ML17046A566
Text
15.2 CONDITION II -
FAULTS OF MODERATE FREQUENCY At worst, these faults result in the reactor shutdown with the plant being capable of returning to operation.
By definition, these faults {or events) do not propagate to cause a more serious fault, i.e. Condition III or IV category.
In addition, Condition II events are not expected to result in fuel rod failures or Reactor Coolant System {RCS} over-pressurization.
For the purposes of this report the following faults have been grouped into this category:
- 1.
Uncontrolled rod cluster control assembly {RCCA) bank withdrawal from a subcritical condition
- 2.
- 3.
4
- 6.
- 7.
- 8.
- 9.
- 10.
- 11.
- 12.
SGS-UFSAR Uncontrolled RCCA bank withdrawal at power Rod cluster control assembly misalignment Uncontrolled boron dilution Partial loss of forced reactor coolant flow Startup of an inactive reactor coolant loop Loss of external electrical load and/or turbine trip Loss of normal feedwater Loss of offsite power to the station auxiliaries Excessive heat removal due to Feedwater System malfunctions Excessive load increase Accidental depressurization of the RCS 15.2-1 Revision 15 June 12, 1996
- 13.
Accidental depressurization of the Main Steam System (MSS)
- 14.
Spurious operation of the Safety Injection System (SIS) at power
- 15.
Turbine generator accidents An evaluation of the reliability of the Reactor Protection System (RPS) actuation following initiation of Condition II events has been completed and is presented in Reference 1 for the relay protection logic.
Standard reliability engineering techniques were used to assess likelihood of the trip failure due to random component failures.
Common mode failures were also qualitatively investigated.
It was concluded from the evaluation that the likelihood of no trip following initiation of Condition II events is extremely small (2 x 107 derived for random component failures}.
The Solid State Protection System (SSPS) design has been evaluated by the same methods as used for the relay system and the same order of magnitude of reliability is provided.
Hence, because of' the high reliability of the SSPS no special provision is proposed to be taken in the design to cope with the consequences of Condition II events without trip.
The time sequence of events during each Condition II fault is shown in Table 15.2-1.
15.2.1 Uncontrolled Rod Cluster Control Assembly Withdrawal from Subcritical Condition 15.2.1.1 Identification of Causes and Accident Description A RCCA withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs 15.2-2 SGS-UFSAR Revision 16 January 31, 1998
resulting in a power excursion.
Such a
transient could be caused by a
malfunction of the Reactor Control or Control Rod Drive Systems.
This could occur with the reactor either subcritical, hot zero power or at power.
The at power case is discussed in Section 15.2.2.
The uncontrolled withdrawal of a single RCCA at power is discussed in Section 15.3.5.
The reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, but some dilution of the RCS boron concentration is required before initiating control rod withdrawal to achieve reactor criticality.
The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis Uncontrolled Boron Dilution).
(Section 15.2.4, The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the assemblies from being withdrawn in other than their respective banks.
Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time.
The RCCA drive mechanisms are of the magnetic latch type, and coil actuation is sequenced to provide variable speed travel.
The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at maximum speed.
The neutron flux response to a continuous reactivity insertion is characterized by a
very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient.
This self limitation of the power burst is of primary importance since it limits the power to a tolerable level during the delay time for protection action.
Should a continuous RCCA withdrawal accident occur the transient will be terminated by the following automatic features of the RPS:
15.2-3 SGS-UFSAR Revision 28 May 22, 2015
- 1.
Source Range High Neutron Flux Reactor Trip -
actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint.
This trip function may be manually bypassed when either intermediate range flux channel indicates a flux level above the source range cutoff level.
It is automatically reinstated when both intermediate range channels indicate a flux level below the source range cutoff level.
- 2.
Intermediate Range High Neutron Flux Reactor Trip actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint.
This trip function may be manually bypassed when two of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power below this value.
- 3.
Power Ranqe High Neutron Flux Reactor Trip (Low Setting) actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power.
This trip function may be manually bypassed when two of the four power range channels indicate a
power level above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.
- 4.
Power Ranqe High Neutron Flux Reactor Trip (High Setting) -
actuated when two out of the four power range channels indicate a power level above a preset setpoint.
This trip function is always active.
In addition, control rod stops on high intermediate range flux level
{one of two) and high power range flux level {one out of four) serve to discontinue rod 15.2-4 SGS-UFSAR Revision 6 February 15, 1987
withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.
15.2.1.2 Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical accident is performed in three stages:
First an average core nuclear power transient calculation, then an average core heat transfer calculation, and finally the departure from nucleate boiling ratio (DNBR) calculation.
The average core nuclear calculation is performed, using spatial neutron kinetics methods, TWINKLE (2), to determine the average power generation with time, including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.
In the second stage, the average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN (3).
In the final stage, the average heat flux is next used in THINC (de~;cribed in Section 4.4) for transient DNBR calculation.
In order to give conservative results for a startup accident, the following assumptions are made concerning the initial reactor conditions:
- 1.
Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient conservative values
{low absolute magnitude) as a function of power are used.
See Section 15.1.6 and Table 15.1-2.
- 2.
Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response 15.2-5 SGS-UFSAR Revision 11 July 22, 1991
SGS-UFSAR time.
However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient.
The conservative value, given in Table 15.1-2, is used in the analysis to yield the maximum peak heat flux.
15.2-Sa Revision 11 July 22, 1991
THIS PAGE INTENTIONALLY BLANK 15.2-Sb SGS-UFSAR Revision 11 July 22, 1991
- 3.
'The reactor is assumed to be at hot zero power.
This assumption is more conservative than that of a lower initial system temperature.
The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific
- heats, and a
less negative (smaller absolute magnitude)
Doppler coefficient all of which tend to reduce the Doppler feedback effect thereby increasing the neutron flux peak.
The initial effective multiplication factor is assumed to be 1. 0 since this results in maximum neutron flux peaking.
- 4.
Reactor trip is assumed to be initiated by power range high neutron flux (low setting).
The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account.
A 10-percent increase is assumed for the power range flux trip setpoint raising it from the nominal value of 25 percent to 35 percent.
Previous
- results, however, show that rise in the neutron flux is so rapid that the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible.
In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.
See Section 15.1.5 for RCCA insertion characteristics.
- 5.
The maximum positive reactivity insertion rate assumed is equal to that for the simultaneous withdrawal of the combination of the two control banks having the greatest combined worth at maximum speed (45 inches per minute).
Control rod drive mechanism design is discussed in Section 3.2.3.
15.2-6 SGS-UFSAR Revision 18 April 26, 2000
- 6.
The initial power level was assumed to be below the power level expected for any shutdown condition.
The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
15.2.1.3 Results Figures 15.2-1 and 15.2-2 show the transient behavior for the indicated reactivity insertion rate with the accident terminated by reactor trip at 35 percent nominal power.
This insertion rate is equal to that for the two highest worth control banks, both assumed to be in their highest incremental worth region.
Figure 15. 2-1 shows the neutron flux transient.
The neutron flux overshoots the full power nominal value but this occurs for only a very short time period.
Hence, the energy release and the fuel temperature increases are relatively small.
The thermal flux response, of interest for DNB considerations, is also shown on Figure 15.2-1.
The beneficial effect on the inherent thermal lag in the fuel is evidenced by a peak heat flux less than the full power nominal value.
There is a large margin to departure from nucleate boiling (DNB) during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core.
Figure 15.2-2 shows the response of the average fuel and cladding temperature.
The average fuel temperature increases to a value lower than the nominal full power value.
The minimum DNBR at all times remains above the design limit.
15.2.1.4 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the RCS are not adversely affected, since the combination of thermal power and the coolant temperature result in a departure from nucleate boiling ratio (DNBR) well 15.2-7 SSGS-UFSAR Revision 18 April 26, 2000 I
I above the design limit.
of DNB.
Thus, no fuel or clad damage is predicted as a result 15.2.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal At Power 15.2.2.1 Identification of Causes and Accident Description Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux.
Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a
net increase in the reactor coolant temperature.
Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise would eventually result in DNB.
Therefore, in order to avert damage to the cladding the RPS is designed to terminate any such transient before the DNBR falls below the limit value.
The automatic features of the RPS which prevent core damage following the postulated accident include the following:
- 1.
Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint.
- 2.
Reactor trip is actuated if any two out of four AT channels exceed SGS-UFSAR an overtemperature AT setpoint.
This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
15.2-8 Revision 18 April 26, 2000
- 3.
Reactor trip is actuated if any two out of four ~T channels exceed SGS-UFSAR an overpower
~T setpoint.
with axial power imbalance to This setpoint is automatically varies 15.2-Ba Revision 7 July 22, 1987
THIS PAGE INTENTIONALLY BLANK 15.2-8b SGS-UFSAR Revision 7 July 22, 1987
ensure that the allowable heat generation rate (kw/ft) is not exceeded.
- 4.
A high p.ressurizer pressure reactor trip actuated from any two out of four pressure channels which is set at a fixed point.
This set pressure is less then the set pressure for the pressurizer safety valves.
- 5.
A high pressurizer water level reactor trip actuated from any two out of three level channels which is set at a fixed point.
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- 1.
High neutron flux (one out of four)
- 2.
Overpower AT (two out of four)
- 3.
Overtemperature AT {two out of four)
The manner in which the combination of overpower and overtemperature AT trips provide protection over the full range of RCS conditions is described in Section 7.
This includes a plot (also shown as Figure 15.1-1) presenting allowable reactor coolant loop average temperature and AT for the design power distribution and flow as a
function of primary coolant pressure.
The boundaries of operation defined by the overpower AT trip and the overtemperature AT trip are represented as "protection lines" on this diagram.
The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines.
The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line.
The DNB lines represent the locus of conditions for which the DNBR equals the limit value.
All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value.
The diagram shows that 15.2-9 SGS-UFSAR Revision 18 April 26, 2000
DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.
The area of permissible operation (power, pressure and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint};
low pressure
{fixed setpoint);
overpower and overtemperature AT (variable setpoints).
15.2.2.2 Method of Analysis This transient is analyzed by the LOFTRAN (4) code.
This code simulates the neutron kinetics,
- RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
The core limits as illustrated on Figure 15.1-1 are used as input Ito LOFTRAN to determine the minimum DNBR during the transient.
In order to obtain conservative values of DNBR the following assumptions are made:
- 1.
Initial conditions of maximum core power and reactor coolant average temperatures and minimum reactor coolant resulting in the minimum initial margin to DNB.
- pressure,
- 2.
Reactivity Coefficients -
Two cases are analyzed:
SGS-UFSAR
- a.
Minimum Reactivity Feedback.
A zero moderator coefficient of reactivity is assumed corresponding to the beginning of core life.
A variable Doppler power coefficient with core power is used in the 15.2-10 Revision 18 April 26, 2000
analysis.
A conservatively small
{in absolute magnitude) value is assumed.
- b.
Maximum Reactivity Feedback.
A conservatively large positive moderator density coefficient and a
large (in absolute magnitude) negative Doppler power coefficient are assumed.
- 3.
The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118 percent of nominal full power, The ~T trips include all adverse instrumentation and setpoint errors, while the delays for the trip signal actuation are assumed at their maximum values.
4 *
'rhe RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
- 5.
The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combination of the two control banks having the maximum combined worth at maximum speed.
This is also much greater than the maximum reactivity insertion rate associated with withdrawal of a part length RCCA.
The effect of RCCA on the axial core power distribution is accounted for by causing a
decrease in overtemperature and overpower
&T trip setpoints proportional to a decrease in margin to DNB.
15.2.2.3 Results Figures 15.2-4 and 15.2-5 show the response of nuclear power, pressurizer
- pressure, core average temperature, and DNBR to a rapid (75 pcm/sec)
RCCA withdrawal incident starting from full power.
Reactor trip on 15.2-11 SGS-UFSAR Revision 18 April 26, 2000 I
I high neutron flux occurs shortly after start of the accident.
Since this is rapid with to the thermal time constants of the plant, small changes in T
and pressure result and a large margin to DNB is maintained.
avg The response of nuclear power, pressurizer pressure, core average temperature, and DNBR for a slow (3 pcm/sec) control rod assembly withdrawal from full power is shown on Figures 15.2-6 and 15.2-7.
Reactor on overtemperature L\\T occurs after a longer period and the rise in temperature is consequently larger than for rapid RCCA withdrawal.
Figure 15.2-8 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for the minimum and maximum reactivity feedback.
It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature L\\T trip channels. The minimum DNBR is never less than the limit value.
Figures 15.2-9 and 15.2-10 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60 and 10 percent power, respectively.
The results are similar to the 100 percent power case, as the initial power is decreased, the range over which the overtemperature L\\T trip is effective is increased.
DNBR fall below the limit value.
15.2.2.4 Conclusions In neither case does the The high neutron flux, high pressurizer pressure, and L\\T channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the limit value.
The rod withdrawal accident at power does not result in exceeding the RCS pressure Safety Limit.
15.2-12 SGS-UFSAR Revision 25 October 26 1 2010
(This text has been deleted) 15.2.3 Rod Cluster Control Assembly Misalignment 15.2.3.1 Identification of Causes and Accident Description Rod cluster control assembly misalignment accidents include:
- 1.
A dropped full-length assembly (single or multiple dropped rods)
- 2.
A dropped full-length assembly bank
- 3.
Statically misaligned assembly Each RCCA has a position indicator channel which displays position of the assembly.
The displays of assembly positions are grouped for the operator r s convenience.
Fully inserted assemblies are further indicated by a rod bottom light.
Group demand position is also indicated.
The full length assemblies are always moved in preselected banks and the banks are always moved in the same preselected sequence.
A dropped assembly or assembly banks are detected by:
- 1.
Sudden drop in the core power level as seen by the Nuclear Instrumentation System
- 2.
Asymmetric power distribution as seen on out of core neutron detectors or core exit thermocouples 15.2-13 SGS-UFSAR Revision 18 April 26, 2000
I
- 3.
Rod bottom lights{s}
- 4.
Rod deviation alarm
- 5.
Rod position indication Misaligned assemblies are detected by:
- 1.
Asymmetric power distribution as seen on out of core neutron detectors or core exit thermocouples or from BEACON {PDMS) core power distribution measurements 2.
Rod deviation alarm
- 3.
Rod position indicators The resolution of the rod position indicator channel is +/-5 percent of span
(+/-7.2 inches).
For Unit 1, deviation of any assembly; from its group by 10.4 percent of span (5 inches or 24 steps) will not cause power distributions worse than the design limits.
For Unit 2, deviation of any assembly; from its group by 10.4 percent of span above 85 percent RTP (24 steps) of 13 percent of span (30 steps) at or below 85 percent RTP, will not cause power distributions worse than the design limits {Reference 16).
The deviation alarm alerts the operator to rod deviation with respect to group demand position in excess of 5 percent of span.
If the rod deviation alarm is not operable, the operator is required to log the RCCA positions in a prescribed time sequence to confirm alignment.
If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to assure the alignment of the non-indicated assemblies.
These operating instructions call for the use of moveable in-core neutron detectors or the power distribution monitoring system (BEACON} if above 25
% power and BEACON is operable to determine assembly misalignment within a prescribed time and following significant motion of the non-indicating assemblies.
15.2-14 SGS-UFSAR Revision 19 November 19, 2001
15.2.3.2 Analysis of Effects and Consequences 15.2.3.2.1 Method of Analysis A.
One or More Dropped RCCAs from the Same Group The LOFTRAN computer code (Reference
- 4) calculates the transient system response for the evaluation of the dropped RCCA event.
The code simulates the neutron kinetics, RCS 1 pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
Transient reactor coolant system state points (temperature, pressure, and power) are calculated by LOFTRAN.
Nuclear models are used to obtain a
hot channel factor consistent with the primary system conditions and reactor power.
By incorporating the primary conditions from the transient analysis and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the THINC code.
The transient response analysis, nuclear peaking factor
- analysis, performed and performance of the DNB design basis confirmation are in accordance with the methodology described in Reference 15.
Note that the analysis does not take credit for the power-range negative flux rate reactor trip.
B.
Dropped RCCA Bank A dropped RCCA bank results in a symmetric power change in the core.
As discussed in Reference 15, assumptions made in the dropped RCCA(s}
analysis provide a bounding analysis for the dropped RCCA bank.
C.
Statically Misaligned RCCA SGS-UFSAR Steady-state power distributions are analyzed using appropriate nuclear physics computer codes.
The peaking factors are then used as input to the THINC code to calculate the DNBR.
The analysis examines the following cases:
- 1.
- 2.
- 3.
With the reactor initially at full power, the worst rod withdrawn with bank D inserted at the insertion limit, With the reactor initially at dropped with bank D inserted at With the reactor initially at dropped with all other rods out.
15.2-15 full power, the insertion full power, the worst rod limit, and the worst rod Revision 18 April 26, 2000 is is is
The analysis assumes this incident to occur at beginning of life since this results in the least-negative value of the moderator temperature coefficient.
This assumption maximizes the power rise and minimizes the tendency of the most-negative moderator temperature coefficient to flatten the power distribution.
An analysis was performed to confirm that BOL bounds EOL conditions.
15.2.3.2.2 Results A.
One or More Dropped RCCAs Single or multiple dropped RCCAs within the same group result in a negative reactivity insertion.
The core is not adversely affected during this period since power is decreasing rapidly.
Either reactivity feedback or control bank withdrawal will reestablish power.
The plant will establish a new equilibrium condition following a dropped rod event in manual rod control.
Without control system intE~raction, and reduced a new equilibrium is achieved at a reduced power level primary temperature.
- Thus, the limiting case has automatic rod control.
For a dropped RCCA event with automatic rod control, the rod control system detects the drop in power and initiates control bank withdrawal.
Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power.
Figure 15.2-11 Sheet 1 and Sheet 2 developed in accordance with Reference 15, show a typical transient response to a dropped RCCA (or RCCAs} in the automatic rod control mode.
In all cases, the minimum DNBR remains above the limit value.
Following plant stabilization, the operator may manually retrieve the RCCA(s) by following approved operating procedures.
B.
Dropped RCCA Bank SGS-UFSAR A dropped RCCA bank results in a negative reactivity insertion greater than 500 pcm.
The core is not adversely affected during the insertion period since power is decreasing rapidly.
The transient will proceed as described in Part A.
However, the return to power will be less due to the greater worth of the entire bank.
The power transient for a dropped RCCA bank is symmetric.
Following plant stabilization, normal procedures are followed.
15.2-16 Revision 18 April 26, 2000
C.
Statically Misaligned RCCA SGS-UFSAR The most severe misalignment situations with respect to DNBR at significant power levels occur when one RCCA is fully inserted with either all rods out or bank D in at its insertion limit, or when bank D is inserted to its insertion limit with one RCCA fully withdrawn.
Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the transient approaches the postulated conditions.
The bank can be inserted to its insertion limit with any one assembly fully withdrawn or inserted without the DNBR falling below the limit value.
Insertion limits in the Technical Specifications may vary from time to time depending on several limiting criteria.
The full-power insertion limits on control bank D must be above that position which meets the minimum DNBR and peaking factors.
The full-power insertion limit is usually defined by other criteria.
Detailed results will vary from cycle depending on fuel arrangements.
For this RCCA misalignment with bank D inserted to its full-power insertion limit and one RCCA fully withdrawn, the DNBR does not fall below the limit value.
The analysis of this case assumes that the initial reactor power, pressure, and the RCS temperature are at the nominal values with uncertainties and an increased radial peaking factor associated with the misaligned RCCA(s).
For RCCA misalignment with one RCCA fully inserted, the DNBR does not faLL below the limit value.
The analysis of this case assumes that initial reactor power,
- pressure, and RCS temperatures are at the nominal values with uncertainties and an increased radial peaking factor associated with the misaligned RCCA(s}.
DNB does not occur for the single RCCA misalignment incident; thus, there is no reduction in the ability of the primary coolant to remove heat from the fuel rod.
The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution.
The resulting linear heat generation rate is well below that which would cause fuel melting.
After identifying an RCCA group misalignment condition, the operator must take action as required by the plant Technical Specifications and operating instructions.
15.2-17 Revision 15 June 12, 1996
15.2.3.3 Conclusions For cases of dropped RCCAs or dropped banks, the DNBR remains greater than the limit value.
Therefore, the DNB design criterion is met and the event does not result in core damage.
For all cases of any single RCCA fully inserted, or*
bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value.
Thus, the RCCA misalignments do not result in core damage.
15.2.4 Uncontrolled Boron Dilution 15.2.4.1 Malfunction of the Reactor Makeup System:
Causes and Accident Description Reactivity can be added to the core by feeding primary grade water into the RCS via the reactor makeup portion of the Chemical and Volume Control System (CVCS).
Boron dilution is a manual operation under strict administrative controls with procedures calling for a limit on the rate and duration of dilution.
A boric acid blend system is provided to permit the operator to match the boron concentration of reactor coolant makeup water during normal charging to that in the RCS.
The CVCS is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value which, after indication through alarms and instrumentation, provides the operator sufficient time to correct the situation in a safe and orderly manner.
The opening of the primary water makeup control valve provides makeup to the RCS which can dilute the reactor coolant. Inadvertent dilution from this source can be readily terminated by closing the control valve.
water to be added 15.2-18 SGS-UFSAR In order for makeup Revision 18 April 26, 2000
to the RCS at pressure, at least one charging pump must be running in addition to a primary makeup water pump.
The rate of addition of unborated makeup water to the RCS when it is not at pressure is limited by the capacity of the primary water supply pumps.
The maximum addition rate in this case is 300 gpm with both pumps running.
The 300 gpm reactor makeup water delivery rate is based on a pressure drop calculation comparing the pump curves with the system resistance curve.
This is the maximum delivery based on the unit piping layout.
Normally, only one charging pump is operating.
The boric acid from the boric acid tank is blended with primary grade water in the blender and the composition is determined by the preset flow rates of boric acid and primary grade water on the control board.
In order to dilute, two separate operations are required:
- 1.
The operator must switch from the automatic makeup mode to the dilute mode, and
- 2.
The start button must be depressed.
Omitting either step would prevent dilution.
Information on the status of the reactor coolant makeup is continuously available to the operator.
Lights are provided on the control board to indicate the operating condition of the pumps in the CVCS.
Alarms are actuated to warn the operator if boric acid or demineralized water flow rates deviate from preset values as a result of system malfunction.
15.2.4.1.1 Method of Analysis To cover all phases of the plant operation, boron dilution during refueling, startup, and power operation are considered in this analysis.
15.2-19 SGS-UFSAR Revision 24 May 11, 2009
I The results presented in this Section are specific to Salem Unit 1.
Analyses were also performed for Salem Unit 2
with the AREVA Model 61/19T Steam Generators.
The Salem Unit 2 results are slightly less than the Unit 1 results presented here.
for this accident.
Table 15.2-1 contains the time sequence of events During
- 1.
the following conditions exist:
One residual heat removal (RHR) pump is operating to ensure continuous mixing in the reactor vessel.
- 2.
The seal injection water supply to the reactor coolant pumps is isolated.
- 3.
The valves on the suction side of the charging pumps are adjusted for addition of concentrated boric acid solution.
- 4.
The boron concentration in the refueling water is approximately 2000
- ppm, corresponding to a shutdown margin of at least 5 percent
~k/k with all RCCAs in; periodic sampling ensures that this concentration is maintained.
- 5.
Neutron sources are present in the core and the source range detectors outside the reactor vessel are active and provide an audible count rate.
During initial core loading BF3 detectors are installed inside the reactor vessel and are connected to instrumentation giving audible count rates to provide direct monitoring of the core.
A minimum water volume in the RCS of 34 68 cubic feet is considered.
This corresponds to the volume necessary to fill the reactor vessel above the nozzles to ensure mixing via the RHR loop.
A maximum dilution flow of 300 gpm, limited by the capacity of the two primary water makeup pumps, and uniform mixing is assumed.
15.2-20 SGS-UFSAR Revision 25 October 26, 2010
The operator has prompt and definite indication of any boron dilution from the audible count rate instrumentation.
High count rate is alarmed in the reactor containment and the Control Room.
In addition a high source range flux level is alarmed in the Control Room. The count rate increase is proportional to the subcritical multiplication factor.
Dilution During Startup Prior to startup the RCS is filled with borated {1618 ppm assumed) water from the refueling water storage tank (RWST}.
Core monitoring is by external BF3 detectors.
Mixing of the reactor coolant is accomplished by operation of the reactor coolant pumps.
High source range flux level and all reactor trip alarms are effective.
In the analysis, a maximum dilution flow of 300 gpm limited by the capacity of the two primary water makeup pumps is considered.
The volume of the reactor coolant is assumed to be 9432 cubic feet, which is the active volume of the RCS excluding the pressurizer.
Dilution at Power With the unit at power and the RCS at pressure, the dilution rate (236 gpm) is limited by the capacity of the charging pumps.
15.2-21 SGS-UFSAR Revision 18 April 26, 2000
I I
15.2.4.1.2 Conclusions For dilution during refueling At the beginning of the core life, equilibrium cycle
- core, the boron concentration must be reduced from 2000 ppm to approximately 1400 ppm before the reactor will go critical.
This would take 30 minutes.
This is ample time for the operator to recognize a high count rate signal and isolate the reactor makeup water source by closing valves and stopping the primary water supply pumps.
For dilution during startup The minimum time required to reduce the reactor coolant boron concentration to 1450 ppm where the reactor would go critical with all RCCAs in, is 19 minutes.
Once again this should be more than adequate time for the operator to recognize the high count rate signal and terminate the dilution flow.
For dilution during full power operation With the reactor in automatic control at full power, the power and temperature increase from boron dilution results in the insertion of the RCCAs and a decrease in shutdown margin.
Continuation of dilution and RCCA insertion would cause the assemblies to reach the minimum limit of the rod insertion monitor.
Before reaching this point, however, two alarms would be actuated to warn the operator of the accident condition.
The first of these, the low insertion limit alarm, alerts the operator to initiate normal boration.
The other, the low-low insertion limit alarm alerts the operator to follow emergency boration procedures.
The low alarm is set sufficiently above the low-low alarm to alarm normal boration without the need for emergency procedures.
If dilution continues after reaching the low-low alarm, there will be 18.7 minutes available for operator action before the total shutdown margin (assuming 1. 3 percent) is lost due to dilution.
Therefore, adequate time is available following the alarms for the 15.2-22 SGS-UFSAR Revision 18 April 26, 2000
operator to determine the cause, isolate the primary grade water source, and initiate reboration.
With the reactor in manual control and if no operator action is taken, the power and temperature rise will cause the reactor to reach the overtemperature AT trip setpoint.
The boron dilution accident in this case is essentially identical to a RCCA withdrawal accident at power.
The maximum reactivity insertion rate for boron dilution at power ( 1.16 pcm/sec) is within the range of insertion rates analyzed for a RCCA withdrawal accident. Prior to the overtemperature AT trip, an overtemperature AT alarm and turbine runback would be actuated.
There are 17.2 minutes after a reactor trip for the operator to determine the cause of dilution, isolate the primary grade water sources and initiate reboration before the reactor can return to criticality assuming a 1.3 percent shutdown margin at the beginning of dilution.
15.2.4.2 Miscellaneous Malfunctions:
Causes, Accident Descriptions, and Analyses An analysis was conducted for the eves and other interconnecting systems for the various modes of reactor operation.
Attention was directed towards identification of possible paths for an inadvertent boron dilution of the RCS to occur.
Each path was analyzed as to the required modes of failure, if any, and the likelihood of occurrence.
Tube failures of heat exchangers located in the CVCS and other interconnecting
{RHR, SI, etc.) systems was evaluated.
It was found that the seal water heat exchanger has seal water return flowing at a lower pressure than that of the component cooling water.
The postulated mode of a failure for this heat exchanger was a single tube failure. Should this occur the total quantity of component cooling water leaking into the RCS would not cause a sharp drop in boron concentration, thereby initiating a sudden increase in reactivity.
The low level alarm in the component 15.2-23 SGS-UFSAR Revision 18 April 26, 2000
cooling surge tank or a high level of chromates in the RCS would notify the operators of the problem.
A total tube rupture was considered to be extremely unlikely and was not E~valuated.
All other heat exchangers are designed such that the primary system pressure is greater than the cooling water system pressure, thus precluding boron dilution from occurring.
Unborated water can enter the eves while flushing resins from the ion exchange demineralizers.
This process involves a total of 600 to 1, 000 gallons of primary water to be flushed with spent resins to the spent resin storage tank.
The only possible path of entry of this water into the eves would be the failure to close the process outlet valve located in the discharge line of each demineralizer.
'fhe eves pressure at this point is slightly less than the flushing water pressure.
The majority of water used to flush the spent resin would, therefore, flow through the demineralizers to the spent resin storage tank (this being the path of least resistance).
The amount of primary water capable of entering the eves would be a small percentage of the total available volume of water.
In order to postulate the worst possible case it was assumed that all 1, 000 gallons enter the eves via the letdown line flowing to the Volume Control Tank {VCT).
The amount of primary water flowing into the VCT depends upon the existing level in the tank.
A three-way valve diverts letdown flow to the CVCS holdup tanks on high level signals in the VCT.
The portion of water flowing into the VCT enters as a spray mixing with approximately 1,000 to 2,000 gallons of borated water present in the tank. One charging pump normally takes suction from the VCT to provide water for charging and for RCP seals.
Total charging flow into the RCS runs as high as 100 gpm.
This enters via the reactor coolant pump seals (20 gpm for all four pumps) and through the charging line to the RCS (55 to 80 gpm).
Therefore, a situation could occur where there is 100 gpm of unborated water entering the RCS.
In order for this to occur, all 1,000 gallons of primary water must flow into the VCT with a minimum amount of mixing with the borated water already present.
The probability of this occurring is extremely low.
Nevertheless, if the situation 15.2-24 SGS-UFSAR Revision 6 February 15, 1987
should arise in which 100 gpm of primary water enters the RCS for a period of 10 minutes and then mixes with an approximate volume of 94,000 gallons of borated water the boron dilution would be minimal.
A limited boron dilution incident occurred at another operating PWR facility due to the injection of NaOH while the reactor was in a cold shutdown condition.
(While performing surveillance testing of the NaOH tank isolation valves, a portion of the tank's contents drained into the RHR System).
The design of the RHR system at Salem precludes such an accident from occurring.
In order to prevent a significant boron dilution event at cold or hot shutdown conditions, a shutdown margin of at least 5 percent is maintained when less than or equal to 350°F while on RHR.
Salem has experienced an inadvertent dilution of the RCS to less than the minimum boron concentration required by the Technical Specifications.
This occurred while the RCS was drained to approximately one-half loop level and a hydrolazer was being used to decontaminate the steam generator channel heads.
Water entered the RCS due to the inability of the hydrolazer suction connection to remove all of the scattered spray water.
A routine reactor coolant boron sample notified the operators of the problem and the RCS was borated to within specifications.
Procedures have since been revised to prevent a
similar recurrence.
Measures have been taken to sample on a much more frequent basis and to constantly keep the reactor operators aware that hydrolazing is going on.
15.2.4.2.1 Conclusions Possible scenarios for an inadvertent boron dilution of the RCS have been identified and evaluated.
The evaluation has assessed the likelihood of each scenario and, in addition, past cases where an inadvertent boron dilution occurred were evaluated.
It is concluded that the scenarios evaluated are not likely to result in a significant boron dilution accident.
15.2-25 SGS-UFSAR Revision 6 February 15, 1987
15.2.5 Partial Loss Of Forced Reactor Coolant Flow 15.2.5.1 Identification of Causes and Accident Description A partial loss of coolant flow accident can result from a
mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump.
If the reactor is at power at the time of the accident, the inunediate effect of loss of coolant flow is a rapid increase in the coolant temperature.
This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.
The necessary protection against a partial loss of coolant flow accident is provided by the low primary coolant flow reactor trip which is actuated by two out of three low flow signals in any reactor coolant loop. Above 36 percent power (Permissive 8}, low flow in any loop will actuate a reactor trip. Between 11 percent power {Permissive 7) and 36 percent power (Permissive 8), low flow in any two loops will actuate a reactor trip.
A reactor trip signal from the pump breaker position is provided as an anticipatory signal which serves as a backup to the low flow signal.
Above Permissive 7, a breaker open signal from any two reactor coolant pumps will actuate a reactor trip.
Normal power for the pumps is supplied through buses connected to the generator.
When a
generator trip occurs, the pumps are automatically transferred to a bus supplied from external power lines, and the pumps will continue to supply coolant flow to the core.
Following any turbine trip where there are no electrical faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds.
The reactor coolant pumps remain connected to the generator thus ensuring full flow for approximately 30 seconds after the reactor trip before any transfer is made.
15.2-26 SGS--UFSAR Revision 14 December 29, 1995
15.2.5.2 Method of Analysis The following case has been analyzed:
- 1.
Four loops initially operating, two pumps coasting down The transient is analyzed by three digital computer codes.
First the LOFTRAN
{4) code is used to calculate the loop and core flow during the transient, the time of reactor trip, and the nuclear power transient following reactor trip.
The FACTRAN code is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN.
Finally the THINC code is used to calculate the minimum DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN.
The DNBR transient presented represents the minimum of the typical or thimble cell for fuel assemblies with and without intermediate flow mixing grids {IFMs).
15.2.5.3 Initial Conditions Initial operating conditions assumed are the most adverse with respect to the margin to DNB, i.e., maximum steady state power level, minimum steady state pressure, and maximum steady state coolant average temperature.
This event is analyzed with the Revised Thermal Design Procedure
{RTDP)
(Reference 21).
Initial reactor power, pressurizer pressure, and RCS temperature are assumed to be at their nominal values.
See Section 15.1. 2 for explanation of initial conditions.
Reactivity Coefficients A conservatively large absolute value of the Doppler-only power coefficient is used (See Table 15.1-2). The total integrated Doppler reactivity from 0 to 100 percent power is assumed to be 0.0185 ~k.
15.2-27 SGS-UFSAR Revision 18 April 26, 2000 I
I The lowest absolute magnitude of the moderator temperature coefficient
( 0. 0 dk/°F) is assumed since this results in the maximum hot-spot heat flux during the initial part of the transient when the minimum DNBR is reached.
Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core.
This momentum balance is combined with the continuity
- equation, a
pump momentum balance and the pump characteristics and is based on high estimates of system pressure losses.
15.2.5.4 Results The calculated sequence of events is shown in Table 15.2-1 for the case analyzed.
Figures 15.2-13 through 15.2-15 show the loop coastdowns, the core flow coastdowns, the nuclear power coastdowns and the average and hot-channel heat flux coastdowns for each of the two cases.
The minimum DNBR for fuel assemblies with and without IFMs is not less than the design limit.
15.2.5.5 Conclusions The analysis shows that the DNBR will not decrease below the limiting value at any time during the transient.
Thus no core safety limit is violated.
15.2.6 Startup of an Inactive Reactor Coolant Loop The Technical Specifications require that all four reactor coolant pumps are operating for reactor power operation and, therefore, operation with an inactive loop is precluded.
This event was originally included in the FSAR licensing basis when operation with a loop out of service was considered.
Based on the current Technical Specifications which deleted all references to three-loop operation, this event has been deleted from the FSAR.
15.2-28 SGS-UFSAR Revision 18 April 26, 2000
THIS PAGE INTENTIONALLY BLANK 15.2-29 SGS-UFSAR Revision 18 April 26, 2000
THIS PAGE INTENTIONALLY BLANK 15.2-30 SGS-UFSAR Revision 18 April 26, 2000
15.2.7 Loss of External Electrical Load and/or Turbine Trip 15.2.7.1 Identification of Causes and Accident Description Major load loss on the plant can result from loss of external electrical load or from a turbine trip.
For either case, offsite power is available for the continued operation of plant components such as the reactor coolant pumps. The case of loss of all offsite ac power is analyzed in Section 15.2.9.
For a
turbine trip, the reactor would be tripped directly {unless below approximately 50-percent power} from a signal derived from the turbine autostop oil pressure (Westinghouse turbine}
and turbine stop valves. The automatic Steam Dump System would accommodate the excess steam generation.
Reactor coolant temperatures and pressure do not significantly increase if the Steam Dump System and Pressurizer Pressure Control System are functioning properly.
If the turbine condenser were not available, the excess steam generation would be dumped to the atmosphere.
Additionally, main feedwater flow would be lost if the turbine condenser were not available.
For this situation, feedwater flow would be maintained by the Auxiliary Feedwater System.
For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated.
The plant would be expected to trip from the RPS.
A continued steam load of approximately 5 percent would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.
15.2-31 SGS-UFSAR Revision 18 April 26, 2000
In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, the low-low steam generator water level signal, the overpower 8T signal, or the overtemperature AT signal.
The steam generator shell side pressure and reactor coolant temperatures will increase rapidly.
The pressurizer safety valves and steam generator safety valves are, however, sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the Steam Dump
- System, spray, pressurizer power-operated relief valves, automatic rod cluster control assembly control, or direct reactor trip on turbine trip.
The steam generator safety valve capacity is sized to remove the steam flow at the engineered safeguards design rating ("'105 percent of steam flow at rated power) from the steam generator without exceeding 110 percent of the steam system design pressure.
The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves.
The zer valves are then able to maintain the RCS pressure within 110 of the RCS design pressure without direct or immediate reactor trip action.
A more complete discussion of overpressure protection can be found in Reference
- 8.
15.2.7.2 Method of Analysis The total loss of load transients is analyzed by employing the detailed digital computer program LOFTRAN.
The program simulates the neutron kinetics,
- RCS, pressurizer, pressurizer relief and
- valves, spray, steam generator, and steam generator valves.
The program pertinent plant variables including temperatures, pressures, and power level.
In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from 100.6 percent of full power without direct reactor trip to show the adequacy of the pressure relieving devices and from 100 percent of full power to demonstrate core protection margins.
15.2-32 SGS-UFSAR Revision 24 May 11, 2009
Typical assumptions are the following:
- 1.
Initial Operating Conditions -
For the cases analyzed to demonstrate that core protection margins are maintained, the Loss of Load accident is analyzed using the Revised Thermal Design Procedure.
For this case, initial core power, reactor coolant temperature, and reactor coolant pressure are assumed to be at their nominal values consistent with steady-state full power operation.
Uncertainties in initial conditions are included in the departure from nucleate boiling ratio (DNBR) limit described in WCAP-11397 (Reference 21).
For the cases analyzed to demonstrate the adequacy of the pressure relieving devices, the Loss of Load accident is analyzed using the Standard Thermal Design Procedure.
For these cases, initial core
- power, reactor coolant temperature, and reactor coolant pressure include allowances for calibration and instrument errors.
- 2.
Moderator and Doppler Coefficients of Reactivity -
The total loss of load is analyzed for beginning of life conditions.
Moderator temperature coefficients of zero and a least negative Doppler power coefficient is used for all cases.
- 3.
Reactor Control From the standpoint of the maximum pressures attained it is conservative to assume that the reactor is in manual control.
- 4.
Steam Release -
No credit is taken for the operation of the Steam Dump System or steam generator power-operated relief valves.
The steam generator pressure rises to the safety valve setpoints where steam release through safety valves limits secondary steam pressure at the setpoint values.
15.2-33 SGS-UFSAR Revision 24 May 11, 2009 I
I I
I
- 5.
Pressurizer Spray and Power-Operated Relief Valves -
Three cases are analyzed:
- 6.
- a.
Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure and RTDB (DNB case}.
- b.
No credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure and STDP (primary pressure case).
- c.
Full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure and STOP (secondary pressure case).
Main feedwater flow to the assumed to be lost at the time of turbine trip.
for auxiliary feedwater flow since a stabilized steam generators is No credit is taken condition will be reached before auxiliary feedwater initiation is normally assumed to occur.
However, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps.
The auxiliary feedwater flow would remove core decay heat following plant stabilization.
Reactor trip is actuated by the first RPS trip setpoint reached with no credit taken for the direct reactor trip on the turbine trip.
15.2.7.3 Figures 15.2-20 through 15.2-22 show the transient response for the total loss of steam load from 100 percent full power operation at beginning of life with zero moderator temperature coefficient assuming full credit for the pressurizer spray and pressurizer power-operated relief valves.
No credit is taken for steam dump.
The reactor is tripped by the overtemperature ilT trip channel.
This case was analyzed to demonstrate that adequate protection of the core thermal limits exists.
The minimum DNBR remains well above the limit value.
15.2-34 SGS-UFSAR Revision 24 May 11, 2009
Figures 15.2-23 through 15.2-25 show the transient response for the total loss of load accident from 100.6 percent full power operation at beginning of life with zero moderator temperature coefficient with no credit taken for pressurizer spray, pressurizer power-operated relief valves, or steam dump.
This case was analyzed to demonstrate the adequacy of the pressure relieving devices.
The reactor is tripped on the high pressurizer pressure signal.
The neutron flux remains constant at 100.6 percent of full power until the reactor is tripped.
The primary pressure increases such that the pressurizer safety valves are actuated.
The peak RCS pressure remains below 110% of the design pressure.
Figures 15.2-25a through 15.2-25c show the transient response for a total loss of load accident from 100.6 percent full power operating at beginning of life with a zero moderator temperature coefficient assuming full credit for the pressurizer spray and pressurizer power-operated relief valves.
No credit is taken for steam dump.
The reactor is tripped by the over-temperature ~T trip channel.
The secondary pressure increases to the point where the secondary relief valves are actuated.
The peak secondary pressure remains below 110% of the design pressure.
The figures presented for this event are taken from explicit calculations performed for the Unit 2 replacement steam generators.
Unit 1 analysis results are similar in nature to those presented here, and the conclusions presented below apply to both sets of analyses.
15.2-35 SGS-UFSAR Revision 24 May 11/ 2009
I 15.2.7.4 Conclusions Results of the analyses show that the plant design is such that a total loss of external electrical load without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the Main Steam System.
Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.
The integrity of the core is maintained by operation of the RPS, i.e., the DNBR will be maintained above the limit value.
Thus there will be no cladding damage and no release of fission products to the RCS.
15.2.8 Loss of Normal Feedwater 15.2. 8. 1 IdE~ntification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite ac power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core.
If the reactor were not tripped during this accident, core damage would possibly occur from a sudden loss of heat sink.
If an alternative supply of feedwater were not supplied to the plant, residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer occurs. Significant loss of water from the RCS could conceivably lead to core damage.
Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.
The following provides the necessary protection against a loss of normal feedwater~
- 1.
Reactor trip on low-low water level in any steam generator.
15.2-36 SGS-UFSAR Revision 18 April 26, 2000
- 2.
Two motor-driven auxiliary feedwater pumps which are started on:
- a.
Low-low level in any steam generator
- b.
Trip of all main feedwater pumps
- c.
Any safety injection signal
- d.
- e.
Manual actuation
- 3.
One turbine-driven auxiliary feedwater pump which is started on:
- a.
Low-low level in any two steam generators, or
- b.
Undervoltage on any two reactor coolant pump buses
- c.
Manual actuation The motor-driven auxiliary feedwater pumps are supplied power by the diesels if a loss of offsite power occurs and the turbine-driven pump utilizes steam from the secondary system.
Both type pumps are designed to start within one minute of the initiating signal even if a loss of offsite power occurs simultaneously with loss of normal feedwater.
The turbine exhausts the secondary steam to the atmosphere.
The auxiliary pumps take suction from the auxiliary feedwater storage tank for delivery to the steam generators.
15.2-37 SGS-UFSAR Revision 24 May 11, 2009
I The analysis shows that following a loss of normal feedwater, the Auxiliary Feedwater System is capable of removing the stored and residual heat thus preventing either over-pressurization of the RCS or loss of water from the reactor core.
A detailed analysis using the LOFTRAN Code is performed in order to obtain the plant transient following a loss of normal feedwater.
The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and Feedwater System.
The digital program computes pertinent variables including the steam generator mass, pressurizer water volume, and reactor coolant average temperature.
Major assumptions are:
- 1.
Reactor trip occurs on low-low steam generator water level at 0%
narrow range span.
- 2.
The plant is initially operating at the nominal NSSS power rating plus uncertainties.
- 3.
A conservative core residual heat generation based on the 1979 version of ANS 5.1-1979 plus two standard deviations.
- 4.
Two motor-driven auxiliary feedwater pumps are assumed available eighty-five seconds after receipt of the low-low steam generator water level reactor trip signal.
- 5.
Auxiliary feedwater total flow of 700 gpm is delivered to all steam generators.
15.2-38 SGS-UFSAR Revision 19 November 19, 2001
- 6.
Secondary system steam relief is achieved through the self-actuated valves.
Note that steam relief will, in fact, be through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater.
However, for the sake of analysis these have been assumed unavailable.
- 7.
The initial reactor coolant average temperature is 5°F higher than the nominal value since this results in a greater expansion of RCS water during the transient and, thus, in a higher water level in the pressurizer.
- 8.
The initial value.
pressure is 50 higher than the nominal 15.2.8.3 Figure 15. 2-28A through 15. 2-28C show normal feedwater.
following a loss of Following the reactor and turbine from full load, the water level in the steam falls due to the reduction of steam void fraction and because steam flow stored and generated heat.
valves continues to the seconds the initiation of the low-low level the auxiliary feedwater pumps are the rate of water level decrease.
The of the feedwater pumps are such that the water level in the steam generators does not recede below the lowest level at which sufficient heat transfer area is available to core residual heat without the pressurizer filling, or water relief from the RCS relief or valves.
The figures for this event are taken from explicit calculations performed for the Unit 2 replacement steam generators.
Unit 1 analysis results are similar in nature to those presented here, and the conclusions presented below apply to both sets of analyses..
15.2.8.4 Results of the analysis show that a of normal feedwater does not adversely affect the core, the RCS, or the steam system since the feedwater is such that the reactor coolant water is not relieved from the zer relief or safety valves.
The of the LONF/LOAC (loss of normal feedwater/ AC Power) event that is documented in this section of the UFSAR has been evaluated by Westinghouse with to an issue associated with the method used to calculate the steam mass at the time the LOW-LOW SG water level setpoint reached for Salem Unit 2.
The results of this evaluation demonstrate that all applicable analysis criteria continue to be satisfied and the conclusions of the UFSAR remain valid.
The mass issue does not impact the Salem Unit 1 analysis.
15.2-39 SGS-UFSAR Revision 26 May 21, 2012
15.2.9 Loss of Offsite Power to The Station Auxiliaries 15.2.9.1 In the event of a complete loss of offsite power and a turbine trip, there will be a loss of power to the plant auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc.
The events following a loss of ac power with turbine and reactor trip are described in the sequence listed below:
- 1.
- 2.
- 3.
- 4.
The Plant vital instruments are emergency power sources.
As the steam system pressure rises following the the steam system power-operated relief valves are Stearn dump to the condenser is to the assumed not to be available.
If the power operated relief valves are not available, the steam generator self-actuated valves may lift to the sensible heat of the fuel and coolant plus the residual heat produced in the reactor.
As the no load is the steam relief valves (or the self-actuated
- valves, relief valves are not. available) are used to power if the power the residual heat and to maintain the at the hot condition.
The emergency diesel generators started on loss of on the emergency buses to supply vital loads.
Feedwater System is started as discussed in the loss of normal feedwater analysis.
The steam-driven feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere.
The motor driven feedwater pumps are by power from the diesel The pumps take suction from the feedwater storage tank for to the steam the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant 15.2-40 SGS-UFSAR Revision 19 November 19, 2001
15.2.9.2 A detailed analysis using the LOFTRAN Code is performed in order to obtain the plant transient response following a loss of off site power.
The simulation describes the plant thermal kinetics, RCS including the natural circulation,
- zer, steam generators and Feedwater System.
The digital program computes pertinent variables including the steam generator mass, pressurizer water volume, and reactor coolant average temperature.
The following major assumptions are made.
These similar to the that power is loss of normal feedwater (section 15.2. 8) assumptions assumed to be lost at the time of reactor trip.
- 1.
Reactor trip occurs on steam generator low-low water level at 0% of narrow range span.
- 2.
The plant is initially operating at the nominal NSSS rated power plus uncertainties.
- 3.
A conservative core residual heat generation is used based on the 1979 version of ANS 5.1 plus two standard deviations.
- 4.
Two motor-driven auxiliary feedwater pumps are available eighty-five seconds after of the low-low steam generator water level reactor The pumps are assumed to deliver a total of 700 gpm to all steam generators.
- 5.
Secondary system steam relief is through the safety valves.
- 6.
Steam relief through the power-operated relief valves or condenser dump valves is assumed to be unavailable.
After normal steam generator level is established, flow is controlled to maintain the water level.
- 7.
The initial reactor coolant average temperature is 5°F higher than the nominal value.
- 8.
15.2.9.3 The initial value.
pressure is 50 higher than the nominal Figures 15.2-280 through 15.2-28F show the plant parameters following a loss of power to the station auxiliaries event.
The sequence of events is provided in Table 15.2-1.
15.2-41 SGS-UFSAR Revision 19 November 19, 2001
Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat.
seconds following the low-low steam generator water level trip, the auxiliary feedwater pumps deliver
- flow, reducing the rate of the water level decrease/
The of the auxiliary feedwater pumps is such that the water level in the steam generators does not recede below the level at which sufficient heat transfer area is available to dissipate core residual heat without relief from the RCS relief or safety valves.
zer or water The results of the analysis show that the natural circulation flow available is sufficient to provide and.RCP coast down.
reactor power is core decay heat removal The natural circulation flow as a in Table 15.2-3.
reactor function of residual The figures presented for this event are taken from explicit calculations performed for the Unit 2 steam generators.
Unit 1 analysis results are similar in nature to those here, and the conclusions below to both sets of 15.2.9.4 Results of the analysis show that a loss of power to the station auxiliaries does not adversely affect the core, the RCS, or the steam system since the auxiliary feedwater capacity is such that the reactor coolant water is not relieved from the pressurizer relief or safety valves.
The RCS is not overpressurized and no water relief will occur through the relief or safety valves.
Thus, there will be no cladding damage and no release of fission products to the RCS.
The of the Loss of offsite power event that documented in this section of the UFSAR has been evaluated by Westinghouse with respect to an issue associated with the method used to calculate the steam mass at the time the LOW-LOW SG water level is reached for Salem Unit
- 2.
The results of this evaluation demonstrate that all criteria continue to be satisfied and the conclusions of the UFSAR remain valid.
The mass issue does not impact the Salem Unit 1 15.2.10 Excessive Heat Removal Due to Feedwater System Malfunctions 15.2.10.1 Reductions in feedwater temperature or excessive feedwater flow additions are means of core power above full power.
attenuated by the thermal of the secondary 15.2-42 SGS-UFSAR Such transients are and of the reactor Revision 26 May 21, 2012
coolant system (RCS).
The overpower/overtemperature protection (high neutron flux, overtemperature ~T, and overpower ~T trips) prevents any power increase that could lead to a departure from nucleate boiling ratio (DNBR) less than the safety analysis limit.
An example of excessive feedwater flow would be a full opening of one or more feedwater control valves due to a feedwater control system malfunction or an operator error.
At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generators.
With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature and thus, a reactivity insertion due to the effects of the negative moderator temperature coefficient of reactivity.
For a
typical excessive feedwater flow feedwater malfunction event, continuous excessive feedwater flow addition is terminated by the steam generator high-high level trip which closes all feedwater control and isolation valves, trips the main feedwater pumps, and trips the turbine.
A second example of excess heat removal is the transient associated with the accidental opening of the low pressure feedwater heater bypass valve that diverts flow around the low pressure feedwater heaters.
The function of this valve is to maintain net positive suction head on the main feedwater pump in the event that the heater drain pump flow is lost--e.g., following a large load decrease.
At power, this increased subcooling will create a greater load demand on the RCS.
15.2.10.2 Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed with the LOFTRAN and THINC computer codes.
LOFTRAN simulates a multi-loop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and main steam safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level as well as a conservative DNBR calculation (Reference 22).
If appropriate, statepoints are then transferred to THINC for a more rigorous DNBR calculation.
The system is analyzed to show acceptable consequences in the event of a feedwater system malfunction.
Feedwater temperature reduction due to low-15.2-43 SGS-UFSAR Revision 29 January 30, 2017
pressure heater bypass valve actuation with an inadvertent of the heater drain pump is considered.
Additionally, excessive feedwater flow addition due to a control system malfunction feedwater control and feedwater considered.
or operator error that control bypass valves Six excessive feedwater flow cases are as follows:
allows one or more to open fully is
- 1.
Zero Power, Single Loop, Manual Rod Control Case -
Accidental opening of one feedwater control valve ( FCV) and one feedwater control bypass valve (FCBV) with the reactor just critical at zero-load conditions assuming a conservatively moderator coefficient characteristic of end of life (EOL) conditions with the reactor in manual rod control.
- 2.
Full Power, Single Loop, Manual Rod Control Case -
Accidental opening of one FCV (with the corresponding FCBV open) with the reactor in manual control at full power.
- 3.
Full Power, Single Loop, Automatic Rod Control Case - Accidental opening of one FCV (with the corresponding FCBV open) with the reactor in automatic control at full power.
- 4.
Zero Power, Multi-Loop, Manual Rod Control Case -
Accidental opening of four FCVs and four FCBVs with the reactor just critical at zero-load conditions assuming a conservatively large moderator density coefficient characteristic of EOL conditions with the reactor in manual rod control.
- 5.
Full Power, Multi-Loop, Manual Rod Control Case -
Accidental opening of four FCVs (with their corresponding FCBVs open) with the reactor in manual control at full power.
- 6.
Full Power, Multi-Loop, Automatic Rod Control Case - Accidental opening of four FCVs (with their corresponding FCBVs open) with the reactor in automatic control at full power.
15.2-43a SGS-UFSAR Revision 24 May 11, 2009
The transient response due to a feedwater system malfunction is calculated with the following assumptions:
- 1.
The hot Procedure full as power cases described in are analyzed with the Revised Thermal Design WCAP-11397-P-A (Reference 21).
Therefore, initial reactor power, pressure, and RCS temperatures are assumed to be at their nominal values.
Uncertainties in initial conditions are included in the limit DNBR calculated using the methodology described in Reference 21.
The zero power cases are analyzed assuming the Standard Thermal Design Procedure.
- 2.
For the single loop accidents at full power, one FCV and one FCBV are assumed to malfunction resulting in a step increase in nominal full load feedwater flow to one steam generator.
- 3.
For the single loop accident at zero load, the malfunction results in an increase in feedwater flow to one steam generator.
- 4.
For the multi-loop accidents at full power, four FCVs and four FCBVs are assumed to malfunction resulting in a step increase in nominal full load feedwater flow to each of the four steam generators.
- 5.
For the multi -loop accident at zero load, the malfunction results in an increase in feedwater flow to each of the four steam generators.
- 6.
The initial water level in all steam generators is at a conservatively low level.
- 7.
No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
- 8.
For malfunctions at zero load with the concurrent MS10 valve failure (see assumption 10), the protection described in Section 15.4.2 (Major Secondary System Pipe Rupture) is modeled.
As a result, feedwater isolation is initiated upon receipt of a safety injection system signal in the limiting
- cases, which occurs before the steam generator high-high water level setpoint is reached.
15.2-43b SGS-UFSAR Revision 29 January 30, 2017
- 9.
The feedwater flow resulting from the malfunction at hot full power is terminated by the steam generator high-high water level signal.
This signal closes all FCVs, FCBVs and feedwater isolation valves and trips the main feedwater pumps and turbine generator (tripping the main feedwater pumps causes valves in the pump discharge line to automatically close).
- 10.
MS10 valves are assumed to fail open concurrently with the feedwater malfunction.
This results in a
typical feedwater malfunction event combined with a main steam system depressurization event, which produces results that bound feedwater malfunction cases without the concurrent MS10 valve failure.
15.2.10.3 Results Opening of a low pressure feedwater heater bypass valve and tripping the heater drain pumps causes a reduction in the feedwater temperature that increases the thermal load on the primary system.
The increased thermal load caused by the opening of the low pressure heater bypass valve and the heater drain pump trip results in a transient very similar (but of reduced magnitude) to that of the Excessive Load Increase event.
Therefore, results for this event are not presented here.
15.2-44 SGS-UFSAR Revision 29 January 30, 2017
Of the full power cases, the manual rod control cases result in the closest approach to the safety analysis limit DNBR.
A turbine trip and reactor trip are actuated when the Over Power Delta-T trip setpoint is reached (Reference
- 22).
Feedwater isolation occurs 32 seconds after the steam generator level reaches the high-high level setpoint.
The zero power feedwater malfunction cases are not reported because they are bounded by the steamline break transient reported in Section 15.4.2.
For all cases of excessive feedwater
- flow, continuous addition of cold feedwater is prevented by automatic closure of all feedwater control valves, closure of all feedwater bypass valves, and a trip of the feedwater pumps on high-high steam generator water level (for full power cases) of safety injection system signal (for zero power cases)
At power, the reactor will automatically be tripped by the overpower/overtemperature protection.
Transient results for both the full-power, single-loop, manual rod-control case and the full-power, multi-loop, manual rod-control case are shown in Figures 15.2-29a through f.
15.2-45 SGS-UFSAR Revision 29 January 30, 2017
These figures show the core heat flux, pressurizer pressure, core average temperature, increase in nuclear power and loop
~T associated with the described accident. The steam generator water level rises until the feedwater flow addition is terminated by the high-high steam generator level trip.
In all cases, the DNBR stays above the safety analysis limit value.
Since the power level rises during this event, the fuel temperature will also rise until the reactor trip occurs.
The core heat flux lags behind the neutron flux due to the fuel rod thermal time constant and, as a result, the limit on the peak linear heat generation rate is not exceeded.
Thus, the peak fuel melting temperature will remain well below the fuel melting point.
The sequence of events for the limiting full power single loop and multi-loop cases are shown in Table 15.2-1.
The figures presented for this event are taken from explicit calculations performed for Unit 2.
Explicit analysis results for the Unit 1 replacement steam generators are similar in nature to those presented here, and the conclusions presented below apply to both sets of analyses.
15.2.10.4 Conclusions The decrease in the feedwater temperature transient due to an opening of the low-pressure feedwater heater bypass valve is less severe than the Excessive Load Increase event (see UFSAR Section 15.2.11).
Based on the results presented in UFSAR Section 15.2.11, applicable acceptance criteria for the decrease in feedwater temperature event have been met.
For the excessive feedwater flow at full power transient, the results show that the DNBRs encountered are above the safety analysis limit value and the limit on the peak linear heat generation rate is not exceeded; therefore, no fuel damage is predicted.
Additionally, an analysis at hot zero power demonstrates that the minimum DNBR remains above the safety analysis limit and the limit on the peak linear heat generation rate is not exceeded.
15.2.11 Excessive Load Increase Incident 15.2.11.1 Identification of Causes and Accident Description An excessive load increase incident is defined as a rapid increase in the steam flow that causes a power mismatch between the reactor core power and the steam 15.2-46 SGS-UFSAR Revision 29 January 30, 2017
generator load demand.
The Reactor Control System is designed to accommodate a 10-percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power.
Any loading rate in excess of these values may cause a reactor trip actuated by the RPS.
This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.
During power operation, steam dump to the condenser is controlled by reactor coolant condition signals; i.e., high reactor coolant temperature indicates a need for steam dnmp.
A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.
Protection against an excessive load increase accident is provided by the following RPS signals:
- 1.
Overpower AT
- 2.
Overtemperature AT
- 3.
Power range high neutron flux 15.2.11.2 Method of Analysis This accident is analyzed using the LOFTRAN Code.
The code simulates the neutron kinetics,
- RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
Four cases are analyzed to demonstrate the plant behavior following a 10-percent step load increase from rated load.
These cases are as follows:
- 1.
Manually controlled reactor at beginning-of-life {BOL)
- 2.
Manually controlled reactor at end-of-life (EOL)
- 3.
Reactor in automatic control at BOL 15.2-47 SGS-UFSAR Revision 18 April 26, 2000 I
- 4.
Reactor in automatic control at EOL At BOL the core has the least negative moderator temperature coefficient of reactivity and therefore the least inherent transient capability.
At EOL the moderator temperature coefficient of reactivity has its highest absolute value.
This results in the largest amount of reactivity feedback due to changes in coolant temperature.
A conservative limit on the turbine valve opening is assumed, and all cases are studied without credit being taken for pressurizer heaters.
Initial operating conditions are assumed at nominal values.
Operational uncertainties and DNBR correlation statistics are considered in the generation of the limiting DNBR (Section 15.1.2).
15.2.11.3 Results Figures 15.2-30 through 15.2-33 illustrate the transient with the reactor in the manual control mode.
As expected, for the BOL case there is a slight power
- increase, and the average core temperature shows a large decrease.
This results in a DNBR which increases above its initial value.
For the EOL manually controlled case there is a much larger increase in reactor power due to the moderator feedback.
A reduction in DNBR is experienced, but DNBR remains above the limit value.
Figures 15.2-34 through 15.2-37 illustrate the transient assuming the reactor is in the automatic control mode.
Both the BOL and the EOL cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure.
For both the BOL and EOL cases, the minimum DNBR remains above the limit value.
15.2-48 SGS-UFSAR Revision 18 April 26, 2000
15.2.11.4 Conclusions It has been demonstrated that for an excessive load increase the minimum DNBR during the transient will not be below the limit value.
15.2.12 Accidental Depressurization of The Reactor Coolant System 15.2.12.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve.
The event results in a rapidly decreasing RCS pressure.
The effect of the pressure decrease is a decrease in the neutron flux via the moderator density feedback, but the Reactor Control System {if in the automatic mode) functions to maintain the power and average coolant temperature until reactor trip occurs.
The pressurizer level increases initially due to expansion caused by depressurization and then decreases following reactor trip.
The reactor will be tripped by the following RPS signals:
- 1.
Pressurizer low pressure
- 2.
Overtemperature
~T 15.2.12.2 Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code LOFT RAN.
The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam 15.2-49 SGS-UFSAR Revision 18 April 26, 2000 I
I
generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
In calculating the DNBR, the following conservative assumptions are made:
- l.
The accident is analyzed using the Revised Thermal Design Procedure.
Initial core power, reactor coolant average temperature, and RCS pressure are assumed to be at their nominal values consistent with steady-state full-power operation.
Uncertainties in initial conditions are included in the DNBR limit described in Reference 21.
- 2.
A zero moderator coefficient of reactivity conservative for BOL operation in order to provide a
conservatively low amount of negative reactivity feedback due to changes in moderator temperature.
The spatial effect of void due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape.
- 3.
A high (absolute value) Doppler coefficient of reactivity such that the resultant amount of positive feedback is conservatively high in order to retard any power decrease due to moderator reactivity feedback.
It should also be noted that in the analysis power peaking factors are kept constant at the design values while, in fact, the core feedback effects would result in considerable flattening of the power distribution.
This would significantly increase the calculated DNBR; however 1 no credit is taken for this effect.
15.2.12.3 Results I Figure 15.2-38 illustrates the nuclear power transient following the accident.
I Reactor trip on overtemperature LlT occurs as shown on Figure 15. 2-38. The pressure decay transient following the accident is given on Figure 15. 2-38.
The resulting DNBR never goes below the limit value as shown on Figure 15.2-39.
15.2-50 SGS-UFSAR Revision 18 April 26, 2000
15.2.12.4 Conclusions The pressurizer low pressure and the overtemperature AT RPS signals provide adequate protection against this accident, and the minimum DNBR remains in excess of the limit value.
15.2.13 Accidental Depressurization of The Main Steam System 15.2.13.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the MSS are associated with an inadvertent opening of a single steam dump, relief or safety valve.
The analyses performed assuming a rupture of a main I
steam pipe are given in Section 15.4.2.
J The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls.
The energy removal from the RCS causes a reduction of coolant temperature and pressure.
In the presence of a negative moderator temperature coefficient, the cooldown results in a reduction of core shutdown margin.
The analysis is performed to demonstrate that the following criterion is satisfied:
assuming a stuck RCCA, with or without offsite power, and assuming a
single failure in the Engineered Safety
- Features, there will be no consequential fuel damage after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief or safety valve.
This criterion is satisfied by verifying that the DNB design basis is met.
The following systems provide the necessary protection against an accidental depressurization of the MSS:
- 1.
SIS actuation from any of the following:
15.2-51 SGS-UFSAR Revision 18 April 26, 2000
- a.
Two out of three channels of low pressurizer pressure.
15.2-Sla SGS-UFSAR Revision 9 July 22, 1989
THIS PAGE INTENTIONALLY BLANK 15.2-51b SGS-UFSAR Revision 9 July 22, 1989
- b.
High differential pressure signals between steam lines.
- 2.
The overpower reactor trips (neutron flux and AT) and the reactor trip occurring in conjunction with receipt of the safety injection signal.
- 3.
Redundant isolation of the main feedwater lines:
sustained high feedwater flow would cause additional cooldown.
Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip,. a safety injection signal will rapidly close all feedwater control valves, trip the main feedwater pumps, and close the backup feedwater isolation valves.
15.2.13.2 Method of Analysis Due to the size of the break and the assumed initial conditions, an Accidental Depressurization of the Main Steam System event is always bounded by the Major Secondary System Pipe Rupture event presented in UFSAR Section 15. 4. 2.
As such, no explicit analysis is performed for the Accidental depressurization of the Main Steam System.
All applicable acceptance criteria are shown to be met via the results and conclusions presented in UFSAR Section 15.4.2.
15.2-52 SGS-UFSAR Revision 22 May 5, 2006
This page left intentionally blank 15.2-53 SGS-UFSAR Revision 22 May 5, 2006
15.2.13.3 Results This event is bounded by the Major Secondary System Pipe Rupture event presented in UFSAR Section 15.4.2.
See UFSAR 15.4.3 for results.
15.2-54 SGS-UFSAR Revision 22 May S, 2006
15.2.13.4 Conclusions The calculations presented in UFSAR Section 15.4.2 represent a similar but more limiting Condition IV transient that typically would require less restrictive acceptance criteria than are used for Condition II transients.
However, this Condition IV transient is analyzed to the more restrictive Condition II acceptance criteria.
By taking this approach, the analysis of the Condition IV can be used to directly bound the Condition II Depressurization of the Main Steam System event.
The results and conclusions presented in UFSAR 15.4. 2 demonstrate that all applicable acceptance criteria are met for the Depressurization of the Main Steam System event.
15.2.14 Spurious Operation of The Safety Injection System at Power 15.2.14.1 Accident Description The Spurious Operation of the Safety Injection System (SIS) at Power is caused by either an operator error or a false electrical actuating signal.
When the SIS is actuated, charging pump suction is diverted from the Volume Control Tank to the RWST, and boric acid is pumped from the RWST to the cold leg of each reactor coolant loop.
The safety injection pumps are also started automatically; but they cannot develop the head necessary to pump borated water into the reactor coolant loops when the Rcs*is at normal operating pressure.
The Spurious Operation of the SIS at Power is classified as a Condition II event, a fault of moderate frequency.
this event are:
The acceptance criteria for analysis of l.Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the applicable DNBR limit.
2.Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values.
3.A Condition II must not escalate into, or cause a more serious fault (e.g., a Condition I I I or Condition IV event) without other faults occurring independently.
15.2-55 SGS-UFSAR Revision 22 May 5, 2006
I 15.2.14.2 Method of Analysis The first criterion, that fuel cladding integrity be maintained, is shown to be satisfied by means of a safety evaluation (see Case 1 below).
The that the RCS and main steam system pressure limits are not exceeded, and that the event would not lead to a more serious event, are demonstrated by means of an accident (see Case 2 below).
Case 1.
Safety Evaluation to show that fuel cladding integrity is maintained.
If no reactor trip signal is assumed to be generated by the SI signal, then borated water from the SIS would cause core and power level to drop, and consequently, the calculated DNB ratio to rise.
The calculated DNBR would increase throughout the transient, without ever approaching its safety analysis limit value.
Therefore, the Spurious Operation of the SIS at Power could not lead to any fuel damage.
Case 2.
Accident Analysis to show that RCS and main steam system pressure limits are not exceeded, and that the event would not lead to a more serious event.
During a Spurious Operation of the SIS at Power event, the addition of borated water from the SIS, into the RCS, can fill the zer and eventually lead to the of water through the pressurizer valves.
Since the valves have not been fied for water one or more of the valves might fail to reseat completely, and thereby create a non-isolatable leak from the RCS.
Such a situation would be an escalation of a Condition II event into a more serious event (a small break LOCA), a violation of the third acceptance criterion.
15.2-56 SGS-UFSAR Revision 25 October 26, 2010
The Spurious Operation of the SIS at Power is analyzed using the LOFTRAN (4]
code.
LOFTRAN simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generator, steam generator safety valves, and the effects of the SI system. The code computes pertinent plant variables, including temperatures, pressures and power level.
The following basic assumptions were used to define and evaluate this event:
- a.
- b.
Initial reactor power is at its maximum value (+0.6%).
Uncertainties are 0
deducted from the initial RCS temperature and pressure (-5 F and -50 psi).
Assuming lower values of initial T and pressure tends to reduce avg the time predicted to fill the pressurizer.
The SI signal causes the reactor to trip.
Core residual decay heat generation is based upon long term operation at the initial power level.
- c.
Two centrifugal charging pumps and one positive displacement charging pump are in operation, with the miniflow valves open.
Full SI flow begins immediately.
- d.
The pressurizer sprays and heaters operate at their maximum capacity.
The pressutizer sprays limit the RCS pressure, permitting a higher SI delivery rate, which fills the pressurizer sooner.
The heaters add energy to pressurized fluid, causing it to expand, and thus fill the pressurizer at an increased rate.
- e.
Either the pressurizer PORV block valves are open, or they are opened by the operators before the pressurizer safety valves open.
- f.
One of the pressurizer PORVs opens, and relieves water.
The PORVs and downstream piping are qualified for this safety-related application (17,18].
15.2-57 SGS-UFSAR Revision 24 May 11, 2009 I
I I
I 15.2.14.3 Results Fuel Cladding Integrity (evaluation)
If the SI signal does not trip the reactor and turbine, then nuclear power would decrease as borated water is added to the core.
Since steam flow would be maintained, the mismatch between nuclear power and load would cause T, avg pressurizer pressure, and pressurizer water volume to decrease until the low pressurizer pressure reactor trip setpoint is reached.
The DNB ratio would increase, due mainly to the decrease in power and T,
and always remain above avg its safety limit value.
Therefore, this event would not pose a challenge to fuel clad integrity.
Pressure Limits and Escalation into a More Serious Event (accident analysis)
An analysis was performed using the LOFTRAN code.
The resulting transient response plots are depicted in Figures 15.2-44 and 15.2-45.
Nuclear
- power, T,
pressurizer pressure, avg and pressurizer water volume
- decrease, and steam pressure increases, as the result of the reactor and turbine trips demanded by the spurious SI signal.
Pressurizer pressure and pressurizer water volume begin to increase as water is added to the RCS by the SIS and the pressurizer sprays and heaters operate.
Pressurizer pressure stabilizes as the pressurizer spraying limits the pressurizer pressure to within about 4 0 psi above its initial value.
The action of the pressurizer sprays, in limiting the pressure, allows more SI water to be added to the reactor coolant system, which surges into the pressurizer.
It is assumed that the operators open the PORV block valves, if they are closed, before the pressurizer safety valves open.
After the pressurizer becomes water-solid, the pressure rapidly :Lncreases to the PORV opening setpoint (conservatively assumed to be only 100 psi above the initial pressure, or 2300 psia).
Only one of the two PORVs is assumed to open and relieve water.
15.2-58 SGS*-UFSAR Revision 18 April 26, 2000
After ten minutes, the transient equilibrates to a relatively stable condition, wherein T is constant, the zer is water-solid, and pressure avg is maintained at or near the PORV setpoint, as water is relieved through PORV.
The event is ultimately ended by the repeated cycling of the operators, who stop the SIS flow and re-establish normal letdown flow, as per the emergency operating The operators will ensure that the PORV block valves are open before the valves open, ten minutes after the initiation of the event.
This action assures the availability of the PORVs to open automatically when their opening setpressure is reached.
The results of the accident analysis indicate that opening one PORV will limit the pressurizer pressure to a level ~hat will not cause any of the pressurizer safety valves to open.
As the safety valves will not open, the event cannot escalate to a more serious event (e.g., a small break LOCA, due to the failure of a valve to reseat completely).
The figures presented for this event are taken from explicit* calculations performed for the Unit 1 replacement steam generators.
Unit 2 analysis results are similar in nature to those presented here, and the conclusions presented below to both sets of 15.2.14.4 Conclusions The results of the Spurious Operation of the SIS at Power evaluation and analysis demonstrate that:
( 1)
Pressures in the reactor coolant and main steam systems are limited to less than 110% of the design values.
Operating one PORV limits the (2) pressure to about the PORV setpressure, which is well below the RCS design pressure.
Fuel cladding (Case 1), which safety is maintained.
This is based upon an evaluation that the DNBR would remain above the DNBR limit value.
(3)
A more serious fault would not result from the Spurious Operation of the SIS at Power event.
The Case 2 analysis results show that an open PORV will limit the pressurizer pressure to a level that will not cause any of the safety valves to open, and thereby preclude the possibility that one or more of these valves would generate a more serious event by opening and failing to re-seat properly.
15.2-59 SGS-UFSAR Revision 18 April 26, 2000
15.2.15 Turbine Generator Accidents The likelihood of a turbine generator failure in which missiles are generated is remote.
A review of the records of all Westinghouse turbine generator units in operation from 1938 to 1969 is presented in Reference 14.
Catastrophic failure of turbines reported in the Appendix fall into one of two categories:
- 1.
Failure by overstressing arising from accidental and excessive over speed
- 2.
Fracture because of defects in the material at speeds under the design over speed Contributing factors in the Westinghouse record of never having had a turbine generator run away to destructive overspeed are redundancy in the control system and routine testing of the main steam valves and the mechanical emergency overspeed protective system while the unit is carrying load.
The overspeed control system for the turbine generator is described in detail in Sections 10.2.2.3 and 10.2.2.4.
When an overspeed condition is sensed, both the overspeed protection controller (OPC) solenoids and the turbine trip regular and backup solenoids are energized at 108% of rated speed to trip the turbine, closing the main steam stop and governor valves as well as the reheat stop and intercept valves.
In the event that these trips fail to function, the mechanical overspeed weight will trip the turbine at 108% of rated speed.
In addition, the backup electrical trip issued from the EHC controller is set at 110% of rated speed. When these valves are tripped, the turbine speed will continue to increase due to the finite valve closure time and the steam which is trapped in the turbine and piping downstream of the tripped valves.
The turbine speed, however, will not exceed the design overspeed (120 percent of rated speed).
The likelihood of a failure in the second category, resulting from material defects, at speeds below design overspeed, is very small. There have been no failures of this nature in the United States since 1956.
This has been attributed to improvements in design, inspection and manufacturing techniques 15.2-60 SGS-UFSAR Revision 27 November 25, 2013
stemming from thE~ work of a special task force of forging suppliers and equipment manufacturers which was set up in 1955 under the auspices of the American Society for Testing and Materials to study turbine and generator rotor failures.
This task force developed the high-toughness NiCrMoV material now used in all turbine rotors and discs.
Reference 14 states that the surrounding casing is designed to prevent external missiles up to at least 120% of rated speed.
Note that Reference 14 applies to Unit 1 only.
For Unit 2, the limiting component for the ruggedized rotors are the turbine blades that are attached to the one-piece rotor.
The heaviest turbine blade is the last row
( 4 7"} blade that weights approximately 12 8 lbs.
A conservative comparison of the results in Reference 14 was made using the highest velocity presented (648 ft/sec) in the report.
This resulted in approximately 5% of the energy calculated for the existing rotor design.
The missiles identified in the report with significantly higher energy levels (12.7 x 106 to 17.8 x 10 6 ft/lbs) were contained within the shell.
Those that exited the shell expended 6
6 9.0 x 10 and 7.7 x 10 ft/lbs of energy to penetrate.
Therefore, it can be concluded that the Unit 2
limiting component (last row of blades) with approximately 1 x 10 6 ft/lbs of energy will be contained within the shell.
15.2-60a SGS-UFSAR Revision 21 December 6, 2004
THIS PAGE INTENTIONALLY BLANK 15.2-60b SGS-UFSAR Revision 16 January 31, 1998
15.2.16 References For Section 15.2
- 1.
Gangloff, W. C., "An Evaluation of Anticipated Operational Transients in Westinghouse Pressurized Water Reactors," WCAP-7486, May 1971.
- 2.
- Risher, D.
H. Jr. and Barry, R.
F.,
"TWINKLE-A Multi-dimensional Neutron Kinetics Computer Code,"
- January, 1975 (Proprietary) and WCAP-8028-A, January, 1975 (Non-Proprietary).
- 3.
Hunin, C.
"FACTRAN, A Fortran Code for Thermal Transients in 002 Fuel Rod," WCAP-7908, June 1972.
- 4.
Burnett, T. W. T. et al., "LOFTRAN Code Description," WCAP-7907-P-A (Non-proprietary), April 1984.
- 5.
- Altomare, S.
R.
and Barry, F.,
"The TURTLE 24.0 Diffusion Depletion Code," WCAP-7758, September 1971.
- 6.
Deleted.
- 7.
Geets, J. M., "MARVEL-A Digital Computer Code for Transient Analysis of a Multiloop PWR System," WCAP-7909, June 1972.
- 8.
- Mangan, M.
A.,
"Overpressure Protection for Westinghouse Pressurized Water Reactors," WCAP-7769, October 1971.
15.2-61 SGS-UFSAR Revision 24 May 11, 2009
- 9.
DELETED
- 10.
Westinghouse Letter, NS-TMA-2162, Anderson to Schwencer, November 15, 1979.
- 11.
Westinghouse Letter, NS-TMA-2167, Anderson to Schwencer, November 28, 1979.
- 12.
Westinghouse Letter, NS-EPR-2545, Rahe to Berlinger, January 20, 1982.
- 13.
DELETED
- 14.
CT-27336, Siemens Technical Report, "Missile Probability Analysis PSEG Nuclear LLC Salem Unit 1", Revision 1, dated November 5, 2003.
- 15.
Hassler, R. L., Lancaster, D. B., Monger, F. A., Ray, S., "Methodology for the Analysis of the Dropped Rod Event," WCAP-11394-P-A, January 1990.
- 16.
- Wathey, T.R.,
"Conditional Extension of Rod Misalignment Technical Specification for Salem Unit 1 and 2," WCAP-14962-P, August, 1997.
- 17.
Engineering Evaluation No. S-2-RC-MEE-1108, "Salem Unit 2 Evaluation of the Pressurizer PORVs for Inadvertent Safety Injection" (July 25, 1996)
- 18.
Engineering Evaluation No. S-1-RC-MEE-1272, "Salem Unit 1 Evaluation of the Pressurizer PORVs for Inadvertent Safety Injection" (December 10, 1997).
- 19.
DELETED
- 20.
DELETED
- 21.
Friedland, A. J., and Ray, S., "Revised Thermal Design Procedure", WCAP-11397-P-A, April 1989.
- 22.
Stewart, J. A., "Salem Unit 1 and 2 Feedwater Malfunction Analysis," CN-TA-15-10, VTD 902896, Sheet 037.
15.2-62 SGS-UFSAR Revision 29 January 30, 2017