops Operating Initially Maximum reactor coolant system pressure, psia 2,646* Maximum clad temperature at core hot spot, F 1,792** Zr-H 2 O reaction at core hot spot, % by weight 0.3

  • This is obtained by modeling the 1% set pressure shift, 3% set pressure tolerance and a loop seal purge time.
    • An increase of 10F in clad average temperature is projected due to the effects of the core inlet flow maldistribution attributed to the RCS flow anomaly. An additional 2 oF increase is projected due to standard ZIRLO or Optimized ZIRLOTM fuel cladding.

CN-3066 STPEGS UFSAR 15.3-17 Revision 17 TABLE 15.3-3 PARAMETERS USED IN REACTOR COOLANT PUMP SHAFT SEIZURE ACCIDENT ANALYSIS Parameter Core power (for radiological source terms) 4100MWt Core power (for steam releases) 3876 MWt (3853MWt + 0.6%) RCS density 8.33 lbm/gallon RCS Mass 2.658E+8 gm SG Mass 659,412 lbm (2.991E+08 gm) Primary-to-Secondary Leakage SGs w/o tube uncovery 0.65 gpm SG w/tube uncovery 0.35 gpm Release from SGs Table 15.3-4 Release from Above (MSIV) Seat Drains SGs w/o tube uncovery 5.79 lbm/sec SG w/tube uncovery 1.93 lbm/sec Steam Flow rate 1.574E+7 lbm/hr Iodine Species Released into the RCS (elemental/organic/particulate) 4.85% / 0.15% / 95%

Iodine Partition Factors for Releases from the Secondary Side (element al/organic/p articulate) 100/1/100 Iodine Species Released from the SG to the Environment (elemental/organic/particulate) 4.85% / 0.15% / 95% Effective Iodine Species Released from the Secondary Side to Environment, after

application of the Partition Factors (elemental/organic/par ticulate) (see 15.C.3) 4.2% / 13.1% / 82.7%

RCS Isotopic Concentrations @ 1% Failed Fuel Table 15.C-2 RCS Pre-existing Iodine Spike Concentrations Tables 15.C-3, -4 Secondary Side Isotopic Concentrations Table 15.C-7 Dose Conversion Factors Table 15.D-10 Decay Constants and Decay Daughter Fractions Table 15.D-11 Offsite breathing rates Table 15.D-5 Offsite /Q's Table 15.D-1 Control Room HVAC Parameters Table 15.D-7

STPEGS UFSAR 15.3-18 Revision 17 TABLE 15.3-3 (continued)

PARAMETERS USED IN REACTOR COOLANT PUMP SHAFT SEIZURE ACCIDENT ANALYSIS Parameter Control Room HVAC Flow Rates Table 15.D-6 TSC HVAC Parameters Table 15.D-9 TSC HVAC Flow Rates Table 15.D-8 Control Room and TSC /Q's Table 15.D-4 STPEGS UFSAR 15.3-19 Revision 17 TABLE 15.3-4 STEAM RELEASED TO THE ENVIRONMENT (lbm) Time (Hours) PORV Above Seat Drains Total 0 - 2 640,000 55,584 695,584 2 - 8 1,120,000 166,752 1,286,752 8 - 12 0 111,168 111,168 12 - 36 0 667,008 667,008 36 - 720 0 0 0 STPEGS UFSAR 15.3-20 Revision 17 TABLE 15.3-5 DOSES RESULTING FROM REACTOR COOLANT PUMP SHAFT SEIZURE ACCIDENT (rem TEDE)

Receptor Dose Applicable Limits EAB (worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 1.9 2.5 LPZ 1.5 2.5 Control Room 3.9 5 TSC 3.7 5

STPEGS UFSAR 15.4-1 Revision 17 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivit y and power distribution anomalies. Reactivity changes could be caused by rod cluster control assembly (RCCA) motion or ejection, boron concentration changes, or addition of cold water to the Reactor Coolant System (RCS). Power distribution changes could be caused by RCCA motion, misalignm ent, or ejection, or by static means such as fuel assembly mislocatio

n. These events are disc ussed in this section. Detailed analyses are presented for the most limiting of these events.

Discussions of the following incident s are presented in this section.

1. Uncontrolled RCCA bank withdrawal from a su bcritical or low power startup condition (Section 15.4.1)
2. Uncontrolled RCCA bank withdraw al at power (Section 15.4.2)
3. RCCA misalignment (Section 15.4.3)
4. Start of inactive reactor coolant at an incorrect temperature (Section 15.4.4)
5. Malfunction or failure of a flow controller in a boiling water reactor (BWR) (not applicable to the South Texas Project Electric Gene rating Station [STPEGS]) (Section 15.4.5)
6. Chemical and Volume Control System (CVCS) malfunction that re sults in a decrease in boron concentration in the reactor coolant (Section 15.4.6)
7. Inadvertent loading and operation of a fuel assembly in an improper position (Section 15.4.7)
8. Spectrum of RCCA ejection accidents (Section 15.4.8)
9. Spectrum of rod drop accident in a BWR (not applicable to STPEGS) (Section 15.4.9) Items 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II events, Item 7 an ANS Condition III event, and Item 8 an ANS Condition IV event. Item 3 entails both Condition II and III events. See Section 15.0.1. 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition 15.4.1.1 Identification of Causes and A ccident Description. An RCCA withdrawal accident is defined as uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power excu rsion. Such a transient could be caused by a malfunction of the reactor control or rod control systems. This could occur with the reactor either subcritical, hot zero power or at power. The "at power" case is discussed in Section 15.4.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedur es with a clean core require boron dilution. The maximum rate of STPEGS UFSAR 15.4-2 Revision 17 reactivity increase in the case of boron dilution is less than that assumed in this analysis (Section 15.4.6). The RCCA drive mechanisms are wired into preselec ted bank configurations which are not altered during reactor life. These circuits prevent the RCCAs from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combin ation of two sequential control banks having the maximum combined worth at maximum speed.

This event is classified as an ANS Condition II in cident (an incident of moderate frequency) as defined in Section 15.0.1.

The neutron flux response to a con tinuous reactivity inser tion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self-limitation of the power excursion is of primary importance since it limits the power to an acceptable level during the delay time for protective action. Should a continuous RCCA withdr awal accident occur, the transient will be terminated by the following automatic features of the Reactor Trip System (RTS):

1. Source Range High Neutron Flux Reactor Trip Actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.
2. Intermediate Range High Neutron Flux Reactor Trip Actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two of the f our power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.
3. Power Range High Neutron Flux Reactor Trip (Low Setting)

Actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed only when two of the four range channels indicate a power level above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.

4. Power Range High Neutron Flux Reactor Trip (High Setting)

Actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip f unction is always active.

STPEGS UFSAR 15.4-3 Revision 17

5. High Positive Neutron Flux Rate Reactor Trip Actuated when the positive rate of change of neutron flux on two out of four power range channels indicate a rate above the preset point. This trip function is always active.

In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one out of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and th e power range flux level trip, respectively. 15.4.1.2 Analysis of Effects and Consequences.

Method of Analysis The analysis of the uncontrolled RCCA bank withdraw al from subcritical accident is performed in three stages: first an average core nuclear power transient calculation, then an average core heat transfer calculation, and finally the departure from nucleate boiling ratio (DNBR) calculation. The average core nuclear calculation is performed using spatial neutron kinetics methods (TWINKLE) (Ref. 15.4-1) to determine the average power generation with time including the various total core feedback effects; i.e., Doppler reactivity and moderator reactivity. The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN (Ref. 15.4-2). The average heat flux is next used in THINC or VIPRE (described in Section 4.4) for transient DNBR calculation.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results for a startup accident, the following assumptions are made:

1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is str ongly dependent on the Doppler coefficient, conservatively low (least negative) values as a function of power are used. The Doppler coefficient used does not directly correlate with Figure 15.0-2 because the TWINKLE code, on which the neutronic analysis is based, is a diffusion-theory code rather than a point-kinetics approximation. The Doppler defect used as an initial condition is 900 pcm.
2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial ne utron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A positive value of +5 pcm/ F, obtained by adjusting the initi al boron concentration in the nuclear code, is used in the analysis to yield the maximum peak heat flux.
3. The reactor is assumed to be at hot zero power. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a

larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.

4. Two reactor coolant pumps (RCPs) are assumed to be in operation. This lowest initial flow minimizes the initial margin to departure from nucleate boiling (DNB).

STPEGS UFSAR 15.4-4 Revision 17

5. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10 percent increase is assumed for the power range flux trip setpoint raising it from the nominal value of 25 percent to 35 percent.

Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is neg ligible. In addition, the reactor trip insertion characteristic is based upon the assumption that the highest worth RCCA is stuck in its fully withdrawn position. The RCCA insertion time to dashpot entry was conservatively assumed to be more than 2.8 seconds.

6. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential c ontrol banks having the greatest combined worth at maximum speed. Control rod drive mechanism (CRDM) design is discussed in Section 4.6.
7. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.
8. The initial power level was assumed to be be low the power level expected for any shutdown condition (10

-9 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-15. Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0.6. No singl e active failure in any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure is assumed to occur in one train of the Reactor Protection System. In the analysis, protection is provided by the operable trai n on a power range high neutron flux (low signal) signal. Results Figure 15.4-1 through 15.4-3 show the transient behavior for the uncontrolled RCCA bank withdrawal, with the accident terminated by reactor trip at 35 percent of nominal power. The reactivity insertion rate used is greater than that calculated for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region.

Figure 15.4-1 shows the neutron power transient. The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is shown on Figure 15.4-2. The be neficial effect of the inherent thermal lag in the fuel is evidenced by a heat flux much less than the full power nominal value. There is a large margin to DNB during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core. Figure 15.4-3 shows the response of the hot spot fuel and cladding temperature. The hot spot fuel average temperature increases to a value below the nominal full power hot spot value. The minimum DNBR at all times remains above the safety analysis limit value.

STPEGS UFSAR 15.4-5 Revision 17 The calculated sequence of events for this accide nt is shown in Table 15.4-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures. 15.4.1.3 Radiological Consequences. There are no radiological consequences associated with an uncontrolled RCCA bank withdr awal from a subcritical or low power startup condition event because radioactivity is contained within the fuel rods and RCS within design limits.

15.4.1.4 Conclusions. In the event of an RCCA withdrawal accident from the subcritical condition, the core and the RCS are not adversely affect ed, because the combination of thermal power and the coolant temperature result in a DNBR which is above the safety analysis limit value. Thus, the DNB design basis as described in Section 4.4 is met. Evaluations of this event have been performed as part of the replacement steam generator program and the 1.4% power uprate program. Because the secondary system is not modeled in the analysis of the event, the steam generator performance does not impact the results of the analysis. As for the power uprate evaluation, with the exceptions of the nominal heat flux, which increased as a result of the power uprate, and the core mass flow rate, which decreased as a result of loop flow asymmetry unrelated to the power uprate, the transient results used to evaluate the DNB consequences remain unchanged. Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam genera tors and the 1.4% power uprate. 15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power 15.4.2.1 Identification of Causes and Accident Description. Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generators lags behind the core power generation until the steam generator (SG) pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad, the RTS is designed to terminate any such transient before the DNBR falls below the safety analysis limit value.

This event is classified as an ANS Condition II in cident (an incident of moderate frequency) as defined in Section 15.0.1. The automatic features of the RTS which prevent core damage following the postulated accident include the following:

1. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint.
2. Reactor trip is actuated if any two-out-of-four channels exceed a rate lag setpoint on the high positive neutron flux rate; this trip is credited in the RCS over-pressure analysis.
3. Reactor trip is actuated if any two out of four T channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB. No credit is taken for the reduction in setpoint associated with an axial power imbalance (see Section 7.2.1). This mo deling technique provides the minimum margin to DNB because it produces a conservative overtemperature trip setpoint.
4. Reactor trip is actuated if any two out of four T channels exceed an overpower T setpoint.

STPEGS UFSAR 15.4-6 Revision 17

5. A high pressurizer pressure reactor trip is actuated if any two out of four pressure channels exceed the setpoint. This set pressure is less than the set pressure for the pressurizer safety valves. 6. A high pressurizer water level reactor trip is actuated if any two out of four level channels exceed the setpoint.

In addition to the above listed reactor trips, there are the following RCC A withdrawal blocks:

1. High neutron flux (one out of four)
2. Overpower T (two out of four)
3. Overtemperature T (two out of four) The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of RCS conditions is described in Chapter 7. Figure 15.0-1C presents allowable reactor coolant loop (RCL) average temperatures and Ts for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as "protection lines" on this diagram. The protection lines are drawn to include all adverse instrumentation a nd setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit value. All points below and to the left of a DN B line for a given pressure have a DNBR greater than the safety analysis limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point. The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressurizer pressure (fixed setpoint); low pressurizer pressure (fixed setpoi nt); overpower and overtemperature T (variable setpoints). 15.4.2.2 Analysis of Effects and Consequences.

Method of Analysis This transient is analyzed by the RETRAN code (Ref. 15.4-13). This code simulates the neutron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, SG, and SG safety valves. The code computes pertinent plant variables including temperatures, pressu res, and power level. The core limits, as illustrated on Figure 15.0-1C, are used as input to RETRAN to determine the minimum DNBR during the transient.

RETRAN computer code calculates DNBR based on the core thermal limits. The core thermal limit lines define the locus of conditions for a wide range of power levels, average RCS temperatures, and pressures where the DNBR is equal to the DNBR safety analysis limit value. RETRAN does not actually perform the DNB calculation other than a partial derivative approximation of the DNB core thermal limit lines. The DNBR value calculated in RETRAN is conservative with a presumed FH , flow rate, and axial power shape. If RETRAN calculated DNBR exceeds the safety analysis limit, a more accurate DNB calculation is performed using a subchannel thermal hydraulic code such as STPEGS UFSAR 15.4-7 Revision 17 VIPRE-W (Ref. 15.4-14). The statepoints of the limiting DNBR case, generated from RETRAN results, are used in the steady state VIPRE-W DNB analysis.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made:

1. This accident is analyzed with the Revised Thermal Design Procedure described in Section 4.4. Initial reactor power, RCS pressure and temperature are assumed to be at their nominal values with the addition of applicable instrumentation biases.
2. The analysis for maximum RCS pressure uses the Standard Thermal Design Procedure. Uncertainties in initial conditions are a pplied to produce the lim iting RCS pressures.
3. Reactivity coefficients - Two cases are analyzed.
a. Minimum Reactivity Feedback: A +5 pcm/F moderator temperature coefficient of reactivity and a least negative Doppler-only power coefficient of reactivity (Figure 15.0-2) are assumed corresponding to the beginning of core life.
b. Maximum Reactivity Feedback: A conservatively large negative moderator temperature coefficient and a most negative Doppler-only power coefficient are assumed. 4. The reactor trip on high neutron flux is assume d to be actuated at a conservative value of 118% of nominal full power. The reactor trip on high positive neutron flux rate is conservatively modeled to actuate when the rate exceeds 8.0% of RTP with a time constant of 2.0 seconds. The reactor trip on high pressurizer pr essure actuates when an analytical setpoint of 2,435 psia is exceeded. The T trips include adverse instrume ntation and setpoint errors. The delays for these trip signal actuations are assumed at conservatively high values.
5. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
6. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinati ons of the two control banks having the maximum combined worth at maximum speed.
7. The effect of RCCA movement on the axial core power distributi on is accounted for by causing a decrease in overtemperature T setpoint proportional to a decrease in margin to DNB. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-15. Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No si ngle active failure in any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure is assumed to occur in one train of the Reactor Protection System.

Protection is provided by the operable train on overtemperature T, power range high neutron flux, or power range neutron flux high posi tive rate signals. A discussion of anticipated transients without trip (ATWT) considerations is presented in Reference 15.4-4.

STPEGS UFSAR 15.4-8 Revision 17 Results Figures 15.4-4 through 15.4-6 show the transient response for a RCCA withdrawal from full power with a reactivity insertion rate of 3 pcm/sec and minimum reactivity feedback. This is the limiting event with regards to DNBR. Reactor trip occurs on overtemperature T signal. The results show the minimum DNBR is greater than the safety analysis limit value.

Figure 15.4-10 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature T channels. The minimum DNBR is always greater than the safety analysis limit value. Figures 15.4-11 and 15.4-12 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60 and 10 percent power, respectively. The results are similar to the 100 percent power case, exce pt as the initial power is d ecreased, the range over which the overtemperature T trip is effective is increased. In neither case does the DNBR fall below the safety analysis limit value. The shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to the minimum feedback low power case in Figure 15.4-12, for example, it is noted that: 1. For high reactivity insertion rates (i.e., between approximately 50 pcm/sec and 100 pcm/sec) reactor trip is initiated by the high neutron flux trip. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNBRs during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium w ith the neutron flux; minimum DNBR during the transient thus de creases with decreasing insertion rate. 2. The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based upon measured RCS average temperature and pressure. This trip circuit is described in detail in Chapter 7; however, it is important in this context to note that the average temperature contribution to the circuit is lead-lag compensated in order to decrease the effect of the thermal capacity of the RCS in response to power increases. 3. For reactivity insertion rate between approximately 50 pcm/sec and 5 pcm/sec, the decrease in the insertion rate reduces the rate of reactor power increase. The high neutron flux reactor trip signal and OTT reactor trip signal are not effective because of the slower power increase.

The pressurizer water level increases due to the rise in RCS temperature. The high pressurizer pressure signal trips the reactor and terminates the event. 4. For reactivity insertion rates less than approximately 5 pcm/sec, the main steam safety valve setpoint is reached sufficiently prior to trip such that the openi ng of these valves acts as an additional heat release path for the RCS, shar ply decreasing the rate of the rise of RCS STPEGS UFSAR 15.4-9 Revision 17 average temperature. This decr ease in rate of rise of the average coolant system temperature during the transient is accentuated by the lead-lag compensation causing the overtemperature T trip setpoint to be reached later with resulting lower minimum DNBRs. For transients initiated from higher power levels (for example, see Figure 15.4-10) the effect described in Item 4 above does not occur since the main st eam safety valves are never actuated prior to trip. Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity inser tion rates, the overpower transient is fast with respect to the fuel rod thermal time constant and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 118 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel temperature will still remain below the fuel melting temperature.

For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the overtemperature T reactor trip before a DNB condition is reached. The peak heat flux is again maintained below 118 percent of its nominal value. Taking into account the effect of the RCC A withdrawal on the axial core power distribution, the peak temperature will remain below the fuel melting temperature.

Since DNB does not occur at any tim e during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rods is not reduced. Thus, the fuel cladding temperature does not rise si gnificantly above its initial value during th e transient.

The calculated sequence of events for this accide nt is shown in Table 15.4-1. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.2.3 Radiological Consequences. There are only minimal radiological consequences associated with an uncontrolled RCCA bank withdrawal at power event. The reactor trip causes a turbine trip and heat is removed from the secondary system through the SG PORVs or safety valves. Since no fuel damage is postulated to occur, the radiological consequences associated with atmospheric steam release from this event are less severe than the steam line break event analyzed in Section 15.1.5.3.

15.4.2.4 Conclusions. The high neutron flux, power range neutron flux high positive rate, and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates (i.e., the minimum value of DNBR is always larger than the safety analysis limit value and the RCS pressure limit is satisfied). Thus , the DNB design basis as described in Section 4.4 is met. 15.4.3 Rod Cluster Control Assembly Misoperation 15.4.3.1 Identification of Causes and Accident Description.

RCCA misoperation accidents include:

STPEGS UFSAR 15.4-10 Revision 17

1. One or more dropped RCCAs within the same group
2. A dropped RCCA bank
3. Statically misaligned RCCA
4. Withdrawal of a single RCCA

Each RCCA has a position indicator channel which displays the position of the assembly. The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod-at-bottom signal, which actuates a local alarm and a control room annunciator. Group demand pos ition is also indicated. RCCAs are always moved in preselected banks and the banks are always moved in the same preselected sequence. Each bank of RCCAs is di vided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group ar e driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical

failures are in the direction of insertion or immobility.

The dropped RCCA, dropped RCCA bank, and statically misaligned RCCA events are classified as ANS Condition II incidents (incidents of moderate frequency) as defined in Section 15.0.1. However, the single RCCA withdrawal incident is classified as an ANS Condition III event, as discussed below.

No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single ra ndom failure is on the order of 10

-4/year; refer to Section 7.7.2.2) or multiple serious operator errors, and subsequent and repeated operator disregard of event indication. The probability of such a combina tion of conditions is very low. The consequences, however, may include slight fuel damage. Thus, consistent with the philosophy and format of American National Standards Institute (ANSI) N18.2, the event is classi fied as a Condition III event. By definition "Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant", and "shall not cause more than a small fraction of fuel elements in the reactor to be damaged-"

This selection of criterion is in accordance with General Design Criterio n (GDC) 25 which states, "The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods" (emphasis added). It has b een shown that single failures resulting in RCCA bank withdrawal s do not violate specified fuel design limits. Moreover, no single STPEGS UFSAR 15.4-11 Revision 17 malfunction can result in th e withdrawal of a single RCCA. Thus, it is concluded th at the criterion established for the single rod withdrawal at power is appropriate and in accordance with GDC 25. A dropped RCCA or RCCA bank is detected by:

1. Sudden drop in the core power level as seen by the nuclear instrumentation system
2. Asymmetric power distribution as seen on excore neutron detectors or core exit thermocouples
3. Rod at bottom signal
4. Rod deviation alarm
5. Rod position indication Misaligned RCCAs are detected by:
1. Asymmetric power distribution as seen on excore neutron detectors or core exit thermocouples
2. Rod deviation alarm
3. Rod position indication The resolution of rod position indica tion channel is +/-5 percent of span. Deviation of any RCCA from its group by twice this distance will not cause power distributions worse than the design limits. The deviation alarm alerts the operator to rod deviation with respect to the group position in excess of 5 percent of span. If the rod deviation alarm is not operable, the operator is required to take action as required by the Technical Specifications. If one or more rod positions indication channels should be out of serv ice, detailed operating instructions shall be followed to assure the alignment of the nonindicated RCCA. The operator is also required to take action as required by the Technical Sp ecifications or the Technical Requirements Manual. In the extremely unlikely event of simultaneous elec trical failures which c ould result in single RCCA withdrawal, rod deviation and rod control failure would both be di splayed on the plant annunciator, and the rod position indication would indicate the relative position of the assemb lies in the bank. The urgent failure alarm also inhibits automatic rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combin ation of errors, would result in activation of the same alarm and the same visual indications. Wit hdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power, and an increase in local power density in the core area associated with the RCCA. Automatic protect ion for this event is provided by the overtemperature T reactor trip, although, due to the increase in local power density, it is not possible in all cases to provide assurance that the core safety limits will not be violated. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided on Figures 15.0-16 and 15.0-17. Plant systems and equipment which are necessary to mitigate the effects of the various control rod misoperations are discussed in Section 15.0.8 and listed in Table 15.0-
6. No single active failure in STPEGS UFSAR 15.4-12 Revision 17 any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure is assumed to oc cur in one train of the Reactor Protection System. Reactor trip is provided by the operable train on low pressurizer pressure. In some of the analyzed cases, equilibrium conditions were reached without reactor trip. 15.4.3.2 Analysis of Effects and Consequences.

15.4.3.2.1 Dropped RCCAs, Dropped RCCA Bank, and Statically Misaligned RCCA:

15.4.3.2.1.1 Method of Analysis - The methods used to evaluate the effects of these events are as follows:

1. One or more dropped RCCAs from the same group For evaluation of the dropped RCCA event, the transient system response is calculated using the RETRAN code (Ref. 15.4-13).

The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer sp ray, SG, and SG safety valves. The code computes pertinent plant variables including temperatur es, pressures, and power level. Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the THINC code or VIPRE code (Ref. 15.4-14).

The transient response, nuclea r peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 15.4-12.

2. Statically Misaligned RCCA Steady-state power distributions are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then used as input to the THINC co de or VIPRE code to calculate the DNBR. 15.4.3.2.2 Results
1. One or more dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion. The core is not a dversely affected during this period, since power is decreasing rapidly. Power may be reestablished either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

STPEGS UFSAR 15.4-13 Revision 17 For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller, after which the control system will insert the control bank in order to restore nominal pow er. Figures 15.4-13 and 15.4-14 show a typical transient response to a dropped RCCA (or RCCAs) in automatic control.

In all cases, the minimum DNBR remains above the limit value. Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.

2. Dropped RCCA Bank Results A dropped RCCA bank typically results in a reactivity insertion of greater than 500 pcm. The core is not adversely affected during the insertion period, sinc e power is decreasing rapidly. The transient will proceed as described in part 1, however, the return to power will be less due

to the greater worth of an entire bank. Following plant stabilization, normal rod retrieval or shutdown procedures may subsequently be followed to further cool down the plant.

3. Statically Misaligned RCCA Results The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postu lated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fu lly withdrawn without the DNBR falling below the limit value. A ny action required of the operator to maintain the plant in a stabilized condition will be in a time frame in excess of 10 minutes following the incident. The insertion limits in the Technical Specifications may vary from time to time depending upon a number of limiting criteria.

It is preferable, therefore, to analyze the misaligned RCCA case at full power for a positio n of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycl e to cycle depending upon fuel arrangements. For this RCCA misalignment with bank D inserted to its full power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor power, pressure, and RCS temperature are at their nominal values (as given in Table 15.0-2) but w ith the increased radial peakin g factor associated with the misaligned RCCA.

DNB calculations have not been performed specifically for RCCAs missing from other banks; however, power shape calculations have been performed, as required, for the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kW/ft situation is less

severe than the bank D case discussed above assuming insertion limits on the other banks equivalent to a bank D full-in insertion limit.

STPEGS UFSAR 15.4-14 Revision 17 For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. This case is analyzed assuming the initial reactor pow er, pressure, and RCS temperature are at their nominal values (as gi ven in Table 15.0-2) but with the increased radial peaking factor associated with the misaligned RCCA. DNB does not occur for the RCCA misalignment incident and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a li near heat generation ra te based upon the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linea r heat generation is well below that which would cause fuel melting. Following the identification of a RCCA group misalignment condition by the operator, the operator is required to take action as required by the Techni cal Specifications and operating instructions. 15.4.3.2.3 Single RCCA Withdrawal Method of Analysis

15.4.3.2.3.1 Method of Analysis - Power distributions within the core are calculated by the computer codes as described in Table 4.1-2. The peaking factors are then used by THINC or VIPRE to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to occur at beginning-of-life since this results in the minimum value of moderator temperature coefficient. This assumption maximizes the power rise and minimizes the tendency of increased moderator temperature to flatten the power distribution.

15.4.3.2.3.2 Results of Analysis - For the single rod withdrawal event, two cases have been considered, as follows:

1. If the reactor is in the manual control mode, continuous withdr awal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, th e increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending upon initial ba nk insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions, at which the overtemperature T trip would be expected to trip the plant, shows that an upper limit for the number of rods with a DNBR less than the limit value is five percent. 2. If the reactor is in the automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the controlling bank. The transient will then proceed in the same manner as Case 1 described above.

STPEGS UFSAR 15.4-15 Revision 17 For such cases as above, a reactor trip will ultimately ensue, although not sufficiently fast in all cases to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal operating procedures may be followed to further cool down the plant. 15.4.3.3 Radiological Consequences. The most limiting RCCA misoperation, accidental withdrawal of a single RCCA, is predicted to result in limited fuel damage. The subsequent reactor and turbine trip would result in atmospheric steam release, assuming the condenser was not available for use. The radiologi cal consequences from this event are less severe than the Reactor Coolant Pump Shaft Seizure (Locked Rotor) event analyzed in Section 15.3.3.

15.4.3.4 Conclusions. For cases of dropped RCCAs or dropped banks, the DNBR remains greater than the safety analysis limit value and, therefore, the DNB design criterion is met.

For all cases of any RCCA fully inse rted, or bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value. For the case of the accident al withdrawal of a single RCCA, with the reactor in the automatic or manual control mode, and initially operating at full power with control bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNBR less than the limit value is five percent of the total fuel rods in the core. The radiological consequences from these events are not limiting.

Evaluations of this event have been performed as part of the replacement steam generator (RSG) program and the 1.4% power uprate program. The RSG evaluation determined that the effect of the secondary-system changes is of no consequence because the event is not coupled to the steam generators. It was concluded in the power uprate evaluation that, with the exception of the nominal heat flux, which increased as a result of the power uprate, the transient results used to evaluate the DNB consequences remain unchanged. Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate.

15.4.4 Startup of an Inactive Reactor Coolant Loop at an Incorrect Temperature 15.4.4.1 Identification of Causes and Accident Description. If the plant is operating with one pump out of service, there is reverse flow th rough the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive l oop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the SG in the inactive loop is not isolated, there is a temperature drop across the SG in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower th an the reactor core inlet temperature.

Operational procedures require that the unit be brought to subcritical prior to starting the pump in an inactive loop in order to bring the inactive loop hot leg temperature closer to the core inlet temperature. Starting of an idle RCP without br inging the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity insertion and s ubsequent power increase.

STPEGS UFSAR 15.4-16 Revision 17 This event is classified as an ANS Condition II in cident (an incident of moderate frequency) as defined in Section 15.0.1. Should the startup of an inactive RCL accident occur, the transient will be terminated automatically by a reactor trip on low reactor coolant flow when the power range neutron flux (two out of four channels) exceeds the P-8 setpoint, which has been previously reset for three-loop operation. 15.4.4.2 Analysis of Effects and Consequences.

Method of Analysis This transient is analyzed by three digital computer codes. The LOFTRAN code (Ref. 15.4-3) is used to calculate the loop and core flow, nuclear power, and core pressure and temperature transients following the startup of an idle pump. FACTRAN (Ref.

15.4-2) is used to calc ulate the core heat flux transient based upon core flow and nuclear power from LOFTRAN. The THINC co de is then used to calculate the DNBR during the transient based upon system flow conditions calculated by LOFTRAN and heat flux as calculated by FACTRAN.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to obtain conservative results for the startup of an inactive loop accident, the following assumptions are made:

1. Initial conditions of maximum core power a nd reactor coolant aver age temperatures, and minimum reactor coolant pressure resulting in minimum initial margin to DNB. The values are consistent with maximum steady-state power level allowed with three loops in operation.

The high initial power gives the greatest temperature difference between the core inlet temperature and the inactive loop hot leg temperature.

2. Following initiation of startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value in approximately 11 seconds.
3. A most negative moderator temper ature coefficient (Section 15.0.4).
4. A least negative Doppler-only pow er coefficient (Figure 15.0-2).
5. The initial RCL flows are at the appropriate values for one pump out of service.
6. The reactor trip is assumed to occur on low reactor coolant flow when the power range neutron flux exceeds the P-8 setpoint. The P-8 setpoint is conservatively assumed to be 85 percent of rated power, which corresponds to the nominal set point for three-loop operation plus 10 percent for nuclear instrumentation errors (Table 15.0-4). A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-18. Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No si ngle active failure in any of these systems or equipment will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting failure assumed in the analysis is defined as malfunction of one train of the Reactor Protection System.

STPEGS UFSAR 15.4-17 Revision 17 Results The results following the startup of an idle pump with the above listed assumptions are shown on Figures 15.4-16 through 15.4-20. As shown in these curv es, during the first part of the transient, the increase in core flow with cooler water results in an increase in nuclear power and a decrease in core average temperature. The minimum DNBR during the transient is considerably greater than the safety analysis limit value. Reactivity addition for the inactive loop startup accident case is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the cooler water entering the core from the hot leg side (colder temperature side prior to th e startup of the transient) of the SG in the inactiv e loop. Thus, the reactivity insertion rate for this transient changes with time. The resultant core nuclear power transient, computed with consider ation of both moderator and Doppler reactivity feedback effects, is shown on Figure 15.4-16.

The calculated sequence of events for this accident is shown in Table 15.4-1. The transient results illustrated on Figures 15.4-16 through 15.4-20 indicat e that a stabilized plant condition, with the reactor tripped, is approached at 30 seconds. Plant cooldown may subsequently be achieved by following normal shutdown procedures.

15.4.4.3 Radiological Consequences. There are only minimal radiological consequences associated with startup of an inactive RCL at an incorrect temperature. Therefore, this event is not limiting. The reactor trip causes a turbine trip and heat is removed from the secondary system through the SG power-operated relief valves or safety valves. Since no fuel damage is postulated to occur from this transient, the radiological consequences associat ed with this event are less severe than the steam line break event, as discussed in Section 15.1.5. 15.4.4.4 Conclusions. The transient results show that th e core is not adversely affected. The DNBR remains above the safety analysis li mit value throughout the transient; thus, the DNB design basis as described in Section 4.4 is met.

Because the primary system power, flow, and temperature conditions are not significantly changed with the incorporation of the replacement steam generators, the temperature differential between the active loop cold leg and the inactive loop hot leg is not significantly affected. The nominal increase in RCS active volume with the Delta 94 steam generators of less than 300 ft 3/SG results in a slight delay in the reactivity transient; however, the delay will not change the core physics or response characteristics. Therefore, there are no advers e impacts on the startup of an inactive coolant loop analysis with the implementation of the replacement steam generators. Current operating procedures do not permit starting a RCP in Mode 1 or 2, and if a RCP trips then procedures require the reactor to be tripped. Evaluations determined that the conclusions presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate. 15.4.5 A Malfunction or Failure of the Flow Cont roller in a BWR Loop That Results in an Increased Reactor Coolant Flow Rate Not applicable to STPEGS.

STPEGS UFSAR 15.4-18 Revision 17 15.4.6 Chemical and Volume Control System Malfunc tion That Results in a Decrease in Boron Concentration in the Reactor Coolant 15.4.6.1 Identification of Causes and Accident Description. Reactivity can be added to the core by feeding unborated water into the RCS via the CVCS. Boron dilution is a manual operation under strict administrativ e controls, with procedures calling for a limit on the rate and duration of dilution. A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the RCS. The CVCS is designed to limit the pote ntial rate of dilution to a va lue which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.

The opening of the primary water makeup control valve provides makeup to the RCS which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve. In order for makeup water to be added to the RCS at pre ssure, at least one charging pump must be running in addition to a reactor makeup water pump. Normally, only one reactor makeup water supply pump is operating while the other is on standby.

With the RCS at pressure, the maximum delivery rate is limited by the control valve. The boric acid from the boric acid tank is blended with reactor grade water and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board. Information on the status of the Reactor Makeup Water System (RMWS) and the CVCS is continuously available to the operator. Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS and RMWS. Alarms are actuated to warn the operator if boric acid or reactor makeup water flow rates deviate from preset values as a result of system malfunction. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided on Figure 15.0-19. Section 15.0.8 a nd Table 15.0-6 briefly address the plant systems and equipment available to mitigate the consequences of the event. This event is classified as an ANS Condition II in cident (an incident of moderate frequency) as defined in Section 15.0.1.

15.4.6.2 Analysis of Effects and Consequences. Method of Analysis The boron dilution analysis was performed to ensure that the operator action time from a flux-multiplication signal to complete loss of shutdown margin is greater than 15 minutes. The event was analyzed for all operating modes except those modes where administrative controls prohibit dilution. The analysis used conservative assump tions for active reactor coolant mixing volume and differential boron worth. The differential boron worth is assumed to be constant rather than a decreasing function of boron concentration.

The analysis is a hand calculation that solves a differential equati on for the boron concentration as a function of time. The time to loss of shutdown marg in is a function of dilution flow rate, RCS active STPEGS UFSAR 15.4-19 Revision 17 volume, and boron concentration. Th e operator action to isolate the di lution flow path and initiate boration terminates the transient prior to loss of the shutdown margin which would challenge fuel and RCS design limits. Plant characteristics and initial conditions assumed in the analyses are briefly discussed in Section 15.0.3. A detailed failure modes and effects analysis (FMEA) has been performed to identify potential boron dilution initiators in Modes 3, 4, and 5 (hot standby, hot shutdown a nd cold shutdown, respectively). Each component of the CVCS was considered to determine the consequences of each possible failure mode. In estimating the maximum dilution flow rates which result from a particular identified initiator, the effects of a single additional active failure or a single operator error of omission has been considered. In order to bound the initiators in the shutdown and standby modes, the initiator with the highest dilution flow rates, the RMWS, has been considered. The Residual Heat Removal System (RHRS) has also been reviewed and is discussed below.

No single active failure will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is defined as malfunction of one train of the Reactor Protection System (RPS). The operating train trips the reactor. The RPS will initiate a trip in Modes 1 and 2 and provides an automatic alarm alerting the plant operators of the abnormal condition. In Modes 3, 4, and 5, the extended range neutron flux multiplication alarm will alert the operator. This alarm is not included in the RPS, but is used to mitigate the event.

Dilution During Refueling An uncontrolled boron dilution accident cannot occur during refueling. This accident is prevented by administrative controls which isolate the RCS from the potential source of unborated water.

Each unborated water source will be isolated from the RCS by a bli nd flange or by a valve that is locked closed or isolated by removal of instrument air or electrical power duri ng refueling operations. These valves and/or secured mechanical connecti ons will block the flow paths which could allow unborated water to reach the RCS. Any makeup whic h is required during refueling will be borated water supplied from the refueling water storage tank (RWST) or the boric acid tank (BAT) using the centrifugal charging pumps and/or the low head safety injection (LHSI) pumps. Makeup water may also be provided from a recycle holdup tank through the boron recycle system. Prior to makeup from this system, all sources of unborated water that could result in the more restrictive of the following two requirements: a. A keff greater than 0.95, or b. RCS boron concentration less than 2800 ppm are isolated by a blind flange or by a valve that is locked closed or isolated by removal of instrument air or electrical power. A sample is taken to ensure the boro n concentration of the boron recycle system is greater than the above requirement.

CN-3027 STPEGS UFSAR 15.4-20 Revision 17 Dilution During Cold Shutdown Conditions at cold shutdown require the react or to have available at least 1.3 percent k shutdown margin. The following conditions are assumed fo r an uncontrolled boron dilution during cold shutdown.

1. Dilution flow (125 gal/min) is assumed as the best estimate maximum flow from the RMWS assuming that multiple simultaneous failures of control valves and alarms have an extremely low potential for occurrence.
2. A minimum water volume of 5,438 ft 3 in the RCS is used. This is a conservative estimate of the active volume of the RCS w ith the reactor coolant loops a nd the pressurizer filled while on one train of residual heat removal (RHR), and 10% of the steam generator tubes plugged. When the water level is drained down from a filled and vented condition in cold shutdown, an uncontrolled boron dilution accident is prevented by administrative controls which isolate the RCS from the potential source of unborated water. The methods described in the previous section will be implemented in this cold shutdown condition. Dilution During Residual Heat Removal System Operation For RHRS operation during Modes 4, 5, and 6, the RCS flows directly through the RHRS. The source for a potential uncontrolled boron dilution accident is the makeup water supply to the RHRS standpipe lines. This flow path to the RCS wo uld only be possible when the RCS is depressurized due to the relative small static head of the standpipe column. When the RHRS is connected to a pressurized RCS, this path would not have any flow. Valves RH171, RH172, and RH173 which isolate the standpipe lines will be locked closed during Modes 5 and 6, and in Mode 4 when the RCS pressure is less than the static head of the standpipe column. This will block the flow paths which could allow unborated water to reach the RCS. Dilution With Two Extended Neutron Flux Instruments Inoperable, Modes 3, 4 and 5a With both Extended Range Neutron Flux Instrument s inoperable, the pote ntial exists for an unmonitored return to criticality in Modes 3, 4 and 5a. To ensure the reactor remains sub-critical, an analysis was performed to identify all potential dilution sources. The valves that secured the dilution flow paths are also identified as follows:

a) Valves that secure flow paths from the Reactor Makeup Water System are:

FCV-0110B, FCV-0111B, CV

-0221, and CV-0201A.

b) Valves that secure flow paths from other dilution sources are:

RH-0171, RH-0172, RH-0173, CV-0272A, CV-0272B, CV-0272C, CV-0272D, CV-0272E, CV-0302, CV-0298A, CV-0298B, CV-0298C, CV-0298D, CV-0298E, CV-0133A, CV-0133B, CV-0124A, CV-0124B, CV-0261, CV-0214, CV-0134A, CV-0134B, CV-0125A, CV-125B, DW-1667, and DW-0691.

STPEGS UFSAR 15.4-21 Revision 17 The analysis assumes the dilution begins when the second Extended Range Neutron Flux Instrument becomes inoperable, and only one dilution source is active. The analysis assumes that the operators secure the flow paths from the Reactor Makeup Water System within 15 minutes. Operators are also required to restore at least one Ex tended Range Neutron Flux Instrument to operable status within one hour, or to secure other dilution flow paths within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the in itiation of the event.

The analysis assumes that the maximum dilution volume is less than 4500 gallons and uses the same mixing methodology as the other boron dilution analyses discussed above. The maximum dilution volume is evaluated as part of the core design process to ensure the minimum shutdown margin requirements in Modes 3, 4 and 5a remain valid.

Dilution During Hot Shutdown and Hot Standby Conditions at hot shutdown and hot standby require th e reactor to have availa ble at least 1.3 percent k shutdown margin. The following conditions are assumed for an uncontrolled boron dilution during hot shutdown and hot standby.

1. Dilution flow (250 gal/min) is assumed as the best estimate maximum flow from the RMWS assuming that multiple simultaneous failures of control valves and alarms have an extremely low occurrence.
2. A minimum water volume of 12,012 ft 3 in the RCS is used. This volume corresponds to the active volume of the RCS with one RCP in opera tion, excluding the pressurizer, and 10% of the steam generator tubes plugged.
3. With no RCP in operation during hot shutdown (with the required RHR pumps in operation), the minimum water volume of 5,438 ft 3 is used along with dilution flow limited to 125 gal/min. This dilution rate is restricted by limiting the flow through valve CV0198 to 125 gal/min. Dilution During Startup Conditions at startup require the reactor to have available at least 1.3 percent k shutdown margin. The following conditions are assumed for an uncontrolled boron dilu tion during startup:
1. Dilution flow is the maximum capacity of two charging pumps, 382 gal/min (analysis is performed assuming two charging pumps are in operation although only one is normally in operation).
2. A minimum RCS water volume of 12,012 ft 3 is assumed. This corresponds to the active RCS volume excluding the pressurizer, and 10% of the steam generator tubes plugged.
3. The initial boron concentration is assumed to be 1,450 ppm, which is a conservative maximum value for the critical concentration at the condition of hot zero power, rods to insertion limits, and no xenon.
4. The critical boron concentration following reactor trip is assumed to be 1,250 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), no xenon condition. The 200 ppm change from the initial condition noted above is a conservative minimum value.

STPEGS UFSAR 15.4-22 Revision 17 Dilution During Full Power Operation In this mode, the plant may be operated in either automatic or manual rod control. The effective reactivity addition rate is a function of the reacto r coolant temperature and boron concentration. The following conditions are assumed for an unc ontrolled boron dilution during full power.

1. Dilution flow for the manual rod control case is the maximum capacity of two charging pumps, 382 gal/min (analysis is performed assuming two charging pumps are in operation although only one is normally in operation), while in the automatic rod control case, the dilution flow to the RCS is limited by the maximum letdown flow, 250 gal/min.
2. A minimum RCS water volume of 12,012 ft 3 is assumed. This corresponds to the active RCS volume excluding the pressurizer, and 10% of the steam generator tubes plugged.
3. The initial boron concentration is assumed to be 1,600 ppm, which is a conservative maximum value for the critical concentration at the condition of hot full power, rods to insertion limits, and no xenon.
4. The critical boron concentration following reactor trip is assumed to be 1,250 ppm, corresponding to the hot zero power, all rods inserted (minus the most reactive RCCA), and no xenon condition. The 350 ppm change from the initial condition noted above is a conservative minimum value. 15.4.6.3 Results and Conclusions. Dilution During Refueling Dilution during refueling cannot occur due to admi nistrative controls, as discussed in Section 15.4.6.2.

Dilution During Cold Shutdown For dilution during cold shutdown, the Technica l Specifications specify the required shutdown margin (with the RCS not drained down). The specified shutdown margin ensures that the operator has at least 15 minutes from the time of the flux multiplication alarm until the total loss of shutdown margin.

Dilution in this mode with the RCS drained down cannot occur due to admi nistrative controls, as discussed in Section 15.4.6.2.

Dilution During Hot Shutdown and Hot Standby For dilution during hot shutdown and hot standby, the Technical Specifications specify the required shutdown margin. The specified shutdown margin ensures that the operator has at least 15 minutes from the time of the flux multiplication alarm until the total loss of shutdown margin. Dilution During Startup In the event of an unplanned appr oach to criticality or boron dilu tion during power escalation while in the startup mode, a reactor tr ip at the power range high neutr on flux low setpoint provides the operator with adequate time (on the order of 25 minutes) to determine the cau se of dilution, isolate STPEGS UFSAR 15.4-23 Revision 17 the unborated water source, and initi ate reboration before the total shutdown margin is lost due to dilution. Table 15.4-1 contains the time sequence of events for this accident. Dilution During Full Power Operation

1. With the reactor in automatic control, the power and temperature increase from boron dilution results in insertion of the RCCAs and a decrease in the shutdown margin. The rod insertion limit alarms (low and low-low settings) provide the operator with adequate time (on the order of 62 minutes) to determine th e cause of dilution, isolate th e unborated water source, and initiate reboration before the total shutdown margin is lost due to dilution.
2. With the reactor in manual control, and if no operator action is taken, the power and temperature rise will cause the reactor to reach the overtemperature T trip setpoint. The boron dilution accident in this case is essentia lly identical to a RCCA withdrawal accident. Both events assume the highest worth RCCA is stuck out of the core in its fully withdrawn position. The maximum reactivity insertion rate for boron dilution is approximately 2.5 pcm/sec. This value is within the range of insertion rates analyzed. Prior to the overtemperature T trip, an overtemperature T alarm would be actuated. There is adequate time available (on the order of 39 minutes) after a reactor trip for the operator to determine the cause of dilution, isolate the unborated water sour ce, and initiate reboratio n before the reactor can return to criticality. Table 15.4-1 contains the time sequen ce of events for this accident. 15.4.6.4 Radiological Consequences. There are only minimal radiological consequences associated with a CVCS malfunction that results in a decrease in boron concentration in the reactor coolant. Since no fuel damage occurs from this transi ent, the radiological consequences associated with this event are less severe than the steam line break event analyzed in Section 15.1.5.3. 15.4.6.5 Conclusions. No fuel damage occurs.

The radiological consequences of this event are not limiting.

The results presented above show that there is adequate time (at least 15 minutes) for the operator to manually terminate the source of dilution flow in the full power, startup, hot standby, hot shutdown, and cold shutdown (with the RCS not drained down) modes of operation. Following termination of the dilution flow, the reactor will be in a stable condition.

The operator can then initiate reboration to recover shutdown margin. Uncontro lled boron dilution in the cold shutdown (with the RCS drained down) and refueling modes is administratively precluded.

Evaluations of this event have been performed as part of the replacement steam generator program and the 1.4% power uprate program. Since the replacement steam generators have a slight increase in volume, operation with them provides a benefit in operator response time for this event. The

conservative conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators and the 1.4% power uprate. 15.4.7 Inadvertent Loading of a Fuel A ssembly into an Improper Position 15.4.7.1 Identification of Causes and Accident Description. Fuel and core loading errors, such as can arise from the inadvert ent loading of one or more fuel assemblies into STPEGS UFSAR 15.4-24 Revision 17 improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment, or the loading of a full fuel assembly during manufacture w ith pellets of the wrong enrichment, will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable absorber rods into a new core

without burnable absorber rods.

Any error in enrichment, beyond the normal manufacturing tolerances , can cause power shapes which are more peaked than those calculated with the correct enrichments. The incore system of moveable flux detectors, which is used to verify power shapes at the start of life is capable of revealing any assembly enrichment error or loading error which cau ses power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the identification number will be checked before each assembly is moved into the core. Serial numbers read during fuel movement are subsequently reco rded on the loading diagram as a further check on proper placing after the loading is completed. The power distortion due to any combination of misplaced fuel assemblies would significantly raise peaking factors and would be read ily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one-third of the fuel assemblies in the core.

There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. Incore flux measurements are taken during the startup subseque nt to every refueling operation. This event is classified as an ANS Condition III incident (an infrequent incident) as defined in Section 15.0.1. 15.4.7.2 Analysis of Effects and Consequences. Method of Analysis This event was analyzed generically for all Westinghouse four-loop plants. The description of the analysis, the results, and the c onclusions presented here in are based on the generic analysis. The generic analysis evaluates representative fuel assemb ly loading errors and is applicable to any first core or reload pattern used in a Westinghouse four-loop plant. Plant specific analysis is not required unless the number of core assemblie s change or the flux thimbles us ed by the incore detectors are relocated. Enrichment errors and core loading errors are minimized by administrative procedures as discussed in the Conclusions.

Steady-state power distributions in the x-y plan e of the core are calc ulated using the TURTLE (Ref. 15.4-5) code based upon macros copic cross sections calculat ed by the LEOPARD (Ref. 15.4-6) code. A discrete representation is used wherein each individual fuel rod is described by a mesh

interval. The power distributions in the x-y plane for a correctly loaded core assembly are given in Chapter 4 based upon enrichments given in that section.

STPEGS UFSAR 15.4-25 Revision 17 For each core loading error case an alyzed, the representative percent deviations from detector readings for a normally loaded core are shown at all incore detector locations (Figures 15.4-21 through 15.4-25).

Results The following core loading error cases have been analyzed:

Case A:

Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case considered was the interchange of two adjacent assemblies near the periphery of the core (Figure 15.4-21).

Case B:

Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly. Two analyses have been performed for this case (Figures 15.4-22 and 15.4-23). In Case B-1, the interchange is assumed to take place with the burnable absorber rods transferred with the Region 2 assembly mistakenly loaded into Region 1.

In Case B-2, the interchange is assumed to take place closer to core center and with burnable absorber rods located in the correct Region 2 position but in a Region 1 assembly mistakenly loaded into the Region 2 position.

Case C:

Enrichment error: Case in which a Region 2 fuel assembly is load ed in the core central position (Figure 15.4-24).

Case D:

Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core periphery (Figure 15.4-25). 15.4.7.3 Conclusions. Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication.

In the event a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins, and perhap s the immediately adjacent pins. Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event a loading error occurs , analyses in this section confirm that resulting power distribution effects will either be readily detected by the incore moveable detector system or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

STPEGS UFSAR 15.4-26 Revision 17 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents 15.4.8.1 Identification of Causes and Accident Description. This accident is defined as the mechanical failure of a control rod mechanism pressure housing resulting in the ejection of an RCCA and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribu tion, possibly leading to localized fuel rod damage.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0-20. Section 15.0.8 a nd Table 15.0-6 briefly addresses the plant systems and equipment available to mitigate the consequences of the event. 15.4.8.1.1 Design Precautions and Protection: Features in the STPEGS reactors preclude the possibility of a rod ejection accident, or limit the consequences if the accident were to occur. These include a proven, conservative mechan ical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuc lear design which lessens the potential ejection worth of RCCAs, and minimizes the number of assemblies inserted at high power levels.

Mechanical Design The mechanical design is discussed in Section 4.6. Mechanical desi gn and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below:

1. The Unit 1 and Unit 2 replacement CRDM housings were hydrostatically tested during fabrication in conjunction with ASME Section III hydrostatic testing of the replacement head.
2. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Movements induced by the design earthquake can be accepted within the allowable primary working stress range specified by the American Society of Mechanical Engin eers (ASME) Code,Section III, for Class 1 components.
3. The latch mechanism housing and rod travel hou sing are each a single le ngth of forged Type 316 stainless steel. This materi al exhibits excellent notch toughness at all temperatures which will be encountered. A significant margin of strength in the elastic range, together with the large energy absorption capability in the plastic range, gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel ho using, are threaded joints reinfo rced by canopy type rod welds. Administrative procedures require periodic inspections of the full penetration welds in the CRDM

pressure boundary (and other) welds. Nuclear Design Even if a rupture of an RCCA drive mechanism housing is postulated, operation utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensa ted by boron changes. Fu rther, the location and STPEGS UFSAR 15.4-27 Revision 17 grouping of control RCCA banks are se lected during the nuclear design to lessen the severity of an RCCA ejection accident. Therefore, should an RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur. However, it may occasionally be desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level.

Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration at low level alarm. Reactor Protection The reactor protection in the event of a rod ejection accident has been described in Reference 15.4-7. The protection for this accident is provided by high neutron flux trip (high and low setting) and high positive rate of neutron flux trip. These protection functions are described in detail in Section 7.2. No single active failure will adversely affect the consequences of the accident. As summarized in Table 15.0-7, the limiting single failure assumed in the analysis is defined as malfunction of one train of the Reactor Protection System. Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a complete RCCA mechanism housing failure, investigations have s hown that failure of a housing du e to either longitudinal or circumferential cracking would not cause damage to adjacent housings. The CRDM is described in Section 3.9.4.

Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor cool ant pressure of 2,250 psia. The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the ro d travel housing and the hollow tube along which the coil assemblies are mounted.

If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings were on the periphery, they might bend outward from their bases. The housing material is quite ductile; plastic hinging without cracking would be expected. Housings adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.

Effects of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, th e broken-off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel. Travel is limited by the missile shield, thereby limiting the proj ectile acceleration. When the STPEGS UFSAR 15.4-28 Revision 17 projectile reached the missile shie ld it would partially penetrate th e shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield. If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. Th e top end plates of the position indicator coil assemblies would prevent the broken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece we re to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage.

Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall upon receiving a trip signal; however this is already taken into account in the analysis by assuming a stuck rod adja cent to the ejected rod. Summary The considerations given above lead to the conclusi on that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase severity of the initial accident. 15.4.8.1.2 Limiting Criteria: This event is classified as an ANS condition IV incident. See Section 15.0.1. Due to the extremely low probability of an RCCA ejection accident, some fuel damage could be considered an acceptable consequence.

Comprehensive studies of the threshold of fuel failu re and of the threshold of significant conversion of fuel thermal energy to mechanical energy have b een carried out as part of the SPERT project by the Idaho Nuclear Corporation (Ref. 15.4-8). Extensive tests of UO 2 zirconium clad fuel rods representative of those in pressuri zed water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Ref. 15.4-9) results, which indicated a failure threshold to 280 cal/gm. Limited re sults have indicated that this threshold decreases by about 10 percent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for ir radiated rods. Also im portant is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally de tectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated r ods; catastrophic failure (large fuel dispersal, large pressure rise) for irradiated rods did not occur below 300 cal/gm. In view of the above experimental results, criteria are a pplied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distorti on, or severe shock waves. These criteria are:

1. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for uni rradiated fuel and 200 cal/gm for irradiated fuel STPEGS UFSAR 15.4-29 Revision 17
2. Peak reactor coolant pressure less than that wh ich could cause stresses to exceed the faulted condition stress limits
3. Fuel melting limited to less than 10 percent of the fuel volume at the hot spot, even if the average fuel pellet enthalpy is below the limits of criterion 1 above. 15.4.8.2 Analysis of Effects and Consequences. Method of Analysis The calculation of the RCCA ejection transient is performed in two st ages: first, an average core channel calculation; and th en, a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time, including the va rious total core feedback effects, i.e., Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient h eat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient. The plant characteristics and initial conditions assumed for the accident analyses are briefly discussed in Section 15.0.3. Additionally, Figure 15.0-20 provides a block diagram showing the various protective sequences for safety actuation available to mitigate the effects of this event. Section 15.0.8 and Table 15.0-6 also briefly discusses the plant systems and equipment available to mitigate the consequences of the event. A detailed discussion of the method of analysis can be found in Reference 15.4-10.

Average Core Analysis The spatial kinetics computer code, TWINKLE (Ref. 15.4-1), is used for the average core transient analysis. This code uses cro ss sections generated by LEOPARD (R ef. 15.4-6) to solve the two-group neutron diffusion theory kinetic equation in one, two, or three spatial dimensions (rectangular coordinates) for six delayed ne utron groups and up to 2,000 spatial points. The computer code includes a detailed multiregion, tran sient fuel-clad-coolant heat tran sfer model for calculation of pointwise Doppler and moderator feedback effects.

In this analysis, the code is used as a one-dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is mixing, it is still necessary to employ very conservative methods (described below) of calculating the rod worth and hot channel factor. Further descri ption of TWINKLE appears in Section 15.0.10.3.

Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spots before and after ejection are co incident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection, the power in this region will necessarily be depressed.

STPEGS UFSAR 15.4-30 Revision 17 The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN (Ref. 15.4-2). This computer code calculates the transient temperature distribution in a cross section of a metal-clad uranium-dioxide fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandberg-Tong correlation (Ref. 15.4-11) to determine the film boiling coefficient after DNB. The Bishop-Sandberg-Tong correlation is conservatively used, assuming zero bulk fluid quality. The DNBR is not calculated; instead, the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 15.0.10.1. FACTRAN calculates the percent of fuel melting based on the peak centerline temperature. The fuel pellet melting is assumed to be spread over a 5F zone instead of taking place at a constant temperature. The FACTRAN model divides the fuel pellet into ten rings of equal volume. The increase in temperature above the melting point in a ring is used to predict the percent of fuel melting in that ring. The percent of fuel melting in a ring is linearly increased from 0% at the melting temperature to 100% at the melting temperature plus five degrees. Changes in fuel rod geometry due to melting are not represented in the code except for fuel volume increases. System Overpressure Analysis Because safety limits for fuel damage specified ea rlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may, therefore, be cal culated on the basis of conventional heat transfer from the fuel a nd prompt heat generation in the coolant. The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in LOFTRAN (Ref. 15.4-3). This code calculates the pressure transient taking into account fluid transport in the RCS and heat transfer to the steam generators. No credit is taken for the po ssible pressure reduction caused by the assumed failure of the control rod pressure housing. 15.4.8.2.1 Calculation of Basic Parameters: Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15.4-3 presents the parameters used in this analysis.

Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculate d using either three-dimensional static methods or by a synthesis method employing one-dimensional and two-dimensional calculations. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allo wed bank insertion at a given power level, as STPEGS UFSAR 15.4-31 Revision 17 determined by the rod insertion limits. Adverse xenon distributions are consider ed in the calculation to provide worst case results. Appropriate margins are added to the ejected rod worth and hot cha nnel factors to account for any calculational uncertainties, includi ng an allowance for nuclear power peaking due to densification.

Power distributions before and af ter ejection for a "wor st case" can be found in Reference 15.4-10.

Experience has shown that the ejected rod wort h and power peaking factors are consistently overpredicted in the analysis. Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels where the power is higher than average. Si nce the weight of a region is depe ndent upon flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting factors determ ined. These weighting factors take the form of multipliers, which, when applied to single channel feedbacks, correct them to effective whole core feedbacks for the appropria te flux shape. In this analysis, since a one-dimensional (axial) spatial kinetics method is employe d, axial weighting is not necessary if the initial condition is made to match the ejected rod configur ation. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time, accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three-dimensional analysis (Ref. 15.4-10).

Moderator and Doppler Coefficient The critical boron concentrations at the beginning of life and end of life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discusse d above, no weighting fact or is applied to these results.

The Doppler reactivity defect is determined as a function of power level using a one-dimensional steady-state computer code with a Doppler weigh ting factor of 1.0. The D oppler coefficient used does not directly correlate with Figure 15.0-2 because the TWINKLE code, on which the neutronic analysis is based, is a diffusion-theory code rather than a point kinetics approximation. The Doppler defect, used as an initial conditi on, does correlate with Figure 15.0-2 and is given in Section 15.0-4. The Doppler weighting factor will increase under accident conditions.

Delayed Neutron Fraction, eff Calculations of the effectiv e delayed neutron fraction (eff ) typically yield values no less than 0.70 percent at beginning of life and 0.50 percent at end of life for the first cycle. The accident is sensitive to eff if the ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of eff of 0.55 percent at beginning of cycle and 0.42 (EOL-HZP) and 0.40 (EOL-HFP) percent at e nd of cycle were used in the analysis.

STPEGS UFSAR 15.4-32 Revision 17 Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 15.4-3 and in cludes the effect of one stuck RCCA adjacent to the ejected r od. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay is assumed to consist of 0.2 seconds for the instrume nt channel to produce a signal, 0.15 seconds for the trip breaker to open, and 0.15 seconds for the coil to release the rods. A curv e of trip rod insertion versus time was used which assumed that inser tion to the dashpot does not occur until 2.8 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over one second after the trip point is reached before significant shutdown reactivity is inserted into the core. This conservatism is particularly im portant for hot full power accidents. The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end of life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution, conservative Doppler and modera tor defects, and an allowance for calculational uncertainties. Physics calculations have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to re duce the shutdown by about an additional one percent k. Therefore, following a reactor trip resulting from an RCCA ejection accide nt, the reactor will be subcritical when the core returns to HZP. Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high positive neutron flux rate trip. These protection functions are part of the RTS. No single failure of the RTS will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.

Results Cases are presented for both beginning a nd end of life at zero and full power.

1. Beginning of Cycle, Zero Power For this condition, control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.86 percent k and a hot channel factor of 14.1. The peak hot spot clad average temperature reached 2,836F, the fuel center temperature was 4,425 F. 2. End of Cycle, Full Power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculat ed to be 0.20 percent k and 7.7, respectively. This resulted in a peak clad average temperature of 2,197 F. An increase of 10 F in clad temperature is projected due to the effects of the core inlet flow maldistribution attributed to the RCS Flow Anomaly. The peak hot spot fuel center temperature reached melting at 4800F. However, melting was restricted to less than 10 percent of the pellet.
3. Beginning of Cycle, Full Power and End of Cycle, Zero Power STPEGS UFSAR 15.4-33 Revision 17 For the End-of-Life Hot Zero Power cases and the Beginning-of-Life-H ot Full Power cases, a curve showing combinations of ejected rod wort hs and hot channel factors which when used in the rod ejection transient with the delayed neutron fract ion and the Doppler weighting factors shown in Table 15.4-1 produce acceptable results. Acceptable results are defined by the criteria stated in section 15.4.8.1.2. An F Q prior to rod ejection of 2.7 was used in all of the full power cases. A summary of the cases presented above is given in Table 15.4-3.

The nuclear power and hot spot fuel and clad temperature transients for the begi nning of life zero power a nd end of life full power cases are presented on Figures 15.4-26 through 15.4-29. The limiting curves for the beginning of life full power and end of life zero power cases are shown on Figures 15.4-30 and 15.4-31.

The calculated sequence of events for the rod ejection accidents, as shown on Figures 15.4-26 through 15.4-29, is presented in Table 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated. The reactor will remain subcritical following reactor trip. The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents (LOCAs) are discussed in Section 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other LOCA to recover from the event.

Fission Product Release It is assumed that fission products are released from the gaps of a ll rods entering DNB. In all cases considered, less than 10 percent of the rods entered DNB based upon a detailed three-dimensional THINC analysis (Ref. 15.4-10). Although limited fuel melting at the hot spot was predicted for the full power cases, it is highly unlikely that melting will occur since the analysis conservatively assumed that the hot spots before and after ejection were coincident.

Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one do llar at beginning of life, hot full power, indicates that the peak pressure do es not exceed that which would cause stress to exceed the faulted condition stress limits (Ref. 15.4-10). Since the severity of the present analysis does not exceed the "worst case" analysis, the accident for this plant will not result in an excessive pressure rise or further damage to the RCS.

Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoin t of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are undermoderated, and bowing will tend to increase th e undermoderation at the hot spot. Since the 17 x 17 fuel design is also undermoderated, the same effect would be observed.

In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow STPEGS UFSAR 15.4-34 Revision 17 away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, su fficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator-to-fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would, therefore, be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis. 15.4.8.3 Radiological Consequences.

An analysis of the e ffects of a postulated rod ejection accident is performed us ing the Alternative Radiological Source Terms, as described in Regulatory Guide 1.183 (Reference 15.4-15). The parame ters used for the analysis are listed in Tables 15.4-4 and 15.4-5.

For the analysis, it is assumed that prior to the postulated accident, the plant is operating at an equilibrium level of radioactivity in the primary and secondary systems as a result of coincident fuel

defects and SG tube leakage. Fo llowing a postulated rod ej ection accident, two activity release paths contribute to the total radiological consequences of the accident. The first release path is via Containment leakage resulting from release of activity from the primary coolant to the Containment.

The second path is the contribution of steam in the secondary system dumped through the safety valves since offsite power is assumed to be lost. 15.4.8.3.1 Model: It is assumed that prior to the accident the plant has been operating with the RCS coolant concentrations at the Technical Specification limit of 60 Ci/gm DE I-131, the secondary side is at its Technical Specification limit of 0.1 Ci/gm DE I-131, and SG tube leakage for a period of time suffic ient to establish equilibrium levels of activity in the primary and secondary coolant. These concentra tions are indicated in Table 15.C-7. The model for the activity available for leakage from the Containment assumes that the activity in the fuel pellet-clad gap and the activity released due to fuel melting is instantaneously mixed in the Containment and available for release. The only removal processes considered for the Containment are radioactive decay and leakage.

The model for the activity available for release to the atmosphere from the safety valves assumes that the release consists of the activity in the secondary coolant prior to the accident plus that activity leaking from the primary coolant through the SG tubes following the accident. The leakage of primary coolant to the secondary side of the SG is assumed to continue at its initial rate, assumed to be the same rate as the leakage pr ior to the accident, until the pressures in the primary and secondary systems are equalized. No mass transfer from the primary system to the secondary system is assumed thereafter. In case of coincident loss of offsite power, activity is assumed to be released to the atmosphere through the SG safety valves.

15.4.8.3.2 Assumptions for the Analysis: Conservative assump tions were used in the analysis of the release of radioactivity to the environment in the event of a postulated rod ejection accident. A summary of the parameters used in the analysis is given in Tables 15.4-4 and 15.4-5. The upper limit of fission product release from the core for the analysis was determined using the following assumptions:

STPEGS UFSAR 15.4-35 Revision 17 Assumptions Applicable to both Scenarios 1. The source term is based upon a power level of 4100 MW thermal, 5 w/o enrichment, and a 3 region core with equilibrium cycl e core at end of life. The th ree regions have operated at a specific power of 39.3 MW/MTU for 509, 1018, and 1527 EFPD, respectively. The assumed power level is greater than the Rated Thermal Power of 3853 MWth plus a 0.6% measurement uncertainty. 2. The clad of 10% of the fuel is damaged during the initiation of this accident, and is assumed to have failed. Therefore, 10% of the core inventory of noble gases and iodines are released from the fuel gap (Regulatory Guide 1.183, Appendix H). Release fractions of other nuclide groups contained in the fuel gap are detailed in Table 3 of Regulatory Guide 1.183. 3. The amount of fuel melt is 0.25%. The 0.25% of the core is determined by the following method: a) A conservative upper limit of 50% of rods experiencing clad damage may experience

centerline melting (a total of 5% of the core); b) Of the rods experiencing centerline melting, only a conservative maximum of the innermost 10 percent of the volume actually melts (0.5% of the core could experienced melting); and c) A conservative maximum of 50% of the axial length of the rod would experience melting due to the power distribution (hal f of the 0.5% of the core is 0.25% of the core). 4. The initial RCS iodine concentrations are base d on a pre-existing iodine spike to the Technical Specification limit of 60 Ci/gm and the initial Secondary system concentrations are based on a pre-existing iodine spike to the Technical Specification limit of 0.1 Ci/gm. Noble Gas concentrations are based on 1% failed fuel. 5. The Control Room ventilation system is assumed to transfer to the emergency mode of operation immediately upon the receipt of the safety injection signal (at t=0). 6. All releases to the atmosphere are assumed to be at ground level. 7. The RCS density is 8.33 lbm/gal. Assumptions Specific to the Release via Containment Leakage Scenario

8. One hundred percent of the noble gases and iodines in the gap of the fuel failed by the accident, plus 100% of noble gases and 25% of the iodines contained in the melted fuel fraction are assumed to be released to the containment in accordance with Appendix H of Regulatory Guide 1.183. 9. The containment free volume is 3.41E+6 ft 3 (+0.1% / -0.85%) or 3.38E+6 ft 3 to 3.41E+6 ft
3. A value of 3.38E+6 ft 3 is utilized for the dilution volume in containment and 3.41E+6 ft 3 is used for the leakage determination. Utilizing the minimum containment free volume conservatively maximizes the radioactive concentration in containment and using the maximum value for determining the containment leakage conservatively maximizes the containment leakage.
10. The activity released to the c ontainment through the rupture in the reactor vessel head is assumed to mix instantaneously throughout the containment. No credit is assumed for removal of iodine in the containment due to containment sprays.

STPEGS UFSAR 15.4-36 Revision 17 11. For the containment leakage case, all leakage is assumed to be at the Technical Specification limit of 0.3 percent per day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 0.15% per day thereafter. 12. Iodines released to the containment (from the fuel and RCS) are assumed to be 95% particulate, 4.85% elemental, and 0.15% organic (Regulatory Guide 1.183, Appendix H, position 4). Assumptions Specific to the Release via the Secondary Side Scenario 13. One hundred percent of the noble gases and iodines in the gap of the fuel failed by the accident, plus 100% of noble gases and 50% of the iodines contained in the melted fuel fraction are assumed to be released to the reactor coolant in accordance with Appendix H of Regulatory Guide 1.183. Fractions of other nuclides released from the melted fuel are used from Table 2 of Regulatory Guide 1.183. Although these are described as LOCA values for fuel melt release, they are conservatively used for the other nuclide groups. 14. The activity released from the fuel from either the gap or from fuel pellets is assumed to be instantaneously mixed with the reactor coolant within the pressure vessel. 15. Primary-to-secondary leakage is conservatively modeled at a total of 1 gpm for all steam generators. Primary-to secondary leakage stops at 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when the RCS and SG pressures are equalized. 16. Iodines released to the Secondary side (from the fuel and RCS) are assumed to be 95% particulate, 4.85% elemental, and 0.15% organic (Regulatory Guide 1.183, Appendix H, position 4). 17. This analysis assumes that iodine released from the steam generators to the environment is 4.85% elemental, 0.15% organic, and 95%

particulate (see Section 15.C.3). 18. partition coefficient of 100 is assumed for iodine, cesium, and rubidium released from the steam generators. (Regulatory Guide 1.183, Appendix H, Section 7.4) Organic iodine is not partitioned. Organic iodine is assumed to migrate directly to the steam space and become immediately available for release.

19. Upon loss of offsite power, a total of 1.56 x 10 7 pounds of steam is discharged from the secondary system through the safety valves or PORVs for 4500 seconds following the accident. Steam release is terminated after this time. The minimum time to release the initial steam generator mass is 191 seconds. The rate of release necessary to release the total steam generator mass of 659,412 pounds in 191 seconds is 207,000 lbm/min. Assuming this flow rate is constant for 4500 seconds yields a total mass release of 1.56 x 10 7 pounds. Note that the total mass released is very conservative in relation to the initial SG mass. 20. Steam continues to be released from the orifices that replaced the MS IV above-seat isolation valves until 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. 21. All releases are via the steam generator PORVS or safeties an d the above-seat drains. These releases occur in the Isolation Valve Cubicle next to the PORVs. Therefore, the PORV-to-Control Room /Qs are used for the Control Room and TSC dose analyses.

STPEGS UFSAR 15.4-37 Revision 17

22. Presence of actual PORV leakage is encompassed by the steam releases necessary to cool the plant to a point where cooling is performed by the RHR system (RCS at 350 psia, 350 F). Therefore, the presence of PORV leakage has no impact on steam releases and dose consequences for the 0-8hr time period. Presence of actual PORV seat leakage after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> has a negligible effect on the doses at the site boundary and control room. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the pressure in the secondary side has been reduced from operati ng pressure (about 1050 psia) to the saturation pressure at 350F (about 135 psia). Assuming flow from the PORV is choke flow, the reduction in pressure would cause a proporti onal reduction in leak flow. A small leakage at the beginning of the event would be reduced by a factor of 10 after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

When the plant reaches 212 F, the release would stop. This additional release would have a negligible effect on doses at the site boundary and control room.

15.4.8.3.3 Results

The thyroid, gamma and beta dos es for the control rod ejection accident are given in Table 15.4-5 for the exclusion zone boundary (EZB) of 1,430 meters and the low population zone (LPZ) of 4,800 meters. 15.4.8.4

Conclusions:

Conservative analyses indicate th at the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that th ere is no danger of furthe r consequential damage to the RCS. The analysis has demonstrated that the fission product release, as a result of a number of fuel rods entering DNB, is limited to less than 10 percen t of the fuel rods in the core. The radiological consequences of this event are well within the guidelines of 10CFR50.67.

15.4.9 Spectrum of Rod Drop Accidents in a BWR

Not applicable to STPEGS. CN-3062 STPEGS UFSAR 15.4-38 Revision 17 REFERENCES Section 15.4

15.4-1 Risher, D.H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A, Janu ary 1975 (Proprietary) and WCAP-8028-A, January 1975 (Nonproprietary).

15.4-2 Hargrove, H.G., "FACTRAN, A Fortran IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908-A, December 1989.

15.4-3 Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Nonproprietary), April 1984.

15.4-4 "Westinghouse Anticipated Transients Without Trip Analysis," WCAP-8330, August 1974.

15.4-5 Barry, R. F., and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code,"

WCAP-7213-P-A, January 1975 (Proprietary) and WCAP-7758-A, January 1975 (Nonproprietary).

15.4-6 Barry, R. F., "LEOPARD, A Spectrum Dependent Non-Spatial Depletion code for the IBM-7094," WCAP-3269-26, September 1963.

15.4-7 Burnett, T. W. T., "Reactor Protection System Diversity in We stinghouse Pressurized Water Reactors," WCAP-7306, April 1969.

15.4-8 Taxelius, T. G. (Ed), "Annual Report - Spert Project, October 1968 - September 1969,"

Idaho Nuclear Corporation IN-1370, June 1970.

15.4-9 Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO 2 - Core Simulated Fuel Elements,"

ANL-7225, January - June 1966, p. 177, November 1966.

15.4-10 Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Special Kinetics Methods," WCAP-7588, Revision 1-A, January 1975.

15.4-11 Bishop, A. A., Sandberg, R. O., and Tong, L.

S., "Forced Convection Heat Transfer at High Pressure After the Critical He at Flux," ASME 65-Ht-31, August 1965.

15.4-12 Haessler, R. L., et al., "Methodology for the Analysis of the Dropped Rod Event,"

WCAP-11394-P-A, (Proprietary) and WCAP-11395-A (Nonproprietary),

January 1990.

15.4-13 Huegel, D.S., et al., "RETRAN-02 Modeling and Qualification for Westinghouse

Pressurized Water Reactor Non-LOCA Safety Analyses," WCAP-14882-P-A (Proprietary) April 1999.

STPEGS UFSAR 15.4-39 Revision 17 REFERENCES (Continued)

Section 15.4

15.4-14 Sung, Y.S., "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal Hydraulic Safety Analysis," WCAP-14565, April 1997.

15.4-15 NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," USNRC, July 2000.

STPEGS UFSAR 15.4-40 Revision 17 TABLE 15.4-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec) Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition Initiation of uncontrolled rod withdrawal from 10

-9 of nominal power 0.0 Power range high neutron flux low setpoint reached 10.3 Peak nuclear power occurs 10.4 Rods begin to fall into core 10.8 Minimum DNBR occurs 12.8 Peak heat flux occurs 12.8 Peak average clad temperature occurs 13.2 Peak average fuel temperature occurs 13.4

Uncontrolled RCCA Bank Withdrawal at Power 3 pcm/sec at HFP Initiation of uncontrolled RCCA withdrawal at a reactivity insertion rate (3 pcm/sec) 0 Overtemperature T reactor trip signal initiated 40.3 Rods begin to fall into core 41.8 Minimum DNBR occurs 42.5

STPEGS UFSAR 15.4-41 Revision 17 TABLE 15.4-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec) Startup of an Inactive Reactor Coolant Loop Initiation of pump startup 0 Power reached P-8 interlock setpoint, coincident with low reactor coolant

flow 5.2 Rods begin to drop 5.7 Minimum DNBR occurs 6.6 Uncontrolled Boron Dilution Dilution during startup Power range high neutron flux, low setpoint reactor trip due to dilution 0 Shutdown margin lost (if dilution continues after trip)

~1500 Dilution during full power operation Automatic reactor control Operator receives low-low rod insertion limit alarm due to dilution 0 Shutdown margin lost ~3690 Manual reactor control Reactor trip on overtemperature T due to dilution 0 Shutdown margin lost (if dilution continues after trip

~2340 STPEGS UFSAR 15.4-42 Revision 17 TABLE 15.4-1 (Continued)

TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec) Rod Cluster Control Assembly Ejection Beginning of Life, Zero Power Initiation of rod ejection 0.0 Power range high neutron flux low setpoint reached 0.206 Peak nuclear power occurs 0.249 Rods begin to drop 0.706 Peak clad temperature occurs 2.48 Peak heat flux occurs 2.48 Peak fuel average temperature occurs 2.61 End of Life, Full Power Initiation of rod ejection 0.0 Power range high neutron flux setpoint reached 0.04 Peak nuclear power occurs 0.13 Rods begin to drop 0.54 Peak heat flux occurs 2.473 Peak fuel average temperature occurs 2.476 Peak clad temperature occurs 2.502 STPEGS UFSAR 15.4-43 Revision 17 TABLE 15.4-3 PARAMETERS USED IN THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT ANALYSIS Beginning of cycle End of cycle Power level, % 102(1) 0 102(1) 0 Ejected rod worth, % k (2) 0.86 0.20 (3) Delayed neutron fraction, % 0.55 0.55 0.40 0.42 Feedback reactivity weighting 1.0-1.6 2.398 1.60 3.625 Trip reactivity, %k 4.0 2.0 4.0 2.0 F q before rod ejection 2.7 - 2.7 - F q after rod ejection (2) 14.1 7.7 (2) Number of operational pumps 4 2 4 2 Max. fuel pellet average temperature, F 4,174(4) 3,836 3,963 3,748(4) Max. fuel center temperature, F 4,980(4) 4,425 4,873 4,203(4) Max. clad average temperature, F 2,366 (4,5,6) 2,836(6) 2,197(5,6) 2,899(4,6) Max. fuel stored energy, cal/gm 183.5 165.8 172.4 161.3 Percent fuel melt <10 0 <10 0 1. 102% of 3800 MWt = 3,876 MWt

2. See Figure 15.4-30
3. See Figure 15.4-31
4. Maximum temperature reached in any case analyzed
5. An increase of 10F in clad temperature is projected due to the effects of the core inlet flow maldistribution attributed to the RCS Flow Anomaly.
6. An additional 2F increase is projected due to standard ZIRLO or Optimized ZIRLO TM fuel cladding.

CN-3066 STPEGS UFSAR 15.4-44 Revision 17 TABLE 15.4-4 PARAMETERS USED IN THE ROD EJECTION ANALYSIS:

RELEASE FROM THE RCB SCENARIO Parameter Core power (for radiological source terms) 4100 MWt Core power (for steam releases) 3876 MWt (3853MWt + 0.6%) RCS density 8.33 lbm/gallon RCS Volume 2.658E+8 gm Initial RCS Activities Iodines Pre-existing spike to Tech Spec limit of 60 Ci/gm Noble Gases 1% Failed Fuel Initial Secondary Side Activities Iodines Pre-existing spike to Tech Spec limit of 0.10 Ci/gm Noble Gases 1% Failed Fuel RCS Isotopic Concentrations @ 1% Failed Fuel Table 15.C-2 RCS Pre-existing Iodine Spike Concentrations Tables 15.C-3, -4 Secondary Side Isotopic Concentrations Table 15.C-7 Fuel Melted by Accident 0.25% of core Fuel Clad Damage 10% of core Iodine Species Released to Containment (elemental/organic/particulate) 4.85% / 0.15% / 95% Iodine Species Released From Containment (elemental/organic/particulate) 4.85% / 0.15% / 95%

Total activity released into the Containment Table 15.4-6 Containment Free Volume For mixing 3.38E+6 ft 3 For leakage 3.41E+6 ft 3 Containment Leak Rate 0-24 hrs 0.3%/day 24 hrs - 30 days 0.15%/day Dose Conversion Factors Table 15.D-10 Decay Constants and Decay Daughter Fractions Table 15.D-11 Offsite breathing rates Table 15.D-5

STPEGS UFSAR 15.4-45 Revision 17 TABLE 15.4-4 (continued)

PARAMETERS USED IN THE ROD EJECTION ANALYSIS:

RELEASE FROM THE RCB SCENARIO Parameter Offsite /Q's Table 15.D-1 Control Room HVAC Parameters Table 15.D-7 Control Room HVAC Flow Rates Table 15.D-6 TSC HVAC Parameters Table 15.D-9 TSC HVAC Flow Rates Table 15.D-8 Control Room and TSC /Q's Table 15.D-4

STPEGS UFSAR 15.4-46 Revision 17 TABLE 15.4-5 PARAMETERS USED IN TH E ROD EJECTION ANALYSIS

RELEASE FROM THE SECONDARY SIDE SCENARIO Parameter Core power (for radiological source terms) 4100 MWt Core power level (for steam releases) 3876 MWt (3853MWt + 0.6%) RCS density 8.33 lbm/gallon RCS Mass 2.658E+8 gm SG Mass 659,412 lbm Initial RCS Activities Iodines Pre-existing spike to Tech Spec limit of 60 Ci/gm Noble Gases 1% Failed Fuel Initial Secondary Side Activities Iodines Pre-existing spike to Tech Spec limit of 0.10 Ci/gm Noble Gases 1% Failed Fuel Primary-to-Secondary Leakage 1 gpm

RCS Isotopic Concentrations @ 1% Failed Fuel Table 15.C-2 RCS Pre-existing Iodine Spike Concentrations Tables 15.C-3, -4 Secondary Side Isotopic Concentrations Table 15.C-7 Fuel Melted by Accident 0.25% of core Fuel Clad Damage 10% of core

Iodine Species Released to RCS (elemental/organic/particulate) 4.85%/0.15%/95% Minimum Time To Release Initial SG Mass 191 seconds Steam Flow Rate To Release Initial SG Mass 2.07E+5 lbm/min Maximum Time For Primary To Secondary Side Pressure Equilibrium 4500 seconds Steam Released To The Environment Table 15.4-8 Iodine Partition Factors For Releases From The Secondary Side (Elemental/Organic/Particulate) 100/1/100 STPEGS UFSAR 15.4-47 Revision 17 TABLE 15.4-5 (Continued) PARAMETERS USED IN TH E ROD EJECTION ANALYSIS

RELEASE FROM THE SECONDARY SIDE SCENARIO Iodine Species Released From The SGs To The Environment (Elemental/Organic/Particulate) 4.85% / 0.15% / 95% Effective Iodine Species Released From The Secondary Side To Environment, After Application Of The Partition Factors (Elemental/Organic/Particulate) (See Section

15.C.3) 4.2% / 13.1% / 82.7% Total Activity In The Steam Generators (RCS+SG) Table 15.4-7 Steam Flow Rate 1.574E+7 lbm/hr Dose Conversion Factors Table 15.D-10

Decay Constants And Decay Daughter Fractions Table 15.D-11 Offsite Breathing Rates Table 15.D-5 Offsite /Q's Table 15.D-1 Control Room HVAC Parameters Table 15.D-7 Control Room HVAC Flow Rates Table 15.D-6 TSC HVAC Parameters Table 15.D-9 TSC HVAC Flow Rates Table 15.D-8

Control Room And TSC /Q's Table 15.D-4

STPEGS UFSAR 15.4-48 Revision 17 TABLE 15.4-6 RELEASE FROM THE RCB SCENARIO:

TOTAL ACTIVITY RE LEASED INTO THE RCB Isotope Curies I-131 9.3E+05 I-132 8.8E+05

I-133 1.2E+06

I-134 1.4E+06

I-135 1.2E+06 Kr-83m 1.1E+05 Kr-85m 2.2E+05 Kr-85 1.7E+04

Kr-87 4.2E+05

Kr-88 5.9E+05

Kr-89 7.2E+05 Rb-86 4.5E+00

Rb-88 1.2E+06

Rb-89 1.5E+06 Xe-131m 9.0E+03 Xe-133m 5.2E+04 Xe-133 1.8E+06 Xe-135m 3.2E+05 Xe-135 4.2E+05

Xe-137 1.4E+06

Xe-138 1.4E+06 Cs-134 3.2E+05

Cs-136 9.3E+04

Cs-137 1.9E+05

Cs-138 2.9E+06

STPEGS UFSAR 15.4-49 Revision 17 TABLE 15.4-7 RELEASE FROM THE SECONDARY SIDE SCENARIO:

TOTAL ACTIVITY IN THE STEAM GENERATORS (RCS+SG) Isotope Curies I-131 1.0E+06 I-132 9.7E+05

I-133 1.4E+06

I-134 1.5E+06

I-135 1.4E+06 Kr-83m 1.1E+05 Kr-85m 2.2E+05 Kr-85 1.7E+04

Kr-87 4.2E+05

Kr-88 5.9E+05

Kr-89 7.2E+05 Rb-86 4.5E+00

Rb-88 1.2E+06

Rb-89 1.5E+06 Xe-131m 9.0E+03 Xe-133m 5.2E+04 Xe-133 1.8E+06 Xe-135m 3.2E+05 Xe-135 4.2E+05

Xe-137 1.4E+06

Xe-138 1.4E+06 Cs-134 3.2E+05

Cs-136 9.3E+04

Cs-137 1.9E+05

Cs-138 2.9E+06

STPEGS UFSAR 15.4-50 Revision 17 TABLE 15.4-8 RELEASE FROM THE SECONDARY SIDE SCENARIO:

STEAM RELEASED TO THE ENVIRONMENT (lbm) Time (Hours) PORV Above Seat Drains Total 0 - 1.25 15,535,885 34,740 15,570,625 1.25 - 36 0 965,772 965,772 36 - 720 0 0 0 Total 15,535,885 1,000,512 16,536,397 STPEGS UFSAR 15.4-51 Revision 17 TABLE 15.4-9 DOSES RESULTING FROM ROD EJECTION ACCIDENT (rem TEDE)

Receptor Containment Leakage Scenario Secondary Side Release Scenario Total Limit EAB (worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 0.86 0.55 1.4 6.3 LPZ 1.7 0.20 1.9 6.3 Control Room 2.4 0.41 2.8 5 TSC 2.3 0.40 2.7 5

STPEGS UFSAR 15.5-1 Revision 1 4 15.5 INCREASE IN REACTOR COOLANT INVENTORY Several events have been postulated which could cause an increase in reactor coolant inventory or a change in reactor coolant boron concentration. Discussion of the following events is presented in this section: 1. Inadvertent operation of Emergency Core Cooling System (ECCS) during power operation.

2. Chemical and Volume Control System (CVCS) malfunction that increases reactor coolant inventory.

These events are considered to be American Nuclear Society (ANS) Condition II transients (Section 15.0.1). 15.5.1 Inadvertent Operation of ECCS During Power Operation 15.5.1.1 Identification of Causes and Accident Description. Spurious Safety Injection System (SIS) operation at power could be caused by error or a false electrical actuation signal. The safety injection (SI) actuation channels are described in Section 7.3.

Following the actuation signal the SI pumps will start. The high

-head safety injection (HHSI) pumps have a shutoff head of approximately 1,700 psi and consequently provide no flow at normal Reactor Coolant System (RCS) pressure. The same argument applies to the low

-head safety injection (LHSI) pump which has a shutoff head of 300 psi.

An SI signal normally results in a reactor trip followed by a turbine trip. However, it cannot be assumed that any single fault that actuates SIS equipment will also produce a reactor trip. If a reactor trip is generated by the spurious SI signal, the plant is automatically brought to the hot standby condition. Since the SI pumps have a shutoff head less than operating pressure in the RCS, their actuation has no effect on the transient.

If the Reactor Trip System (RTS) does not produce an immediate trip as a result of the spurious SI signal, the reactor will continue to operate at power. Since the SI pumps have a shutoff head of approximately 1,700 psi they will not introduce borated water into the RCS following their actuation at normal RCS pressure.

No single active single failure is postulated for this event. If a reactor trip occurs, then the protection sequences shown in Figure 15.0

-21 will mitigate the consequences of this event.

15.5.1.2 Conclusions. Spurious SI without immediate reactor trip has no effect on the RCS.

If a reactor trip is generated by the spurious SI signal, a normal shutdown can be commenced without boration from the SI pumps because of the shutoff head of approximately 1,700 psi.

An evaluation determined that, for the replacement steam generator program, this event is bounded by the CVCS malfunction that increases reactor coolant inventory as presented in UFSAR Section 15.5.2.

STPEGS UFSAR 15.5-2 Revision 1 4 15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory 15.5.2.1 Identification of Causes and Accident Description. A malfunction of the CVCS could result in the inadvertent injection of borated water, which could lead to filling the pressurizer to a water

-solid condition.

The most limiting case would result if charging was in automatic control and the pressurizer level channel being used for charging control failed in a low direction. This would cause maximum charging flow to be delivered to the RCS and letdown flow to be isolated. This case also conservatively assumes that the charging pumps draw suction from the volume control tank (VCT) for the duration of the transient, precluding the introduction of higher borated water from the Refueling Water Storage Tank (RWST) to the RCS. To prevent filling the pressurizer water

-solid, the operator must terminate charging.

The acceptance criteria for this event is to ensure that the pressure boundary is not breached and that the fuel design limits are not exceeded. Therefore, the analysis is performed to ensure that the pressurizer does not become water solid and that DNBR limits are not exceeded following a CVCS malfunction that increases the reactor coolant inventory.

Plant systems and equipment, which are available to mitigate the effects of the accident, are discussed in Section 15.0.8 and listed in Table 15.0

-6. In addition to the failed pressurizer level channel, a single active failure is assumed in the analysis. As summarized in Table 15.0

-7, the limiting single failure assumed is a malfunction of one train of the Reactor Protection System. The operating train trips the reactor on high pressurizer water level.

15.5.2.2 Analysis of Effects and Consequences.

Method of Analysis The CVCS malfunction is analyzed by employing the detailed digital computer code, LOFTRAN (Ref. 15.5-1). This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, pressurizer heaters, steam generator (SG), and SG safety valves. The program computes pertinent plant variables, including temperatures, pressures, and power level.

The assumptions and sensitivities incorporated in the analyses are as follows:

1. Initial Operating Conditions The plant is initially operating at 102 percent of the nominal NSSS design rating. Pressurizer water level is assumed to be 7.1 percent above its normal programmed level. For various cases analyzed, the initial reactor coolant average temperature is 5.1F above or below the nominal value, and the initial pressurizer pressure is 46 psi above or below its nominal value.
2. Reactivity Coefficients
a. Minimum reactivity feedback cases - a least-negative moderator temperature coefficient and a least

-negative Doppler

-only power coefficient.

CN STPEGS UFSAR 15.5-3 Revision 1 4 b. Maximum reactivity feedback cases

- a conservatively large moderator temperature coefficient and most

-negative Doppler

-only power coefficient.

3. Reactor Control The reactor is assumed to be in automatic or manual rod control. Manual rod control tends to conservatively reduce the time at which pressurizer filling is predicted.
4. Charging System Maximum charging system flow is based on RCS backpressure from one centrifugal charging pump and one positive displacement charging pump with pump flowrate interactions accounted for is delivered to the RCS. The charging flow is assumed to be relatively cold (~35F) and to have the same boron concentration as the RCS for the duration of the transient.
5. Reactor Trips The transient is initiated by the pressurizer level channel which is used for control purposes failing low. Three channels remain intact and will initiate reactor trip on high pressurizer level based on the 2/4 logic.
6. Decay Heat Core residual heat generation is based on the 1979 version of ANS 5.1 (Reference 15.5

-2), which is a conservative representation of the decay energy release rates.

7. Pressurizer Pressure Control The pressurizer heaters and sprays are assumed to be operable or inoperable. Assuming the pressurizer heaters and sprays are operable conservatively reduces the time at which pressurizer filling is predicted.

The assumptions and sensitivities have shown that when the pressurizer sprays and heaters are in operation, it takes less time for the pressurizer to go water solid than when they are not included. Therefore, the following cases are presented at the most limiting conditions generated from the assumptions and sensitivities noted above. Case 1. Minimum Reactivity Feedback with Pressurizer Spray and Heaters operable, automatic rod control Case 2. Maximum Reactivity Feedback with Pressurizer Spray and Heaters operable, manual rod control

Operator Action Requirement

To prevent filling the pressurizer to a water solid condition, the operator must take action to terminate the charging flow. This operator action is required within 10 minutes after initiation of the event.

Several alarms should alert the operator of this event: CN-2881 CN-2881 STPEGS UFSAR 15.5-4 Revision 1 4 Letdown Flow

-- Low Alarm (LETDN HX OUTL FLOW HI/LO)

Charging Flow

-- High Alarm (CHG FLOW HI/LO)

Completion of protective action by the operator is performed in accordance with plant operating procedures.

Results Figures 15.5

-1 and 15.5

-2 show the transient response of nuclear power, core average temperature, pressurizer pressure, and pressurizer water volume for the most limiting conditions analyzed.

For each case analyzed, the departure from nucleate boiling ratio (DNBR) does not drop below its initial value.

The sequence of events is listed in Table 15.5-1. 15.5.2.3 Conclusions. The results show that none of the operating conditions during the transient approach core limits. To prevent water relief from the pressurizer, the operator mus t terminate charging. The sequence of events presented in Table 15.5

-1 shows that the operator has sufficient time to take corrective action.

An evaluation of this event has been performed as part of the replacement steam generator program. Since this event is a RCS inventory issue with maximum charging flow dictated by pressurizer pressure assumptions, replacing the steam generators has a negligible effect on the charging flow rate or the steam volume of the pressurizer. Hence, the conclusions of the analysis presented in this section remain valid with respect to the replacement steam generators.

15.5.2.4 Mode 3 Operations Above Programmed Level.

During cooldown operations prior to chemical degassing of the RCS, the pressurizer level is permitted to exceed the programmed level of 25% to an indicated level of up to 55%. During this operation, only one charging pump is permitted to be in operation. Pressurizer water level control is in manual.

The analysis for this condition assumes that letdown fails closed. The pressurizer water level increases initiating the pressurizer water level high alarm. Pressurizer water level continues to increase at a rate of approximately 3 percent/min. The operator is assumed to correct the condition within 10 minutes.

The analysis conservatively assumes the following:

The pressurizer water level high alarm is set at a high value of 70 percent.

The temperature of the charging flow is 35 o F. The charging pump flow is at run out flow.

An error of 6.0 percent is assumed for the pressurizer water level high alarm.

Operators are made aware of the importance of correcting unanticipated pressurizer water level increases through a pre

-job brief.

The results of the analysis show that after receiving the pressurizer water level high alarm, the operator has more than ten minutes to correct the potential pressurizer overfill condition before the pressurizer goes water solid.

STPEGS UFSAR 15.5-5 Revision 1 4 REFERENCES Section 15.5:

15.5-1 Burnett, T. W., et al., "LOFTRAN Code Description", WCAP

-7907-P-A (Proprietary), WCAP 7907-A (Nonproprietary), April 1984.

15.5-2 "American National Standard for Decay Heat Power in Light Water Reactors", ANSI/ANS 5.1

-1979, August 1979.

STPEGS UFSAR 15.5-6 Revision 1 4 TABLE 15.5

-1 CVCS MALFUNCTION TIME SEQUENCES Case Event Time (sec)

1. Minimum reactivity feedback with pressurizer spray and heaters operable, automatic rod control Maximum charging begins, letdown isolated 0.0 High pressurizer water level reactor trip setpoint reached 557.1 Rods begin to drop 559.1 Pressurizer fills 641.3 2. Maximum reactivity feedback with pressurizer spray and heaters operable, manual rod control Maximum charging begins, letdown isolated 0.0 High pressurizer water level reactor trip setpoint reached 510.5 Rods begin to drop 512.5 Pressurizer fills 608.1 CN-2881 CN-2881 STPEGS UFSAR 15.6-1 Revision 1 8 15.6 DECREASE IN REACTOR COOLANT INVENTORY Events which result in a decrease in reactor coolant inventory as discussed in this section are as follows: 1. Inadvertent opening of a pressurizer safety or relief valve (Section 15.6.1)
2. Failure of small lines carrying primary coolant outside containment (Section 15.6.2)
3. Steam generator tube rupture (Section 15.6.3)
4. Boiling water reactor (BWR) piping failure outside Containment (not applicable to South Texas Project Electric Generating Station [STPEGS]) (Section 15.6

.4) 5. Loss-of-Coolant Accident (LOCA) resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (RCPB) (Section 15.6.5)

Items 1 and 2 above are considered to be American Nuclear Society (ANS) Condition II events and

Items 3 and 5 are considered to be ANS Condition IV events.

15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve 15.6.1.1 Identification of Causes and Accident Description. Accidental depressurization of the Reactor Coolant System (RCS) could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flow rate of a relief valve, and will therefore allow a much more rapid depressurization upon opening, the most severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve.

Initially, the event results in a rapidly decreasing RCS pressure, which could reach hot leg saturation conditions without reactor protection system intervention. Pressure decreases prior to and after reactor trip. The effect of the pressure decrease is to decrease/increase power depending on the moderator density feedback. The reactor control system (if in the automatic mode) or moderator density feedback (if positive MTC) functions to maintain power and average coolant temperature essentially constant until reactor trip. Initially, the pressurizer level increases due to expansion caused by the depressurization and then decreases following reactor trip.

The reactor may be tripped by the following Reactor Trip System (RTS) signals:

1. Overtemperature T 2. Pressurizer low pressure A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-22. An inadvertent opening of a pressurizer safety valve is classified as an ANS Condition II event, a fault of moderate frequency (Section 15.0.1).

STPEGS UFSAR 15.6-2 Revision 1 8 15.6.1.2 Analysis of Effects and Consequences. The accidental depressurization transient is analyzed by employing the detailed digital computer code RETRAN

-02 (Ref. 15.6

-29). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator (SG), and SG safety valves. The code computes pertinent plant variable including temperatures, pressures, and power level.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results in calculating the departure from nucleate boiling ratio (DNBR) during the transient, the following assumptions are made:

1. This accident is analyzed with the Revised Thermal Design Procedure described in Section 4.4. Initial reactor power, RCS pressure and temperature are assumed to be at their nominal values with the addition of applicable instrumentation biases.
2. A most positive moderator temperature coefficient of reactivity is assumed. The spatial effect of void due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.
3. A small (absolute value) Doppler coefficient of reactivity is assumed (Figure 15.0

-2) so that the resultant amount of negative feedback is conservatively low in order to maximize any power increase due to moderator reactivity feedback.

Normal reactor control systems are not required to function. The rod control system is assumed to be in the manual mode in order to maximize the power increase due to moderator feedback and to prevent rod insertion prior to reactor trip. The RTS functions to trip the reactor on the appropriate signal. Plant systems and equipment, which are available to mitigate the effects of the accident, are discussed in Section 15.0.8 and listed in Table 15.0

-6. No single active failure will prevent the RTS from functioning properly. As summarized in Table 15.0

-7, the limiting single failure assumed in the analysis is defined as malfunction of one train of the Reactor Protection System. Results The system response to an inadvertent opening of a pressurizer safety valve is shown on Figures

15.6-1 through 15.6

-3. Figure 15.6

-1 illustrates the nuclear power transient following the depressurization. Nuclear power increases slowly until reactor trip occurs on overtemperature T. The pressure decay transient and average temperature transient following the accident are given on Figure 15.6

-2. The DNBR transient is shown on Figure 15.6

-3; DNBR remains above the safety analysis limit value throughout the transient.

The calculated sequence of events for the inadvertent opening of a pressurizer safety valve incident is shown in Table 15.6

-1. 15.6.1.3 Radiological Consequences. An inadvertent opening of a pressurizer safety or relief valve releases primary coolant to the pressurizer relief tank; however, even assuming a direct release to the Containment atmosphere, the radiological consequences of this event would be substantially less than that of a LOCA because less primary coolant is released and the activity is lower as fuel damage is not predicted as a result of this event.

STPEGS UFSAR 15.6-3 Revision 1 8 15.6.1.4 Conclusions. The results of the analysis show that the overtemperature T RTS signal provides adequate protection against the RCS depressurization event. The DNB design basis as described in Section 4.4 is met.

15.6.2 Failure of Small Lines Carrying Primary Coolant Outside Containment 15.6.2.1 Identification of Causes and Accident Description. Several small lines in the plant carry primary coolant outside the Containment. These lines are the sample lines which conform to General Design Criterion (GDC) 55 of 10CFR50, Appendix A, and the Chemical and Volume Control System (CVCS) letdown line. There are no instrument lines which carry primary coolant outside the Containment.

Block diagrams summarizing various protection sequences for actions required to mitigate the consequences of these events are provided in Figures 15.0

-23 and 15.0

-31. 15.6.2.1.1 Accident Description

- Sample Line Break: The sample lines and the isolation valves inside and outside Containment are open when sampling, sample line purging, or degassing operations are being performed. The sample lines are the pressurizer sample lines and the RCS hot leg sample lines. Outside Containment the isolation valves on these lines are pneumatically operated; inside Containment the valves are solenoid operated. This accident is classified as an ANS Condition II event, a fault of moderate frequency.

The postulated failure of a sampling line outside Containment would take place between the isolation valve outside Containment and the sample panel. A break in this area would result in the release of primary coolant to the Mechanical Auxiliary Building (MAB).

There are multiple indications in the control room which will alert the operator to a possible primary leak in the MAB (MAB area radiation monitors, MAB air monitors, pressurizer level deviation alarms, charging flow/letdown flow alarms, etc.). Upon indication that a sample line break has occurred, the operator will take action to close the Containment isolation valve.

15.6.2.1.2 Accident Description

- Letdown Line Break: The postulated failure of the CVCS letdown line outside Containment would result in the release of primary coolant to the MAB.

Because the failure is assumed to occur outside the Reactor Containment Building (RCB), the primary coolant has been reduced in temperature and pressure by the regenerative heat exchanger and the letdown orifices, respectively. Because the break is downstream of the letdown orifices, the break flow rate is within the capability of the normal makeup system. Therefore, the primary system is expected to be unaffected by this postulated accident. This is considered a Condition II event.

Frequent operation of the normal makeup system, increased flow of the charging pumps, and low level in the volume control tank (VCT) are indicated in the main control room and provide the operators with sufficient information to identify the line failure. It is conservatively estimated that the operator isolates the CVCS letdown line within 30 minutes of the postulated line failure. No credit is taken for automatic isolation of the letdown line which could occur depending upon the location. Temperature sensors which initiate automatic isolation are provided near postulated letdown line break locations when required to protect plant equipment and structures.

STPEGS UFSAR 15.6-4 Revision 1 8 15.6.2.2 Analysis of Effects and Consequences.

15.6.2.2.1 Analysis Assumptions

- Sample Line Break: Since the coolant sample is obtained at differing temperatures and pressures within the RCS, an analysis was performed to determine the sample line whose failure results in the greatest release of primary coolant activity.

That line is the pressurizer liquid sample line and the following discussion treats that postulated failure. This analysis is based on the TID

-14844 source terms.

The parameters used for the analysis are listed in Table 15.6

-2. The fraction of water flashing to steam has been calculated and this value used as the fraction of iodines in the water that become airborne. All of the noble gases in the reactor coolant spilled are assumed to be released to the MAB atmosphere.

No credit was taken for any mixing, holdup, or filtration of the activity released to the MAB atmosphere. No credit is taken for ground deposition or decay in transit after release the environment.

If the postulated accident is assumed to occur coincident with an existing iodine spike (caused by a previous power transient) the primary coolant concentrations are assumed to be equal to the Technical Specification limit for full power operation following an iodine spike. These concentrations are given in Table 15.A

-4. If the postulated accident is assumed to cause an iodine spike, the release rate of iodine to the primary coolant is increased by a factor of 500, as discussed in Appendix 15.A.

15.6.2.2.2 Analysis Assumptions

- Letdown Line Break: The release of primary coolant due to the postulated failure of a CVCS letdown line is composed of three portions: the coolant contained in the line at the time of failure, the reverse flow of coolant contained in the piping downstream of the break, and the coolant released until the isolation valves are closed.

This analysis is based on the TID

-14844 source terms.

Because the postulated failure is downstream of the letdown orifices, the maximum release rate through the isolation valves and out the break is limited to 40 lbm/sec (letdown of 250 gal/min).

Conservatively assuming operator action to close the isolation valves within 30 minutes, and including the initial forward and reverse flow of coolant contained in the line, a total release of 7.45 x

10 4 lbm is obtained.

The fraction of water flashing to steam has been calculated and this value used as the fraction of iodines in the water that become airborne. All of the noble gases in the reactor coolant spilled are assumed to be released to the MAB atmosphere.No credit was taken for any mixing, holdup, or filtration of the activity released to the MAB atmosphere. No credit is taken for ground deposition or decay in transit after release to the environment.

If the postulated accident is assumed to occur coincident with an existing iodine spike (caused by a previous power transient), the primary coolant concentrations are assumed to be equal to the STPEGS UFSAR 15.6-5 Revision 1 8 Technical Specification limit for full power operation following an iodine spike. The concentrations are given in Table 15.A

-4. If the postulated accident is assumed to cause an iodine spike, the release rate of iodine to the primary coolant is increased by a factor of 500, as discussed in Appendix 15.A.

15.6.2.3 Radiological Consequences. The parameters utilized in calculating the effects of the sample line failure are presented in Table 15.6

-2. The parameters utilized in the letdown line failure analysis are presented in Table 15.6

-3. The offsite doses resulting from both postulated line failures are presented in Table 15.6

- 4. The doses are found to be a small fraction of the guideline values of 10CFR1

00. 15.6.3 Steam Generator Tube Rupture 15.6.3.1 Identification of Causes and Accident Description. The accident examined is the complete severance of a single Steam Generator (SG) tube. The accident is assumed to take place at power. The reactor coolant is assumed to be contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident Loss of Offsite Power (LOOP) or failure of the turbine bypass system, discharge of activity to the atmosphere takes place via the SG power

-operated relief valves (PORVs) and/or safety valves.

Since the SG tube material is a highly ductile material (see Chapter 5 for Steam Generator tube materials), the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance. An accumulation of minor leaks which exceed the Technical Specification limits is not permitted during the unit operation.

Due to a series of alarms, the operator will readily determine that a Steam Generator Tube Rupture (SGTR) has occurred. The operator will then identify and isolate the ruptured SG. The isolation procedure can be completed before the water level in the ruptured SG rises into the main steam pipe.

Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by a tube rupture:

1. Pressurizer low pressure and low level alarms are actuated and charging flow increases in an attempt to maintain pressurizer level. There is a steam flow/feedwater (FW) flow mismatch before trip because FW flow to the ruptured SG is reduced due to the RCS break flow.
2. The condenser vacuum pump discharge radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system. In addition, indication will be available from the steam line and/or the SG blowdown radiation monitors.
3. Continued loss of reactor coolant inventory leads to a reactor trip signal generated by the overtemperature delta

-T circuit or low pressurizer pressure. The plant cooldown which STPEGS UFSAR 15.6-6 Revision 1 8 follows a reactor trip leads to a rapid change of pressurizer level. Low pressurizer pressure initiates a Safety Injection (SI) signal soon after the reactor trip. The SI signal automatically terminates normal FW supply and initiates auxiliary feedwater (AFW) addition.

4. The reactor trip automatically trips the turbine and if offsite power is available, the steam dump valves would open to allow steam blowdown to the condenser. In the event of a coincident LOOP, the steam dump valves would automatically close to protect the condenser. The SG pressure would rapidly increase, resulting in steam discharge to the atmosphere through the SG PORVs and/or safety valves.
5. Following reactor trip, the continued action of AFW supply and borated SI flow provides a heat sink which absorbs some of the decay heat. This reduces steam bypass to the condenser or atmosphere from the ruptured SG during the recovery procedure.
6. SI flow maintains RCS inventory. RCS pressure trends toward the equilibrium value where SI flow rate equals break flow rate. The time after trip when the operator can see returning pressurizer level depends on the amount of operating auxiliary equipment and operator actions to cool down and depressurize the RCS.

Plant systems and equipment, which are available to mitigate the effects of the accident, are discussed in Section 15.0.8 and listed in Table 15.0-6. A flow diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure

15.0-24. 15.6.3.2 Recovery Procedure. Immediately apparent symptoms of a tube rupture accident are also symptoms of small steam line breaks and LOCAs. These symptoms include falling pressurizer pressure and level and increased charging flow. It is important for the operator to determine that the accident is a SGTR in order to carry out the correct recovery procedure. In the event of a complete tube rupture, it will be clear soon after trip that the level in the ruptured SG(s) is rising more rapidly than in the others. This is a unique indication of a SGTR. Also, this accident could be identified by either a condenser vacuum pump discharge radiation monitor alarm, main steam line radiation monitor, or a SG blowdown radiation monitor alarm.

The operator carries out the following actions after reactor trip which lead to isolation of the ruptured SG and to unit cooldown. These actions are detailed in the STP Emergency Operating Procedures.

With Offsite Power Available:

1. Manually regulate AFW flow to the intact SGs to maintain a minimum on

-scale water level. Identify the ruptured SG by uncontrolled rising water level or radiation monitors. Manually regulate AFW flow to the ruptured SG to maintain minimum water level with the SG tubes covered. 2. The steam dump valves will open automatically, allowing steam dump to the condenser, which will establish and maintain no-load Tavg conditions.

3. Close the main steam isolation valve (MSIV) and isolate all other steam paths from the ruptured SG.

STPEGS UFSAR 15.6-7 Revision 1 8 4. Dump steam to the condenser from the intact SGs at a maximum rate to establish subcooling margin for RCS depressurization.

5. Decrease RCS pressure by use of pressurizer spray valves until the appropriate criteria based on pressurizer water level, RCS pressure, and/or RCS subcooling are met. This will decrease the pressure differential between the RCS and ruptured SG.
6. Based upon pressurizer water level, secondary heat sinks, RCS subcooling, and RCS pressure, stop the SI pumps and control charging flow to minimize break flow to the secondary system. At this point, RCS pressure and ruptured SG pressure should be maintained approximately equal. 7. Continue dumping steam to the condenser from the intact SGs and decrease RCS pressure by use of pressurizer spray valves. Decrease pressure in the ruptured SG by backfill, blowdown, or steam release.
8. Initiate operation of the Residual Heat Removal System (RHRS) when the RCS temperature is less than 350F and the RCS pressure is less than 350 psig.

With a LOOP:

1. Manually regulate AFW flow to the intact SGs to maintain a minimum on

-scale water level. Identify the ruptured SG by uncontrolled rising water level or radiation monitors. Manually regulate AFW flow to the ruptured SG to maintain minimum water level with the SG tubes covered. 2. The SG pressure will rapidly increase, resulting in steam discharge to the atmosphere through the SG PORVs and/or safety valves.

3. Close the MSIV and isolate all other steam paths from the ruptured SG.
4. Dump steam through the intact SGs PORVs at the maximum rate to establish subcooling margin for RCS depressurization.
5. Decrease RCS pressure by use of the auxiliary pressurizer spray valves or pressurizer PORVs until the appropriate criteria based on pressurizer water level, RCS pressure, and/or RCS subcooling are met. This will decrease the pressure differential between the RCS and ruptured SG.
6. Based upon pressurizer water level, secondary heat sinks, RCS subcooling, and RCS pressure, stop SI pumps and control charging flow to minimize break flow to the secondary system. At this point, RCS pressure and ruptured SG pressure should maintained approximately equal.
7. Continue dumping steam from the intact SGs and decrease RCS pressure. Decrease pressure in ruptured SG by backfill, blowdown, or steam release.
8. Initiate operation or the RHRS when the RCS temperature is less than 350F and the RCS pressure is less than 350 psig.

STPEGS UFSAR 15.6-8 Revision 1 8 The condensate accumulated in the secondary system can be examined and processed as required.

15.6.3.3 Analysis of Effects and Consequences.

Method of Analysis Two analyses are performed for this accident. The first analysis determines the margin of the steam generators to an overfill condition and the second determines the radiological consequences of the accident.

The time required to terminate the break flow in the margin

-to-overfill analysis and radiological consequences are determined by a STP

-specific simulation of the accident using the RETRAN computer code. The simulations account for STP

-specific operator action times and equipment response characteristics according to the methodology detailed in WCAP

-10698-P-A and Supplement 1 to WCAP-10698-P-A. The high level operator response times assumed in the analysis for the design base case are provided in Table 15.6

-3A. In estimating the mass transfer from the RCS through the broken SG tube the following assumptions are made:

1. Reactor trip occurs automatically on overtemperature T or low pressurizer pressure. An SI signal occurs on low pressurizer pressure.
2. After reactor trip, the break flow reaches equilibrium at the point where incoming SI flow is balanced by outgoing break flow. The break flow continues until the operators cool down and depressurize the RCS. The actions controlling the operators' response are contained in the STP Emergency Operating Procedures.
3. The SGs are controlled at the PORV setting or the safety valve setting if it is reached.

No single active failure will adversely affect the consequences of the accident. Table 15.0

-7 lists the worst single failure assumed in the analyses. In the margin to overfill analysis, the limiting single failure is the failure of the auxiliary feedwater flow control valve in the flow path of the ruptured steam generator to close on demand. An operator action is required to stop the associated auxiliary feedwater pump. For the offsite dose analysis, the limiting single failure is a failed

-open PORV on the ruptured steam generator.

Margin-to-Overfill-Analysis The margin

-to-overfill analysis makes the following assumptions:

1. Offsite power is lost upon reactor trip.
2. The initial SG water mass reflects a conservative adjustment to provide the minimum margin to overfill. 3. Operation of the AFW system is assumed to occur. The maximum potential AFW flow rate of 675 gal/min was supplied to the ruptured steam generator. The minimum AFW flow of 500 gpm was supplied to the three intact steam generators.
4. The condenser is not available for steam dump operation.

STPEGS UFSAR 15.6-9 Revision 1 8 Steam Generator Tube Rupture Analysis for Above MSIV Seat Drain Line Flow Restrictor Orifices An SGTR analysis was performed to determine the effect of replacing the above seat main steam line SOVs with 3/8" orifices. It is determined that for a SGTR, an additional mass release through the orifice from the ruptured and intact steam generators is observed. For the duration from SGTR initiation to cold shutdown, the plant is assumed to be at hot standby for 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> with instantaneous cold shutdown at 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This is conservative in evaluating the additional mass release through the orifice since with operator action and Limiting Conditions for Operations the secondary pressure would decrease so as to be in hot shutdown within at least 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> and cold shutdown within the next 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. After 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />, no further steam releases are assumed.

Radiological Consequences Analysis The Alternative Radiological Source Terms, as described in Regulatory Guide 1.183 (Reference 15.6

-30), are used in this analysis.

If the postulated accident is assumed to occur coincident with an existing iodine spike, the primary coolant concentrations are assumed to be equal to the Technical Specification limit for full power operation following an iodine spike. If the postulated accident is assumed to result in an iodine spike, the primary coolant iodine concentrations are modeled by increasing the release rate from the fuel over the initial primary system release rate. Further discussion of this iodine spike is contained in Appendix 15.C.

The radiological consequences analysis makes the following assumptions:

1. The source term is based upon a power level of 4100 MW thermal, 5 w/o enrichment, and a three region core with equilibrium cycle core at end of life. The three regions have operated at a specific power of 39.3 MW/MTU for 509, 1018, and 1527 EFPD, respectively. The assumed power level is greater than the Rated Thermal Power of 3853 MWth plus a 0.6% measurement uncertainty.
2. The equilibrium secondary activity before the accident is based upon a pre

-incident primary

-to-secondary leakage of 1 gpm. This is conservative since the Technical Specifications limit the pre-accident leakage to 150 gpd per steam generator or 600 gpd (0.42 gpm) total.

3. No fuel failures are assumed to be caused by the SGTR.
4. Total primary

-to-secondary leakage through the steam generator tubes prior to the accident and during the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the transient is 1 gpm. Eight hours after the accident, th e residual heat removal system starts and primary

-to-secondary leakage is stopped. Primary

-to-secondary leakage is conservatively modeled at 0.65 gpm for the three intact steam generators and at 0.35 gpm for the ruptured steam generator

. 5. The intact SGs do not experience tube bundle uncovery. Therefore, primary

-to-secondary coolant leakage into the intact SGs mixes with the bulk water in the SG and no flashing to the environment is assumed to occur.

6. For a pre-accident iodine spike, the activity in the reactor coolant is based upon an iodine spike which raises the reactor coolant concentration to 60 Ci/gm of dose equivalent I

-131. The STPEGS UFSAR 15.6-10 Revision 1 8 secondary coolant activity is based on 0.1 Ci/gm of dose equivalent I

-131. Noble gas activity is based on 1% failed fuel.

7. For an accident

-induced iodine spike, the accident initiates an iodine spike in the RCS which increases the iodine release rate from the fuel to a value 335 times greater than the release rate corresponding to a RCS concentration of 1 Ci/gm dose equivalent I-131. Iodines, Cs, and Rb are assumed to be released at this rate for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> (Cs and Rb are released at the rate of I

-131). The iodine activity released from the fuel to the RCS is conservatively assumed to mix instantaneously and uniformly in the RCS. Since Regulatory Guide 1.183 specifies that the chemical form of particulate iodine is (CsI), the spike is also assumed to relatively increase the Alkali metal (Cs and Rb) in the RCS. Noble gas activity is conservatively based on 1% failed fuel. 8. The activity released from the fuel gap is assumed to be instantaneously mixed with the reactor coolant within the pressure vessel per Regulatory Guide 1.183.

9. A partition coefficient of 100 is assumed for elemental iodine released from the steam generators. (Regulatory Guide 1.183, Appendix E, Section 5.6) Organic iodine is not partitioned. Organic iodine is assumed to migrate directly to the steam space and become immediately available for release

. 10. For the first 10 minutes of the accident, the PORV on the ruptured SG lifts to control SG pressure. Operators are assumed to identify the ruptured steam generator and attempt to close the PORV on the ruptured steam generator in 10 minutes. However, the PORV is assumed to fail open (the single failure for this accident scenario) at that time. It is assumed that the failed PORV is isolated by manually closing the PORV block valve within 15 minutes of the PORV failure. Therefore, the steam release via the ruptured steam generator's PORV is assumed to continue for a total of 25 minutes. 11. Eight hours after the accident, the residual heat removal system is in operation and no further steam containing radionuclides is released from steam generators to the environment except the leakage through the MSIV above

-seat drain orifices. The release through the orifices continues until 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br /> after the start of the accident. (These orifice releases occur in the Isolation Valve Cubicle next to the PORVs. Therefore, the PORV

-to-Control Room and TSC dose analyses.) This is conservative since all releases would terminate in less than 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> when the RHR system is in operation.

12. The SG releases are via the PORVs and ruptured SG safety valves. The above

-seat drain releases occur in the Isolation Valve Cubicle next to the PORVs. Therefore, the PORV

-to- 13. Offsite Power is lost. After 66.5 seconds, the condensers are unavailable for steam dump.

14. The Control Room ventilation system automatically transfers to the emergency mode of operation after the initiation of safety injection. This is assumed to happen at t=0 instead of upon reactor trip at 66.5 seconds. Since the mass releases are increased by about 40%, the time difference is negligible.

STPEGS UFSAR 15.6-11 Revision 1 8 15. All activity is released to the environment with no consideration given to cloud depletion by ground deposition during transport to the Exclusion Area Boundary (EAB) and Low Population Zone (LPZ).

16. Reactor coolant density is 8.33 lbs/gal.
17. Presence of actual PORV leakage on the intact steam generators is encompassed by the steam releases necessary to cool the plant to a point where cooling is performed by the RHR system (RCS at 350 psia, 350 F). Therefore, the presence of PORV leakage has no impact on steam releases and dose consequences for the 0

-8hr time period. Presence of actual PORV seat leakage on the intact steam generators after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> has a negligible effect on the doses at the site boundary and control room. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the pressure in the secondary side has been reduced from operating pressure (about 1050 psia) to the saturation pressure at 350F (about 135 psia). Assuming flow from the PORV is choke flow, the reduction in pressure would cause a proportional reduction in leak flow. A small leakage would be reduced by a factor of 10 after 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. When the plant reaches 212F, the release would stop. This additional release would have a negligible effect on doses at the site boundary and control room. Presence of actual PORV seat leakage on the ruptured steam generators during the accident has no impact on steam releases or dose consequences. A release via the open PORV continues for 25 minutes until the PORV'S block valve is closed. No other release from the PORV is assumed.

18. After a SGTR accident, Emergency Operating Procedures direct the operator to close two isolation valves to the turbine driven auxiliary feed pump. Up to the time the valves are closed, a release path from the secondary side of D steam generator exists through either valve through an orifice and to the condenser. The SGTR analysis includes a previously identified release path through the MSIV above seat drains (ASD). This pathway is modeled as a 3/8 inch orifice with choke flow continuous for 36 hours4.166667e-4 days <br />0.01 hours <br />5.952381e-5 weeks <br />1.3698e-5 months <br />. This pathway contributes only a very small part of the total dose from a SGTR. The flow orifice is a 1/8 inch orifice. Assuming choke flow through this orifice, the orifice would release about 1/9th the mass of the analyzed 3/8 inch ASD orifice. Accordingly, the dose contribution would be 10% of the small ASD dose. Since the line is routed to the condenser, the particulates (iodine) will be plated out in the line or condenser and not released to the atmosphere. Only noble gases would be released from the condenser to the atmosphere. The added dose contribution would be negligible.

Input parameters used for the SGTR analysis are given in Table 15.6

-5. 15.6.3.4 Results Margin-to-Overfill Results. The margin

-to-overfill analysis shows that sufficient margin-to-overfill exists for the most limiting initial conditions. The sequence of events for the margin-to-overfill analysis is provided in Table 15.6

-3B. Figure 15.6

-4 shows the ruptured steam generator volume versus time. Therefore, overfill of the ruptured steam generator will not occur for a design basis SGTR.

Radiological Consequences Analysis. The sequence of events for the radiological consequences analysis is provided in Table 15.6

-3C. The results of the radiological consequences analysis are presented in Table 15.6

-10. This table shows the thyroid, whole

-body gamma, and beta

-skin doses for the various cases analyzed for the exclusion zone boundary (EZB) distance of 1,430 STPEGS UFSAR 15.6-12 Revision 1 8 meters and the low population zone (LPZ) distance of 4,800 meters. The results show that the doses are a small fraction of the 10 CFR 50.67 limits when an iodine spike is caused by the accident. The results also show that the doses are within the 10 CFR 50.67 limits when a preexisting iodine spike exists. 15.6.3.5 Conclusion. A SGTR will cause no subsequent damage to the RCS or the reactor core. An orderly recovery from the accident can be completed even assuming simultaneous LOOP. The event will not result in the overfilling of any steam generator. Radiological consequences from this event are within the limits of 10CFR 50.67.

During plant startup, the above MSIV seat drain line valves are opened for removal of accumulated condensate to protect the turbine from water induction damage and to prevent water hammer in the steam lines. During normal operations, manual valves isolate the above MSIV seat drain lines. Specific analyses for simultaneous steam releases from all four steam generators via opened above MSIV seat drain lines concurrent with a SGTR event or a main steam line break with a design primary to secondary system leak demonstrate that radiological doses will not exceed 10CFR 50.67 limits and the additional steam demand will not result in exceeding applicable reactor safety acceptance criteria. Due to the use of restricting orifices, flow from the lines will be limited and no operator action is required to close the above MSIV seat drain line isolation valves.

15.6.4 Radiological Consequences of Main Steam Line Failure Outside Containment (BWR)

Not applicable to STPEGS.

15.6.5 Loss of Coolant Accidents 15.6.5.1 Identification of Causes and Frequency Classification. A LOCA is the result of a pipe rupture of the RCS pressure boundary. For the analyses reported here, a major pipe break (large break) is defined as a rupture with a total cross sectional area equal to or greater than 1.0 ft

2. This event is considered an ANS Condition IV event, a limiting fault, in that it is not expected to occur during the lifetime of the plant, but is postulated as a conservative design basis. See Section 15.0.1.

A minor pipe break (small break), as considered in this section, is defined as a rupture of the reactor coolant pressure boundary (Section 5.2) with a total cross sectional area less than 1.0 ft 2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered a Condition III event, in that it is an infrequent fault which may occur during the life of the plant.

The acceptance criteria for the LOCA are described in 10CFR50.46 (Ref. 15.6

-2) as follows:

1. The calculated peak fuel element clad temperature is below the requirement of 2,200 F. 2. The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1 percent of the total amount of Zircaloy in the reactor.
3. The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limits of 17 percent are not exceeded during or after quenching.

STPEGS UFSAR 15.6-13 Revision 1 8 4. The core remains amenable to cooling during and after the break.

5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long

-lived radioactivity remaining in the core.

These criteria were established to provide significant margin in Emergency Core Cooling System (ECCS) performance following a LOCA. Reference 15.6

-3 presents a study with regard to the probability of occurrence of RCS pipe ruptures.

15.6.5.2 Sequence of Events and Systems Operations. Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. An SI signal is generated when the appropriate setpoint is reached. These countermeasures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of power to a residual level corresponding to fission product decay heat. The large

break analysis only takes credit for borated water and does not take credit for control rod insertion to ensure the reactor remains subcritical up to the point of hot leg recirculation.

During the hot leg recirculation phase, credit is taken for both control rod insertion and borated water.

2. Injection of borated water provides for heat transfer from the core and prevents excessive clad temperatures.

Description of Large Break LOCA Transient The sequence of events for a large break LOCA are presented on Figure 15.6-5. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-25. Before the break occurs, the unit is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant. At the beginning of the blowdown phase, the entire RCS contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. Thereafter, the core heat transfer is based upon local conditions with transition boiling and forced convection to steam as the major heat transfer mechanisms.

The heat transfer between the RCS and the secondary system may be in either direction depending upon the relative temperatures. In the case of continued heat addition to the secondary, secondary system pressure increases and the main steam safety valves (MSSVs) may lift to limit the pressure. The SI signal actuates a FW isolation signal which isolates normal FW flow by closing the main FW isolation valves. This SI signal also initiates emergency FW flow by starting the AFW pumps.

The secondary flow aids in the reduction of RCS pressure. The beneficial effects of reduced secondary pressure due to MSSV lift and AFW injection are not credited in the large break LOCA calculation.

STPEGS UFSAR 15.6-14 Revision 1 8 When the RCS depressurizes to 583.6 psia (including uncertainties), the accumulators begin to inject borated water into the reactor coolant loops (RCLs). Since the LOOP is assumed, the reactor coolant pumps (RCPs) are assumed to trip at the inception of the accident. The effects of pump coastdown are included in the blowdown analysis.

The blowdown phase of the transient ends when the RCS pressure (initially assumed at 2,300 psia) falls to a value approaching that of the Containment atmosphere. Prior to or at the end of the blowdown, the mechanisms responsible for the bypassing of emergency core cooling water injected into the RCS are assumed not to be effective. At this time (called end of bypass) refill of the reactor vessel lower plenum begins. Refill is complete when emergency core cooling water has filled the lower plenum of the reactor vessel which is bounded by the bottom of the fuel rods (called bottom of core recovery time).

The reflood phase of the transient is defined as the time period lasting from the end of refill until the reactor vessel has been filled with water to the extent that the core temperature rise has been terminated. From the latter stage of blowdown and the beginning of reflood, the SI accumulator tanks rapidly discharge borated cooling water into the RCS, contributing to the filling of the reactor vessel downcomer. The downcomer water elevation head provides the driving force required for the reflooding of the reactor core. The low

-head and high

-head safety injection pumps aid the filling of the downcomer and subsequently supply water to maintain a full downcomer and complete the reflooding process.

Continued operation of the ECCS pumps supplies water during long

-term cooling. Core temperatures have been reduced to long

-term steady

-state levels associated with dissipation of residual heat generation. After the water level of the RWST reaches a minimum allowable value, coolant for long

-term cooling of the core is obtained by automatically switching to the cold leg recirculation phase of operation in which spilled borated water is drawn from the Containment emergency sumps by the low

-head and high

-head safety injection pumps and returned to the RCS cold legs. The Containment Spray System (CSS) continues to operate (drawing water from the sumps) to further reduce Containment pressure. Approximately 5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after initiation of the LOCA the ECCS is realigned to supply water to the RCS hot legs in order to control the boric acid concentration in the reactor vessel.

Description of Small Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA, there are only three characteristic stages, i.e., a gradual blowdown in which the decrease in water level is checked, core recovery, and lon g-term recirculation. For the small break LOCA transient, secondary pressure relief, due to MSSV and SG PORV lift, and AFW injection are modeled in the analysis.

A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figure 15.0

-25. 15.6.5.3 The results of analyses presented in this section demonstrate that the amounts of radioactivity released to the environment in the event of a postulated LOCA do not result in doses which exceed the limits specified in 10CFR 50.67.

STPEGS UFSAR 15.6-15 Revision 1 8 The LOCA is modeled as a release of nuclides from the reactor core into the containment building in the timeframe presented in Table 15.6

-11. Subsequent releases to the environment are as follows:

Leakage through the containment walls, at the allowed Technical Specification leakage rate of 0.3% for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and one half that value after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> The (pre-clad rupture) activity in the reactor coolant system through the containment supplemental purge system, terminating when the supplemental purge system isolation valves close (automatically upon receipt of the safety injection signal)

Leakage via Engineered Safety Features (ESF) components in the Fuel Handling Building, at an assumed rate of 8280 cc/hr (double the allowed leakage rate of 4140 cc/hr).

Credit for containment spray is taken to reduce the amount of radionuclides available for leakage from the containment.

The radiological source term characteristics and release timing are based on the Alternative Source Term (AST) methodology in Regulatory Guide 1.183 (Reference 15.6

-30). The RADTRAD code (Reference 15.6

-31) is used for this analysis.

Doses to the public at the Exclusion Area Boundary (EAB) and the Low Population Zone (LPZ) and to operators in the Control Room and the Technical Support Center (TSC) are determined.

For conservatism, the LOCA core source terms are those associated with a DBA power level of 4100 MWth compared to the licensed power level of 3853 MWth with a 0.6% measurement uncertainty.

The AST values used in this analysis were derived using guidance outlined in Regulatory Guide

1.183. The ORIGEN 2.1 code was used to calculate plant

-specific fission product inventories for use in the DBA LOCA dose analyses. The assumed period of irradiation was sufficient (three

-region equilibrium cycle core at end of life with the three regions having operated at 39.31 MW/MTU for 509, 1018, and 1527 EFPD, respectively) to allow the activity of dose

-significant radionuclides to reach equilibrium or to reach maximum values. Certain radionuclides appearing in the default list of radionuclides for the RADTRAD computer code but not appearing in the summary of the ORIGEN analysis were taken from the PWR default file for RADTRAD. These include Ba139, La141, and Np239 and Am241, Cm242, Cm244, Pu238, Pu239, Pu240, and Pu241 (used with activities increased by a factor of three for conservatism because of their half

-lives being greater than 100 days).

In addition to the radionuclides appearing in the RADTRAD list, Kr83m, Xe131m, Xe133m, and Xe135m were added for dose analysis purposes based on their inclusion in TID

-14844. Xe138 was also added. Co58 and Co60 were deleted from the list because only 63 radionuclides can be used.

Omitting Co58 and Co60 decreased the control room dose by about 0.01 percent while adding the noble gas isotopes increased the control room dose by about 0.1 percent.

Fission product activities were calculated for immediately after shutdown and decayed for the required times. The shutdown values are shown in Table 15.6-12. 15.6.5.3.1 Containment Leakage Contribution: Following a postulated double

-ended rupture of a reactor coolant pipe with subsequent blowdown, the ECCS keeps cladding temperatures well below STPEGS UFSAR 15.6-16 Revision 1 8 melting, and limits zirconium

-water reactions to an insignificant level, assuring that the core remains intact and in place. As a result of the increase in cladding temperature and rapid depressurization of the core, however, some cladding failure may occur in the hottest regions of the core. Thus a fraction of the fission products accumulated in the pellet

-cladding gap may be release to the RCS and thereby to the Containment.

15.6.5.3.1.1 Activity Release to Containment

- The offsite doses resulting from a hypothetical accident releasing core activity have been analyzed. Activity releases of these magnitudes have a considerably lower probability than that associated with gap activity releases; that is, these hypothetical releases reflect an accident in which the ECCS has been ineffective in preventing core damage. For the analysis of this hypothetical case, the assumptions outlined in RG 1.183 were used to determine the initial activity release. Thus, a total of 100 percent of the core noble gas inventory, 40 percent of the core iodine inventory, 30 percent of the core cesium and rubidium inventory, and 5 percent of the core tellurium and antimony inventory is assumed to be released from the RCS and available for leakage from the Containment. The total core inventory is given in Table 15.C

-1. Of the iodine activity released to the Containment, it is assumed that 4.85 percent is in the elemental form, 0.15 percent is in the organic or methyl iodine form, and 95 percent is in particulate form.

Primary containment leakage to the environment is modeled as a diffuse area source in conformance with Regulatory Guide 1.194.

15.6.5.3.1.2 Containment Model Parameters

- The quantity of activity released through leakage from the Containment was calculated with a two

-volume model of the Containment to represent sprayed and unsprayed regions of the Containment. This model is discussed in the RADTRAD documentation (Reference 15.6

-31). The Containment leak rate to the atmosphere used in the analysis is the design basis leak rat e indicated in the Technical Specifications. For the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the accident, the leak rate is assumed to be 0.30 percent per day, while for the remainder of the 30

-day period the leak rate is assumed to be 0.15 percent per day. This Containment leakage is assumed to leak directly to the environment.

The total free volume and sprayed volume of the Containment have been calculated and are addressed in Section 6.7. Part of this volume is covered by the Containment spray, while some is not.

The major portion of the unsprayed volume is within the secondary shield wall below the operating floor. Activity released to the containment is apportioned to the sprayed and unsprayed regions according to volume, 0.8 to the sprayed region and 0.2 to the unsprayed region based on the relative volumes.

The transfer rate between the sprayed and unsprayed regions is assumed to be limited to the force convection induced by the Reactor Containment Fan Cooler (RCFC) units. The number of units assumed in operation and the total mixing flow are presented in Table 15.6

-13. This assumed minimum flow rate conservatively neglects the effects of natural convection, steam condensation, and diffusion, although these effects are expected to enhance the mixing rate between the sprayed and unsprayed volumes. The majority of the RCFC air supply, except a small portion discharged to the STPEGS UFSAR 15.6-17 Revision 1 8 dome, is discharged to the space within the secondary shield wall, where it is relieved to the balance of the Containment volume through the vent areas. A portion of the RCFC air supply (less than 10 percent) recirculates below the operating floor, but this small fraction is too small to materially affect the dose analysis. The conservatism of having ignored all mixing flow other than that provided by the RCFC units more than compensates for the slight reduction in RCFC mixing flow associated with this recirculation. The RCFC units are described more fully in Sections 6.2.2 and 6.2.5.

Containment spray removal coefficients are based on Standard Review Plan 6.5.2, "Containment Spray as a Fission Product Cleanup System," Revision 2, December 1998, with "particulate" removal coefficients applied to "aerosols." Spray timing is adjusted slightly to reflect AST

-caused differences in time to reach decontamination factor (DF) credit limits.

For noble gases, the only removal processes considered are radioactive decay and leakage. Elemental iodine and airborne activity in particulate form (including most of the iodine as CsI) are assumed to be removed by radioactive decay and leakage, plateout, and also by the CSS. The effectiveness of the Containment spray and of the plateout for the removal of the activity from the Containment atmosphere and the models used to determine the iodine removal efficiencies are discussed in Section 6.5.2. Only the elemental and particulate iodine forms are assumed to be effectively removed by the spray. A spray removal rate of 20 hr

-1 is assumed until the airborne elemental iodine is reduced by a factor of 60. After this time, the elemental spray removal rate is assumed to be zero. The deposition removal rate for elemental iodine is assumed to be 4.5 hr

-1 which is also assumed to be zero once the DF of 60 is reached For particulates, a spray removal rate of 6.9 hr

-1 is assumed until a DF of 50 is reached and it is then reduced to 10% of this value .

Containment leakage through electrical penetrations into the electrical penetration area is very limited (0.025 cfm out of 7.02 cfm containment leakage). It is held up in the electrical penetration area as a source of gamma shine dose to the Control Room. A discussion of releases into the electrical penetration area as a source for a "sneak path" of airborne contaminants into the Control Room is provided in Section 15.D.2.

2. 15.6.5.3.1.2.1 Containment Sump pH and Iodine Re

-evolution

- An evaluation of containment sump pH was conducted to ensure that the particulate iodine deposited into the containment water during the DBA LOCA does not re

-evolve beyond the amount recognized in the DBA LOCA analysis. The objective of the analysis was to determine the transient containment sump pH so that the removal of elemental and particulate iodine (cesium iodide

- CsI) from the containment atmosphere in the course of the DBA LOCA would not be overstated. The analysis credits the pH buffering effect of trisodium phosphate (TSP) stored in the containment sump.

15.6.5.3.1.2.2 Determination of Sump pH

- The calculation methodology for containment sump pH control is based on the approach outlined in NUREG

-1465 and NUREG/CR

-5950 (References 15.6

-32 and 15.6

-33). Specifically, credit is taken for TSP dissolution in the containment water as a result of released reactor coolant and injected spray water coming in contact with the stored TSP in the lower elevation of containment.

In calculating the sump pH, the three major contributors to strong acid production are considered: boric acid from the reactor coolant system, the accumulators, and the refueling water storage tank STPEGS UFSAR 15.6-18 Revision 1 8 (RWST); nitric acid from radiolysis of water; and, hydrochloric acid from radiolysis of chloride

-bearing cable jacket/insulation. Production of organic acid from coatings was also evaluated and found to be negligible.

The amount of cable insulation in containment was determined by performing a survey of design documents and determining the total volume of cable insulation and jacket materials. The design inputs were conservatively established to maximize the post

-LOCA production of acids and to minimize the post

-LOCA production and/or addition of bases.

The initial effects on post

-accident containment sump pH is from rapid fission product transport and the formation of cesium compounds, which results in increasing the containment sump pH. The buffering effect of TSP within a few hours is sufficient to offset the effects of these acids that are transported to the sump and maintain containment sump pH at or above 7.0 for the first day.

The impact of HCl formation from cable radiolysis is about four times greater than the impact of nitric acid formation from water radiolysis. As radiolytic production of nitric acid and hydrochloric acid proceeds and these acids are transported to the pool over the first days of the event, the pH becomes more acidic. After the first day, the containment sump pH will begin to decrease, reaching 6.8 by the end of the 30

-day duration of the radiological consequence analysis for the DBA LOCA, and the impact of that decrease has been reflected in the Control Room and offsite doses. The pH values as a function of time presented in Table 15.6

-15.

Although the results of this analysis indicate that the sump pH drops slightly below 7.0, in reality there should be little impact on the actual iodine re

-evolution due to the conservatisms in the analysis

Conservative estimates on cable dimensions and materials were made to increase the cable insulation mass and its effect on sump pH; Cesium compounds are not credited in the long

-term pH analyses and the determination of the final (i.e., 30 day) pH value; No credit is taken for basic alkali metal compounds that result from fission products co

-released with the iodine; Conservative assumptions were made to retain 10% of non

-noble gas activity as airborne activity for the full 30 days, even in the presence of sprays, and all of the noble gas activity is assumed to remain airborne (increasing the amount of radiation exposure to cables); and Conservative assumptions were made concerning the vulnerability of cables to beta radiation.

Additional conservatisms are incorporated into the determination of iodine re

-evolution.

STPEGS UFSAR 15.6-19 Revision 1 8 Iodine Re-evolution The STP DBA LOCA analysis assumes iodine removal from the containment atmosphere by both containment sprays and natural diffusion to walls. This will lead to a large fraction of activity being deposited in the containment sump. The sump water will also retain soluble gaseous and soluble fission products such as iodides and cesium, but not noble gases. Once deposited, the iodine will remain in solution as long as the containment sump pH is maintained at or above 7.0. An analysis of the associated iodine DF for containment iodine removal and retention was also performed.

When evaluating the impact of pH being below 7 in the long term (i.e., the elemental iodine DF for spray and natural removal), the maximum sump temperature is used in conjunction with the lowest pH, even though the first condition occurs in the first minutes of the accident and the latter condition occurs at the very end of the 30

-day dose assessment period. This is a very conservative treatment of the impact of sump pH on iodine DF.

A DF of 60, corresponding to a pH of 6.8 was determined to be appropriate and is used in the dose analysis, even though the calculated value of pH at 30 days is just below 6.85. At a pH of 7.0, the DF approaches 150. The calculation is very conservative in that (1) the highest sump temperature is used and (2) the lowest pH is assumed throughout the duration of the accident. The DF of 60 will be exceeded at all times since early in the accident the sump pH is greater than 6.8 and later the sump temperature is much less than the maximum value.

15.6.5.3.1.3 Containment Leakage Doses

- Doses resulting from activity leakage from the Containment have been calculated using the models presented in Appendix 15.D. The doses are presented in Table 15.6

-17 for the EZB distance of 1,430 meters and the outer boundary of the LPZ at 4,800 meters.

15.6.5.3.1.4 Control Room Model Parameters and Assumptions

- A failed train of control room HVAC is assumed, consistent with an electrical division failure which minimizes the number of RCFC units available to cool and mix the containment atmosphere. The Control Room model parameters are presented in Section 15.D.2.2. No credit is taken for filtration of the pressurization (make-up) flow into the Control Room.

Included in the dose analysis for the Control Room is the shine contribution from the RCB, the external cloud, the HVAC filters and the cloud in the electrical penetration room on the same elevation as the main control room.

15.6.5.3.1.4.1 TSC Model Parameters and Assumptions

- The TSC model parameters are presented in Section 15.D.2.3. No credit is taken for filtration of the pressurization (make

-up) flow into the TSC.

Included in the dose analysis for the TSC is the shine contribution from the RCB, the external cloud, and HVAC filters.

15.6.5.3.2 ESF Leakage Contribution:

A potential source of fission product leakage following a LOCA is the leakage from Engineered Safety Features (ESF) components which are located in the Fuel Handling Building (FHB). This leakage may be postulated to occur during the STPEGS UFSAR 15.6-20 Revision 1 8 recirculation phase for long

-term core cooling and Containment cooling by sprays. The water contained in the Containment sumps is used after the injection phase and is recirculated by the ECCS pumps and the Containment spray pumps.

15.6.5.3.2.1 Fission Product Source Term

- Since most of the radioiodine released during the LOCA would be retained by the Containment sump water, due to operation of the CSS and the ECCS, it is assumed that 40 percent of the core iodine inventory is introduced to the sump water to be recirculated through the external piping systems, consistent with Table 2 of Regulatory Guide 1.183.

Because noble gases are assumed to be available for leakage from the Containment atmosphere and are not readily entrained in water, the noble gasses are not assumed to be part of the source term of this contribution to the total LOCA dose.

15.6.5.3.2.2 Leakage Assumptions

- The amount of water in the Containment sumps at the start of recirculation is the total of the RCS water and the water added due to operation of the engineered safeguards, i.e., the ECCS and CSS. This amount has been calculated to be 460,000 gallons. This value is conservatively low to maximize iodine concentration in the sump water.

ESF leakage into the FHB The ECCS recirculation piping and components external to the Containment are designed in accordance with applicable codes and are described in Section 6.3. The CSS is described in Sections 6.2.2 and 6.5.2.

The maximum potential recirculation loop leakage is tabulated in Table 15.6

-16. Each recirculation subsystem includes a high

-head safety injection (HHSI) pump, a low

-head safety injection (LHSI) pump, a residual heat exchanger, the Containment sump, and associated piping and valves. Thus three separate subsystems are provided for recirculation, as well as for injection, each of which is adequate for long

-term cooling.

Since three redundant subsystems are available during recirculation, leakage for any component in any subsystem can be terminated by shutting down the LHSI and HHSI pump associated with that subsystem and by closing the appropriate pump suction and discharge isolation valves.

The ESF component leakage values presented in Table 15.6

-16 represent expected leakages from ESF equipment and are used to arrive at a total leakage from all three trains of ESF equipment. The radiological dose model (see Section 15.6.5.3.2.3) does not distinguish between the specific source, component, or train of the ESF leakage. The radiological dose model conservatively uses twice the total leakage developed in Table 15.6-16. The component values presented in Table 15.6

-16 are used to generate the maximum leakage value and do not represent individual component maximums.

Iodine Re-evolution from ESF Leakage The percentage of iodine in ESF system coolant leakage outside containment that becomes airborne may be assumed to be 10% as long as the pH is equal to or greater than 7.0. However, this is only true for the first day per Table 15.6

-14. From the analysis described in Section 15.6.5.3.1.2.2, at a pH of 6.8, the I 2 fraction is about 2.5 times greater than at a pH of 7.0; and at a pH of 6.9, the I 2 fraction is about 1.6 times greater than at a pH of 7.0.

STPEGS UFSAR 15.6-21 Revision 1 8 Therefore, to account for the impact of a pH less than 7 on iodine re

-evolution from ESF leakage, the 10% re-evolution fraction (for a pH > 7, Regulatory Guide 1.183) is increased by the ratio of elemental iodine abundance at pH = f(t) to that at pH = 7. From t = 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to t = 20 days a factor of 1.6 (16%) (corresponding to pH = 6.9) is used, and from t = 20 days to t = 30 days a factor of 2.5 (corresponding to pH = 6.8) is used.

The iodine partition factor applicable for this leakage is assumed to be 0.1 for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, 0.16 from one day to 20 days, and 0.25 from 20 days to 30 days.

15.6.5.3.2.3 ESF Leakage Doses

- The iodine activity, once released to the atmosphere of the FHB, is assumed to be immediately collected by the FHB HVAC and released to the environment at ground level without credit for filtration. For determination of the dose contribution from ESF leakage, all radionuclides assumed to be released from the core (except noble gases) are assumed t o be instantaneously and homogeneously mixed in the containment sump. Actual leakage from the RCS sump through ESF equipment would not start until after the recirculation phase of the accident begins. However, for conservatism, and to decouple the dose analyses from the actual calculated recirculation start time, ESF leakage is assumed to begin at t=0.

The offsite doses due to the recirculation leakage are presented in 15.6-17 for the EZB of 1,430 meters for the initial two

-hour period and the LPZ outer boundary distance of 4,800 meters for the 30-day duration of the accident.

15.6.5.3.3 Containment Purge Contribution: In the event of a LOCA coincident with the Containment supplementary purge system in operation, the purge is assumed to be isolated within 23 seconds following LOCA initiation. During normal power operation, the Containment supplementary purge system vents the containment at 4,500 ft 3/min. However, for this analysis, the maximum flow rate due to the pressure spike inside the Containment was used (71,000 ft 3/min in for each purge line, intake and exhaust). The Containment purge system is described in Section 9.4. The Containment airborne iodine inventory available for release is assumed to be the total primary coolant iodine inventory based upon an activity of 1.0 Ci/g dose equivalent I

-131. No failed fuel is assumed since isolation occurs prior to the core reaching a temperature which could cause a fuel failure.

15.6.5.3.3.1 Containment Purge Doses

- The offsite doses calculated due to Containment purging are presented in Table 15.6

-17 for the EZB of 1,430 meters and LPZ outer boundary distance of 4,800 meters.

15.6.5.4 Core and System Performance

. 15.6.5.4.1 Mathematical Model: The requirements of an acceptable ECCS Evaluation Model are presented in Appendix K of 10CFR50 (Ref. 15.6

-2). Large Break LOCA Evaluation Model The analysis of a large break LOCA transient is divided into three phases: blowdown, refill, and reflood. There are three distinct transients analyzed in each phase, including the thermal

-hydraulic transient in the RCS, the pressure and temperature transient within the Containment, and the fuel and

STPEGS UFSAR 15.6-22 Revision 1 8 clad temperature transient of the hottest fuel rod in the core. Based upon these considerations, a system of inter

-related computer codes has been developed for the analysis of the LOCA.

The description of the various aspects of the LOCA analysis methodology is given in WCAP

-8339 (Ref. 15.6

-4). This document describes the major phenomena codes, which ensure compliance with the acceptance criteria.

The SATAN-VI, BASH, COCO, and LOCBART codes, which are used in the LOCA analysis, are described in detail in References 15.6

-5 through 15.6

-8 and 15.6

-27. Modifications to these codes and methods are specified in References 15.6

-9, 15.6-10, 15.6-11, 15.6-11a, 15.6-11h and 15.6

-23. These codes are used to assess the core heat transfer geometry and to determine if the core remains amenable to cooling throughout and subsequent to the blowdown, refill, and reflood phases of the LOCA. The SATAN

-VI computer code analyzes the thermal

-hydraulic transient in the RCS during blowdown. The BASH code is used to determine the system response during the refill and reflood phases of the transient. The COCO computer code is used to calculate the containment pressure transient during all three phases of the LOCA analysis. The LOCBART computer code is used to compute the thermal transient of the hottest fuel rod during the three phases.

The large-break analysis was performed with the approved version of the evaluation model, with BASH (Ref. 15.6

-8). Modifications to the evaluation model and methods for application to ZIRLO cladding are identified in Reference 15.6

-24.

SATAN-VI is used to calculate the RCS pressure, enthalpy, density, and the mass and energy flow rates in the RCS as a function of time during the blowdown phase of the LOCA. SATAN

-VI also calculates the accumulator water mass and internal pressure, and the pipe break mass and energy flow rates that are assumed to be vented to the containment during blowdown. At the end of the blowdown, information on the state of the system is transferred to the BASH code, which performs the calculation of the refill period to bottom of core (BOC) recovery time. Once the vessel has refilled to the bottom of the core, the reflood portion of the transient begins. The BASH code is used to calculate the thermal

-hydraulic simulation of the RCS for the reflood phase.

Information concerning the core boundary conditions is taken from all of the above codes and input to the LOCBART code for the purpose of calculating the core fuel rod thermal response for the entire transient. From the boundary conditions, LOCBART computes the fluid conditions and heat transfer coefficient for the full length of the fuel rod by employing mechanistic models appropriate to the actual flow and heat transfer regimes. Conservative assumptions ensure that the fuel rods modeled in the calculation represent the hottest rods in the entire core.

The containment pressure analysis is performed with the COCO code, which is interactive with the BASH code. The transient pressure computed by the COCO code is then passed to the BASH code for the purpose of supplying a backpressure at the break plane while computing the reflood transient. A schematic representation of the computer code interfaces for large

-break calculations is shown in Figure 15.6

-6. The evaluation model assumes the initial containment atmosphere pressure and temperature at nominal conditions.

STPEGS UFSAR 15.6-23 Revision 1 8 The evaluation of the effects of Thermal Conductivity Degradation (TCD) on PCT uses the LOCBART Transient Extension Method (Reference 15.6

-34). The evaluation takes credit for the beneficial effects of assembly power and peaking factor burn

-down resulting from the depletion of fissionable isotopes. Figures 15.6

-59 and 15.6

-60 show the peaking factors assumed in the TCD evaluation. These peaking factors are checked to ensure they remain bounding as part of the reload process.

Small Break LOCA Evaluation Model The NOTRUMP computer code is used in the analysis of LOCAs due to small breaks in the RCS. The NOTRUMP computer code is a state

-of-the-art, one-dimensional general network code consisting of a number of advanced features. Among these features are the calculation of therma l

nonequilibrium in all fluid volumes, flow regime

-dependent drift flux calculations with counter

-current flooding limitations, mixture level tracking logic in multiple

-stacked fluid nodes, and regime

-dependent heat transfer correlations. The NOTRUMP small break LOCA ECCS evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the Nuclear Regulatory Commission (NRC) concerns expressed in NUREG

-0611, "Generic Evaluation of Feedwater Transients and Small Break Loss

-of-Coolant Accidents in Westinghouse Designed Operating Plants."

In NOTRUMP, the RCS is nodalized into volumes interconnected by flow paths. The transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum applied throughout the system. A detailed description of NOTRUMP is given in References 15.6

-13a and 15.6

-13b. Modifications to the evaluation model for the modeling of safety injection into the broken loop and changes to the condensation model are described in reference 15.6-23. The STP SBLOCA analysis is fundamentally the same as other SBLOCA analyses performed by Westinghouse, but some variation from the typical Westinghouse SBLOCA analysis application were incorporated due to the unique features of the STP design and SBLOCA behavior. These unique modeling features include:

Use of an explicit loop (4

-loop) NOTRUMP model, Modeling of the SG PORVs in SBLOCA, and Modeling an operator action to lower SG PORV setpoints to 1000 psig within 45 minutes of accident initiation.

The STP design has a number of unique features which were considered in the application of the evaluation model. The STP ECCS system includes accumulators and independent, dedicated (unheadered) pumped ECCS in three of the four reactor coolant loops. The remaining loop (Pressurizer loop

-loop D) has no accumulator or pumped ECCS. In addition, STP features safety-grade PORVs for each of the four steam generators. The PORVs will lift, providing secondary steam relief when the pre

-set pressure is reached. The PORVs were modeled in the same manner as other atmospheric relief (i.e. MSSVs) as described in the approved version of the NOTRUMP Topical Report (Ref. 15.6

-13a). Operator action is credited to lower the SG PORV setpoints to at STPEGS UFSAR 15.6-24 Revision 1 8 least 1000 psig within 45 minutes after accident initiation (Ref. 15.6

-28). The purpose of the action is to provide a more rapid cooldown of the primary side by depressurizing the secondary side during a small break LOCA using SG PORVs. The SBLOCA analysis only takes credit for the SG PORVs, since the steam dumps are not safety

-grade. The operator actions to lower secondary side pressure using either the SG PORVs or the steam dumps are achievable from the plant control room. Consistent with the intent of the Emergency Operating Procedures (EOPs), the operator action credited in the SBLOCA analysis does not initiate a mitigating safety function, but facilitates the automatic mitigation capability of the SG PORVs.

These unique design features, in conjunction with various limiting single failure (LSF) assumptions can lead to large asymmetries between reactor coolant loops. To adequately and accurately model the effects of these asymmetries, it is necessary to use an explicit loop (4

-loop) version of the NOTRUMP model.

Use of an explicit loop model allowed appropriate modeling capability to capture the potential loop

-

to-loop asymmetries in ECCS, AFW delivery, and SG PORVs (depending on the LSF assumed and the assumed location of the faulted loop). With the exception of the additional noding required to model the four explicit loops, all the typical features of the NOTRUMP model were employed in the STP analysis, including:

Loop seal restriction, SI in the Broken Loop (except for LSF scenarios in which no SI is available to the broken loop), COSI condensation model, and Those models and assumptions as set forth in the approved version of the NOTRUMP topical report (Ref. 15.6

-13a). The safety

-grade (Class 1E) SG PORVs were modeled in the same manner as other atmospheric relief valves (i.e., MSSVs) as described in the approved version of the NOTRUMP topical report (Ref. 15.6

-13a). To ensure conservatism in the modeling, uncertainties were calculated for the STP-specific instrumentation and these uncertainties were added to the opening pressure based on the current setpoint modeled in the calculations. Opening of the SG PORVs is assumed to be automatic and no operator action is required to actuate this system. Operator action is modeled to lower the steam generator PORV setpoints to less than 1000 psig within 45 minutes of accident initiation.

The potential failure of one or more SG PORVs to open due to failure of a diesel has been included in the LSF studies. A failure of the SG PORV to close was concluded not to represent a degradation to the mitigation capability for SBLOCA.

The use of NOTRUMP in the analysis involves, among other things, the representation of the reactor core as heated control volumes with an associated bubble rise model to permit a transient mixture height calculation. The multinode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a loss-of-coolant transient.

STPEGS UFSAR 15.6-25 Revision 1 8 Clad thermal analyses are performed with the LOCTA IV (Ref. 15.6

-25) code which uses as input the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height history from the NOTRUMP hydraulic calculations.

Schematic representation of the computer code interfaces for small break calculations is given on Figure 15.6

-7. 15.6.5.4.2 Input Parameters and Initial Conditions

Tables 15.6

-18 and 15.6

-19 list important input parameters and initial conditions used in the analysis.

The large break LOCA analysis was performed assuming a T hot upper head and Model E steam generators. This configuration is bounding relative to the current plant configuration with a Tcold upper head and Delta

-94 steam generators. The small break LOCA analysis was performed with the current plant configuration, including a Tcold upper head and Delta

-94 steam generators.

The analyses support a range of operating temperatures (582.3 F T AVG 593.0F) and a range of main feedwater temperatures (390 F TMFW 440F). The large break LOCA analysis also supports operation with a 3% RCS flow reduction.

The effect of two 18

-inch containment supplementary purge valves, conservatively assumed to be open at the initiation of the large break LOCA transient and to remain open for their 25 second closure time (including a 2 second signal delay), was accounted for in the large break LOCA analysis. SBLOCA assumes a conservative constant containment backpressure throughout the transient, so the effects of the supplementary purge valves were not modeled for the small break LOCA calculation.

The large break LOCA is analyzed for both minimum and maximum safeguards. As explained in Reference 15.6

-16a, maximum safeguards (no active single failure) may be limiting if minimum safeguards are insufficient to condense all the steam in the intact loops. Minimum safeguards (loss of offsite power, one SI train spilling to containment, and failure of one diesel causing a loss of one safety injection train), however, is limiting. The large break LOCA analysis has included an additional 2 percent steam generator tube plugging to account for the effect of the concurrent seismic/LOCA event.

Under some conditions, there is the possibility that top skewed power shapes could provide more limiting large break LOCA results. This scenario is explicitly addressed in the large break LOCA analysis. Reference 15.6

-35 concluded that the LOCA ZIRLO models are acceptable for application to Optimized ZIRLOTM cladding in Large Break and Small Break LOCA analyses, and that no additional calculations are necessary for evaluating the use of Optimized ZIRLOŽ cladding provided STPEGS UFSAR 15.6-26 Revision 1 8 plant specific ZIRLO calculations were previously performed. An exception to this is identified in the Safety Evaluation Report (SER) of Reference 15.6

-34 for plants licensed with the Westinghouse Appendix K code LOCBART; however, an evaluation performed for the implementation of Optimized ZIRLOŽ cladding concluded that the ZIRLO models are acceptable for application to Optimized ZIRLOŽ cladding for Units 1 and 2.

The bases used to select the numerical values that are input parameters to the analysis have been conservatively determined from extensive sensitivity studies (Refs. 15.6

-16 through 15.6

-19). In addition, the requirements of Appendix K regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions pertain to the conditions of the reactor and associated safety system equipment at the time the postulated LOCA occurs, and include such items as the core peaking factors, containment pressure, and performance of the ECCS system. Decay heat generated throughout the transient is also conservatively calculated.

15.6.5.4.3 Results: Large Break Results Based upon the results of the LOCA sensitivity studies (Refs. 15.6

-16, 15.6-18, and 15.6

-19), the limiting large break was found to be double

-ended cold leg guillotine (DECLG). Therefore, only the DECLG break is considered in the large break ECCS performance analysis. Calculations were performed for a range of Moody break discharge coefficients.

The large break LOCA analysis was performed to bound operation with a 3 percent RCS flow reduction and all combinations of Model E steam generators with T HOT upper head temperature or Delta 94 steam generators with TCOLD upper head temperature, Integral Fuel Burnable Absorber (IFBA) or non

-IFBA fuel, standard (STD), V5H, V5H

+ and (RFA) with Zirc

-4 cladding or RFA fuel with ZIRLO cladding. The modeling of V5H

+ and RFA with ZIRLO clad fuel was performed in accordance with the methods described in Reference 15.6

-24. Note, ZIRLO models were evaluated and deemed acceptable for application to Optimized ZIRLOŽ cladding.

The initial backfill pressure for IFBA fuel can affect the rod internal pressure at which the most limiting large break LOCA results will be calculated. An evaluation has confirmed that the most limiting IFBA case across the range of pressure uncertainties applicable to the low backfill pressure IFBA fuel rods was considered. The minimum rod internal pressure IFBA fuel with ZIRLO cladding was shown to be limiting over non

-IFBA fuel with ZIRLO cladding. Also, non

-IFBA and IFBA fuel with Zirc-4 cladding was shown to be no n-limiting. Under certain conditions, the potential exists that top

-skewed power shapes could be more limiting than the chopped cosine power shape for the large break LOCA analysis. Consistent with the large break LOCA Evaluation Model methodology (Reference 15.6-11b), explicit analysis of the top

-skewed power shapes was performed and demonstrated that the chopped cosine power shape was limiting. The results of the large break LOCA analysis calculations are summarized in Tables 15.6

-20 and 15.6-21. Six cases are presented in these tables. The first three cases represent the break spectrum sensitivity study which demonstrates that the C D = 0.8 discharge coefficient is limiting. These cases are based on Min SI assumptions, High T AVG, cosine power shape, and model non

-IFBA fuel with STPEGS UFSAR 15.6-27 Revision 1 8 ZIRLO cladding at F T = 2.55. The fourth case represents the limiting case and is based on C D = 0.8, Min SI, High T AVG, cosine power shape, and IFBA fuel with ZIRLO cladding. The fifth case represents a non

-limiting case which modeled C D = 0.8, Min SI, Low T AVG, cosine power shape, and IFBA fuel with ZIRLO cladding. The sixth case represents another non

-limiting case which modeled C D = 0.8, Max SI, High T AVG, cosine power shape, and IFBA fuel with ZIRLO cladding.

The minimum containment pressure analysis used in the ECCS evaluation and the large break mass and energy release data for the break resulting in the highest calculated peak clad temperature is presented in Section 6.2.1.5.

Figures 15.6

-8 through 15.6

-40 present the Nuclear Steam Supply System (NSSS) parameters of principal interest for the large break ECCS analyses. For all cases analyzed, the transient values of the following parameters are presented:

1. Peak clad temperature
2. Reactor core pressure
3. Reflood transient core and downcomer levels
4. Core inlet fluid velocity
5. Thermal power during blowdown
6. Containment pressure For the limiting case, C D = 0.8, Min SI, High T AVG, cosine power shape with IFBA fuel and ZIRLO cladding, the following additional transient parameters are presented:
1. Core flow during blowdown (inlet and outlet)
2. Core heat transfer coefficients
3. Hot spot fluid temperature
4. Mass released to containment during blowdown
5. Energy released to containment during blowdown
6. Fluid quality at the hot spot
7. Mass velocity during blowdown
8. Accumulator water flow rate during blowdown
9. Pumped safety injection water flow rate during reflood

The maximum clad temperatures calculated for the large break cases are shown in Table 15.6-21. The maximum temperature meets the acceptance criteria limit of 2200 oF of 10CFR50.46. The STPEGS UFSAR 15.6-28 Revision 1 8 maximum local metal water reaction is below the embrittlement limit of 17 percent as required by 10CFR50.46. The total core metal

-water reaction is less than 1 percent for all breaks, as compared with the 1 percent criterion of 10CFR50.46, and the clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. As a result, the core temperature will continue to drop and the ability to remove decay heat generated in the fuel for an extended period of time will be provided.

Analysis results for conditions with reduced loop operating temperatures confirmed that the predicted peak clad temperature was lower for lower loop temperatures.

Small Break Results Due to the asymmetries presented by the unique design features of the STP design, multiple combinations of limiting single failures were considered. These included common mode failures (emergency diesel generator failure) that could lead to various failures of pumped ECCS, AFW, and PORVs. Sensitivity studies of these multiple scenarios were performed to establish the limiting scenario in terms of small break LOCA results. The limiting single failure is a malfunction of the actuation signal to the emergency bus for loops A and D, which causes a failure of diesel generator A, leading to a loss of pumped ECCS, motor

-driven AFW, and PORV in loop A, and loss of the turbine-driven AFW and PORV in loop D, with the break in loop B. This scenario also assumes that one SI train spills to containment. The results of this limiting scenario are presented here.

The basis for the loop seal restriction in the NOTRUMP evaluation model (References15.6

-13a and 15.6-24) is eliminated with the explicit loop modeling (i.e., no lumped intact loops). However, continued application of the loop seal restriction to the intact loops, consistent with the approved modeling, was evaluated and judged to be appropriately conservative for the limiting cases described here. Based upon the results of the LOCA sensitivity studies (Ref. 15.6

-18), the limiting small break was found to be less than a 10

-inch-diameter rupture of the RCS cold leg. Therefore, a range of small break analyses are presented which establishes the most limiting break size. From these calculations, the 2-inch equivalent diameter break was found to be limiting. The 1.5

-inch break cases were shown to result in no core uncovery. The high end of the loop operating temperature range and the high end of the MFW operating range were anticipated to provide the most limiting small break LOCA results, and were therefore chosen as the base case assumptions for the break spectrum calculations.

Subsequent studies for the combinations of other operating conditions in these ranges show that the high end of the loop operating temperature range combined with the high end of the MFW operating range provided the limiting results. The results of the 2

- and 3-inch cases are summarized in Tables 15.6-2 2, 15.6-23, 15.6-24 and 15.6

-25. Figures 15.6

-41 through 15.6

-58 present the principal parameters of interest for the small break ECCS analyses. For all cases presented in the UFSAR the following transient parameters are presented:

1. RCS pressure
2. Core mixture height

STPEGS UFSAR 15.6-29 Revision 1 8 3. Peak clad temperature

4. Core power after reactor trip (common to all transients)

For the limiting 2

-inch, high loop temperature, high MFW temperature case, the following additional transient parameters are presented:

1. Core steam flow rate
2. Rod film transfer coefficient
3. Hot spot fluid temperature The effects of ZIRLO cladding, instrument tubes, thimble, and grids are small (~5F), and are included in the results presented in Table 15.6

-24. The maximum calculated peak clad temperature for all small breaks analyzed are shown in Table 15.6-24. These results are within all acceptance criteria limits of 10CFR50.46. Analysis results for conditions with reduced loop operating temperatures confirmed that the predicted peak clad temperature was lower for lower loop temperatures.

STPEGS UFSAR 15.6-30 Revision 1 8 REFERENCES Section 15.6

15.6-1 Burnett, T. W. T., et al., "LOFTRAN Code Description", WCAP

-7907-P-A (Proprietary), WCAP

-7907-A (Nonproprietary), April 1984.

15.6-2 "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors", 10CFR50.46 and Appendix K of 10CFR50.

15.6-3 "Reactor Safety Study

- An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants", WASH

-1400, NUREG

-75/014, October 1975.

15.6-4 Bordelon, F. M., Massie, H. W., and Borden, T. A. "Westinghouse ECCS Evaluation Model-Summary", WCAP

-8339 (Nonproprietary), July 1974.

15.6-5 Bordelon, F. M., et al., "SATAN

-VI Program: Comprehensive Space Time Dependent Analysis of Loss of Coolant", WCAP

-8302, June 1974 (Proprietary) and WCAP-8306, June 1974 (Nonproprietary).

15.6-6 Kelly, R. D., et al., "Calculated Model for Core Reflooding After a Loss of Coolant Accident (WREFLOOD Code)", WCAP

-8170, June 1974 (Proprietary) and WCAP-8171, June 1974 (Nonproprietary).

15.6-7 Bordelon, F. M. and Murphy, E. T., "Containment Pressure Analysis Code (COCO)", WCAP-8327, June 1974 (Proprietary) and WCAP

-8326, June 1974 (Nonproprietary).

15.6-8 Young, M. Y. et. al., "The 1981 Version of the Westinghouse ECCS Evaluation Model Using the BASH Code," WCAP

-10266-P-A Rev. 2, (Proprietary), 1981.

15.6-9 Bordelon, F. M., et al., "Westinghouse ECCS Evaluation Model

- Supplementary Information", WCAP

-8471-P-A, April 1975 (Proprietary) and WCAP

-8472-A, April 1975 (Nonproprietary).

15.6-10 "Westinghouse ECCS Evaluation Model, 1981 Version", WCAP

-9220-P-A, Rev. 1 (Proprietary), WCAP

-9221-A, Rev. 1 (Nonproprietary), February 1982.

15.6-11 Letter from C. Eicheldinger of Westinghouse Electric Corporation to D. B. Vassallo of the Nuclear Regulatory Commission, Letter Number NS

-CE-924 dated January 23, 1976.

15.6-11a Letter from N. Liparulo of Westinghouse Electric Corporation to W.T. Russel of the Nuclear Regulatory Commission, Letter Number NTD

-NRC-95-4540 dated August 29, 1995.

STPEGS UFSAR 15.6-31 Revision 1 8 REFERENCES (Continued) 15.6-11b Letter from N. Liparulo of Westinghouse Electric Corporation to the Nuclear Regulatory Commission, Letter Number NTD

-NRC-95-4518 dated August 7, 1995.

15.6-11h Letter, E. P. Rahe (Westinghouse) to James R. Miller (USNRC), NS-EPRS-2679, November 9, 1982.

15.6-13a Lee, H., Rupprecht, S. D., Tauche, W. D., Schwarz, W. R., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code", WCAP

-10054-P-A, August 1985.

15.6-13b Meyer, P. E., "NOTRUMP, A Nodal Transient Small Break and General Network Code", WCAP

-10079-P-A, August 1985.

15.6-13c Frantz, E. R., Huang, P. H., Ofstun, R. P., "Comparison of the TREAT and NOTRUMP Small Break LOCA Transient Results", WCAP

-11232, September 1986.

15.6-14 Skwarek, R., Johnson, S., Meyer, P., "Westinghouse Emergency Core Cooling System Small Break October 1975 Model", WCAP

-8970, April 1977 (Proprietary).

15.6-16 Beck, H. S., Kemper, R. M., "Westinghouse ECCS

- Four Loop Plant Sensitivity Studies with Upper Head Fluid Temperature at T HOT", WCAP-8865, October 1976.

15.6-16a Letter, E. P. Rahe (Westinghouse) to R. L. Tedesco (USNRC), Letter Number

NS-EPR-2538, December 22, 1981.

15.6-17 "Westinghouse ECCS Evaluation Model Sensitivity Studies", WCAP

-8341, July 1974 (Proprietary), WCAP

-8342, July 1974 (Nonproprietary).

15.6-18 Salvatori, R., "Westinghouse ECCS

- Plant Sensitivity Studies", WCAP

-8340, July 1974 (Proprietary) and WCAP

-8356, July 1974 (Nonproprietary).

15.6-19 Johnson, W. J., Massie, H. W., Thompson, C. M., "Westinghouse ECCS - Four Loop Plant (17 x 17) Sensitivity Studies", WCAP-8565-P (Proprietary) and WCAP

-8566 (Nonproprietary), July 1975.

15.6-20 Lewis, Huang, Behnke, Fittante, Gelman, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," WCAP

-10698-P-A (Proprietary) and WCAP-10750-A (Non-Proprietary), August 1987; and Supplement 1 to WCAP-10698-P-A and WCAP

-10750A, March 1986.

STPEGS UFSAR 15.6-32 Revision 1 8 REFERENCES (Continued) 15.6-21 Holderbaum D. F., Lewis R. N., Rubin K., "LOFTTR2 Analysis for a Steam Generator Tube Rupture for the South Texas Project Units 1 and 2,"

WCAP-12369-P (Proprietary) and WCAP

-12370 (Non

-Proprietary), September 1989 15.6-23 Besspiata, J.J., et al, "The 1981 Version of the W ECCS Evaluation Model Using the BASH Code

- Addendum 2: BASH Methodology Improvements and Reliability Enhancements," WCAP

-10266, Rev. 2, Addendum 2 (Proprietary), 1988.

15.6-24 Davidson, S. L., and Nuhfer, D. L., "Vantage+ Fuel Assembly Reference Core Report," WCAP

-12610-P-A (Proprietary), 1995.

15.6-25 Thompson, C. M., et al., "Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection in the Broken Loop and COSI Condensation Model," WCAP

-10054-P-A, Addendum 2, Revision 1, 1995.

15.6-26 Rupprecht, S. D., et. al., " W Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP

-11145-P-A (Proprietary) and WCAP-11372-A (Non-Proprietary)

15.6-27 Bordelon, F. M., "LOCTA

-IV Program: Loss

-of-Coolant Transient Analysis," WCAP-8301 (Proprietary), 1974.

15.6-28 Letter from Thomas W. Alexion (NRC) to William T. Cottle (STPNOC), Issuance of Amendments 119 (NPF

-76) and 107 (NPF

-80), December 14, 1999, ST-AE-NOC-000566. 15.6-29 Huegel, D.S., et al., "RETRAN

-Pressurized Water Reactor Non

-LOCA Safety Analyses," WCAP

-14882-P-A (Proprietary) April 1999.

15.6-30 NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," USNRC, July 2000.

15.6-31 Humphreys, S.L., et. al., RADTRAD, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," NUREG/CR

-6604 Including Supplements 1 and 2 (RADTRAD version 3.03, USNRC, October 2002).

15.6-32 NUREG-1465, "Accident Source Terms for Light

-Water Nuclear Power Plants," USNRC.

15.6-33 NUREG/CR-5950, "Iodine Evolution and pH Control," USNRC, December 1992.

STPEGS UFSAR 15.6-33 Revision 1 8 REFERENCES (Continued)

15.6-34 Schoff, R.R, "Incorporation of the LOCBART Transient Extension Method into the 1981 Westinghouse Large Break LOCA Evaluation Model with BASH (BASH-EM),"WCAP-10266-P-A, Revision 2, Addendum 3-A, Revision 1, October 2007

15.6-35 WCAP-12610-P-A & CENPD-404-P-A, Addendum 1-A, "Optimized ZIRLOŽ," July 2006.

STPEGS UFSAR 15.6-34 Revision 1 8 TABLE 15.6

-1 DECREASE IN REACTOR COOLANT INVENTORY Accident Event Time (sec)

Inadvertent opening of a pressurizer safety valve Safety valve opens fully

0.0 Overtemperature

T reactor trip setpoint reached 20.8 Rods begin to drop 22.3 Minimum DNBR occurs 22.9 STPEGS UFSAR 15.6-35 Revision 1 8 TABLE 15.6-2 PARAMETERS USED IN SAMPLE LINE FAILURE RADIOLOGICAL ANALYSIS Core thermal power for radiological source term, MWt 4,100 Fuel defects prior to accident 1.0% GWPS operating prior to accident No Time assumed for operator to close isolation valves, min 30 Mass of primary coolant release, lbm* 1.6 x 10 4 Primary coolant concentrations pre-existing iodine spike current iodine spike Table 15.A

-4 Table 15.A

-6 Meteorology Table 15.B

-1, 5 percentile Dose model Appendix 15.B Flashing fraction 0.57 Dose conversion factors ICRP 30, Table 15.B-3

  • Evaluated for line of maximum release, the pressurizer sample line.

STPEGS UFSAR 15.6-36 Revision 1 8 TABLE 15.6

-3 PARAMETERS USED IN CVCS LETDOWN LINE FAILURE RADIOLOGICAL ANALYSIS Core thermal level, MWt 4,100 Fuel defects prior to accident 1.0% GWPS operating prior to accident No Time assumed for operator to close isolation valves, min 30 Mass of primary coolant released, lbm 7.43 x 10 4 Primary coolant concentrations pre-existing iodine spike concurrent iodine spike Table 15.A

-4 Table 15.A

-6 Meteorology Table 15.B

-1, 5 percentile Dose model Appendix 15.B Flashing Fraction 0 - 3.5 sec 3.5 - 11.8 sec 11.8 - 1,800 sec 0.18 0.18 0.20 Dose conversion factors ICRP 30, Table 15.B

-3 STPEGS UFSAR 15.6-37 Revision 1 8 TABLE 15.6

-3A ASSUMED OPERATOR ACTIONS TIMES Design Basis Steam Generator Tube Rupture Analysis Action Time (minutes) Identify and isolate ruptured SG 10 minutes Operator closes spurious opening of ruptured SG PORV (Dose analysis only) 15 minutes after SG PORV opens Operator initiates RCS cooldown 30 minutes from break initiation Operator initiates RCS depressurization after end of cooldown 9 minutes Operator initiates SI termination after end of depressurization 2 minutes Operator starts controlling pressurizer pressure to minimize break flow after SI termination 4 minutes STPEGS UFSAR 15.6-38 Revision 1 8 TABLE 15.6

-3B MARGIN TO OVERFILL ANALYSIS Sequence of Events Event Time (sec) Steam Generator Tube Rupture Occurs 0 Reactor Trip 68 Loss of Offsite Power 68 SI Actuation 427 Ruptured SG Isolated 600 AFW Flow to Ruptured SG Isolated 720 RCS Cooldown Initiated 1800 RCS Cooldown Terminated 2306 RCS Depressurization Initiated 2846 RCS Depressurization Terminated 2902 SI Terminated 3022 Start Controlling RCS Pressure to Minimize Break Flow 3262 Break Flow Terminated 3280 STPEGS UFSAR 15.6-39 Revision 1 8 TABLE 15.6

-3C OFFSITE DOSE ANALYSIS SGTR with Failure of SG PORV (Hot Full Power)

Sequence of Events Event Time (sec) Steam Generator Tube Rupture Occurs 0 Reactor Trip 66.5 Loss of Offsite Power 66.5 AFW Flow Delivered to Ruptured SG 126.5 SI Actuation 544.5 Ruptured SG Isolated 607 Ruptured SG AFW Flow Isolated 607 Ruptured SG PORV Fails Open 607 Ruptured SG PORV Block Valve Closed 1507 RCS Cooldown Initiated 1800 Two Charging Pumps Started 1800 RCS Cooldown Terminated 2611 RCS Depressurization Initiated 3151 RCS Depressurization Terminated 3306 SI Terminated 3426 Charging Flow Terminated 3486 Break Flow Terminated 5128 STPEGS UFSAR 15.6-40 Revision 1 8 TABLE 15.6

-4 DOSES FROM SMALL LINE BREAKS OUTSIDE CONTAINMENT Exclusion Zone Boundary, 1430 m Low Population Zone, 4800 m Offsite Doses

- Sample Line Failure Pre-existing Iodine Spike Thyroid dose, rems Whole-body dose, rems Skin beta dose, rems 11.5 2.76 x 10-2 1.70 x 10-2 3.37 8.08 x 10-3 4.97 x 10-3 Concurrent Iodine Spike Thyroid dose, rems Whole-body dose, rems Skin beta dose, rems 11.7 5.25 x 10-2 2.77 x 10-2 3.43 1.54 x 10-2 8.04 x 10-3 Offsite Dose

- CVCS Letdown Line Failure Pre-existing Iodine Spike Thyroid dose, rems Whole-body dose, rems Skin beta dose, rems 18.9 5.37 x 10-2 4.13 x 10-2 5.53 1.57 x 10-2 1.21 x 10-2 Concurrent Iodine Spike Thyroid dose, rems Whole-body dose, rems Skin beta dose, rems 18.7 9.24 x 10-2 5.78 x 10-2 5.48 2.70 x 10-2 1.69 x 10-2 STPEGS UFSAR 15.6-41 Revision 1 8 TABLE 15.6

-5 PARAMETERS USED IN STEAM GENERATOR TUBE RUPTURE RADIOLOGICAL ANALYSES Parameter Core Power (For Radiological Source Terms) 4100MWt Core Power Level (For Steam Releases) 3876 MWt (3853MWt + 0.6%)

RCS & Secondary Density 8.33 lbm/gallon RCS Mass 2.658E+8 gm SG Node Volume Intact 5.937E+4 gal Ruptured 1.979E+4 gal Secondary Mass 659,412 lbm Primary-to-Secondary Leakage Intact 0.65 gpm Ruptured 0.35 gpm Accident Time Line Table 15.6

-6 Operator Action Times diagnose SGTR

@10 minutes close PORV block valve on ruptured SG

@25 minutes Total Break Flow Table 15.6-6 Total Flashed Break Flow Table 15.6

-7 Total Intact SG Flow to Atmosphere Table 15.6

-8 Total Ruptured SG Flow to Atmosphere Table 15.6

-9 Release from Above (MSIV) Seat Drains Intact SGs 5.79 lbm/sec Ruptured SG 1.93 lbm/sec Steam Flow Rat e 1.574E+7 lbm/hr DF in Condenser (before LOOP) 10,000 Increase In Iodine Release Rate Into The RCS For The Accident

-Induced Spike 335 Iodine Species Released From The RCS (Elemental/Organic/Particulate) 4.85%/0.15%/95%

STPEGS UFSAR 15.6-42 Revision 1 8 TABLE 15.6

-5 (continued)

PARAMETERS USED IN STEAM GENERATOR TUBE RUPTURE RADIOLOGICAL ANALYSES Iodine Species for Flashed RCS Break Flow to the environment (elemental/organic/particulate) 4.85%/0.15%/95%

Iodine Species Released from the SG to the Environment (elemental/organic/particulate) 4.85%/0.15%/95%

Iodine Partition Factors for Releases from the Secondary Side (elemental/organic/particulate) 100/1/100 Effective Iodine Species Released from the Secondary Side to Environment, after application of the Partition Factors (elemental/organic/particulate) (see 15.C.3) 4.2%/13.1%/82.7%

Dose Conversion Factors Table 15.D

-10 Decay Constants and Decay Daughter Fractions Table 15.D

-11 Offsite breathing rates Table 15.D

-5 Table 15.D

-1 Control Room HVAC Parameters Table 15.D-7 Control Room HVAC Flow Rates Table 15.D

-6 TSC HVAC Parameters Table 15.D

-9 TSC HVAC Flow Rates Table 15.D

-8 Table 15.D

-4 STPEGS UFSAR 15.6-43 Revision 1 8 TABLE 15.6

-6 TOTAL BREAK FLOW USED IN SGTR DOSE ANALYSIS Phase Ending Time (sec) Total Flow During Period (lbm) SG Tube Rupture 0 - Reactor Trip 66.5 5517 Ruptured SG Isolated 607 35515 Ruptured SG PORV Block Valve Closed 1507 70466 RCS Flashing in Faulted SG Stops 2087 41613 Break Flow Terminated 5248 138562 Dose Model Parameter Chang es 7380 0 RHR Entry 28980 0 End of Orifice Releases 129800 0 STPEGS UFSAR 15.6-44 Revision 1 8 TABLE 15.6

-7 TOTAL FLASHED BREAK FLOW USED IN SGTR DOSE ANALYSIS Phase Ending Time (sec) Total Flow During Period (lbm) SG Tube Rupture 0 - Reactor Trip 66.5 864 Ruptured SG Isolated 6 07 2374 Ruptured SG PORV Block Valve Closed 1507 9660 RCS Flashing in Faulted SG Stops 2087 3448 Break Flow Terminated 5248 0 Dose Model Parameter Changes 7380 0 RHR Entry 28980 0 End of Orifice Releases 129800 0 STPEGS UFSAR 15.6-45 Revision 1 8 TABLE 15.6

-8 TOTAL INTACT SG FLOW TO ATMOSPHERE USED IN SGTR DOSE ANALYSIS Phase Ending Time (sec) Total Flow During Period (lbm) SG Tube Rupture 0 - Reactor Trip 66.5 336000 Ruptured SG Isolated 607 51919 Ruptured SG PORV Block Valve Closed 1507 10317 RCS Flashing in Faulted SG Stops 2087 187936 Break Flow Terminated 5248 385021 Dose Model Parameter Changes 7380 327062 RHR Entry 28980 1621851 End of Orifice Releases 129800 0 STPEGS UFSAR 15.6-46 Revision 1 8 TABLE 15.6

-9 TOTAL RUPTURED SG FLOW TO ATMOSPHERE USED IN SGTR DOSE ANALYSIS Phase Ending Time (sec) Total Flow During Period (lbm) SG Tube Rupture 0 - Reactor Trip 66.5 117600 Ruptured SG Isolated 607 14092 Ruptured SG PORV Block Valve Closed 1507 183911 RCS Flashing in Faulted SG Stops 2087 0 Break Flow Terminated 5248 0 Dose Model Parameter Changes 7380 0 RHR Entry 28980 70056 End of Orifice Releases 129800 0 STPEGS UFSAR 15.6-47 Revision 1 8 TABLE 15.6

-10 DOSES RESULTING FROM STEAM GENERATOR TUBE RUPTURE (rem TEDE)

Receptor Pre-Existing Iodine Spike Accident-Induced Iodine Spike Result Limit Result Limit EAB (worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) 2.37 25 1 1.08 2.5 2 LPZ 0.92 25 1 0.44 2.5 2 Control Room 2.15 5 1 1.00 5 1 TSC 2.09 5 0.98 5 1 10CFR50.67 2 10CFR50.67 as modified by Regulatory Guide 1.183 in Table 6 on Page 1.183

-20.

STPEGS UFSAR 15.6-48 Revision 1 8 TABLE 15.6

-11 LOCA TIME-DEPENDENT RELEASE FRACTIONS Time Period (sec)

Fraction of core inventory 1 0 - 30 No Release 30 - 1830 Gases Xe, Kr - 0.1/hr (0.05 total)

Elemental I

- 4.9E-3/hr (2.4E

-3 total) Organic I

- 1.5E-4/hr (7.5E

-5 total) Aerosols I, Br - 0.095/hr (0.0475 total)

Cs, Rb - 0.1/hr (0.05 total) 1830 - 6510 Gases Xe, Kr - 0.73/hr (0.95 total)

Elemental I

- 1.3E-2/hr (1.7E

-2 total) Organic I

- 4.0E-4/hr (5.3E

-4 total) Aerosols I, Br - 0.256/hr (0.3325 total)

Cs, Rb - 0.192/hr (0.25 total)

Te Group - 0.038/hr (0.05 total)

Ba, Sr - 0.015/hr (0.02 total)

Noble Metals

- 1.9E-3/hr (2.5E

-3 total) La Group - 1.5E-4/hr (2E-4 total) Ce Group - 3.8E-4/hr (5E-4 total) 1 From RG 1.183 Table 2 considering the chemical form described in RG 1.183, Section 3.5.

STPEGS UFSAR 15.6-49 Revision 1 8 TABLE 15.6

-12 LOCA: REACTOR CORE FISSION PRODUCT INVENTORY

@ t=0 Isotope Ci/MWt Kr83m 3.41E+03 Kr85m 7.07E+03 Kr85 2.93E+02 Kr87 1.34E+04 Kr88 1.90E+04 Xe131m 2.68E+02 Xe133m 1.66E+03 Xe133 5.37E+04 Xe135m 1.02E+04 Xe135 1.34E+04 Xe138 4.39E+04 I131 2.59E+04 I132 3.71E+04 I133 5.37E+04 I134 5.85E+04 I135 4.88E+04 Rb86 9.92E+01 Cs134 5.37E+03 Cs136 1.54E+03 Cs137 3.17E+03 Sb127 3.05E+03 Sb129 8.29E+03 Te127m 4.32E+02 Te127 3.05E+03 Te129m 1.22E+03 Te129 8.05E+03 Te131m 3.66E+03 Te132 3.82E+04 Ba139 4.98E+04 Ba140 4.63E+04 Mo99 4.83E+04 Tc99m 4.07E+04 Ru103 3.90E+04 Ru105 2.68E+04 STPEGS UFSAR 15.6-50 Revision 1 8 TABLE 15.6

-12 (continued)

LOCA: REACTOR CORE FISSION PRODUCT INVENTORY

@ t=0 Isotope Ci/MWt Ru106 1.34E+04 Rh105 3.05E+04 Y90 3.56E+03 Y91 3.41E+04 Y92 3.41E+04 Y93 3.90E+04 Zr95 4.39E+04 Zr97 4.39E+04 Nb95 4.32E+04 La140 4.63E+04 La141 4.62E+04 La142 4.15E+04 Pr143 3.90E+04 Nd147 1.73E+04 Am241 2.75E+00 Cm242 1.05E+03 Cm244 6.17E+01 Ce1 41 4.39E+04 Ce143 4.15E+04 Ce144 3.41E+04 Np239 5.12E+05 Pu238 8.71E+01 Pu239 1.96E+01 Pu240 2.48E+01 Pu241 4.17E+03 Sr89 2.68E+04 Sr90 2.37E+03 Sr91 3.17E+04 Sr92 3.41E+04 STPEGS UFSAR 15.6-51 Revision 1 8 TABLE 15.6

-13 PARAMETERS USED IN ANALYSIS OF LOSS-OF-COOLANT ACCIDENT OFFSITE DOSES Parameter Core power level (for radiological source terms) 4100 MWt Core power level (for RCS steam releases for supplemental purge) 3876 MWt (3853 MWt + 0.6%)

Core inventory per MWt Table 15.6

-12 Activity in coolant blowdown (1% failed fuel)

Table 15.C

-2 Coolant blowdown mass 9.3E5 lbm Activity release from overheated fuel Table 15.C

-1 Volume of containment sprayed region 2.7E6 ft 3 Volume of containment unsprayed region 6.8E5 ft 3 Volume of water in containment sump 61,486 ft 3 Volume of electrical penetration area 101,477 ft 3 Volumetric flowrate due to open purge valves 142,000 cfm Duration of flow through open purge valves 23 seconds Volumetric flowrate between sprayed and unsprayed regions of containment 152,475 cfm (3 of 6 coolers) Volumetric leakrate from containment 0.3%/day, first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 0.15%/day, 24

-720 hours ESF leakrate 4140 cc/hr (analyzed at 8280 cc/hr)

Fraction of radioiodine released from ESF leakage 10% (0-24 hours) 16% (24-480 hours) 25% (480 hours0.00556 days <br />0.133 hours <br />7.936508e-4 weeks <br />1.8264e-4 months <br />

-720 hours) Fraction of core iodine inventory released to RCB Table 15.6

-11 STPEGS UFSAR 15.6-52 Revision 1 8 TABLE 15.6

-13 (continued)

PARAMETERS USED IN ANALYSIS OF LOSS-OF-COOLANT ACCIDENT OFFSITE DOSES Fraction of Iodines released into the RCB which is available for release See Table 15.6-10 Iodine Species for the Iodines Released to RCB (elemental/organic/particulate) 4.85%/0.15%/95%

Iodine Species in ESF Leakage (elemental/organic/particulate) 97% / 3% / 0%

Containment electrical penetration leakrate 100 sccm per penetration Number of containment electrical penetrations 18 Ventilation exhaust rate for electrical penetration area 833 cfm Containment Spray start time 2.34 minutes Maximum post

-LOCA containment pressure 41.2 psig Maximum post

-LOCA containment temperature 330 F Assumed FHB exhaust rate (for ESF leakage)

Infinite Assumed FHB filter efficiency (for ESF leakage) 0% Dose Conversion Factors Table 15.D

-10 Decay Constants and Decay Daughter Fractions Table 15.D

-11 Offsite breathing rates Table 15.D

-5 Table 15.D

-1 Control Room HVAC Parameters Table 15.D

-7 Control Room HVAC Flow Rates Table 15.D

-6 TSC HVAC Parameters Table 15.D

-9 TSC HVAC Flow Rates Table 15.D

-8 Table 15.D

-4 STPEGS UFSAR 15.6-53 Revision 1 8 TABLE 15.6

-14 SPRAY REMOVAL PARAMETERS Event Time (hr) Elemental 1 Particulate/Aerosol Sprayed Region Unsprayed Region Sprayed Region Unsprayed Region Break 0.0000 4.5 4.5 0.0 0.0 CSS Start 0.039 24.5 4.5 6.9 0.0 Elemental DF of 60 Reached 1.855 0.0 0.0 6.9 0.0 Particulate DF of 50 Reached 2.185 0.0 0.0 0.7 0.0 30 days 720. 0.0 0.0 0.0 0.0 1 Includes removal by deposition

STPEGS UFSAR 15.6-54 Revision 1 8 TABLE 15.6

-15 SUMP CONCENTRATIONS AND pH AS A FUNCTION OF TIME End of Time Interval

[HNO 3] [HCl] [H+] pH 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> 8.19E-06 2.70E-05 3.52E-05 7.0 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 1.13E-05 4.42E-05 5.55E-05 7.0 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> 1.77E-05 8.00E-05 9.77E-05 7.0 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> 2.82E-05 1.29E-04 1.58E-04 7.0 1 day 4.21E-05 1.84E-04 2.27E-04 7.0 3 days 8.13E-05 3.34E-04 4.16E-04 6.9 10 days 1.53E-04 6.10E-04 7.64E-04 6.9 20 days 1.99E-04 7.48E-04 9.47E-04 6.9 30 days 2.2 9E-04 8.12E-04 1.04E-03 6.8 STPEGS UFSAR 15.6-55 Revision 1 8 TABLE 15.6

-16 MAXIMUM POTENTIAL RECIRCULATION LOOP LEAKAGE EXTERNAL TO CONTAINMENT Component Leakage (cm 3/hr) Containment spray system pum ps 30 Low-head safety injection pumps 30 High-head safety injection pumps 60 Valves 4,0 2 0 Total 4,140

Note: The ESF component leakage values presented above represent expected leakages from ESF equipment and are used to arrive at a total leakage from all three trains of ESF equipment. The radiological dose model (see Section 15.6.5.3.2.3) does not distinguish between the specific source, component, or train of the ESF leakage. The radiological dose model conservatively uses twice the total leakage developed above. The component values presented above are used to generate the maximum leakage value and do not represent individual component maximums.

CN-3135 STPEGS UFSAR 15.6-56 Revision 1 8 TABLE 15.6

-17 DOSE RESULTING FROM LARGE BREAK LOSS OF COOLANT ACCIDENT (rem TEDE)

EAB 1 LPZ Control Room/TSC 2 Dose Component Result Limit Result Limit Control Room TSC Limit Containment Leakage 5.55 2.60 1.9 9 1.83 Elec. Penetration Room 0.01 0.01 0.02 0.02 ESF Leakage 0.10 0.27 1.57 1.47 Purge Leakage 0.02 0.01 0.02 0.02 Shine components N/A N/A 0.14 1.06 TOTAL 5.68 25 2.89 25 3.74 4.40 5 1 Most limiting 2

-hour dose 2 30 day dose CN-3152 STPEGS UFSAR 15.6-57 Revision 1 8 TABLE 15.6

-18 INPUT PARAMETERS USED IN SMALL BREAK LOCA ANALYSES Core Power(1), MWt 3,853 Peak Linear Power (includes 100.6% factor), kW/ft 14.318 Total Peaking Factor 2.70 Axial Peaking Factor 1.62 (1.55 for once burned standard fuel)

Power Shape See Figure 15.6

-58 Fuel Assembly Array 17 x 17 XL, V5H, V5H+, RFA Accumulator Water Volume (nominal), ft 3/accumulator 1,196.4 Accumulator Water Temperature, F 120 Accumulator Tank Volume (nominal), ft 3/accumulator 2,500 Accumulator Gas Pressure (minimum), psia 600 Safety Injection Pumped Flow See Note 2 Containment Parameter s N/A Thermal Design Flow, gpm/loop 98,000 Vessel Inlet Temperature, o F 566.95 / 542.85 (4) Vessel Outlet Temperature, o F 631.05 / 609.75 (4) Reactor Coolant Pressure, psia 2,300 (3) Steam Pressure, psia 1,107 / 904 (4) Steam Generator Tube Plugging Level, %

10 Main Feedwater Temperature, o F 390.0 TMFW 440.0 AFW Flow, gpm (5) Loop A 0 Loop B 500 Loop C 500 Loop D 0 AFW Temperature, o F 212 STPEGS UFSAR 15.6-58 Revision 1 8 TABLE 15.6

-18 (Continued)

INPUT PARAMETERS USED IN SMALL BREAK LOCA ANALYSES MSSV Set pressure, psig (6) Valve 1 1285 Valve 2 1295 Valve 3 1305 Valve 4 1315 Valve 5 1325 SG PORV Set pressure (automatic), psig (7) 1225

1. This licensed core power has been increased by 1.4% due to a reduced calorimetric uncertainty. The analysis value included a calorimetric uncertainty of 2%. The uncertainty has been reduced to 0.6%. The remaining 1.4% has been reallocated to allow for the power uprate.
2. Minimum safety injection capacity calculations were based upon one HHSI/LHSI train injecting and one spilling to containment.
3. This value bounds the actual pressure of 2250 psia plus 46 psi uncertainty.
4. Corresponds to the range of RCS average temperatures analyzed (593 oF/582.3 oF, respectively). Vessel inlet and outlet temperatures incorporate the effects of 6 oF uncertainty.
5. Corresponds to the limiting single failure scenario leading to the limiting PCT.
6. Value is adjusted in the analysis to include 3% accumulation and 3% uncertainty for each valve. Data represents each of five valves on each of four steam generators.
7. Value is adjusted to include 4.58% uncertainty. While there is no "accumulation" for this PORV, an additional 4.9% was added to allow for full flow.

STPEGS UFSAR 15.6-59 Revision 1 8 TABLE 15.6-19 INPUT PARAMETERS USED IN LARGE BREAK LOCA ANALYSES Core Power(1), MWt 3,853 Peak Linear Power (includes 100.6% factor), kW/ft 13.523 Total Peaking Factor 2.55 Axial Peaking Factor 1.62 (1.55 for once burned standard fuel)

Power Shape Chopped Cosine Fuel Assembly Array 17 x 17 XL, V5H, V5H

+, RFA Accumulator Water Volume (nominal), ft 3/accumulator 1,196.4 Accumulator Water Temperature , F 90 Accumulator Tank Volume (nominal), ft 3/accumulator 2,500 Accumulator Gas Pressure (minimum),psia 583.6 Safety Injection Pumped Flow See Note 2 Containment Parameters See Section 6.2.1.5 Thermal Design Flow, gpm/loop(4) 92,500 Vessel Inlet Temperature, F - High T AVG(4) - Low T AVG(4) 565.19 540.98 Vessel Outlet Temperature, F - High T AVG (4) - Low T AVG(4) 632.81 611.62 Reactor Coolant Pressure, psia 2,300 Steam Pressure, psia

- High T AVG(4) - Low T AVG(4) 1,117 894 Steam Generator Tube Plugging Level, %(3) 10 1. This licensed core power has been increased by 1.4% due to a reduced calorimetric uncertainty. The analysis value included a calorimetric uncertainty of 2%. The uncertainty has been reduced to 0.6%. The remaining 1.4% has been reallocated to allow for the power uprate.

2. Minimum safety injection capacity calculations were based upon one HHSI/LHSI train injecting and one spilling to containment. Maximum safety injection capacity calculations were based upon three HHSI/LHSI trains injecting and no lines spilling to containment.
3. The large break LOCA analysis has included an additional 2% SGTP to account for the effect of the concurrent seismic/LOCA event.
4. Corresponds to 3% reduced RCS flow.

STPEGS UFSAR 15.6-60 Revision 1 8 TABLE 15.6

-20 LARGE BREAK

- EVENTS Occurrence Time (seconds)

C D=0.6 C D=0.8 C D=1.0 C D=0.8 C D=0.8 C D=0.8 (Min SI) (Min SI) (Min SI) (Min SI) (Min SI) (Max SI) Event HI T AVG HI T AVG HI T AVG LO T AVG HI T AVG HI T AVG non-IFBA non-IFBA non-IFBA non-IFBA IFBA IFBA limiting case Accident Initiation 0.0 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 0.6 0.6 0.6 0.5 0.6 0.6 Safety Injection Signal 3.6 3.0 2.6 3.4 3.0 3.0 Start Accumulator Injection 17.0 14.0 12.0 13.0 14.0 14.0 End of ECC Bypass 29.0 24.9 22.5 26.8 24.9 24.9 End of Blowdown 29.2 24.9 22.6 26.8 24.9 24.9 Start Pumped ECC Injection 33.2 33.0 32.6 32.6 33.0 33.0 Bottom of Core Recovery 36.9 32.7 30.4 34.6 32.7 32.7 Accumulators Empty 48.2 44.4 42.3 45.1 44.4 45.2 STPEGS UFSAR 15.6-61 Revision 1 8 TABLE 15.6

-21 LARGE BREAK LOCA ANALYSIS RESULTS DECLG C D=0.6 (Min SI) HI T AVG non-IFBA DECLG C D=0.8 (Min SI) HI T AVG non-IFBA DECLG C D=1.0 (Min SI) HI T AVG non-IFBA DECLG C D=0.8 (Min SI) LO T AVG non-IFBA DECLG C D=0.8 (Min SI) HI T AVG IFBA DECLG C D=0.8 (Max SI) HI T AVG IFBA Peak clad temperature, °F 2026 2068 2007 2055 2090* 2089 Elevation, ft 9.50 8.00 9.50 9.50 8.00 8.00 Max local ZR/H 2O reaction, % <15.5 (1) <15.5 (1) <15.5 (1) 15.5 (1) <15.5 (1) <15.5 (1) Elevation, ft N/A (1) N/A (1) N/A (1) N/A (1) 11.25 (1) N/A (1) Total ZR/H 2O reaction

<1.0 <1.0 <1.0 <1.0 <1.0 <1.0 Burst time, sec 43.40 56.29 62.66 57.52 62.78 62.89 Elevation, ft 6.00 6.25 7.75 6.25 7.75 7.75

  • Subsequent evaluations have resulted in the following changes to the calculated peak clad temperature:

A 46 oF penalty to account for the impact of boiling in the downcomer as well as correction of previously identified errors in the LOCBART code.

A 30 oF benefit for using PAD Version 4.0 code.

A 6 oF penalty to account for an error affecting the pellet volume heat generation rate in the LOCBART code. A 5 oF penalty to account for a reconciliation of the AOR A 0 oF penalty to account for Thermal Conductivity Degradation and peaking factor burn

-down. 8 oF GEDM Violation Assessment (Unit 2 Cycle 18)

Accounting for the above changes, the PCT has inc reased to 2117 o F for Unit 1 and 212 5 o F for Unit 2, which remains below the 10CFR50.46 acceptance limit of 2200 o F. (1) The limiting local oxidation was calculated for the C D=0.8, Min SI, HI TAVG, IFBA fuel, 11.0 ft top

-skewed power shape.

CN-3117, CN-3149, C N-3166 STPEGS UFSAR 15.6-62 Revision 1 8 TABLE 15.6

-22 SMA Event Hi, Hi(1) Hi, Lo(2) Lo, Hi(3) Lo, Lo(4) Start (Accident Initiation) 0.0 0.0 0.0 0.0 Reactor Trip Signal, sec 75.2 75.1 52.5 52.5 Top of Core Uncovered, sec 2009 2019 1975 1975 Accumulator Injection Begins, sec N/A N/A N/A N/A Peak Clad Temp Occurs, sec 2704 2705 2396 2418 Top of Core Covered, sec 3357 3334 3293 3296 (1) Hi, Hi - High Loop Temperature, High MFW Temperature - RCS Tavg = 593.0 o F TMFW = 440.0 o F (2) Hi, Lo - High Loop Temperature, Low MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 390.0 o F (3) Lo, Hi - Low Loop Temperature, High MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 440.0 o F (4) Lo, Lo - Low Loop Temperature, Low MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 390.0 o F STPEGS UFSAR 15.6-63 Revision 1 8 TABLE 15.6

-23 SMALL BREAK (2 in.) ANALYSIS RESULTS Hi, Hi(1) Hi, Lo(2) Lo, Hi(3) Lo, Lo(4) Peak clad temperature, F 1578* 1557 1500 1526 Elevation, ft.

13.50 13.50 13.50 13.25 Max. local ZR/H 2O reaction, %

0.93 0.88 0.39 0.46 Elevation, ft.

13.50 13.50 13.50 13.25 Total ZR/H 2O reaction, %

< 1.0 < 1.0 < 1.0 < 1.0 Hot rod burst time, sec.

N/A N/A N/A N/A Elevation, ft.

N/A N/A N/A N/A (1) Hi, Hi - High Loop Temperature, High MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 440.0 o F (2) Hi, Lo - High Loop Temperature, Low MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 390.0 o F (3) Lo, Hi - Low Loop Temperature, High MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 440.0 o F (4) Lo, Lo - Low Loop Temperature, Low MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 390.0 o F

  • A subsequent evaluation resulted in the following change to the calculated peak clad temperature.

- A 34 oF Penalty has been applied to address inconsistencies in several drift flux models as well as the nodal bubble rise/droplet fall models.

The addition of the penalty results in maximum peak clad temperature of 1612 oF. The Small Break LOCA peak clad temperature remains below the 10CFR50.46 acceptance limit of 2200 o F.

STPEGS UFSAR 15.6-64 Revision 1 8 TABLE 15.6

-24 Event Hi, Hi(1) Hi, Lo(2) Lo, Hi(3) Lo, Lo(4) Start (Accident Initiation) 0.0 0.0 0.0 0.0 Reactor Trip Signal, sec 34.3 33.8 21.8 21.8 Top of Core Uncovered, sec 590 599 606 604 Accumulator Injection Begins, sec N/A N/A N/A N/A Peak Clad Temp Occurs, sec 1280 1292 1185 1121 Top of Core Covered, sec 1847 1835 1863 1911

(1) Hi, Hi - High Loop Temperature, High MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 440.0 o F (2) Hi, Lo - High Loop Temperature, Low MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 390.0 o F (3) Lo, Hi - Low Loop Temperature, High MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 440.0 o F (4) Lo, Lo - Low Loop Temperature, Low MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 390.0 o F STPEGS UFSAR 15.6-65 Revision 1 8 TABLE 15.6

-25 SMALL BREAK (3 in.) ANALYSIS RESULTS Hi, Hi(1) Hi, Lo(2) Lo, Hi(3) Lo, Lo(4) Peak clad temperature, F 1547 1510 1456 1418 Elevation, ft.

13.5 13.5 13.5 13.25 Max. local ZR/H 2O reaction, %

0.93 0.73 0.52 0.36 Elevation, ft.

13.5 13.5 13.25 13.25 Total ZR/H 2O reaction, %

< 1.0 < 1.0 < 1.0 < 1.0 Hot rod burst time, sec.

N/A N/A N/A N/A Elevation, ft.

N/A N/A N/A N/A

(1) Hi, Hi - High Loop Temperature, High MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 440.0 o F (2) Hi, Lo - High Loop Temperature, Low MFW Temperature

- RCS Tavg = 593.0 o F TMFW = 390.0 o F (3) Lo, Hi - Low Loop Temperature, High MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 440.0 o F (4) Lo, Lo - Low Loop Temperature, Low MFW Temperature

- RCS Tavg = 582.3 o F TMFW = 390.0 o F STPEGS UFSAR 15.7-1 Revision 1 8 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT A number of events have been postulated which could result in a radioactive release from a subsystem or component. These events are:

1. Waste gas system failure [deleted]
2. Postulated radioactive releases due to liquid

-containing tank failure (release to atmosphere) [deleted]

3. Postulated radioactive releases due to liquid

-containing tank failure (ground release)

4. Design basis fuel handling accidents
5. Spent fuel cask drop accident The above events are considered to be American Nuclear Society (ANS) Condition III events, with the exception of the fuel handling accidents, which are considered to Condition IV events.

15.7.1 Waste Gas System Failure Consideration of this accident has been removed from NUREG

-0800 and from the STP Safety Evaluation Report.

15.7.2 Postulated Radioactive Releases due to Liquid

-Containing Tank Failure (Release to Atmosphere)

Consideration of this accident has been removed from NUREG

-0800 and from the STP Safety Evaluation Report.

15.7.3 Postulated Radioactive Releases Due to Liquid

-Containing Tank Failure (Ground Release) 15.7.3.1 Identification of Causes and Accident Description. Radioactive liquid release may occur, or be postulated to occur, as a result of leaks in piping, leaks in tanks and other equipment, and failure of tanks and other equipment.

An analysis was performed to determine the worst possible tank failure based upon contained activity and volume. As a result of this review, the worst activity for the radionuclides

considered was the evaporator concentrates tank (ECT) for radionuclides other than tritium and the recycle holdup tank (RHT) for tritium. It should be noted that both of these tanks are located in a seismic Category I structure.

15.7.3.2 Analysis Assumptio ns. For the purpose of this analysis, all tanks containing radioactivity were reviewed, taking into consideration their specific activity as well as the tank volume. The worst total activity available for release was found to be the evaporator concentrates tank for all nuclides except tritium. Due to its size, the RHT contains the most activity of tritium.

STPEGS UFSAR 15.7-2 Revision 1 8 Thus the Cs

-137, SR-90, and I-129 contents of the ECT tank were assumed to be released to the groundwater. A coincidental release of just the RHT tritium contents was also assumed to provide the maximum offsite nuclide concentrations. The assumptions used in determining the activities can be found in Table 15.7

-3 with the activities provided in Table 15.7

-4. The radionuclides considered were obtained by comparing the half

-life versus the transit time to the Colorado River (about 95.9 years). The resulting concentrations and methods of dispersion can be found in Section 2.4.13.

15.7.3.3 Radiological Consequences. The radiological consequences of this accident are presented in Section 2.4.13.

The impact of operating at a feedwater temperature as low as 390 oF on the radiological source terms has been evaluated. It was determined that operation under this scenario would have a negligible impact on the isotopic inventory of the liquid waste processing system, as described in Section 11.2, and on the radiological consequences of a LWPS failure.

15.7.4 Design Basis Fuel Handling Accidents 15.7.4.1 Identification of Causes and Accident Description. The design basis fuel handling accident is defined as the dropping of a spent fuel assembly during fuel handling, resulting in the rupture of the cladding of the fuel rods in the assembly despite many administrative controls and physical limitations imposed upon fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures under direct surveillance of a supervisor.

During refueling operations, the Normal Containment Purge Subsystem is operating as described in Section 9.4.5. Should a fuel handling accident occur in the Containment, the Reactor Containment Building (RCB) Purge Isolation monitors are capable of identifying that the activity release has occurred and initiating Containment isolation, if aligned for automatic operation. The accident analysis does not take credit for this function.

The analysis described in Section 15.7.4.2 does not take credit for holdup or filtration fo r

accidents in either the Fuel Handling Building or in the containment building. However, using insights from TSTF

-51, and consistent with the guidance in NUMARC 93

-01, Revision 3 , Section 11.3.6.5, Safety Assessment for Removal of Equipment from Service During Shutdown Conditions," subheading "Containment

-Primary (PWR)/Secondary(BWR),"

STPNOC makes the following commitments to mitigate the consequences of a potential fuel handling accident. During the movement of irradiated fuel within the Containment, penetrations providing direct access from the containment atmosphere to the outside atmosphere shall be either (1) closed by an isolation valve, blind flange, or manual valve, or (2) be capable of being closed as soon as possible but within two hours.

Should a fuel handling accident occur in the FHB

, the spent fuel pool ventilation monitors are capable of identifying that the activity release has taken place, diverting the building exhaust flow through the carbon filter units, and starting the booster fans, if the ventilation system is aligned for automatic operation.

CN-3132 CN-3132 STPEGS UFSAR 15.7-3 Revision 1 8 The purpose of these commitments are to isolate the RCB for postulated fuel handling accident in the RCB and further reduce dose by natural decay and to enable the Ventilation System to draw the release from a postulated fuel handling accident in the containment in the proper direction such that it can be monitored (not treated).

Also , these commitments maintain the FHB Ventilation System and associated radiation monitor availability to reduce doses even further below that provided by the natural decay and to avoid unmonitored releases; and to enable the FHB Ventilation System to draw the release from a postulated fuel handling accident in the FHB in the proper direction such that it can be treated and monitored.

The two hours to restore the FHB Exhaust Air System and the Control Room Makeup and Cleanup Filtration System to OPERABLE status and to close containment penetrations or openings in the event of a fuel handling accident is reasonable because these systems are not required to mitigate the accident. These systems are not credited in the accident analyses. Dose limits are within requirements assuming an instantaneous release from the Fuel Handling Accident. The additional administrative actions are taken to further filter and monitor the release as a defense-in-depth measure.

Therefore, automatic RCB isolation capability is not required during refueling operation

s. The function, instrument type, setpoints, safety class, and other pertinent information on the RCB Purge Isolation monitors are given in Section 11.5. Isolation of the Containment is described in Section 6.2.4, which discusses the valves, mode of operation, closure time, and other information.

The FHB Ventilation System is described in Section 9.4.2. Should a fuel handling accident occur in the FHB, the spent fuel pool ventilation monitors are capable of identifying that the activity release has taken place, diverting the building exhaust flow through the carbon filter units, and starting the booster fans, if the ventilation system is aligned for automatic operation.

The accident analysis does not take credit for this function.

During the movement of irradiated fuel within the Containment, penetrations providing direct access from the containment atmosphere to the outside atmosphere shall be either (1) closed by an isolation valve, blind flange, or manual valve, or (2) be capable of being closed as soon as possible but within two hours. Therefore, automatic isolation capability is not required during refueling operation

s. The spent fuel pool ventilation monitors are discussed in Section 11.5.

The design basis fuel handling accident is classified as an ANS Condition IV event, a limiting fault. A block diagram summarizing various protection sequences for safety actions required to mitigate the consequences of this event is provided in Figures 15.0

-28 and 15.0

-29 15.7.4.2 Analysis Assumptions. The assumptions postulated in the calculation of the radiological consequences of a fuel handling accident in the FHB or the RCB are based upon the assumptions of Regulatory Guide (RG) 1.25.

CN-3132 CN-3132 CN-3132 CN-3132 STPEGS UFSAR 15.7-4 Revision 1 8 15.7.4.2.1 Assumptions for the Fuel Handling Accident

. An analysis of a postulated fuel handling accident is performed. The parameters used for the analysis are listed in Table 15.7-8. The assumptions for the conservative RG 1.183 evaluation are:

a. The bounding core inventory is based on a power level of 4100 MWth compared to the Rated Thermal Power (RTP) level of 3853 MWth with a 0.6%

measurement uncertainty.

b. Iodine inventory in the fuel to the fuel pin gap are given in Table 15.7

-7. c. The dropped fuel assembly and the impacted assembly are assumed to be the highest powered assemblies in the core at their discharge burnup. However, for conservatism, the same core average inventory (Ci/MWt) used for the LOCA (see Section 15.6.5) has been applied to this accident (but with increased gap fractions for Kr

-85 and I-131 and application of a radial peaking factor) because of the higher Ci/MWt for I

-131. The fuel

-clad gap activities at the time of shutdown are given in Table 15.7

-7. Damaged rods are assumed to release their gas gap activities. A factor of 1.7 is applied to the values in this table to model the highest power assemblies in the core.

d. The release consists of the gap activity in the 264 fuel pins in the dropped assembly and 50 pins in an impacted fuel assembly, for a total of 314 fuel pins. Since there are 193 fuel assemblies in the core, there are 50,952 fuel pins in a core. e. The accident occurs 42 hours4.861111e-4 days <br />0.0117 hours <br />6.944444e-5 weeks <br />1.5981e-5 months <br /> after plant shutdown. Radioactive decay of the fission product inventory during this interval is taken into account.
f. The minimum water depth between the top of the damaged fuel rods and the spent fuel pool surface or the reactor vessel flange is 23 ft.
g. The iodine released from the water surface is 43% organic and 57% elemental.
h. The spent fuel pool and refueling water decontamination factors (DFs) for iodine are taken as 200 in accordance with RG 1.183. Based on the same reference, the DFs for all other radionuclides (other than noble gasses) are assumed to be infinite. i. The release from the fuel and the water is modeled as a puff release. No credit is taken for filtration by the FHB exhaust air system filters or for hold

-up in either the containment or the FHB.

j. Radionuclides released from the spent fuel are assumed to be released at ground level to the environment.

STPEGS UFSAR 15.7-5 Revision 1 8 k. The Control Room and TSC internal air is assumed to be in equilibrium with the air outside the Control Room HVAC intake. Therefore, the Control Room and TSC are not assumed to be pressurized during the accident, nor are any assumptions made as to the functioning of the Control Room and TSC HVAC systems. No credit is taken for any filtration (makeup or recirculation cleanup) in either the Control Room or the Technical Support Center.

l. The Reactor Containment Building (RCB) normal and supplemental purge is via the Plant Vent. Therefore, for the FHA releases, the Plant

-Vent-to Control via this Plant Vent. The Plant

-Vent-to- the RCB Equipment Hatch opening since the Plant Vent is much closer to the Control room air intake than the Equipment Hatch (which is located on the southwest quadrant of the RCB).

15.7.4.3 Radiological Consequences. The TEDE at the EZB and the LPZ for the design basis fuel handling accidents are is presented in Table 15.7

-9 for accidents occurring in either the FHB or the RCB. Control Room and TSC dose consequences are also presented in this table.

15.7.5 Spent Fuel Cask Drop Accident In accordance with 10CFR71, the spent fuel shipping cask is designed to sustain a free

-fall in air of 30 ft onto an unyielding surface followed by a specified puncture, fire, and immersion in water with the release of no more than a specified small quantity of radioactivity. The design of the spent fuel handling equipment limits the postulated fall of a spent fuel shipping cask to less than 30 ft, as described in Section

9.1. Since

spent fuel casks are designed to withstand such loadings, the radiological consequences of this accident are not evaluated.

STPEGS UFSAR 15.7-6 Revision 1 8 TABLE 15.7 CONTAINING TANK FAILURE Core thermal power, Mwt 4,100 Fuel defects (Based upon a 3

-region core burnup model) 0.12% Activity inventory Activity shown in Table 15.7

-4 Volume of spill, gal Recycle holdup tank Evaporator concentrates tank 64,000 4,0 00 Model for spill transport to wells and surface waters See Section 2.4.13

STPEGS UFSAR 15.7-7 Revision 1 8 TABLE 15.7

-4 ACTIVITY AVAILABLE FOR RELEASE Isotope Curies* H-3 242** Cs-137 8.3 Sr-90 4.5 x 20-3 I-129 2.2 x 10-5

  • Assuming the tank is 80%full
    • Recycle holdup tank

STPEGS UFSAR 15.7-8 Revision 1 8 TABLE 15.7

-7 BASE FISSION PRODUCT GAP INVENTORY FOR THE FUEL HANDLING ACCIDENT 1 (Ci/MWt) Isotope At Shutdown t=0 At Time of Accident t=42 hr Kr83m 3.41E+0 3 5.05E-04 Kr85m 7.07E+03 9.26E+00 Kr85 5.86E+02 5.86E+02 Kr87 1.34E+04 1.40E-06 Kr88 1.90E+04 5.77E-01 Kr89 2.32E+04 0 Xe131m 2.68E+02 2.79E+02 Xe133m 1.66E+03 9.79E+02 Xe133 5.37E+04 4.87E+04 Xe135m 1.02E+04 1.08E+02 Xe135 1.34E+04 3.83E+03 Xe 137 4.63E+04 0 Xe138 4.39E+04 9.77E-41 I131 4.14E+04 3.56E+04 I132 3.71E+04 1.38E-01 I133 5.37E+04 1.33E+04 I134 5.85E+04 1.33E-10 I135 4.88E+04 6.46E+02 1 Reflects core inventory without 1.7 peaking factor or pool DFs applied.

STPEGS UFSAR 15.7-9 Revision 1 8 TABLE 15.7

-8 PARAMETERS USED FOR THE FUEL HANDLING ACCIDENT Parameter Previous Reactor Power 4100 MWt Fuel Decay Period 42 hrs Radial Peaking Factor

1.7 Release

Fractions Noble Gases (except Kr

-85) 5% Kr-85 10% Iodines (except I

-131) 5% I-131 8% Number of Failed Rods (Equivalent Assemblies) 314 of 50952 Minimum water depth over damaged fuel 23 feet Pool Water Iodine Decontamination Factor 200 Release Period Instantaneous Release Location Plant Vent Credit for Filtration on Release No Credit for Control Room or TSC HVAC Filtration No Dose Conversion Factors Table 15.D

-10 Decay Constants and Decay Daughter Fractions Table 15.D

-11 Table 15.D

-1 Table 15.D

-5 STPEGS UFSAR 15.7-10 Revision 1 8 TABLE 15.7

-9 DOSE RESULTING FROM A FUEL HANDLING ACCIDENT (rem TEDE)

Offsite (0

-2 hours) Control Room/TSC EAB LPZ Limit 1 Result Limit 2 0.83 0.30 6.3 3.39 5 1 10CFR50.67, as modified by Regulatory Guide 1.183 in Table 6, page 1.183

-20. 2 10CFR50.67

STPEGS UFSAR

15.8-1 Revision 1 8 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM A discussion of anticipated transients without sc ram is provided in WCAP

-8440, "Anticipated Transients Without Trip Analysis for a Four

-Loop (3817) Westinghouse PWR", and WCAP

-8330, "Westinghouse Anticipated Transients Without Trip Analysis". Additional analysis which forms the basis for the ATWS Mitigation System is provided in Westinghouse Letter NS

-TMA-2182 "ATWS Submittal", December 1979, (ST-HS-HS-33509). The ATWS mitigation system is described in Section 7.

8. CN-3131 STPEGS UFSAR 15.A-1 Revision 15 APPENDIX 15.A CN-2897 FISSION PRODUCT INVENTORIES FOR TID-BASED ANALYSES 15.A.1 Activities in the Core The calculation of the core iodine and noble gas fission product inve ntories is performed with the ORIGEN code (Refs. 15A-1 and 15.A

-2). All inventories are base d upon a core power level of 4,100 Mwt. The core activities are given in Table 15.A-1.

The applicability of V5H fuel is discussed in Section 15.A.5. 15.A-2 Activities in the Fu el Pellet-Cladding Gap The fuel-clad gap activities are determined using the model given in Regulatory Guide 1.25. Thus, the amount of activity accumulated in the fuel-clad gap is assumed to be 10 pe rcent of the iodine and 10 percent of the noble gases accumulated at th e end of core life, except Kr-85, I-127, and I-129, where it is assumed to be 30 percent of the core activity. The gap activities are given in Table 15.A-1. 15.A-3 Concentrations in the Coolants The concentrations of various radionuclides in the primary and secondary coolants are presented in Section 11.1. The concentrations of iodines and n oble gases are given in Ta ble 15.A-2. Section 11.1 presents the assumptions by which these concentrations were calculated. During full-power operation, the primary coolant concentration Technical Specification limit for continued operation up to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is 60 Ci/g of equivalent I-131. The iodine limit takes into account an iodine spike occurring because of a previous power tr ansient. The reactor coolant concentrations corresponding to these Technical Specification lim its are given in Table 15.A-4. The secondary coolant Technical Specification limit is 0.10 Ci/g of equivalent I-131. The concentrations corresponding to this limit are given in Table 15.A-5.

The effects of iodine spiking caused by an accident have been accounted for by increasing the iodine source term in the primary system upon depressu rization or reactor sh utdown. The iodine concentration during the iodine spike is governed by the fo llowing differential equation:

i RCS i RCS Lii i N M LR N M fNP dt dN where: P i = Production Rate for Nuclide i, Ci / gm-sec = Radioactive Decay Constant for Nuclide, i, sec

-1 N i = Concentration of Nuclide i, Ci / gm L = Letdown Flow, gm / sec STPEGS UFSAR 15.A-2 Revision 15 M RCS = RCS mass, gm = Letdown Demineralizer Efficiency/100, unitless LR = Rate of Reactor Coolant System Identified and Unidentified Leakage (as allowed by plant Technical Specifications), gm / sec The release rate from the fuel has been increased by a factor of 500 (over the equilibrium condition release rate) to model the effect of the spike. The iodine appearance rates in the reactor coolant for normal steady-state operation at 1 Ci/g of dose equivalent I-131 and for an assumed accident-initiated iodine spike are give in Table 15.A-6. The iodine appearance rates for the SGTR are given in Table 15.A-7. 15.A-4 The Impact of Extended Burnup Fuel on Source Terms The source terms presented in Sect ions 15.A-1 through 15.A-3 are based on an equilibrium fuel cycle using discharge burnup of 33,000 MWD/MTU. The use of extended burnup fuel at STPEGS has been reviewed in NUREG/CR-5009, "Assessment of the Use of Extended Burnup Fuel in Light Water Power Reactors" (Ref. 11.1-4 and 11.1-5) and has been determined to not significantly change the results previously presente d in safety analysis reports based on operation to 33,000 MWD/MTU discharge burnup. The increase of fuel burnup and enrichment up to 5.0 w/o U-235 will not significantly impact the radiological consequences of both LOCA and non-LOCA accidents discussed in Chapter 15 or the control room operator doses presented in Sect ion 6.4. NUREG/CR-5009 pr edicts a possible 20%

increase in the offsite thyroid dose as a result of a Fuel Handling Accident due to an increase in the release fraction of I-131 in to the fuel-clad gap for extended bu rnup fuel. This increase has been previously reviewed for STPEGS and found to be acceptable (Reference 11.1-5). This increase is reflected in the source term used for the fuel ha ndling accident in RCB as presented in Table 15.7-11.

Source terms based on an equilibrium fuel cycle using batch average burnups of 20,000 MWD/MTU, 40,000 MWD/MTU, and 60,000 MWD/MTU (each at 1/3 core size) with fuel enriched to a nominal 5.0 w/o U-235, have been evaluated and do not signi ficantly change the resu lts in sections 15.A.1 through 15.A.3 or the radiological consequences presented in Chapter 15. 15.A-5 Applicability of V5H Fuel Upgrade The effect of the V5H fuel upgrade on the radioa ctivity concentrations in the fluid systems was reviewed and it was determined that the original reactor core activity listed in Table 15.A-1 is bounding. Therefore, the UFSAR analyses based on th is activity are not adversely impacted by the fuel upgrade. For comparison, the activity concentrations calculated for the V5H fuel are listed in Table 15.A-1A. the corresponding reactor coolant activity for the V5H upgrade is shown in Table 11.1-2A. 15.A.6 Impact of Operating at Reduced Feedwater Temperature on Source Terms The impact of operating at a feedwater temperature as low as 420 o F for Model E steam generators or as low as 390 oF for Delta 94 steam generators on the radiological source terms has been evaluated. It STPEGS UFSAR 15.A-3 Revision 15 was determined that operation unde r either scenario would have a negligible impact on the fission product inventories in the plant systems. The impact of the change s on the reactor co olant inventory and the inventory in the secondary side was evaluated and determined to have a negligible impact on the activities of these systems. 15.A.7 Impact of Westinghouse Delta 94 Steam Generators on Source Terms The impact of replacing the Westinghouse Model E steam generators with Westinghouse Model 94 steam generators on the radiological source terms has been evaluated. It was determined that operation with either type of steam generator would have a neglig ible impact on the fission product inventories in the plant systems. The impact of the changes on the reactor coolant inventory and the inventory in the secondary side was evaluated and determined to have a negligible impact on the activities of these systems.

STPEGS UFSAR 15.A-4 Revision 15 References 15.A-1 Bell, M. J., "ORIGEN - The ORNL Isot ope Generation and Depletion Code", ORNL-4628, Oak Ridge National Laboratory (May 1973) 15.A-2 Oak Ridge National Laboratory, RS IC-DLC-38, "ORIGEN Yields and Cross Sections - Nuclear Transmutation and Decay Data from ENDF/B-IV", Radiation Shielding Information Center 15.A-3 Holderbaum D. F., Lewis R. N., Rubin K., "LOFTRR2 Analysis for a Steam Generator Tube Rupture for the South Texas Project Units 1 and 2, "WCAP-12369-P (Proprietary) and WCAP-12370 (Non-Proprietary), September 1989 STPEGS UFSAR 15.A-5 Revision 15 TABLE 15.A-1 CORE AND GAP ACTIVITIES* BASED UPON FULL-POWER OPERATION FOR 900 DAYS Isotope Core Activity (curies) Fraction of Activity in Gap Gap Activity (curies) I-131 1.1 x 10 8 0.10 1.1 x 10 7 I-132 1.6 x 10 8 0.10 1.6 x 10 7 I-133 2.3 x 10 8 0.10 2.3 x 10 7 I-134 2.5 x 10 8 0.10 2.5 x 10 7 I-135 2.2 x 10 8 0.10 2.2 x 10 7 Xe-131m 8.0 x 10 5 0.10 8.0 x 10 4 Xe-133m 3.4 x 10 7 0.10 3.4 x 10 6 Xe-133 2.2 x 10 8 0.10 2.2 x 10 7 Xe-135m 4.6 x 10 7 0.10 4.6 x 10 6 Xe-135 4.8 x 10 7 0.10 4.8 x 10 6 Xe-138 1.9 x 10 8 0.10 1.9 x 10 7 Kr-83m 1.4 x 10 7 0.10 1.4 x 10 6 Kr-85m 3.1 x 10 7 0.10 3.1 x 10 6 Kr-85 7.7 x 10 5 0.10 2.3 x 10 5 Kr-87 5.7 x 10 7 0.10 5.7 x 10 6 Kr-88 8.1 x 10 7 0.10 8.1 x 10 6 Kr-89 1.0 x 10 8 0.10 1.0 x 10 7 I-127 3.2 kg 0.30 0.96 kg I-129 13 kg 0.30 3.9 kg

  • Based upon three-region core which has been operated at a core power level of 4100 MWt for 300, 600, and 900 effective full power days, respectively, for each region. These values bound the activities for V5H fuel.

STPEGS UFSAR 15.A-6 Revision 15 TABLE 15.A-1A CORE ACTIVITIES FOR V5H FUEL UPGRADE AND THE PARAMETERS USED IN CALCULATION Fuel Enrichment 5.0 W/O U-235 Power 4100 MWT Cycle Length 509 EFPD Burnup (1/3 core) 60,000 MWD/

MTU @ 1527 EFPD irradiation Burnup (1/3 core) 40,000 MWD/

MTU @ 1018 EFPD irradiation Burnup (1/3 core) 20,000 MWD/MTU @ 509 EFPD irradiation Core Average Temperature 585.6 degrees F Reactor Core Activity Nuclide Activity (Ci) I-131 1.13E8 I-132 1.64E8 I-133 2.31E8 I-134 2.50E8 I-135 2.14E8

Xe-131m 7.67E5 Xe-133m 3.31E7 Xe-133 2.29E8 Xe-135m 4.58E7 Xe-135 6.45E7 Xe-138 1.86E8

Kr-83m 1.35E7 Kr-85m 3.01E7 Kr-85 1.24E6 Kr-87 5.53E7 Kr-88 7.88E7 Kr-89 9.73E7 STPEGS UFSAR 15.A-7 Revision 15 TABLE 15.A-2 COOLANT CONCENTRATIONS - DESIGN BASIS Isotope Primary Concentration

( Ci/g) Secondary Water ( Ci/g) Concentration Steam ( Ci/g) I-131 2.4 1.5 x 10-3 1.5 x 10-3 I-132 2.8 9.9 x 10-4 9.9 x 10-6 I-133 3.8 2.2 x 10-3 2.2 x 10-5 I-134 5.7 x 10-1 6.3 x 10-6 6.3 x 10-8 I-135 2.1 1.0 x 10-3 1.0 x 10-5 Xe-131m 2.0 nil 4.2 x 10-5 Xe-133m 1.6 x 10 1 nil 3.3 x 10-4 Xe-133 2.5 x 10 2 nil 5.2 x 10-3 Xe-135m 4.6 x 10-1 nil 1.4 x 10-4 Xe-135 6.8 nil 1.4 x 10-4 Xe-138 6.4 x 10-1 nil 1.3 x 10-5 Kr-85m 2.0 nil 4.2 x 10-5 Kr-85 7.3 nil 1.5 x 10-4 Kr-87 1.2 nil 2.5 x 10-5 Kr-88 3.6 nil 7.5 x 10-5 STPEGS UFSAR 15.A-8 Revision 15 TABLE 15.A-4 REACTOR COOLANT IODINE CONCENTRATIONS*

Isotope Concentration

( Ci/g) I-131 4.6 x 10 1 I-132 5.2 x 10 1 I-133 7.2 x 10 1 I-134 1.0 x 10 1 I-135 4.0 x 10 1

  • Concentrations are based upon Technical Specification specific activity limits of 60 Ci/g of dose equivalent I-131 (which takes a preexisting iodine spike into account) and upon ICRP 30 DCF.

STPEGS UFSAR 15.A-9 Revision 15 TABLE 15.A-5 SECONDARY COOLANT IODINE CONCENTRATION BASED ON TECHNICAL SPECIFICATION LIMIT Isotope Gap Activity at Shutdown (Ci)

I-131 7.5 x 10-2 I-132 8.8 x 10-2 I-133 1.2 x 10-1 I-134 1.8 x 10-2 I-135 6.6 x 10-2

  • Based upon Technical Specification specific activity limit of .10 Ci/g of dose equivalent I-131

STPEGS UFSAR 15.A-10 Revision 15 TABLE 15.A-6 IODINE APPEARANCE RATES IN THE REACTOR COOLANT Isotope Equilibrium Appearance Rates due to Fuel Defects (Ci/sec)

Appearance Rated due to an Accident - Initiated Iodine Spike (Ci/sec)

I-131 1.3 x 10-2 6.5 I-132 3.3 x 10-2 17 I-133 2.3 x 10-2 12 I-134 1.3 x 10-2 6.5 I-135 1.6 x 10-2 8.0

Note: The iodine appearance rates above ar e calculated using the parameters below. Letdown Flow (gpm) 250 CVCS Demineralizer Efficiency 1 DEI I-131 RCS Concentration (Ci/gm) 1 RCS Mass (gm) 2.658E+8 RCS Density (gm/gal) 3.78E+3 RCS Volume (gal) 7.03E+4 RCS Leakage (gpm) 16.42 STPEGS UFSAR 15.B-1 Revision 15 APPENDIX 15.B CN-2897 DOSE MODELS FOR TID-BASED ANALYSES This appendix describes the mathematical models and parameters used for the fission product transport from the postulated accident site to the environment and fo r the radiological dose calculations for analyses using the TID-14688 based methodology. 15.B.1 General Accident Parameters This section describes the paramete rs used in analyzing the radiol ogical consequences of postulated accidents. The site-specific, 5-percentile, short-term dispersion factors for the worst sector (assuming ground level releases) are given in Table 15.B-1. (See Section 2.3.4 for additional details on meteorology.) the breathing rates used are presente d in Table 15.B-2. The thyroid (via inhalation pathway), beta skin, and gamma body (via submersion pathway) dose factors are discussed in Section 15.B.4 and are given in Table 15.B-3. 15.B.2 Offsite Radiological Conse quences Calculational Models This section presents the models and equations used for calculating the integrated activity released to the environment, the accident flow paths, and the equations for dose calculations. Two major release models are considered: A single holdup system with no internal cleanup A holdup system wherein a two-region spray model is used for internal cleanup CN-2897 15.B.2.1 Accident Release Pathways. The release pathway for the accident analyzed with TID-based source methodology is given below.

Small Line Break outside Containment (Sample Line Failure and CVCS Letdown Line Failure)

The activity release to the environment due to a Small Line Break outside Containment will be direct and unfiltered, with no holdup.

15.B.2.2 Single-Region Release Model. It is assumed that any ac tivity released to the holdup volume instantaneously diffuses to uniformly occupy the hold up volume.

The following equations are used to calculate the integrated activity released from postulated accidents. t 1e0At 1 A (Eq. 15.B.2-1) where: A 1(t) = source activity at time t, Ci STPEGS UFSAR 15.B-2 Revision 15 A 1(0) = initial source activity at time t 0 , Ci 1 = Total removal constant from primary holdup volume, sec

-1 1 = d + 1 + r (Eq. 15.B.2-2) where: d = decay removal constant, sec

-1 1 = primary holdup leak or release rate, sec

-1 r = internal removal constant (i.e., sprays, plateout, etc.), sec

-1 Thus, the direct release rate to the atmosphere from the primary holdup volume R u (t) = 1 [A 1 (t)] (Eq.

15.B.2-3) where: R u(t) = unfiltered release rate, Ci/sec The integrated activity release is the integral of the above equation. IAR (t) = (Eq. 15.B.2-4) dt t 1eo 1 A 1t odtt u R t o This yields: IAR (t) = (Eq. 15.B.2-5) t 1e1 1/o 1 A 115.B.2.3 Offsite Thyroid Dose Calculation Model. Offsite thyroid doses are calculated using the equation:

D TH = j/Q j BR ij IAR THi i jDCF (Eq. 15.B.2-6) CN-2897 where: (IAR)ij = integrated activity of isotope i released (1 1) during the time interval j, Ci (BR)j = breathing rate during time interval j, m 3/sec (/Q)j = offsite atmospheric dispersion factor during time interval j, sec/m 3

1 No credit is taken for cloud depletion by ground deposition and radioactive decay during transport to the exclusion are boundary or the outer boundary of the low population zone.

STPEGS UFSAR 15.B-3 Revision 15 DCFTHi = thyroid dose conversion factor via inhalation for isotope i, rem/Ci D TH = thyroid dose via inhalation, rems 15.B.2.4 Offsite Beta Skin Dose Calculational Model. Assuming a semi-infinite cloud of gamma emitters, offsite beta skin doses are calculated using the equation:

D S = j/Q ij IAR j i iDCF (Eq. 15.B.2-7) CN-2897 where: D S = beta skin dose, rem DCF i = beta skin dose conversion factor for isotope i, rem-m 3/Ci-sec (IAR)ij = integrated activity of isotope i released during the time interval j, Ci (x/Q)j = offsite atmospheric dispersion factor during time interval j, sec/m 3 CN-2897 15.B.3 Dose Conversion Factors The thyroid (via inhalation pathway), beta skin, and gamma body (via submersion pathway) dose factors based upon Regulatory Guide 1.109 (Ref. 15.B-3) are given in Table 15.B-3.

For certain analyses, dose conversion factors (DCFs) were derived from ICRP 30 data (Reference 15.B-5) as an alternative to those based on Regulatory Guide 1.109. These DCFs may be used as a replacement for the DCFs based upon Regulatory Guide 1.109 for control room, Technical Support Center (TSC), and offsite calculations. However, unless stated in the accident description, the DCFs based upon Regulatory Guide 1.109 we re used in an analysis.

Thyroid DCF

The tabulated ICRP 30-based thyroid DCFs listed in Table 15.B-3 originate from Federal Guidance Report 11 (Ref. 15.B-6). These coefficients give committed dose equivalence (CDE) to the thyroid per unit activity of inhaled radionuclides. The coefficients were calculated using the most recent metabolic and physiologic modeling and should provide the best estimate of thyroid dose.

Skin DCF The most recent publication for skin dose conversion factors is Federal Guidance Report 12 (Ref.

15.B-7). However, these reported DCFs contain contributions to skin dose from both photons and electrons. The skin DCFs are partially corrected for gamma contribution based on the control room volume. This gives a more conservative dose calculation than beta alone. The total skin DCFs were taken from Reference 15.B-7, with the exception of Kr-89 and Xe-137, which were taken from Reference 15.B-8. The "beta skin dose" is analo gous to the Shallow Dose Equivalent (SDE) dose.

STPEGS UFSAR 15.B-4 Revision 15 The larger volume of the control room will also make a conservative gamma correction to the skin DCF for use with the smaller Technical Support Center. This is because the Murphy-Campe geometry factor term (Ref. 15.B-2) is inversely proportional to the volume, and the DCF correction is inversely related to the geometry factor which makes the DCF directly related to the node volume. Therefore, the larger control room volume makes a conservatively larger DCF.

The skin DCFs are conservative to use for offsite doses. This is because the Regulatory Guide 1.109 for skin doses are based on beta exposure only.

Including the control room volume-corrected gamma contribution in the offsite skin doses is more conservative than beta only.

Total Body DCF

The Total Body DCF taken from Federal Guidance Report 12 assumes submersion in a semi-infinite

cloud of effluent. The cloud concentration is assumed to be uniform throughout the problem domain. Whole body DCFs were taken from Federal Guid ance Report 12 with the exception of Kr-89 and Xe-137, which were taken from Reference 15.B-8.

The "whole body dose" is equivalent to the Deep Dose Equivalent (DDE) dose.

STPEGS UFSAR 15.B-5 Revision 15 REFERENCES 15.B-1 International Commissi on on Radiation Protection (ICRP), "Report to Committee II on Permissible Dose for Internal Radiation," International Commission on Radiation Protection (ICRP), Publication 2, 1959. CN-2897 15.B-2 Not Used 15.B-3 "Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50 Appendix I," USNRC Regulatory Guide 1.109, Rev. 1, October 1977. CN-2897 15.B-4 Not Used 15.B-5 International Commission on Radiation Protection (ICRP), "Limits for Intakes of Radionuclides by Workers," ICRP Publication 30, Annals of the ICRP Volume 2, 1979. 15.B-6 U.S. Environmental Protection Agency, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," Federal Guidance Report No. 11, EPA-520/1-88-020, " September 1988.

15.B-7 U.S. Environmental Protection Agency, "External Exposure to Radionuclides in Air, Water and Soil," Federal Guidance Report No. 12, EPA 402-R-93-081, September 1993.

15.B-8 U.S. Department of Ener gy, "External Dose-Rate Conversio n Factors for Calculation of Dose to the Public," DOE/EH-0070, July 1988.

STPEGS UFSAR 15.B-6 Revision 15 TABLE 15.B-1 DISPERSION FACTORS Evaluation Point Minimum Distance from Plant Time Period. Hrs 5 percentile x/Q (sec/m

3) EZB* 1,430 m 0-2 1.2 x 10-4 LPZ** 4,800 m 0-2 3.8 x 10-5 2-8*** 1.6 x 10-5 8-24 1.1 x 10-5 24-96 4.3 x 10-6 96-720 1.2 x 10-6
  • Minimum exclusion zone boundary is 1,430 m. ** Outer boundary of low population zone is 4,800 m from plant.
      • LOCA analysis uses this x/Q value for LPZ 0-8 hr time period.

STPEGS UFSAR 15.B-7 Revision 15 TABLE 15.B-2 BREATHING RATES FOR AN INDIVIDUAL OFFSITE Time Period After Accident Breathing Rate 0 -8 hours 3.47x 10-4 m 3/sec 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.75 x 10-4 m 3/sec 24 hrs - 30 days 2.32 x 10-4 m 3/sec STPEGS UFSAR 15.B-8 Revision 15 TABLE 15.B-3 DOSE CONVERSION FACTORS USED IN ACCIDENT ANALYSIS Based on ICRP 2 and Reg Guide 1.109 Based on ICRP 30 Total Body Beta Skin Thyroid Total Body Beta Skin Thyroid Nuclide (rem-m 3/ ci-sec) (rem-m 3/ ci-sec) (rem/ci) (rem-m 3/ ci-sec) (rem-m 3/ ci-sec) (rem/ci) I-131 8.72E-2 3.17E-2 1.49E+6 6.734E-2 4.087E-2 1.080E+6 I-132 5.13E-1 1.32E-1 1.43E+4 4.144E-1 1.617E-1 6.438E+3 I-133 1.55E-1 7.35E-2 2.69E+5 1.088E-1 1.032E-1 1.798E+5 I-134 5.32E-1 9.23E-2 3.73E+3 4.810E-1 2.011E-1 1.066E+3 I-135 4.21E-1 1.29E-1 5.60E+4 2.953E-1 1.153E-1 3.130E+4 Kr-83M 2.40E-6 NA NA 5.550E-6 1.547E-5 NA Kr-85M 3.71E-2 4.63E-2 NA 2.768E-2 5.468E-2 NA Kr-85 5.1E-4 4.25E-2 NA 4.403E-4 4.843E-2 NA Kr-87 1.88E-1 3.08E-1 NA 1.524E-1 3.482E-1 NA Kr-88 4.66E-1 7.51E-2 NA 3.774E-1 1.221E-1 NA Kr-89 5.26E-1 3.2E-1 NA 3.232E-1 3.981E-1 NA Xe-131m 2.9E-3 1.51E-2 NA 1.439E-3 1.544E-2 NA Xe-133m 7.96E-3 3.15E-2 NA 5.069E-3 3.227E-2 NA Xe-133 9.32E-3 9.70E-3 NA 5.772E-3 1.145E-2 NA Xe-135m 9.89E-2 2.25E-2 NA 7.548E-2 3.144E-2 NA Xe-135 5.38E-2 5.90E-2 NA 4.403E-2 7.066E-2 NA Xe-137 4.50E-2 3.87E-1 NA 3.026E-2 4.642E-1 NA Xe-138 2.80E-1 1.31E-1 NA 2.135E-1 1.728E-1 NA STPEGS UFSAR 15.B-9 Revision 15 TABLE 15.B-4 AVERAGE GAMMA AND BETA ENERGY FOR NOBLE GASES AND IODINES (MEV/dis)

Nuclide E E B Xe-131m 0.0029 0.16 Xe-133m 0.02 0.212 Xe-133 0.03 0.153 Xe-135m 0.43 0.099 Xe-135 0.246 0.325 Xe-138 1.2 0.66 Kr-85M 0.156 0.253 Kr-85 0.0023 0.251 Kr-87 0.793 1.33 Kr-88 2.21 0.248 I-131 0.38 0.19 I-132 2.2 0.52 I-133 0.6 0.42 I-134 2.6 0.69 I-135 1.4 0.43 STPEGS UFSAR 15.C-1 Revision 15 CN-2897 APPENDIX 15.C FISSION PRODUCT INVENTORIES FOR AST-BASED ANALYSES This appendix describes the fission product inventories and paramete rs used for the analyses of various postulated accidents using the Alternative Source Term from Regulatory Guide 1.183. 15.C.1 Activities in the Core The calculation of the core iodine and noble gas fission product inve ntories is performed with the ORIGEN 2.1 code (Reference 15.C-1). The source term is based upon a power level of 4100 MW thermal, 5 w/o enrichment, and a 3 region core with equilibrium cycle core at end of life. The three regions have operated at a specific power of 39.3 MW/MTU for 509, 1018, and 1527 EFPD (20,000 MWD/MTU, 40,000 MWD/MTU, and 60,000 MWD/MTU), respectively. The assumed period of irradiation was sufficient to allow the activity of dose-significant radionuclides to reach equilibrium or to reach maximum values. The assumed power level is greater than the Rated Thermal Power of 3853 MWth plus a 0.6% measurement uncertainty. The Alternate Source Term (AST) described in

Regulatory Guide 1.183 (Reference 15.C-2) requires the consideration of additional radionuclides to ensure that the TEDE dose (which considers organs other than t hyroid) is properly calculated. The core activities are given in Table 15.C-1. 15.C.2 Activities in the Fu el Pellet-Cladding Gap The fuel-clad gap activities are determined usi ng the guidance provided in Regulatory Guide 1.1.83. To conform with this regulatory guidance, 5% of the core inventory of iodine and noble gas is assumed to be in the fuel-clad gap, excluding I-131 and Kr-85, where 8% and 10% are assumed, respectively. Additionally, Table 3 of Regulatory Guide 1.183 shows that 12% of the core cesium and rubidium should be assumed to be in the fuel-clad gap.

Peak Pin Evaluation for non-LOCA Fuel Gap Inventory Footnote 11 for Regulatory Guide 1.183, Table 3, Non-LOCA Fraction of Fi ssion Product Inventory in Gap, states that the release fractions for Table 3 are "acceptable for use with currently approved LWR fuel with a peak burnup of 62,000 MWD/MTU provided that the maximum linear heat generation rate does not exceed 6.3 kW/ft peak rod average power for burnups exceeding 54

GWD/MTU" (the "54/

6.3" criteria).

Westinghouse's core design code ANC (Reference 15.C-3) was used to calculate the best estimate pin power and pin burnup for a fuel cycle. For the purpose of this evaluation, the code is used to calculate and edit the limiting relative power and the limiting pin burnup of the assembly for Unit 1 Cycles 13 and 14 and Unit 2 Cycle 12. The 3 cycles ev aluated are typical 18-month cycles that were designed for about 500 EFPD hot full power energy plus an additional 30 EFPD of coastdown operation.

STPEGS UFSAR 15.C-2 Revision 15 The evaluation selected the limiting relative pin power and the limiting pin burnup of the assembly. This assessment approach is conservatively bounding as it assumes that the maximum power rod is also the maximum burnup rod of the assembly.

At hot full power condition (3853 Mwth), the average linear power density of a fuel pin is 5.4 Kw/ft. Therefore, the 6.3 Kw/ft pin power limit corresponds to a "relative" pin power value of 1.167 (norma lized to an average of 1.0). CN-2897 The Unit 2 Cycle 12 maximum relative pin power for burnup exceeding 54 GWD/MTU is 1.055, well below the 1.167 limit. The maximum pin bu rnup for the cycle, including 30 EFPD of coastdown, is 58,433 MWD/MTU. The Unit 1 Cycle 13 limiting pin burnup remains below 54

GWD/MTU at the end of hot full power (cycle burnup about 19350 MWD/MTU). The maximum pin burnup slightly exceeded 54 GWD/MTU at extended coastdown (20700 MWD/MTU). However, since the limiting burnup assemblies are located on the core periphery, the relative pin power is only 0.901, well below the 1.167 limit.

The Unit 1 Cycle 14 limiting pin burnup exceeds 54 GWD/MTU at the middle of the cycle (about 9,000 MWD/MTU). Assemblies having high pin bur nup are located on the core periphery. The relative pin powers for these assemb lies are less than 0.7. As the core depletes, 8 of the in-board assemblies have maximum pin burnup exceeding 54 GW D/MTU near the end of the cycle. The maximum relative pin power for these assemblies reaches 1.042 at the end of hot full power (about 18380 MWD/MTU). The maximum pin burnup remain s below 58 GWD/MTU. Continued operation with power coastdown does not show an increase in the relative pin power. The highest pin burnup for the cycle, including a power coastdown to 19500 MWD/MTU, is 60,588 MWD/MTU. The relative pin power for the assembly is 0.703. All parameters are well below the limits specified in the Regulatory Guide 1.183.

The above evaluation of STP's typical cycle designs shows that the "54/6.3" criteria is met with significant margin. The highest relative pin power for pin bur nup greater than 54 GWD/MTU is 1.055, which corresponds to a linear heat rate of about 5.7 Kw/ft. STP uses a low-low core leakage design, placing high burnup fuel on the core periphery, to improve the fuel economy. As a result, the high burnup fuel assemblies typically have a low relative power. In some instances, a limited number of twice-burned fuel assemblies may be placed in inboard locations to optimize the core power peaking behavior. In this case, the assembly will be driven to have a higher power. Unit 2 Cycle 12, for instance, has a peak pin power of 1.055 for burnups greater than 54 GWD/MTU. Inboard placements of these assemblies are usually planned one cycle in advance and are evaluated during the cycle design to make sure the power peaking and pin burnup are not outside the norm. STP plans to continue to use this design approach for future core designs; therefore, it is expected that the "54/6.3" criteria will continue to be met with adequate margin.

Currently, the licensed limit for the maximum burnup of a fuel pin is 62,000 MWD/MTU. However, the 6.3 Kw/ft pin power limit for burnup greater than 54 GWD/MTU is not currently a requirement for reload cycle design verification. To ensure this criterion is met in future cycles, the procedure used to check the adequacy of a core design includes an evaluation on the pin power/burnup of the design core.

In summary, an evaluation was performed to determine the best estimate fuel rod average burnup and power for STP's typical 18-month cycle designs. The evaluation shows that the Regulatory Guide "54/6.3" criteria for the application of Alternative Source Term are met with significant margin. The STPEGS UFSAR 15.C-3 Revision 15 highest relative pin power for pin burnup greater than 54 GWD/

MTU is 1.055, which corresponds to a linear heat rate of 5.7 Kw/ft. STP plans to continue to use a low-lo w leakage core design approach and it is expected that the "54/6.3" criteria will continue to be met. 15.C.3 Concentrations in the Coolants Primary Coolant Since the iodine concentrations at 1% failed fuel bound the concentrations for the normal Technical Specification limit of 1 Ci/gm DE I-131, the concen trations corresponding to the 1% failed fuel condition are used. The RCS concentrations at 1% failed fuel are pres ented in Table 15.C-2.

Pre-Existing Iodine Spike to the Tech Spec Limit of 60 Ci/gm During full-power operation, the primary coolant c oncentration Technical Specification limit for continued operation up to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> is 60 Ci/g of equivalent I-131. The iodine limit takes into account an iodine spike o ccurring because of a prev ious power transient.

The initial iodine concentration in the reactor coolant is based on 60 Ci/gm DE I-131. Equation 1 shows the formulation for calculating DE I-131.

60 131 135 135 131 134 134 131 133 133 131 132 132 131DCF DCF DCF DCF DCF DCF DCF DCF (Eq 1) where, 131 = concentration of I-131 132 = concentration of I-132 CN-2897 133 = concentration of I-133 134 = concentration of I-134 135 = concentration of I-135 DCF 131 = I-131 dose conversion factor DCF 132 = I-132 dose conversion factor DCF 133 = I-133 dose conversion factor DCF 134 = I-134 dose conversion factor DCF 135 = I-135 dose conversion factor

The relative abundance of each isotope in the RCS is used in conjunction with Equation 1 to solve for the five concentrations. The concentration of ea ch isotope in the RCS, ba sed on 1% failed fuel, is presented in Table 15.C-2. The dose conversi on factors are in Table 15.D-10. These dose conversion factors are the thyroid conversions from Reference 15.C-6.

The following relationships are based on the concentrations in Table 15.C-2.

131 1327.14.2 131 1337.18.2 131 1347.152.0 131 1357.16.7 The relationships above are substituted in Equation 1 and this equation is solved for 131.

STPEGS UFSAR 15.C-4 Revision 15 The reactor coolant concentrations corresponding to these Technical Specification limits are given in Tables 15.C-3 and -4.

Coincident or Accident-Induced Iodine Spiking The effects of iodine spiking caused by an accident have been accounted for by increasing the iodine source term in the primary system upon depressu rization or reactor sh utdown. The iodine concentration during the iodine spike is governed by the fo llowing differential equation:

i RCS i RCS Lii i N M LR N M fNP dt dN where: P i = Production Rate for Nuclide i, Ci / gm-sec = Radioactive Decay Constant for Nuclide, i, sec

-1 N i = Concentration of Nuclide i, Ci / gm L = Letdown Flow, gm / sec M RCS = RCS mass, gm = Letdown Demineralizer Efficiency/100, unitless LR = Rate of Reactor Coolant System Identified and Unidentified Leakage (as allowed by plant Technical Specifications), gm / sec The release rate from the fuel is increased by an accident-dependent factor (over the equilibrium condition release rate) to model the effect of the spike. The iodine, cesium, and rubidium in the reactor coolant for a MSLB coincident iodine spike are given in Table 15.C-5. Similarly, the iodine, cesium, and rubidium in the reactor coolant system for the SGTR coincident iodine spike are given in Table 15.C-6.

Secondary System Source Terms The initial iodine concentration in the secondary systems is based on the Technical Specification limit of 0.10 Ci/gm DE I-131. Equation 2 shows the formulation for calculating DE I-131.

10.0 131 135 135 131 134 134 131 133 133 131 132 132 131DCF DCF DCF DCF DCF DCF DCF DCF (Eq 2) CN-2897 where, 131 = concentration of I-131 132 = concentration of I-132 133 = concentration of I-133 134 = concentration of I-134 135 = concentration of I-135 DCF 131 = I-131 dose conversion factor DCF 132 = I-132 dose conversion factor DCF 133 = I-133 dose conversion factor STPEGS UFSAR 15.C-5 Revision 15 CN-2897 DCF 134 = I-134 dose conversion factor DCF 135 = I-135 dose conversion factor The relative abundance of each isotope in the RCS is used in conjunction with Equation 2 to solve for the five concentrations. The concentration of ea ch isotope in the RCS, ba sed on 1% failed fuel, is presented in Table 15.C-2.

The following relationships are based on the concentrations in Table 15.C-9.

131 1327.14.2 131 1337.18.2 131 1347.152.0 131 1357.16.7 The relationships above are substituted in Equation 2 and this equation is solved for 131.

The noble gas concentrations and the organic iodine concentration are determined as a function of the primary-to-secondary leak rate and the steam flow rate (1.574E+07 lbm/hr). The RCS concentrations are taken from Table 15.C-2. The secondary concentra tions are calculated usi ng the equation below.

RateFlowSteam Leakrate Secondary to Primary ion Concentrat RCS ion Concentrat Secondary The initial RCS and secondary activities are presented in Table 15.C-9. The RCS mass used for calculating the activities is 2.658E+8 gm. The secondary mass is 659,412 lbm (2.991E+8 gm). This results in the secondary side concentration of a nuclide being a factor of 3.18E-5 that of the primary side concentration.

Iodine Species Released from Steam Generators For the applicable accidents, the release of iodines from the fuel (and RCS) is modeled in accordance with Regulatory Guide 1.183 (Appendix E.4: 4.85% elemental, 0.15% organic, and 95% particulate.

Appendix E also states that the i odine release from the SG should be 97% elemental and 3% organic.

This is a result of not releasing the particulates that comprise 95% of the RCS flow mixing into the bulk SG water. However, Section 5.5.4 allows for a partition factor of 100 for iodines and states that

"[t]he retention of particulate radionuclides in the steam generators is limited by the moisture carryover for the steam generators." The contradiction is that in A ppendix E, Section 4, the particulates are seemingly not released and in Section 5.5.4 there is some guidance on handling particulates.

STPEGS UFSAR 15.C-6 Revision 15 The STP analysis, therefore, make two assumptions: CN-2897 1. Organic iodines are released without the reduction of 100 afforded by the partition factor granted in Appendix E, Section 5.5.4; and

2. Release of iodine particulates will be modeled, in seeming contradiction to Appendix E, Section 4, but using the partition factor of 100.

Therefore, the 4.85/0.015/95 split from the RCS becomes

100 95/115.0/10085.4 when the partition factors are applied. The resulting split is then 0.0485/0.15/0.95 among the iodine species. Renormalizing, the fractions are 4.2% elemental, 13.1% organic, and 82.7% particulate.

The analysis input uses the Regulatory Guide 1.183 split of 4.85% elemental/ 0.15% organic/ 95%

particulate. However, after the application of the partition factors, the effective release to the environment is then 4.2% elemental/ 13.1% organi c/ 82.7% particulate. Note that the number of curies of iodines released is greater than that required by Regulatory Guide 1.183 (particulates are released and no partition factor is used to reduce the amount of organics released).

STPEGS UFSAR 15.C-7 Revision 15 CN-2897 References 15.C-1 ORNL RSICC CCC-371, ORIGEN2, V2.1, Isotope Generation and Depletion Code -

Matrix Exponential Method, August 1991.

15.C-2 Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors", USNRC, July 2000.

15.C-3 Liu, Y. S., et al., "ANC: A Wes tinghouse Advanced Nodal Code", WCAP-10965-A (Proprietary) and WCAP-10966-A (Non

-Proprietary), September 1986.

15.C-4 Regulatory Guide 1.109, "Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance W ith 10 CFR Part 50, Appendix I," Revision 1, October 1997.

15.C-5 International Commissi on on Radiation Protection (ICRP), "Report to Committee II on Permissible Dose for Internal Radiation," International Commission on Radiation Protection (ICRP), Publication 2, 1959.

15.C-6 "Federal Guidance Report No. 11, Lim iting Values of Radionuclide Intake and Air Concentration and Dose Conversion factors for Inhalation, Submersion, and Ingestion," EPA 520/1-88-020, Environmental Protection Agency, Washington, D.C., 1988.

STPEGS UFSAR 15.C-8 Revision 15 CN-2897 TABLE 15.C-1 REACTOR CORE SOURCES Isotope Core Sources (Ci) Isotope Core Sources (Ci) Kr83m 1.40E+07 Te131m 1.50E+07 Kr85m 2.90E+07 Ba137m 1.20E+07 Kr85 1.20E+06 Ba140 1.90E+08 Kr87 5.50E+07 Ru103 1.60E+08 Kr88 7.80E+07 Ru105 1.10E+08 Kr89 9.50E+07 Ru106 5.50E+07 Xe131m 1.10E+06 Y91 1.40E+08 Xe133m 6.80E+06 Y92 1.40E+08 Xe133 2.20E+08 Y93 1.60E+08 Xe135m 4.20E+07 Zr95 1.80E+08 Xe135 5.50E+07 Zr97 1.80E+08 Xe137 1.90E+08 Nb95 1.30E+08 Xe138 1.80E+08 La140 1.90E+08 I131 1.06E+08 La142 1.70E+08 I132 1.52E+08 Pr143 1.60E+08 I133 2.20E+08 Nd147 7.10E+07 I134 2.40E+08 Ce141 1.80E+08 I135 2.00E+08 Ce143 1.70E+08 Cs134 2.20E+07 Ce144 1.40E+08 Cs136 6.30E+06 Sr89 1.10E+08 Cs137 1.30E+07 Sr90 9.70E+06 Sb129 3.40E+07 Sr91 1.30E+08 Te129m 5.00E+06 Sr92 1.40E+08 Te129 3.30E+07 STPEGS UFSAR 15.C-9 Revision 15 TABLE 15.C-2 REACTOR COOLANT SOURCES @ 1% FAILED FUEL Isotope RCS (Ci/gm) Isotope RCS (Ci/gm) Kr83m 3.7E-01 Te131m 1.6E-02 Kr85m 1.5E+00 Te132 1.8E-01 Kr85 7.6E+00 Ba137m 1.0E+00 Kr87 9.8E-01 Ba140 2.5E-03 Kr88 2.8E+00 Mo99 4.6E-01 Kr89 8.4E-02 Tc99m 4.2E-01 Xe131m 2.8E+00 Ru103 3.3E-04 Xe133m 4.2E+00 Ru106 1.1E-04 Xe133 2.4E+02 Y91 3.2E-04 Xe135m 4.0E-01 Y92 7.8E-04 Xe135 7.6E+00 Y93 2.5E-04 Xe137 1.6E-01 Zr95 3.8E-04 Xe138 5.8E-01 Nb95 3.8E-04 I131 1.7E+00 La140 7.0E-04 I132 2.4E+00 Pr143 3.6E-04 I133 2.8E+00 Ce143 3.1E-04 I134 5.2E-01 Ce144 2.8E-04 I135 7.6E+00 Sr89 2.4E-03 Rb86 1.7E-02 Sr90 1.2E-04 Rb88 3.7E+00 Sr91 3.8E-03 Rb89 1.7E-01 Sr92 1.0E-03 Cs134 1.4E+00 Cs136 2.5E+00 Cs137 1.1E+00 Te129m 6.3E-03 Te129 1.0E-02 CN-2897 STPEGS UFSAR 15.C-10 Revision 15 TABLE 15.C-3 RCS IODINE CONCENTRATIONS FOR A PRE-EXISTING IODINE SPIKE TO 60 Ci/gm Isotope Iodine Concentrations (Ci/gm) I-131 42.5 I-132 60.0 I-133 70.0 I-134 13.0 I-135 190.0 CN-2897 STPEGS UFSAR 15.C-11 Revision 15 CN-2897 TABLE 15.C-4 TOTAL RCS Cs AND Rb ACTIVITY FOR A PRE- EXISTING IODINE SPIKE Isotope Total RCS Cs and Rb Activity (ci) Rb-86 1.36E+2 Rb-88 2.95E+4 Rb-89 1.34E+3 Cs-134 1.12E+4 Cs-136 1.99E+4 Cs-137 8.77E+3 STPEGS UFSAR 15.C-12 Revision 15 CN-2897 TABLE 15.C-5 RCS ISOTOPE INVENTORY DUE TO ACCIDENT-INDUCED SPIKE FOR A MSLB (500X RELEASE RATE)

Isotope Iodine Activity (Ci) I-131 1.73E+05 I-132 5.62E+05 I-133 3.23E+05 I-134 2.35E+05 I-135 1.12E+06 Rb-86 2.06E+03 Rb-88 5.07E+06 Rb-89 2.65E+05 Cs-134 1.68E+05 Cs-136 3.04E+05 Cs-137 1.32E+05 STPEGS UFSAR

CN-2897 TABLE 15.C-6 RCS IODINE INVENTORY DUE TO AN 8-HOUR ACCIDENT-INDUCED SPIKE FOR A SGTR ACCIDENT (335X RELEASE RATE)

Isotope Iodine Activity Ci I-131 1.16E+05 I-132 3.77E+05 I-133 2.16E+05 I-134 1.57E+05 I-135 7.44E+05

15.C-13 Revision 15

STPEGS UFSAR 15.C-14 Revision 15 TABLE 15.C-7 RCS AND SECONDARY CONCENTRATIONS AND ACTIVITIES FOR A PRE-EXISTING IODINE SPIKE (RCS @60 Ci/gm) (Secondary @ 0.1 Ci/gm DEI, Noble Gases Based On 1% Failed Fuel)

Isotope Concentration RCS (Ci/gm) Secondary (Ci/gm) Activity RCS (Ci) Secondary (Ci) I-131 4.25E+01 7.08E-02 1.1E+04 2.1E+01 I-132 6.00E+01 1.00E-01 1.6E+04 3.0E+01 I-133 7.00E+01 1.17E-01 1.9E+04 3.5E+01 I-134 1.30E+01 2.17E-02 3.5E+03 6.5E+00 I-135 1.90E+02 3.17E-01 5.1E+04 9.5E+01 Kr-83m 3.7E-01 1.2E-05 9.8E+01 3.6E-03 Kr-85m 1.5E+00 4.8E-05 4.0E+02 1.4E-02 Kr-85 7.6E+00 2.4E-04 2.0E+03 7.2E-02 Kr-87 9.8E-01 3.1E-05 2.6E+02 9.3E-03 Kr-88 2.8E+00 8.9E-05 7.4E+02 2.7E-02 Kr-89 8.4E-02 2.7E-06 2.2E+01 8.1E-04 Rb-86 1.7E-02 5.4E-07 4.5E+00 1.6E-04 Rb-88 3.7E+00 1.2E-04 9.8E+02 3.6E-02 Rb-89 1.7E-01 5.4E-06 4.5E+01 1.6E-03 Xe-131m 2.8E+00 8.9E-05 7.4E+02 2.7E-02 Xe-133m 4.2E+00 1.3E-04 1.1E+03 3.9E-02 Xe-133 2.4E+02 7.6E-03 6.4E+04 2.3E+00 Xe-135m 4.0E-01 1.3E-05 1.1E+02 3.9E-03 Xe-135 7.6E+00 2.4E-04 2.0E+03 7.2E-02 Xe-137 1.6E-01 5.1E-06 4.3E+01 1.5E-03 Xe-138 5.8E-01 1.8E-05 1.5E+02 5.4E-03 Cs-134 1.4E+00 4.5E-05 3.7E+02 1.3E-02 Cs-136 2.5E+00 8.0E-05 6.6E+02 2.4E-02 Cs-137 1.1E+00 3.5E-05 2.9E+02 1.0E-02 Cs-138 8.9E-01 2.8E-05 2.4E+02 8.4E-03 CN-2897 STPEGS UFSAR 15.D-1 Revision 15 CN-2897 APPENDIX 15.D DOSE MODELS FOR AST-BASED ANALYSES This appendix describes the mathematical models and parameters used for the fission product transport from the postulated accident site to the environment and fo r the radiological dose calculations for analyses using the Alternative Source Term from Regulatory Guide 1.183 (Reference 15D-1). 15.D.1 Meteorology and Atmospheric Dispersion The meteorological measurement program at STP is described in UFSAR Section 2.3.3. The /Q values used for the AST application have been developed using data obtained for the years 2000 to 2004. The /Q values resulting at the Control Room inta ke are calculated using the NRC-sponsored computer code ARCON96 (Reference 15.D-2) consistent with the pr ocedures in Regulatory Guide 1.194, "Atmospheric Relative Concentrations for Control Room Radiol ogical Habitability Assessments at Nuclear Power Plants," (Reference 15.D-3).

The /Q values resulting at the EAB and LPZ are calculated using the NRC-sponsored computer code PAVAN (Reference 15.D-4), consistent wi th the procedures in Regulatory Guide 1.145 (Reference 15.D-5).

15.D.1.1 PAVAN Analysis of EAB and LPZ /Q The minimum EAB and LPZ boundaries are located at 1430 m and 4800 m. The postulated releases do not qualify as elevated releases in accordance with Regulatory Guide 1.145; therefore, they were executed by PAVAN as "ground" type releases requiring an assumption of a 10 m release height. The minimum cross sectional area of the containment bu ilding used for the building wake calculation is 2734 m 2. A containment height of 61.9 meters was used for the build ing wake factor in the annual average calculation.

Meteorological data from the five-year period, (2000 - 2004) were used in the PAVAN analysis.

The /Q values for offsite locations were evaluated using the methods of Regulatory Guide 1.145. The offsite /Q values calculated for the AST analyses are presented in Table 15.D-1. The 0-2 hr /Q is used for the worst 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> doses in the AST dose analyses.

STPEGS UFSAR 15.D-2 Revision 15 15.D.1.2 Control Room and Technical Support Center /Q Analyses CN-2897 For each unit at STP, there are three release points:

the containment building outer wall surface; the Plant Vent; and, the SG power operated relief valve (PORV) nearest the Control Room intake (this is also the area of the steam release for a postulated MSLB)

These points are illustrated in Figure 15.D-1.

For all postulated accidents, steam releases from the secondary system (inc luding the MSLB) are all assumed to occur in the Isolati on Valve Cubicle (IVC), located betw een the containment building and the turbine building. This structure houses the main steam lines, the safety relief valves and the SG PORVs. The distance from the closest SG PORV to the control room HVAC emergency intake was

used as the basis for the PORV-to-CRE /Q. Since this maximizes the /Q, a /Q for each PORV, steam line, or safety relief valve was not generated. The PORV-to-CRE /Q is used for all secondary system steam releases.

Releases from the Fuel Handli ng Building (for the Fuel handli ng Accident and the LOCA ESF leakage) are vented to the atmo sphere via the Plant Vent. The RCB normal and supplemental purge is also via the same Plant Vent. Therefore, for the FHA releases and the LOCA supplemental purge release, the Plant-Vent-to-Control Room /Q is used. Releases from the RCB Personnel Airlock are also exhausted via this Plant Vent. The Plant-Vent-to-Control Room /Q also bounds a release from the RCB Equipment Hatch opening since the Plant Vent is much closer to the Control Room air intake than the Equipment Hatch (which is located on the southwes t quadrant of the RCB).

Each unit at STP has two associated receptors, the Control Room Emergency Makeup Air Intake and the Electrical Auxiliary Building Air Intake. The Control Room Emergency Makeup Air Intake is the air intake for both the Control Room and the Technical Support Center (TSC) HVAC systems.

The Control Room and TSC are bot h wholly contained w ithin the Elec trical Auxiliary Building. Therefore, unfiltered in-leakage entering either the Control Room or the TSC would come from the Electrical Auxiliary Building atmos phere. Since the Electrical Auxiliary Building Air Intake is adjacent to the Control Room Emergency Makeup Air Intake, the /Q values calculated for the Control Room/TSC are also used for the Electrical Auxiliary Building and the unfiltered in-leakage entering either the Control Room or the TSC.

The postulation of a loss of offsite power does not change the location of release points or receptor locations. Steam releases from the secondary side are conservatively assumed to be released through the PORVs in the IVC. This is closer to the CR/TSC HVAC intake than any release points in the Turbine Generator Building (TGB).

Control Room /Q values for releases from the containment, from the plant vent, and from the PORV area were calculated using the computer code ARCON96 using the methods of Regulatory Guide 1.194. The STP meteorological databases for the five-year period (2000 - 2004) were used in the ARCON96 modeling analysis. Wind measurements were taken at 10 m and the vertical temperature STPEGS UFSAR 15.D-3 Revision 15 difference was measured between 60 m and 10 m. The minimum wind speed (i.e., wind threshold) was set to the ARCON96 default value of 0.5 m/sec in accordance with Regulatory Guide 1.194, Table A-2. CN-2897 ARCON96 requires the direction from the receptor to the source. Because plant north and true north are aligned, there is no need to correct directions. Using guidance from Section 3.2.4.5 of Regulatory Guide 1.194, the containment surface rel eases are taken to be on the surface of the containment at the horizontal location closest to the receptor. The release elevation for containment surface releases, using the Section 3.2.4.5 of Regulatory Guide 1.194, is the vertical center of the above-grade portion of the containment projected on a plane tangent to the containment surface and perpendicular to the line of sight from the containment center to the intake. Accordingl y, the elevation of the containment leakage is determined to be 129.5 feet.

Using Sections 3.2.4.4 and 3.2.4.5 of Regulatory Guide 1.194, the initial sigmas for the containment

surface source are:

Y0 = 26' 4" = 8.03 m, and Y0 = 33' 10" = 10.31 m.

To determine the building area, the guidance in Regulatory Guide 1.194, Table A-2, was followed.

The area to be used for each release point was chosen to be the vertical cross-section of the building that has the largest impact on the building wake for the release point. For all of the release points considered, the largest impact on the building wake is the containment building. The containment is treated as a right cylinder surmounted by half of a spheroid with horizontal radius equal to the cylinder radius and vertical radius equal to the height difference between the containment spring line and the top of the containment.

The vertical cross-sec tion is thus a rectangle surmounted by half an ellipse with those same dimensions. The grade el evation is 28'0", the containment spring line is 153'0", and the top of the containment is 231'0". The containment radius is 79'0". The resulting area of the containment is 29,429 ft

2.

The plant grid system is used to place release and receptor locations on a Cartesian coordinate grid. With the grid data, distances ar e computed using the Pythagorean Theorem in two dimensions (x,y) only. Distances between release locations and receptor points are presented in Table 15.D-2. All releases are treated as point sources , with the exception of containment leakage, which is treated as a diffuse source. The height of these release points are all less than 2.5 times the height of their adjacent buildings and therefore, in accordance with Regulatory Guide 1.194, are modeled as "ground level" releases. Buoyancy or mechanical jets of high energy releases ar e not credited in the /Q analyses.

A /Q value was determined from each release point in both units to each receptor in that unit. The maximum /Q value for a release point/receptor point pair in one unit was used in the analyses (for example, the /Q value from the PORV in Unit 2 to the Control Room in Unit 2, and the /Q value from the RCB in Unit 1 to the Control Room in Unit 1). The 0-2 hr /Q is used for the worst 2-hour doses.

STPEGS UFSAR 15.D-4 Revision 15 Table 15.D-3 presents data used to develop the ARCON96 analyses. The maximum /Q for a release source-to-receptor pair in the same unit was chos en for use in the dose analyses. Table 15.D-4 presents a summary of the ARCON96 resu lts used in the radiological analyses. CN-2897 15.D.2 Analytical Models The RADTRAD code (Version 3.0.3, Reference 15.D-6) was used to determine offsite doses and doses to Control Room and Technical Support Cent er personnel. However, the Fuel Handling Accidents used a simplified spreadsheet technique.

No credit for personal protective equipment or prophylactic drugs is taken in the analyses.

The 0-2 hr X/Q is used for the worst 2-hour doses for offsite, cont rol room, and TSC dose analyses.

15.D.2.1 Offsite Dose Model The analytical equation for determining the offsite doses is described in Section 2.3.1 of the RADTRAD documentation (Reference 15.D-6). The following is a summary of that discussion.

The dose to the hypothetical individual is calculated us ing the specified /Qs and the amount of each nuclide released during the exposure period. The air immersion dose from each nuclide, n , in an environmental compartment is calculated as:

nc n envnc DCF QAD , , where = air immersion (cloudshine) dose due to nuclide n in the environment compartment (Sv) envnc D , DCFc,n = FGR 11 and 12 (References 15.D-7 and -8) air immersion (cloudshine) dose conversion factor for nuclide n as disc ussed in Section 1.4.3.3 of the RADTRAD documentation. (Sv m 3/Bq s) /Q = atmospheric relative concentration (s/m

3) A n = released activity of nuclide n (Bq). The inhalation dose from each nuclide, n, in an environmental compartment is calculated as:

ni n envniDCFBR QAD , , where = inhalation dose commitment due to nuclide n in the environment compartment (Sv) envni D , BR = breathing rate (m 3 / s) DCF i,n = inhalation dose conversion factor for nuclide n as discussed in Section 1.4.3.3 of the RADTRAD documentation (Sv/Bq)

/Q = atmospheric relative concentration (s/m

3)

STPEGS UFSAR 15.D-5 Revision 15 A n = released activity of nuclide n (Bq). CN-2897 The breathing rates used in the offsite analyses are presented in Table 15.D-5.

The TEDE is determined at the EAB for the lim iting 2-hour period and at the outer boundary of the LPZ. No correction is made for depletion of the effluent plume by deposition on the ground.

15.D.2.2 Control Room Analytical Model To determine the dose to personnel in the control room, the RADTRAD code and the built-in control room model are used. The analytical equation for determining the control room and TSC doses is described in Section 2.3.2 of the RADTRAD documentation. The following is a summary of that discussion.

The dose to a hypothetical individual in the control room is calculated based on the time-integrated concentration in the control room compartment. The air immersion dose in the control room is:

Fnc n CRncGDCFdttCD/)(, ,

Where C n (t) is the instantaneous concentration of nuclide n in the compartment. The Murphy-Campe (Reference 15.D-9) geometric factor, G F, relates the dose from an infinite cloud to the dose from a cloud of volume V as: 3380 1173 V G F The inhalation dose in the control room is Fni n CRni GDCFOFBRdttCD , ,)( where OF = occupancy factor.

The control room envelope is located at elevatio n 35 ft and in two heati ng, ventilating, and air conditioning (HVAC) rooms at elevations 10 ft a nd 60 ft. in the Electrical Auxiliary Building as shown in Figure 6.4-1 of the UFSAR.

The Control Room HVAC system is designed to maintain the control room envelope at a minimum of 0.125-inch water gauge (wg) positive pressu re relative to the surr ounding area, following postulated accidents (other than hazardous chemical/smoke releases) and/or Loss-of-Offsite Power (LOOP), by introducing makeup air equivalent to the expected exfilt ration air during plant emergency conditions (Engineered Safety Features [E SF] signal and/or high ra diation in outside air). The design outside makeup air is 2,000 ft 3/min and drawn from a single intake on the east side of the Electrical Auxiliary Building at elevation 80 ft-0 in. Additionally , during postulated accident conditions, on detection of high radi ation in the outside air or safe ty injection (SI) signal, outside STPEGS UFSAR 15.D-6 Revision 15 CN-2897 makeup air for the control room envelope is automatically routed through makeup air units and cleanup units containing charcoal filters. The control room air is also automatically recirculated partially (i.e., 10,000 ft 3/min) through control room air cleanup un its containing charco al filters. This arrangement provides cleanup of the control room air.

The control room envelope HVAC system is not connected to other areas or HVAC systems where the potential for radioactivity exists, except for sharing common air intake and exhaust with the remaining Electrical Auxiliary Building.

The Control Room HVAC model schematic is shown in Figure 15.D-2. The mathematical model used to represent the system uses a single outside air intake and a filtered make-up inflow which mixes with part of the recirculating air in the Control Room Envelope. The combined recirculating air and make-up air stream is then filtered before being supplied to the air-handling unit along with the remaining recirculating air. The air handling un it supplies the conditioned air to the control room envelope. A summary of these parameters is presented in Table 15.D-6. The assumed unfiltered in-

leakage into the control room envelope is 100 cfm.

Unless otherwise noted, the analyses assume there is an emergency diesel failure and that only two trains of HVAC are in operation. The make-up flow rate for two trains of emergency HVAC operation is 2000 cfm. The make-up flow is assumed to operate at +10% of design flow (2200 cfm).

The flow rate for two trains of Control Room HVAC recirculation flow is 8600 cfm (4300 1 cfm per train). The Control Room HVAC exhaust flow rate (Label G of Figure 15.D-2) is 2300 cfm. The Control Room HVAC exhaust flow rate is the sum of the make-up flow (Lab el A of Figure 15.D-2) and the unfiltered in-leakage (Label F of Figure 15.D-2). Also, each of the three trains of Control Room HVAC system contains two sets of 2-inch charcoal filters. The first 2-inch filter is the make-up filter. Filtered make-up air is then combined with recirculated air and then passes through the 2-inch recirculation filter before entering the Control Room.

The analyses assume that all makeup flow is unfiltered (e.g., removing the 4 inches of filtration per train, two inches for the makeup filters and two inches of the cleanup filters). Only the recirculation filtration is credited. Hence, the assumed make-up air flow (Label A on Figure 4.2-2) on Table 15.D-6 is assumed to be 0 cfm. The 2200 cfm make-up flow is added to the 100 cfm unfiltered in-leakage value (which includes the contribution from door pumping action from Control Room ingress and egress) and a total of 2300 cfm is assumed to di rectly enter the Control Room without filtration (Label F on Figure 15.D-2). No cr edit is taken for the use of non-ESF ventilation systems during the Design Basis Accident. In summary, Table 15.D-6 reflects the air flow with two trains operating while Table 15.D-7 reflects the flows used in the analyses.

CN-2910 Air flow through the cleanup filters is maintained below 70% relative humidity to ensure the assumed filter efficiencies for iodine removal used in the postulated Chapter 15 accidents (see Appendix 15D). The humidity is maintained by the cooling provided by the Essential Chilled Water System supply to the main CRE AHUs. Op eration of the heaters in the CRE HVAC 1 Per plant procedures, the acceptance criteria for the surveillance testing of the make-up flow and make-up+clean-up flow is 1000 cfm +/- 10% and 6000 cfm +/- 10%, respectively. Therefore, it is acceptable to have a recirculation flow rate of 4300 cfm ([6000 cfm x 0.9] - [1000 cfm x 1.1]) = 5400 cfm - 1100 cfm = 4300 cfm. The +/- 10% band on the flow rages is based on the acceptance criteria of TS Surveillance 4.7.7.c.3. CN-2897 STPEGS UFSAR 15.D-7 Revision 15 CN-2910 Makeup filters is not necessary to maintain the proper humidity over the charcoal beds, even assuming the pressurization air is at 100% RH.

The Control Room recirculation clean-up filter efficiencies are assumed to have 95% removal efficiency for elemental iodine and organic iodine and 99% removal efficiency for particulates. The calculated control room volume is 304,000 ft

3. Approximately 10% of this volume is occupied by walls and equipment. The volume us ed in dose analyses is 274,080 ft
3.

Note that the Fuel Handling Accident analysis does not credit either the make-up or recirculation filters. The Control Room internal air is assumed to be in equilibrium with the air outside the Control Room HVAC intake. Therefore, the Control Room is not assumed to be pressurized during the accident, nor is any assumptions made as to the functioning of the Control Room HVAC systems.

CRE Unfiltered In-leakage and Possible "Sneak" Paths The unfiltered in-leakage into the CRE is assumed to be 100 cfm for all accidents. The Control Room and the TSC are enclosed in the Electrical Auxiliary Building and the surrounding spaces are supplied by the Electrical Auxiliary Building HVAC sy stem. The intake of the Electrical Auxiliary Building HVAC system is located just south of the Control Room/TSC HVAC intakes on the east wall of the Electrical Auxiliary Bu ilding (points D/H on Fi gure 15.D-1). Since the two intakes are very close, the Control Room/TSC /Q's are used for the air entering the Electrical Auxiliary Building HVAC, and, therefore, for the unfiltered in-leakage.

Since the spaces surrounding the Control Room are in the Electrical Auxiliary Building, the chances for a more direct, unanalyzed, path (i.e., a "sneak" path) for airborne contaminants to enter the Control Room are minimized. The largest potential source of a "sneak" path is the Electrical Penetration area which is directly between the Control Room Envelope and the containment building (on the bottom of the Control Room Envelope, west of the Relay Room and Computer Room, as depicted in Figure 6.4-1) for the LOCA and Co ntrol Rod Ejection accidents. However, the possibility of leakage from the containment into the penetration area and finally into the Relay Room and Control Room Envelope is minimized by the presence of double doors between the Relay Room and the penetration area (partially shown on Figure 6.4-1). In addition, there is no equipment located in the penetration area that must be manipulated or observed in a post-accident scenario. Therefore, traffic through the doors would be minimal, if any. In consideration of the above, leakage from the penetration area into the Control Room Envelope is not considered credible. CN-2897 15.D.2.3 Technical Support Center (TSC) Analytical Model To determine the dose to personnel in the TSC, RADTRAD is used and the control room node in the code is used as the TSC. The analytical model of the TSC is identical to the one discussed for the control room in Section 15.D.2.2, above. No cr edit is taken for the use of personal protective equipment or prophylactic drugs in the accident analyses when calculating dose consequences to TSC personnel. A description of the TSC HVAC model is given below.

STPEGS UFSAR 15.D-8 Revision 15 CN-2897 It is assumed that walls and equipment occupy 25% of the TSC volume measured from exterior dimensions. The TSC volume used in radiological dose analysis is 48170 ft

3. The TSC HVAC make-up flow passes through two 2-inch carbon filters in series. However, for conservatism, this analysis assumes that all makeup flow is unfiltered. A portion of the recirculation flow from the TSC passes through the carbon filters. The remainder of the recirculation flow combines with the make-up flow prior to entering the air-handling unit. The TSC HVAC model schematic is given by Figure 15.D-3.

TSC filter efficiencies are based on two 2-inch filters in series. The TSC HVAC make-up flow rate is 1100 cfm. The TSC HVAC make-up flow rate (Label A on Figure 15.D-3) operates at +10% off design (1210 cfm). The recirculation flow rate is 5000 cfm. The recirculation flow rate (Label C) operates at -5% off design (4750 cfm). The TSC HVAC exhaust flow rate (Label H on Figure 15.D-

3) is 1225 cfm. The fan shaft in-leakage (Label F on Figure 15.D-3) is 5 cfm. The unfiltered in-leakage (Label G on Figure 15.D-3) is 10 cfm. The TSC HVAC exhaust flow rate is the sum of the make-up flow (Label A on Figure 15.D-3), the fan shaft in-leakage (Label F on Figure 15.D-3) and the unfiltered in-leakage (Label G on Figure 15.D-3).

The TSC HVAC system is non-safety; therefore, no single failures are assumed.

15.D.3 Dose Conversion Factors and Physical Parameters The dose conversion factors (DCF) used in the LOCA and FHA are the default RADTRAD values (Reference 15.D-6, Tables 1.4.3.3-1 and -2).

The DCFs used in the MSLB, SGTR, CREA, and LRA analyses are presented in Table 15.D-10. The

AST DCFs for inhalation (CEDE) and external exposure (EDE) are from Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion" (Reference 15.D-7), and Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil" (Reference 15.D-8).

The LOCA and FHA analyses use the default R ADTRAD isotopic data and progeny data (Reference 15.D-6, Table 1.4.3.2-2). Table 15.D-11 presents phys ical data for the isotope s of interest for the MSLB, SGTR, CREA, and LRA analyses. The half life data is from Reference 15.D-10. The progeny and decay fractions are from RADTRAD (Reference 15.D-6, Table 1.4.3.2-2). Some meta-stable isotopes of xenon not contained in RADTRAD are assumed to always decay to the ground state of the same isotope.

Table 15.D-12 provides the ICRP-30 CEDE DCFs (from Reference 15.D-7) for determining DE I-131 for plant surveillances in a manner consistent with the radiological analyses in Chapter 15.

STPEGS UFSAR 15.D-9 Revision 15 CN-2897 REFERENCES 15.D-1 NRC Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," USNRC, July 2000. 15.D-2 NRC NUREG - 6331, "Atmospheric Dispersion Relative Concentrations in Building Wakes," Revision 1, May 1997, ARCON 96, RSICC Computer Code Collection No. CCC-664.

15.D-3 NRC Regulatory Guide 1.194, "Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear Power Plants," USNRC, June

2003. 15.D-4 Bander, T.J., PAVAN, An Atmospheric Dispersion Program for Evaluating Design Basis Accidental Releases of Radioa ctive Materials from Nuclear Power Stations, NUREG/CR-2858, PNL-4413, Pacific Northwest National Laboratory, Richland, WA, 1982. 15.D-5 NRC Regulatory Guide 1.145, "Atmospheric Dispersion Mode ls for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, USNRC, November 1982. 15.D-6 Humphreys, S.L., et. al., RADTRAD, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," NUREG/CR-6604 Including Supplements 1 and 2 (RADTRAD version 3.

03, USNRC, October 2002). 15.D-7 U.S. Environmental Protection Agency, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," Federal Guidance Re port No. 11, EPA-520/1-88-020, " September 1988.

15.D-8 U.S. Environmental Protection Agency, "External Exposure to Radionuclides in Air, Water and Soil," Federal Guidance Report No. 12, EPA 402-R-93-081, September 1993.

15.D-9 Murphy, K.G. and Campe, K. M., "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Cr iterion 19," Paper presented at the 13 th AEC Air Cleaning Conference.

15.D-10 Nuclides and Isotopes, 14 th Edition, GE Nuclear Energy, 1989.

STPEGS UFSAR 15.D-10 Revision 15 TABLE 15.D-1

/Q VALUES FOR RADIOLOGICAL DOSE CALCULATIONS - EAB AND LPZ Time Interval EAB @ 1430m (sec/m 3) LPZ @4800m (sec/m 3) 0-2 hrs 1.44E-4 5.27E-5 2-8 hrs N/A 2.24E-5 8-24 hrs N/A 1.46E-5 1-4 days N/A 5.75E-6 4-30 days N/A 1.51E-6 CN-2897 STPEGS UFSAR 15.D-11 Revision 15 TABLE 15.D-2 GEOMETRIC RELATIONSHIPS BETWEEN RELEASE LOCATIONS AND RECEPTORS Release Location Control Room for Unit Distance (m) Direction to Source (°) Release Height (m) Receptor Height (m) U1 RCB Leakage 1 62.44 274.45 30.94 16.46 U1 Plant Vent 1 62.50 240.81 21.03 16.46 U1 East PORV 1 84.39 292.11 20.73 16.46 U2 RCB Leakage 2 62.14 274.46 30.94 16.46 U2 Plant Vent 2 62.50 240.81 21.03 16.46 U2 East PORV 2 84.11 292.19 20.73 16.46 CN-2897 STPEGS UFSAR 15.D-12 Revision 15 TABLE 15.D-3 DATA USED TO GENERATE CONTROL ROOM/TSC ARCON96 INPUTS Parameter Containment Diameter 158 feet Containment Height 203 feet Area Of Containment 29,429 ft 2 Building Area 2734.0 m 2 Distances Between Release Points And Receptors See Table 15.D-2 Effluent Vertical Velocity 0.0 m/s Vent Or Stack Flow 0.0 m 3/s Vent Or Stack Radius 0.0 m Release Height Table 15.D-2 Intake Height 16.5 m Direction: Intake To Source Table 15.D-2 Terrain Elevation Difference 0.0 m Release Type Ground level Surface Roughness Length 0.2m Minimum Wind Speed 0.5 m/s Wind Direction Sector Width 90° Sector Averaging Constant

4.3 Height

Of Lower Wind Speed Instrument 10 m Height Of Upper Wind Speed Instrument 60 m Wind Speed Units Miles per hour Initial Value Of Sigma Y 8.03 (RCB) 0.00 (Others) Initial Value Of Sigma Z 10.31 (RCB) 0.00 (Others) CN-2897 STPEGS UFSAR 15.D-13 Revision 15 TABLE 15.D-4 CONTROL ROOM AND TSC /Q VALUES (sec/m 3) Release Point Time IntervalContainmentPlant Vent PORV 0-2 hrs 2.17E-4 7.12E-4 6.13E-4 2-8 hrs 1.37E-4 5.28E-4 3.27E-4 8-24 hrs 6.15E-5 2.04E-4 1.55E-4 1-4 days 4.14E-5 1.61E-4 1.01E-4 4-30 days 2.30E-5 9.76E-5 7.18E-5 CN-2897 STPEGS UFSAR 15.D-14 Revision 15 TABLE 15.D-5 BREATHING RATES FOR AN INDIVIDUAL OFFSITE Time LPZ and EAB 0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 3.5 x 10-4 m 3/sec 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.8 x 10-4 m 3/sec 1 - 4 days 2.3 x 10-4 m 3/sec 4 - 30 days 2.3 x 10-4 m 3/sec CN-2897 STPEGS UFSAR 15.D-15 Revision 15 TABLE 15.D-6 CONTROL ROOM HVAC FLOW RATES (2 train operation)

Flow Path Figure 15.D-2 Label Flow Rate (cfm)

Make-up A 2200 1 Clean-up (or recirculation)

B 10,800 Clean-up (or recirculation)

C 8600 A/C Intake D 24,760 A/C + Clean-up Exhaust E 35,560 Unfiltered In-leakage F 100 2 Exhaust Flow G 2300 CN-2897 1 Set to 0 cfm in the analytical model. See Table 15.D-7 2 Set to 2200+100=2300 cfm in the analytical model. See Table 15.D-7 STPEGS UFSAR 15.D-16 Revision 15 TABLE 15.D-7 PARAMETERS USED IN MODELING THE CONTROL ROOM Parameter Value Pressurization (makeup) flow (Label A on Figure 15.D-2) 0 cfm 1 Pressurization (makeup) 2" filter efficiency: inorganic (elemental) organic particulate 0%

0%

0%

Clean-up (recirculati on) flow (Label C on Figure 15.D-2) 8600 cfm Clean-up (recirculation) filter efficiencies ( 2" filters (2)): inorganic (elemental) organic particulate 95%

95%

99%

Relative Humidity in the clean-up (recirculation) filters

Free Volume

<70% 274,080 ft 3

Unfiltered In-leakage (Label F on Figure 15.D-2)

(2200 cfm pressurization flow plus 100 cfm unfiltered in-

leakage, including door pumping action) 2300 cfm total

/Q's Table 15.D-4

Control Room Occupancy Factors 0-24 hrs 100% 1-4 days 60% 4-30 days 40%

Breathing Rate 3.5E-4 m 3/sec CN-2897 CN-2910 CN-2897

1 All makeup flow is assumed to be unfiltered, bypassing the 2" recirculation filters.

STPEGS UFSAR 15.D-17 Revision 15 TABLE 15.D-8 TSC HVAC FLOW RATES Flow Path Figure 15.D-3 Label Flow Rate (cfm)

Make-up A 1210 1 Clean-up (or recirc) + Make-up B 5960 Clean-up (or recirc)

C 4750 A/C Intake D 5225 A/C + Clean-up E 9975 Fan Shaft In-leakage F 5 Unfiltered In-leakage G 10 2 Exhaust Flow H 1225 CN-2897 1 Set to 0 cfm in the analysis. See Table 15.D-9.

2 Set to 1210+10+5=1225 cfm in the analysis. See Table 15.D-9.

STPEGS UFSAR 15.D-18 Revision 15 TABLE 15.D-9 PARAMETERS USED IN MODELING THE TSC Parameter Value Pressurization (makeup) flow (cfm)

(Label A on Figure 15.D-3)

0 1 Clean-up (recirculation) flow (cfm)

(Label C on Figure 15.D-3)

4750 Filter efficiencies: inorganic (elemental) organic Particulate 99%

99%

99% Free Volume

48,167 ft 3 Unfiltered Inleakage (cfm)

(Labels F & G on Figure 15.D-3)

1225 /Q Table 15.D-4 Control Room/TSC Occupancy Factors 0-24 hrs 100% 1-4 days 60% 4-30 days 40% Breathing Rate 3.5E-4 m 3/sec CN-2897 1 All makeup flow is assumed to be unfiltered, bypassing the 4" of filtration used for the makeup and recirculation pathways.

STPEGS UFSAR 15.D-19 Revision 15 TABLE 15.D-10 DOSE CONVERSION FACTORS USED IN ACCIDENT ANALYSES Isotope EDE (Sv-m 3/Bq-sec) CEDE (Sv/Bq) I-131 1.82E-14 8.89E-09 I-132 1.12E-13 1.03E-10 I-133 2.94E-14 1.58E-09 I-134 1.30E-13 3.55E-11 I-135 7.98E-14 3.32E-10 Kr-83m 1.50E-18 0 Kr-85m 7.48E-15 0 Kr-85 1.19E-16 0 Kr-87 4.12E-14 0 Kr-88 1.02E-13 0 Sr-89 7.73E-17 1.12E-08 Xe-131m 3.89E-16 0 Xe-133m 1.37E-15 0 Xe-133 1.56E-15 0 Xe-135m 2.04E-14 0 Xe-135 1.19E-14 0 Xe-138 5.77E-14 0 Rb-86 4.81E-15 1.79E-09 Rb-87 1.82E-18 8.74E-10 Rb-88 3.36E-14 2.26E-11 Rb-89 1.06E-13 1.16E-11 Cs-134 7.57E-14 1.25E-08 Cs-135 5.65E-19 1.23E-09 Cs-136 1.06E-13 1.98E-09 Cs-137 7.74E-18 8.63E-09 Cs-138 1.21E-13 2.74E-11 Ba-137m 2.88E-14 0 CN-2897 STPEGS UFSAR 15.D-20 Revision 15 TABLE 15.D-11 ISOTOPIC HALF LIFES, PARENT-TO-DAUGHTER DECAY ISOTOPES AND FRACTIONS Isotope T 1/2 (sec) Daughter 1 Fraction 1 Daughter 2 Fraction 2 I-131 6.947E+05 Xe-131m 0.1100E - I-132 8.208E+03 - - - - I-133 7.488E+04 Xe-133m 0.2900E-01 Xe-133 0.9700E+00 I-134 3.156E+03 - - - - I-135 2.365E+04 Xe-135m 0.1500E+00 Xe-135 0.8500E+00 Kr-83m 6.696E+03 - - - - Kr-85m 1.613E+04 Kr-85 0.2100E+00 - - Kr-85 3.386E+08 - - - - Kr-87 4.572E+03 Rb-87 0.1000E+01 - - Kr-88 1.022E+04 Rb-88 0.1000E+01 - - Kr-89 1.890E+02 Rb-89 0.1000E+01 - - Sr-89 4.365E+06 - - - - Xe-131m 1.028E+06 - - - - Xe-133m 1.892E+05 Xe-133 0.1000E+01 - - Xe-133 4.530E+05 - - - - Xe-135m 9.180E+02 Xe-135 0.9940E+00 Cs-135 0.6000E-03 Xe-135 3.276E+04 Cs-135 0.1000E+01 - - Xe-137 2.292E+02 - - - - Xe-138 8.460E+02 - - - - Rb-86 1.610E+06 - - - - Rb-87 1.515E+18 - - - - Rb-88 1.062E+03 - - - - Rb-89 9.240E+02 Sr-90 0.1000E+01 - - Cs-134 6.510E+07 - - - - Cs-135 7.250E+13 - - - - Cs-136 1.140E+06 - - - - Cs-137 9.510E+08 Ba-137m 0.9500E+00 - - Cs-138 1.932E+03 - - - - Ba-137m 1.531E+02 - - - - CN-2897 STPEGS UFSAR 15.D-21 Revision 15 TABLE 15.D-12 RELATIVE IMPORTANCE OF IODINE ISOTOPES FOR DE I-131 DETERMINATION Isotope CEDE DCF (rem/Ci) Relative Importance I-131 3.29E+04 1.0E+00 I-132 3.81E+02 1.2E-02 I-133 5.85E+03 1.8E-01 I-134 1.31E+02 4.0E-03 I-135 1.23E+03 3.8E-02 CN-2897

Retrieved from "https://kanterella.com/w/index.php?title=ML16207A570&oldid=1263794"