ML17160A481
| ML17160A481 | |
| Person / Time | |
|---|---|
| Issue date: | 10/31/1993 |
| From: | Monteleone S NRC OFFICE OF NUCLEAR REGULATORY RESEARCH (RES) |
| To: | |
| References | |
| CON-FIN-A-3988 NUREG-CP-0132, NUREG-CP-132, NUDOCS 9311010020 | |
| Download: ML17160A481 (42) | |
Text
ATPACHMENTC To PLAA631 NUREG/CP-0132 Transactions of the Twenty-First Water Reactor Safety Information Meeting To Be Held at Bethesda Marriott Hotel Bethesda, Maryland October 25-27, 1993 Date Published:
October 1993 Compiled by: Susan Monteleone, Meeting Coordinator OAice of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555
~a 1tqy t4
~i
~e nOa O
e+n o~
- 4+
'A
'V
. SIMULATORBENCHMARKINGSTUDIES FOR ATWS SCENARIOS M. A. Chaiko and C. A. Kukielka Pennsylvania Power and Light Co.
Allentown, PA 18101 ABSTRACT There is much interest in the nuclear industry concerning the ability of training simulators to adequately model severe accident conditions, specifically ATWS events.
The Pennsylvania Power and Light Co. has recently installed a new simulator which was provided by S3 Technologies.
As part ofthe licensed operator training program, PPEcL provides training on Emergency Operating Procedures (EOPs).
Since the ATWS event is challenging from both a computational and operational point of view, the Engineering Department was asked to benchmark the new simulator performance.
The purpose ofthis benchmark was to ensure simulator fidelitywith EOP basis calculations which are numerically more rigorous. Once acceptable simulator fidelity had been demonstrated, EOPs were evaluated to ensure they could be implemented by the operators.
This paper examines the details ofthe new simulator response for ATWS events, and exposes the PAL ATWS procedures to further examination.
The simulator benchmark was carried otit using the PPkL-developed SABRE code which has been benchmarked against plant data and industry-accepted codes.
For many ATWS scenarios, the new simulator, which is based upon first principles, provides predictions consistent with SABRE.
Reactor power levels, consistent with SABRE results, are significantly higher than predicted by the old simulator, and containment pressurization occurs much more rapidly than previously simulated.
Additionally, the new simulated reactor water level, pressure and power are far more responsive to perturbations than predicted by the old simulator. This responsiveness is consistent with SABRE predictions and has helped to define modifications to the ATWS emergency operating procedures.
The modified procedures enhance the operators ability to respond to ATWS given the much more realistic reactor model.
This effort was very beneficial to the company.
It brought together the expertise of operators, trainers and engineers.
As a result of this cooperative effort, we are confident, that the new simulator provides realistic representation of the ATWS event and thereby provides an optimal platform to test PAL's ATWS strategy and operator proficiency.
1.INTRODVCTION
'Pennsylvania Power & Light Company (PP&L) has recently installed a new plant simulator, developed by S3 Technologies, at its Susquehanna Steam Electric Station (SSES).
As part ofthis
'simulator upgrade project, benchmarking studies have been carried out to identify any anomalies associated with simulator response.
In this paper, simulator benchmarking results are presented for Anticipated Transient Without Scram (ATWS) events.
This benchmarking effort represents an element of PP&L's risk management strategy'hich requires that defense in depth for both plant equipment and procedures be established and monitored.
Establishing procedural defense in depth involves demonstrating through analysis that the procedures minimize the likelihood ofcore and/or containment damage caused by actions taken or actions not taken.
Moreover, simulator exercises are carried out to determine ifsufficient time, information, and equipment is available for the operator to reliably execute the procedural steps.
Through application ofthis strategy, PP&L has developed ATWS procedures that minimize, with a high degree of confidence, the likelihood oflosing either core or primary containment integrity.
These procedures deviate significantly from the BWR Owners'roup Emergency Procedure Guidelines and have been reviewed by the NRC.2 Procedural actions are based upon the followingmitigative steps:s Early initiation of water level reduction to a target control band of -80" to -110" with an allowable range of-60" to Top ofActive Fuel (TAF).4 Immediate initiation of Standby Liquid Control System (SLCS) whenever the reactor power is greater than 5% coincident with a valid scram signal, 3.
Continued operation ofthe reactor at rated pressure in the event of an ATWS with SLCS failure, and 4.
Initiation of manual control rod insertion to effect reactor shutdown in the event of SLCS failure, and to ensure long term reactivity control ifSLCS is operable.
These strategic actions work together to protect both core and containment integrity. The reactor water level target region minimizes the challenge to the core from unstable operation since the feedwater spargers are uncovered; this promotes feedwater heating by steam condensation.5 Susquehanna Steam Electric
- Station, Individual Plant Evaluation, PP&L Report NPE 91-001,
- December, 1991.
Emergency Operating Procedure Inspection Combined Rcport Nos. 50-387/9346 and 50-388/9346, Docket Nos. 50-387 and 50-388, April, 1993.
"Technical Basis for PP&L's'Approach to ATWS Procedural Guidance".
PP&L Report NE-92%0, June, 1992 and PP&L Safety Evaluations NL-92%16. %17, 418, 419, & -020.
4 Top ofActive Fuel (TAF) is at -161". Therefore -110" is 4.25'bove TAF and -80" is 6.75'bove TAF.
"MitigationofBWR Core Thermal-Hydraulic Instabilities in ATWS", NEDO-32164, December, 1992.
It also facilitates boron mixing so that the injected boron willbe entrained from the lower plenum upward into the core.s Prompt level reduction and boron injection.protect the containment by rapidly reducing reactor power.
Manual control rod insertion (MRI) insures long term reactivity control.
In the event of an ATWS with SLCS failure, prompt level reduction and initiation ofMRI, with continued operation ofthe reactor at rated pressure, allows reactor shutdown without exceeding the primary containment design pressure.
Depressurization ofa critical reactor is avoided because it can present a threat to core integrity from inadvertent injection from high-capacity, low-
'pressure Emergency Core Cooling systems (ECCS).
Moreover, the reactor is expected to.be highly unstable at low-pressure conditions.7 Using these procedures, PP&L has demonstrated through analysis and simulator exercises'hat the
. Susquehanna plant can survive an MSIV closure ATWS with complete failure of the Standby Liquid Control System (SLCS) without damaging the core or exceeding the containment design pressure.
Simulator exercises verify that the procedures derived from this operating strategy can be reliably executed even in this challenging event (ATWS with SLCS failed).
The ultimate success ofthe PAL ATWS strategy'epends upon the validity ofthe methods used to develop the procedures and the fidelity of the simulator used to test them.
Reactor response during various ATWS scenarios has been evaluated using the PAL SABRE code.
These calculations form the technical basis for parts of the PP8'cL ATWS strategy.
SABRE has been benchmarked against plant data, RETRAN predictions, and TRACG results, and has been found adequate for reactor simulation under conditions associated with ATWS events.s A summary of SABRE benchmarking studies is presented in the Appendix to this paper.
The simulator benchmarking effort for ATWS consists ofa comparison ofsimulator and SABRE predictions for reactor transient behavior associated with shutdown by MRI and SLCS, operation at reduced RPV water levels, and operation with reactor pressure perturbations.
Examination of reactor response under these conditions was considered for simulator benchmarking because it involves evaluation of power, water-level and core-flow relationships, the worth of liquid boron and control rods, the response of a critical core to RPV pressure disturbances, and containment thermal response for short and long term ATWS scenarios.
A description ofthe. simulator models is given in Section 2, and results ofthe simulator benchmarking studies are presented in Section 3.
The Susquehanna simulator includes detailed modeling ofbalance-of-plant equipment in addition to the reactor and containment.
It can therefore reveal operational difficulties associated with implementing the ATWS strategy which are not discernible from the more-restricted SABRE models.
Evaluation ofthe procedural steps for potential implementation difficulties is part of the "The Management ofATWS by Boron Injection", NUREG/CR-5951, March,1993.
Hill,P.R., Appendix A to "An Independent Review of BWR ATWS/Stability Analyses Using the TRACG.
Computer Code", Electric Power Research Institute, February. 1992.
PP&L Report RA-B-NA445, "SABRE:
A Computer Code for Simulation of Boiling Water Reactor Dynamics Undhr Failure to Scram Conditions," Rev. 1. June, 1993.
PP&L defense-in-depth criteria for procedures, i.e., there must be suf6cient time, information and equipment available for the operator to reliably execute the procedural steps.
Section 4 of this paper discusses operational difhculties associated with controlling RPV water level during certain ATWS simulator. exercises.
A modified water level control strategy to address this problem with level control is then presented.
- 2. DESCRIPTION OF SIMULATORMODELS The Susquehanna Steam Electric Station is a two unit plant utilizing General.Electric's Boiling
'ater Reactor 4 product line for the Nuclear Steam Supply System and a Mark II pressure suppression containment system.
Both reactors are currently rated at 3293 Mwt; however, the thermal power is being uprated by 5%.
Both units share the PP&L designed advanced control room.
Additionally, each unit has a remote shutdown panel for shutdown from outside the control room and separate relay rooms for each division ofplant logic and instrumentation.
The new simulator is architecturally similar to the Unit 1 control room. The instructor's console is housed behind a mirrored glass wall which gives the appearance of the Unit 2 control room.
A remote shutdown panel is included as part of the simulator as well as a section of a relay room.
Plant behavior is simulated using Encore computers.
Plant simulations are based upon first-principle models and are expected to provide an accurate representation of the plant response trends in real time.
The simulator employs a S-equation, drift-flux model to describe thermal-hydraulic conditions within the reactor.
The core model consists of 3 power channels and a bypass channel.
Coarse noding (3 axial nodes in core) is used to allow simulations in real time.
The major drawback associated with the coarse axial noding of the power channels is a poor description of density-wave propagation through the core.
Since the simulator employs a coarse axial description of the reactor hydraulic conditions, unstable reactor operation cannot, in general, be predicted.
However, proficient execution of procedures requires practice on the simulator.
This places a requirement on the simulator to generate oscillations such as those that occurred at the LaSalle Nuclear Power Plant on March 3, 1988.
This conflict between the requirements for a finely-noded reactor model and real time computing is. reconciled by imposing oscillations on all core power indication whenever the reactor enters operating regimes where density-wave oscillations are expected to initiate.
While this approach resolves the conflict in requirements, there are still some modeling limitations. For example, the simulator cannot predict interactions between density-wave instabilities and reactor pressure because there is no net power increase associated with the instabilities; they are only superimposed on the power indication.
SABRE calculations indicate that reactor pressure response strongly reinforces core instability when a critical reactor is rapidly depressurized during an ATWS event.
For the neutronics calculation, a l-group, 3-dimensional neutronics model with coarse noding (150 core nodes) is used in the simulator.
Polynomial curve-fits of reactivity in terms of void fraction, fuel temperature, moderator temperature, control fraction, boron concentration, xenon concentration, and samarium concentration are used to compute the nodal reactivity contributions to the total core reactivity.
SIMULATORBENCHMARKINGRESULTS As part of simulator benchmarking efforts, several ATWS scenarios were run on the new SSES simulator.
In order to benchmark these simulator results against the basis calculations for the SSES ATWS procedure, SABRE calculations for the same scenarios were carried out.
In this Section, reactor and containment response are compared against SABRE results for four different ATWS scenarios.
The four benchmarking studies examine reactor response under conditions where:
1.
Manual control rod insertion (MRI)is used for reactor shutdown, 2.
The reactor is operated at low downcomer water levels, 3.
The core is subjected to reactor pressure perturbations, and 4.
Reactor shutdown is achieved with boron injection.
In all four transients, the main steam isolation valves (MSIVs) are closed (isolation ATWS). All transients are initiated at or above the 100% rod line (3293 MW thermal), and an end-of-cycle (EOC) core model was used.
Simulator scenarios discussed in this section were carried out by training and engineering personnel.
In some instances, details of the ATWS emergency operating procedure (EOP) were not strictly followed in order to accelerate the simulator exercises.
However, shortcuts were only taken on steps which are insignificant with regard to the benchmarking effort.
Discussion is provided in the following sections to indicate where the scenario evolution would differ ifthe ATWS EOP had been rigorously followed.
3.1 Reactor Shutdown with MRI This scenario involves an MSIV closure with scram failure.
Alternate Rod Insertion (ARI) and SLCS are also assumed to fail.
With these equipment failures, reactor shutdown can still be achieved by individually inserting control rods via the Reactor Manual Control System (RMCS).~
This system is used to carry out routine control rod maneuvers in the plant.
The RMCS relies on flow paths which are independent of the scram system.
In order to initiate MRI, the operator must bypass the insert rod blocks associated with the Rod Worth Minimizer (RWM) and the Rod Sequence Control System (RSCS).
At Susquehanna, the RWM can be bypassed by means of a "Susquehanna Steam Electric Station Individual Plant Evaluation", NPE-91%01, Volume 4, p. F-251,
- December, 1991.
control-room switch.
Although the RSCS must currently be bypassed outside the control room, PP8cL is planning to install a control room bypass switch to defeat the RSCS under ATWS conditions. In this scenario, it is assumed that the RSCS bypass switch is installed.
Following the MSIV closure, the turbine-driven feedwater pumps continue injection to the Reactor Pressure Vessel (RPV) while there is suf5cient steam pressure available within the main steam lines.
The simulator predicts that feedwater will remain available for -170 seconds following the MSIV closure.
The SABRE model, which is based on pressure decay rates obtained from plant data for an MSIV closure transient, indicates that feedwater will continue to inject for about 120 seconds following the MSIV closure.
It was assumed in this scenario that operators do not take manual control ofthe feedwater system prior to loss ofinjection from main-steam-line pressure decay.
Following depletion of feedwater, the HPCI and RCIC systems automatically initiate when level drops to their set points. MRI is initiated at 5 minutes into the event.
The control rod insertion rate for this simulation averaged 58 seconds per rod.
During the scenario, HPCI suction automatically transferred from the condensate storage tank to the suppression pool as a result of high pool level.
The EOPs instruct the operator to defeat the suction transfer by manually bypassing the transfer logic in the relay room.
However, defeating of the HPCI suction transfer logic was omitted in this scenario.'o The first loop of suppression pool cooling was brought into service at 720 seconds into the scenario, and the second loop was started at 880 seconds.
Figure 3.1-1 shows a comparison of the simulator and SABRE calculations for power, water level, total core flow(jet pump flow) and HPCI injection. Simulator data points were obtained by reading points from plotted output.
Note that the simulator and SABRE results give very good agreement with regard to the decline in reactor power due to MRI. Both calculations indicate that '37control rods are required to bring the reactor to a Hot Shutdown condition (<1% fission power) with level maintained within the EOP target region of-80" to -110".
The SABRE calculation indicates the occurrence of a sudden recriticality of 47% power caused by an SRV actuation just before the end of the transient.
Recriticality is caused by a moderator incursion generated by the sudden change in RPV pressure.
The single power channel model used in SABRE could be responsible for an exaggerated core power response to SRV actuations.
Following this power spike the reactor returns to a shutdown condition.
Comparison ofreactor water level response shows that the simulator equilibrium water level for full HPCI and RCIC injection is about -145" (-35" lower than the level calculated by SABRE).
At low reactor water levels, the simulator calculates a slightly higher power than SABRE (this is conservative for training purposes).
The higher power results in a lower equilibrium water level for a given makeup flow rate. This difference is discussed further in Section 3.2.
In order to increase HPCI reliability under A'PVS conditions, PP&L is planning a plant modification which would eliminate the HPCI suction transfer logic on high suppression pool level.
RCIC flowwas maintained at 600 gpm for nearly the entire transient.
In the SABRE calculation, HPCI flow is adjusted with a controller model to maintain a specified level.
The rapid fluctuations in HPCI flow (see Figure 3.1-1) generated by the SABRE calculation are caused by the controller model and are not realistic, since in the plant, HPCI is manually controlled by the operator.
The overall rate of decay of the HPCI flow rate during the transient does, however, match closely with the simulator trend.
The plot ofjet pump flow in Figure 3.1-1 shows that the simulator and SABRE results forjet pump flow differ by only 2 to 3 MLbm/hr during the power decline.
Figure 3.1-2 gives a comparison ofprimary containment parameters for the manual rod insertion scenario.
The average suppression pool temperature calculated by the simulator shows very close agreement with the SABRE calculation.
For this transient, pool temperature peaks at -230 'F.
Note that the initial pool temperature is 73 'F which is a low initial temperature for summer operation."
For the average drywell temperature
- response, the simulator and SABRE calculations show acceptable agreement.
With regard to suppression pool level, the largest difference between the calculations is about 0.4 ft. Note that pool level response corresponds to indicated level; it does not account for the level rise due to the thermal expansion of the water.
This contribution is neglected in the plot because the plant instrumentation determines pool level from pool hydrostatic pressure.
More limiting SABRE calculations predict a peak drywell pressure of 31 psig (22 psi below design pressure) for the isolation ATWS with ARI and SLCS failure when MRI is initiated at 10 minutes rather than 5 minutes into the event.
This result is based on a conservative control rod insertion rate of 90 seconds/rod as opposed to the 58 seconds/rod for the scenario described above.
Also, the initial suppression pool temperature is assumed to be 90 'F, and the two suppression pool cooling loops are brought into service at 15 and 20 minutes.
With installation of the control-room bypass switch for the RSCS, initiation of MRI at 10 minutes is probably conservative.
'.2 Reactor Operation at Low Water Levels In this scenario, MSIV closure with scram failure occurs at t = 10 seconds.
At the same time, the feedwater pumps are manually tripped to effect a rapid initial drop in water level.
There is no boron injection or control rod insertion.
HPCI and RCIC initiate on low RPV water level.
At 200 seconds, the operator reduces HPCI injection to about 4200 gpm to further reduce water level, and at 350 seconds, there is a further reduction in HPCI flow to -3500 gpm.
HPCI and RCIC suction is maintained on the CST throughout the entire transient.
Figure 3.2-1 shows a comparison of core power response to the decreasing water level.
Power response shows excellent agreement throughout the entire transient with differences ofonly 1 to 2 ll A more realistic initial temperature would be between 80 and 90 'F; however, the simulator was not re-initialized at a higher pool temperature because this is not an important parameter for benchmarking purposes.
percent power.
RPV water level, however, shows some disagreement.
For t > 75 seconds, the simulator water level is roughly 3 feet lower than the SABRE-calculated level.
The difference in
'water level response is due to the higher power level calculated by the simulator at water levels
,approaching TAF. This is seen more clearly from the plot ofcore power versus water level which is als'o given in Figure 3.2-1.
The important point illustrated by this phase-plane plot is the relatively constant power level calculated by the simulator as water level approaches TAF.
As level drops from -130" to -150", the simulator power remains essentially constant at 26 to 27/o power.
SABRE, on the other hand, predicts a power drop from -28/o at -110" to -20/o as level
'pproaches -150".
In SABRE benchmarking
- studies, power-versus-level behavior agreed closely with results of RETIE calculations performed by EPRI (see Section A.2 of the Appendix).
The close agreement between the SABRE and RETRAN calculations indicates that the simulator may be over-predicting core power at low RPV water levels (-130" to TAF).
Differences in simulator and SABRE power predictions are, however, relatively small, and it appears that the simulator gives a good overall description ofreactor power response under ATWS conditions.
3.3 Core Power Response to Reactor Pressure Perturbations This section examines the effect ofRPV pressure perturbations on core power.
SRV actuations produce abrupt changes in RPV pressure which interact with core power through void reactivity effects. Details ofsimulator power and RPV pressure response'to SRV cycling were recorded for an MSIV-closure ATWS scenario.
During a period ofthe simulation, water level was maintained slightly below TAF (--165").
There was no boron injection or control rod insertion during this part of the transient.
Details of simulator power and RPV pressure response are shown in Figure3.3-1.
Also shown in Figure 3.3-1 are SABRE results for similar reactor operating conditions.
In the SABRE calculation, SRV actuations were controlled in an attempt to match the simulator pressure trace as closely as possible.
Although there are differences in the pressure
- traces, the pressurization and depressurization rates are reasonably close.
The simulator and SABRE calculations for core power show excellent agreement.
Both codes predict power fluctuations up to -40~/o ofrated power..
3.4 Reactor Shutdown with Boron Injection Results for an MSIV-closure ATWS with SLCS operable are presented in this Section.
The MSIVclosure is initiated at t=28 seconds.
As in Section 3.1, it is assumed that operators do not take manual control of feedwater flow prior to its coast-down from depletion of main steam line pressure.
Once feedwater flow ceases, level drops rapidly, and HPCI and RCIC systems initiate.
HPCI and RCIC, with suction from the condensate storage tank (CST), are used to control level throughout the transient.
SLCS is conservatively initiated at 165 seconds following the s'cram failure.
Based on observations during EOP validation exercises, a realistic time delay for SLCS initiation is -90 seconds.
The two Suppression Pool Cooling loops are initiated at 15 and 16 minutes following the MSIV closure.
This is a realistic time delay for initiation ofpool cooling.
Simulator and SABRE predictions for this event are presented in Figure 3.4-1.
The simulator decay of core power as a result of SLCS injection shows good agreement with the SABRE calculation.
As observed in the results of Sections 3.1 and 3.3, the simulator predicts a lower reactor water level for a given makeup flow rate.
This is due to the slightly higher core power level calculated by the simulator at low downcomer water levels. In this scenario, water level was allowed to recover as the reactor approached the Hot Shutdown condition.
Ifthe Susquehanna ATWS EOP had been followed, level would have been controlled within the target region of.-80" to -110", and momentary level fluctuations between top ofactive fuel (TAF)
'and
-60" would be permitted.
The EOPs only allow level recovery when the Hot Shutdown Boron Weight (HSBW) is injected to the vessel.
Currently, the Susquehanna EOPs use the HSBW specified by the BWR Owners'roup
. Guidelines which is 755 ppm.'2 In order to achieve this boron concentration, SLCS injection is required for 32 minutes.
When the Susquehanna EOPs are revised to incorporate changes associated with the power uprate ofthe units, a plant-specific value of494 pp'm>> willprobably be used for the HSBW. Note that the HSBW is defined as a zero-power condition (no voids) with coolant at the s'aturation temperature corresponding to rated reactor pressure.
During SLCS injection, reactor shutdown willoccur before the HSBW is injected because some voids (-20%)
are present within the core when Hot Shutdown is initiallyachieved.
Figure 3.4-1 also shows HPCI flow during the transient.
The SABRE calculation was carried out with the intention ofmatching the simulator HPCI flow as closely as possible.
This approach was taken so that a valid comparison ofreactor power and water level could be obtained.
Figure 3.4-1 shows that the simulator predicts a peak pool temperature of 160 'F while SABRE calculates a value of 165 'F.
This corresponds to a 6% difference in the pool temperature rise.
The peak drywell pressure results are 4.8 psig and 4.3 psig for the simulator and SABRE, respectfully.
3.5 Summary ofBenchmark Studies In general, the simulator reactor and containment response for ATWS shows good agreement with the EOP basis calculations.
The only noted difference is core power at RPV water. levels approaching TAF.
The simulator shows an essentially constant power behavior as level is decreased from about -130" to TAF (-161"). The SABRE calculations, on the other hand, show a gradual drop in power as level is decreased.
However, the differences in power calculations are relatively small, and it is concluded that the simulator gives a good overall description of reactor transient response for ATWS events.
"BWR Chvners'roup Emergency Procedure Guidelines Revision 4". NEDO-31331.
1987. Appendix C.
(Document OEI 83904 C), p. C-A2-3.
PAL calculation NFE-B-NA458, Rev. 0, "SSES Specific Nuclear Fuel Characteristics for ATWS Analysis," February, 1993.
80 70
~ 60 o 50 o>
~ 40 Z 30 oj 20 10 a
~
5 g
~
SABRE
~
Simulato
~ S
~ ~
60 40 j
20 0
-20
~
~0
-80 x -100
- -120
-140
-160
~
~
IIL~
SABRE
~
Simulato
+jp
~
~
TAF= -161" 0
500 1000 1500 2000 2500 Time (sec) 0 500 1000 1500 2000 2500 Time (sec) 30 25
~ 20
~
15 o
o 10 C4
~ gS SABRE
~
Simulato
~
g 6000 5000 E
g 4000 o
o~ 3000
> 2000
~gM
SABRE
~ Simulato
-5 0
500 1000 1500 2000 2500 Time (sec) 0 500 1000 1500 2000 2500 Time (sec)
Figure 3.1-1 Comparison ofsimulator and SABRE predictions ofreactor response for MSIV-
.closure ATWS with manual rod insertion.
14
. 210
. 185 4
160 8
135 OI 110 85
SABRE
> Simulato 12 a~ 10 8
4 4
~ ~
E
SABRE
~
Simulato 60 1000 2000 3000 Time (sec) 1000 2000 Time (sec) 3000 180
~ 170
~
160 2~ 150 2
140 i
~ 130 A 120 110 8
~ R
~ S
SABRE
~
Simulato 26 25.5 25
~ 24.5 a
24 8
O'~ 23.5 Q
23 22.5 22
~ ST g
~
SABRE
~
Simulato 0
500 1000 1500 2000 2500 Time (sec) 0 500 1000 1500 2000 2500 Time (sec)
Figure 3.1-2 Comparison ofsimulator and SABRE predictions ofprimary containment response for MSIV-closure ATWS with manual rod insertion.
120
~o 80 0~
60 P4 o
40 20 0
> Simulato
SABRE 0
100 200 300 400 Time (sec) 50 0
-50
~ -100
-150
< Simulato
SABRE TAF= -161" 100 200 300 400 Tun: (sec) 35 6000 30 Cl 0
C4 o 25
~
~
~
SABRE
~
Simulato 5000 E
g 4000 O
~o 3000
~ 2000 1000
SABRE
~
Simulato 20
-150
-130
-110 Doi~ncomer Water Level (inches) 0 0
100 200 300 400 Time (sec)
Figure 3.2-1 Comparison ofsimulator and SABRE power/Ievel behavior for MSIV-closure ATWS with no boron injection. RCIC injection flow is -600 gpm.
1200 Steam Dome Pressure (psig) 50 Core Power (% of Rated) 1000 800 40 30 20 600 50 100 150 200 250 50 1200 50 100 150 200 250 1000 800 600 Simulator 40 30 20 10 Simulator 50 100 150 200 250 50 100 150 200 250 Time (sec)
Time (sec)
Figure 3.3-1 Comparison ofsimulator and SABRE core power response to RPV pressure perturbations.
120
~'100 80 O
o4 60.
~
4o Ps0 20 IS
~Q
. SABRE
~
Simulato 40 20 5
0
-20 ao
-60
-80 W -100
-120
~
~
a ~
SABRE
~
Simulato
~EM
~0
~g SS
~
TAF= -161" 500 1000 Time (sec) 1500 500 1000 1500 Time (sec) 5000 4500 4000 Ea. 3500
~ 3000 E 2500 Pz. 2000 1500 1000
SABRE
~
Simulato 500 1000 1500 Time (sec) 170
~ 160 jo 150 A~ 140 I 130 i-120 3
~ 110 O
100 90
~
so 70
~
~ ~
~
SABRE
> Simulato 500 1000 Time (sec) 1500 Figure 3.4-1 Comparison ofSimulator and SABRE predictions for reactor and suppression pool response during MSIV-closure ATWS with boron injection.
- 4. MODIFICATIONTO ATWS LEVELCONTROL BANDAS A RESULT OF SIMULATOREXERCISES The previous version (Rev. 4) ofthe Susquehanna ATWS procedure required water level control within the range of-80" to -1'10". Iflevel could not be maintained within this band, the procedure allowed the operator to rriaintain level between -80" and -161".
The extended level band was intended for situations in which insufficient makeup flow prohibits maintaining level above -110".
Validation ofthe EOPs (Rev. 4) was carried out on the old SSES simulator.
Comparison of the old sim'ulator response with EOP basis calculations indicated that the simulator significantly under
'redicted reactor power at reduced RPV water levels during ATWS scenarios.
Consequently, it was recognized that the procedure validation process could not reveal all potential difficulties associated with operator implementation ofthe EOPs.
. As anticipated, the reactor response predicted by the new SSES simulator, during ATWS scenarios, is characterized by higher power levels and increased oscillatory behavior.
It is clear that under certain plant configurations, particularly the high-power ATWS with MSIVs open and feedwater injecting to the vessel, operators can expect difficultyin maintaining RPV water level within a 30" control band, i.e., -80" to -110".
The feedwater injection rate is manually controlled by the operator during ATWS events because the water level controller is not designed to maintain the low levels required for ATWS mitigation.
Control of injection rate is accomplished by varying pump speed to obtain an appropriate pump discharge pressure.
Owing to plant design,
- however, the magnitude of expected RPV pressure fluctuations can easily exceed 100 psi.
- Roughly, pressure can be expected to vary from the setpoint at which all turbine bypass valves go closed (935 psig) to the lift set point of the first group of SRVs (1076 psig).
Although this pressure range is a small fraction ofthe total reactor pressure, it is large enough to cause serious difficulties in maintaining a constant feedwater injection rate.
The reason for the difficulty can be seen from inspection of the plant data presented in Table 4.1.
The plant data in Table 4.1 shows that the pressure drop from the pump discharge to the RPV is 48 psi for operation at 3 MLb/hr, which is a typical injection rate for a full power ATWS with water level in the -80" to -100" range.
Observe that ifthe magnitude ofthis pressure differential decreases by only 10 psi, the pump flowwillcompletely shut off An increase in the magnitude of the pressure drop of-35 psi will result in rated feedwater injection to the vessel.
Consequently, large variations in feedwater injection rates are possible for a non-isolation ATWS with manual feedwater flow control and RPV pressure fluctuations in the range of 100 psi.
Therefore, it is unrealistic to expect the operator to maintain an essentially constant RPV water level in a non-isolation ATWS when feedwater is manually controlled for vessel makeup.
In the isolation ATWS where HPCI and RCIC are used for RPV makeup, level control is much'asier for the operator because these systems are designed to automatically maintain constant flow
rates.
Therefore, the HPCI/RCIC injection rates are much less sensitive to RPV pressure fluctuations.
In order to address the operational difficulties associated with RPV water level control in an ATWS event, modifications to the EOP water level control instructions have been implemented.
As outlined in Table 4.2, there are distinct advantages to maintaining RPV water level within the band of-80" to -110" during ATWS mitigation. However, the desirability of maintaining level in this band had to be reconciled with the fact that the operator cannot maintain a 30" level band under some plant configurations (non-isolation ATWS with feedwater injecting to the vessel).
As result, the EOP water level control guidance for ATWS required modification in order to acknowledge the fact that the operator cannot maintain a 30" band during some scenarios. 'At the same time, however, it was important to retain the benefits associated with level control between
-80" to -110" whenever possible.
In order to satisfy both of these goals,-the level control guidance described by Figure 4.1 was adopted.
With this level control guidance, the operator is required to maintain level within the 101-inch band from -60" to -161"..Concurrently, the operator must attempt to maintain level within the target band because of the undesirable consequences ofprolonged level control outside the target (see discussion in Table 4.2).
~Within the framework of the level control guidance specified in Figure 4.1, level fluctuations outside the target region are expected and acceptable.
On the average, however, the water level should be maintained near or within the target region.
If there is insufficien makeup flow available to maintain level within the target region, prolonged level control below -110", but above -161", is acceptable because the only alternative is rapid depressurization of the RPV followed by core reflooding with low-pressure ECCS.
Ifnormal water level is maintained during an ATWS, high levels of core-inlet subcooling will result from loss of feedwater heating or from cold-water injection with HPCI and RCIC.
The increase in subcooling can drive the reactor into a severely unstable mode of operation with power pulses reaching several thousand percent of rated power.
General Electric calculations predict localized fuel melting in scenarios where no operator action is taken to manually runback feedwater flowto reduce level and uncover the feedwater spargers.t4 In the Susquehanna reactors, the feedwater nozzles are located at -24". The upper limit of the water level control band for the ATWS EOP is set at -60" (3 feet below the nozzles).
With level at -60", there should be efficient steam condensation on subcooled makeup flow injected through the feedwater spargers, and therefore, highly unstable behavior is not expected.
The upper limit of -60" is imposed because there is uncertainty with regard to the degree of steam condensation when level is only slightly below the spargers.
Because of the uncertainty associated with condensation effects as level approaches the spargers, the operator should be aware that power oscillations are possible even when the spargers are uncovered.
This is the reason for the caotion (Figure 4.1) associated with operation at levels approaching -60".
The caution associated with "ATWS Rule Issues Relative to Core Thermal-Hydraulic Stability", NEDO-32047, January 1992.
prolonged operation with level between -110" and -161" (TAF) is included because boron mixing willbe degraded at low levels, and core power is more responsive to SRV actuations.
Table 4.1 Feedwater System Operating Data for Flow Coast-Down Following MSIVClosure.
RPV Pressure at Sparger Elevation
( si )
989.6 991.8 983.1 Feedwater Pump Discharge Pressure
( si )
1075 1040 1021 Pressure Drop from Pump Discharge to RPV at Elevation of S ar ers(
si) 85.4 48.2 37.9 Feedwater Flow Rate (MLb/hr) 13.3 3.0 0.0 Figure 4.1 Modified Level control guidance for ATWS mitigation.
Maintain RPV water level between -60" and -161".
Outside the target region the following caution applies:
CAUTION:
Prolonged operation outside the target region can lead to increased containment thermal loading and power instability.
-60"
-80" Caution applies in this region.
(yellow)
-110" TARGET (white)
Caution applies in this region.
(yellow)
-161" TAF
Table 4.2 Benefits Associated with Maintaining RPV Water Level Between -80" and -110" During ATWS Mitigation.
Concern Fuel Integrity Benefits Associated with Level Control Band 1.
2.
3.
Provides margin for core coverage.
Avoids operation near TAF where core power is more responsive to RPV pressure fluctuations.
Feedwater spargers are uncovered by sufficient margin to provide highly efficient steam condensation on subcooled liquid injected through feedwater spargers (sparger nozzles are located at -24").
Heating of feedwater by steam condensation limits reactivity insertion and greatly reduces potential for power instabili Containment Thermal Loading Operator Performance 4
5.
6.
7.
Level range maintains sufficient core flow to carry liquid boron from lower plenum upward into the core.
With this level range, upward boron entrainment ceases only when reactor approaches Hot Shutdown condition.
In full-power, MSIV-closure ATWS, with no additional failures, level reduction is sufficien to facilitate reactor shutdown with suppression pool temperature within NRC limit of 190 'F (NUREG-0460 Criteriats).
- failure, level reduction is sufficient to allow reactor shutdown by. manual rod insertion before containment reaches design pressure of53 psig.
For full-power ATWS with MSIVs open, RPV steaming rate is within the turbine bypass capacity with water level between -80" and -110".
Makes level control easier because RPV level is maintained above narrow region of downcomer (downcomer free area decreases from 300 A2 to 88 ft2 as level is decreased below-110").
For an ATWS initiated from the 100%
rod
- line,
-'110" corresponds to the equilibrium water level for full HPCI and RCIC injection.
That is, in a full-power ATWS with MSIVs closed, water level will automatically seek the specified water level range.
- 10. RPV level can be determined from Wide Range level instrumentation.
Below -125", EOP requires use of Fuel 7one indication which is not calibrated for hi h ressure o eration.
"Anticipated Transients Without Scram for Light Water Reactors", NUREG%460, 1978.
- 5.
SUMMARY
PP&L has developed ATWS Emergency Operating Procedures that minimize the risk to both core and containment integrity. This has required taking substantial deviations from the BWR Owners'roup Emergency Procedure Guidelines for ATWS.
The NRC has reviewed these procedures and observed their use during simulator exercises; they are currently in place in the plant.
Simulator exercises have demonstrated that the operators can reliably implement the procedures as necessary to preclude core and containment damage, even in the more severe cases of ATWS with SLCS failure. The benchmarking studies presented here demonstrate simulator fidelity with best-estimate calculations.
This benchmarking provides assurance that the operator training is consistent with the expected plant response during ATWS. Thus, operators are provided with the best procedural guidance and simulator training for ATWS mitigation, given the current understanding ofplant transient behavior.
APPENDIX SABRE BENCHMARKINGSTUDIES This appendix contains the results of SABRE benchmarking studies against industry-accepted computer codes.
Additional benchmarking results are given in PPAL report RA-B-NA-045, Rev. l.
A.1 MSIVClosure ATWSComparison to PP&L RETRAN Calculations.
SABRE results for an MSIV-closure ATWS are compared with results obtained with the PP8cL RETRAN model's which has been approved by the NRC for core reload analysis.'
one-dimensional description of the neutron kinetics is used in the RETRAN calculation which was carried out with the inptlt deck contained in PPEcL calculation No. NFE-B-01-002, Rev.
3.
Modifications to this base deck consist of defeating the scram and specifying the feedwater flow rate and enthalpy followingthe reactor isolation.
4 A summary of the case-specific input parameters for the SABRE calculations are presented in Table A-1 along with corresponding values used in the RETRAN simulation.
"Qualification of Transient Analysis Methods for BWR Design and Analysis", PL-NF-8905, Rcv. 0, Pennsylvania Power &Light Company, 1989.
NRC Safety Evaluation Relating to PP8cL Topical Report PL-NF-89405, Docket Nos. 50-387 and 50-388.
Table A-1 Initial Conditions and Input Parameters for Simulation ofMSIVClosure ATWS.
Parameter MSIVstroke time seconds Initial core thermal ower Initial total core flow b
Initial steam dome ressure sia Initial core inlet subcoolin TU/Lb InitialFeedwater flowrate b
Initial feedwater enthal TU/Lb SABRE 4.0 3293 100 1005 26.0 13.26 348.2 RETRAN 4.0 3293 100 1005 23.7 13.47 356.4 In the SABRE code initialization, the core inlet flow, power, pressure, and water level are specified.
The core-inlet subcooling is then varied until the calculated initial reactivity is zero.
A comparison of the initial subcooling values in Table A-1 shows that the neutronics data base in SABRE is consistent with the plant conditions obtained with the "best-estimate" PP&L RETRAN model.
Figure A-1 shows a comparison of the SABRE and RETRAN results.
Both codes calculate a
peak power of -400% of rated power which indicates that the reactivity coefficients in SABRE are consistent with the detailed one-dimensional kinetics model in RETRAN.
The SABRE calculation shows a secondary power spike of -180% which is not present in the RETRAN calculation.
For natural circulation conditions (t > -20 seconds),
the SABRE prediction of core power agrees closely with the RE'IRAN result although it is slightly higher.
Also, for SRV cycling, both codes calculate power fluctuations ofsimilar magnitude and shape.
The peak steam dome pressure calculated by SABRE is 1188 psia which occurs at 8.1 seconds.
RETRAN predicts a peak pressure of 1197 psia at 6.7 seconds.
This corresponds to about a 10%
difference in the magnitude ofthe pressure rise.
SABRE predicts a broader pressure spike which is apparently responsible for the secondary power spike of -180% calculated by SABRE but not evident in the RETRAN results.
Both codes show fairly good agreement with regard to the water level transient.
The swell in water level is caused by the overall decrease in reactor power due to the recirculation pump trip.
The more rapid drop in level, predicted by SABRE, is attributed to the slightly higher power level calculated by the SABRE code.
The SABRE calculation for the decay ofthe core flow rate as a result ofthe pump trip also agrees very well with the RETRAN result.
450 400
~
350 300 O
~o 250
>~ 200 O~
150 u
100 50
SABRE
- RETRAN
\\\\
A p
~
v v<v 1200 1180 1160 1140 5
1120
~
1100 1080 A
1060 1040 1020 1000 I
t I
l I
l I
I 1
SABRE
- RETRAN (Ii I
t
]
I t
1 I
g i I Lg
/
0 20 40 60 80 Time (sec) 0 20 40 60 80 Time (sec) 60 40 20
~ -20
-40
~ %r\\
L~
\\
SABRE
- RETRAN 120 100 80 2
o 60 K
40 PeO 20
SABRE
- RETRAN v 4v
-60 0
20 40 60 80 Time (sec) 0 20 40 60 80 Time (sec)
Figure A-1 Comparison ofSABRE and RE'I'RAN calculation results for MSIV-closure ATWS.
A.2 MSIVClosure ATWS Comparison to NSAC-70 Results In this section, SABRE results are compared with a RETIE simulation of RPV boildown during an isolatioxt ATWS with no high-pressure makeup.'he RETIE simulation was carried out with a one-dimensional core neutronics
- model, and the cross-section set was developed for 100% power and flow at EOC conditions.
Results of this RETRAN calculation, which are for a BWR/4, provide a prediction ofreactor behavior over a wide range ofRPV water levels (normal level to below top of active fuel). 'Initial conditions and pertinent modeling assumptions for this calculation are listed in Table A-2.
In this MSIV-closure ATWS, there is no high-pressure injection (HPCI or RCIC) operable once the feedwater fiow decays to zero.
In the initial part of the RETRAN calculation (t < 40 seconds),
reactor pressure is controlled by cycling of safety/relief valves.
After 40 seconds, a
pressure-control model is used to maintain steam dome pressure constant at about 1100 psia.
The SABRE calculation is carried out in a similar manner.
Table A-2 Initial Conditions and Modeling Assumptions Used in RPV Boildown Simulation.
Parameter Initial Power Initial Steam Dome Pressure Feedwater Enthal Initial Core Flow MSIVs Full Closed Feedwater Flow Reaches Zero Pressure Control Initiated Value Used in SABRE 3293 MW 1005 sia 348.2 Btu/Lb 100 MLb r
3.5 seconds 37 seconds 40 seconds Value Used in RETRAN 3293 MW 1020 sia 349.9 Btu/Lb 100 MLb hr 3.501 seconds 45 seconds 40 seconds RETRAN results shown in Figure A-2, with the exception of the axial power shapes, were obtained in tabular form from one of the authors of the calculation.
The axial power shape plot was developed by reading values from Figure 4-15 of NSAC-70.
The values obtained from Figure 4-15 ofNSAC-70 were multiplied by the number ofcore nodes (12) used in the RETRAN model to get the power shape based on normalized nodal power.
Figure A-2 also shows that the core power during the RPV boildown gives good overall agreement with the RETRAN results.
At very low levels (below top of active fuel), however, SABRE predicts a slightly higher power level than RETRAN. The oscillations in core power calculated by SABRE at 40 seconds are due to the initiation ofthe pressure-control mode part ofthe calculation.
Peterson,.C.E.,
Gose, G.C., Hentzcn; R.D., McClure, J.A., Chexal, B., and Layman, W., "Reducing BWR Power by Water Level Control During an ATWS - A transient Analysis", NSAC-70, Electric Power Research Institute, Palo Alto. CA, 1984.
Figure A-2 also shows the upward shift in axial power shape predicted by SABRE and RETRAN, respectively, during the boildown.
The upward shift in the core power distribution is caused by the loss ofcore-inlet subcooling during the inventory decrease and by the. drop, in core inlet flow rate.
I 100 140 120 100
~
~
O 80 S
o 60 C4 4o
'20
,0
'SABRE
~ RETRAN 50 0
-so
-100
-150
-200
-250
SABRE RETRAN 58 0
50 100 150 200 Time (sec) 0 50 100 150 200 Time (sec) 25 23 21 19 o
17 15 o
13 11 9
7 5
3 1
SABRE
t=o
-,- - t=160 sec 0.5 1
Axial Power Profile 1.5 12 11 10 9
o 8
cl 7
o 6
at 4
3 2
1 0
RETRAN
t=0
--- t=160 sec 0.5 1
Axial Power Profile 1.5 Figure A-2 Comparison ofSABRE and RETRAN (NSAC-70) results for core power, water level, and axial power shift during RPV boildown. Axial power profile is nodal power divided by average nodal power.
A.3 Turbine Trip ATWS from MEOD Rod Line - Comparison to GE TRAC Results In this section, SABRE is compared with TRACG results for a turbine trip ATWS initiated from the'EOD (maximum extended operating domain) rod line.>>
TRACG includes a three-dimensional neutronics model with multiple core hydraulic channels and a two-fluid flow model.
TRACG is considered a "state-of-the-art" computer code for simulation ofBWR behavior under unstable operating regimes.
The TRACG results are therefore very useful for assessing the accuracy ofSABRE in predicting BWR instabilities. Both simulations are carried out with 100%
turbine bypass capacity.
The initial conditions for these calculations are given in Table A-3.
Table A-3 Initial Conditions for Simulation ofBWR Recirculation Pump Trip from MEOD Rod Line.
~ Parameter Initial Core Power InitialTotal Core Flow Initial Feedwater Tem erature SABRE 3293 MW 81.3 MLb/hr 417 'F TRACG 3323 MW 81.3 MLb/hr 420 'F In this scenario, feedwater injection is available since the reactor is unisolated;
- however, feedwater heating is not maintained because ofthe loss ofextraction steam from the turbine.
The loss offeedwater heating leads to high levels ofcore-inlet subcooling which drives the reactor into severely unstable operation.
Both TRACG and SABRE use a 60 second time constant to model the decay offeedwater temperature.
Figure A-3 shows the calculation results for the core-average power and the core-inlet subcooling.
The TRACG results for power only represent the oscillation amplitude.
These amplitudes were obtained from graphical output contained in NEDO-32047.
The amplitude of the power pulses predicted by SABRE show fairly good agreement with the large-amplitude spikes calculated by TRACG.
SABRE cannot predict the chaotic transition between large and small power pulses exhibited by the TRACG results because of its single core channel model.
Nevertheless, the. single-channel core model is useful in predicting the peak amplitude of core power pulses under highly unstable reactor operating conditions.
The largest power spike predicted by the TRACG calculation is about 3300% of rated core power; the peak power pulse predicted by SABRE is 2709% which occurs at 197 seconds.
Thus SABRE and TRACG show fairly good agreement with regard to the maximum power amplitude which is a key result ofthe analysis since it can determine whether or not fuel damage willoccur.
A comparison ofcalculated core-inlet subcooling levels is also presented in Figure A-3. This plot shows that SABRE computes a significantly higher level of core-inlet subcooling than TRACG.
NEDO-32047, "ATWS Rule Issues Relative to Core Thermal-Hydraulic Stability", General Electric Company, January, 1992.
The peak subcooling calculated by SABRE is about 95 K; TRACG calculates a peak subcooling of about 60 K.
The higher level of subcooling calculated by SABRE is due to the increase in time-average core power caused by the large-amplitude power oscillations.
Over the time period from 180'to 240 seconds, the time-average power calculated by SABRE is 129% of rated power, and the average amplitude of. the power pulses is 1940% of rated power.
As the time-average power increases, the core-exit quality increases and there is less saturated liquid exiting the steam separators to mix with the highly subcooled feedwater.
This leads to higher levels of core-inlet subcooling even though there'is no further change in feedwater temperature.
The dips in core-inlet subcooling calculated by SABRE are due to the occurrence of flow reversals at the core entrance.
In contrast to the SABRE result, TRACG does not predict a significant increase in time-average power as a result ofthe power pulses.
The mean power during the time period oflarge irregular oscillations is 78% ofrated power (NEDO-32047, pp. 6-6 and 6-7). Power level shortly after the recirculation pump trip is 60%; the increase in mean power to 78% is due to the rise in core-inlet subcooling which is caused by the loss offeedwater heating.
The discrepancy in the TRACG and SABRE results is probably due to core channel modeling difFerences (multiple channels in TRACG and single channel in SABRE).
35 30 H p2 0
o~ 20 N
~~
15 gu.
10 OZ 5
SABRE
~ TRA S
~
~ I
~I 80 C4 o
60 Ch 40 C
o 20
SABRE
~ TRA 0
50 100 150 200 250 1am(sec) 100 200 Time (sec)
Figure A-3 Comparison ofSABRE and TRACG results for turbine-trip ATWS initiated from MEOD rod line. TRACG results in power plot indicate representative values of power oscillation amplitude.
El l),
t ATTACHMENTD TO PLA"1631 '
page 1 of12 ANALYSISOF THE PEACH BOTTOM NUREG-1150 PRA WITHTHE SSES MODIFICATIONSINCORPORATED
ATrACHMEHTDTo PLA4631 Page 2 of 12 ANALYSISOF THE PEACH BOTTOM NUREG-1150 PRA WITHTHE SSES MODIFICATIONSINCORPORATED The following pages present a re-analysis of the Peach Bottom NUREG-1150 PRA'ith the SSES modifications incorporated.
The re-analysis was done in two ways 1) incorporating the SSES equipment and procedure modifications but using the 1150 models and data and 2) also incorporating and taking credit for the SSES IPE differences in models and data.
These analyses were requested from the chief engineer responsible for the SSES IPE and have been reviewed.
The first two tables present the summary results Rom the re-analysis, The accident sequence indices are those used in the NUREG-1150.
The "Delta for Methods" represents the factor difference due to differing methods and the "Delta for Modifications" represents the factor difference due to SSES equipment and procedure modifications.
The subsequent pages giyq the analyses of the individual sequences, Additional sensitivity analyses are also carried opt for the probability of failing to actuate SLCS.
'Analysis ofCore Damage Frequency:
Peach Bottom, Unit 2 Internal Events", NUREG/CR4550, August 1989.
Sheet4 t ATPACHMENTD TO PLA"t63l
'Page3of 12 l
Credit for Modeling Differences and Modifications Accident NUREG-Delta New Delta With PP&L Sequence 1150 Methods Frequenc Modifications Mods nOte 1
2 3
4 5
6 7
8 9
10 11 12 13 14 15 16 17 18 1.64E-06 1.40E-06 2.79E-07 2.12E-07 1.90E-07 1.30E-07 1.25E-07 1.14E-07 8.73E-08 5.72E-08 6.41E-08 4.63E-08 4.37E-08 3.29E-08 2.69E-08 2.45E-08 2.20E-08 1.70E-08 1
1 0.055 1
0.1 1
1 1
1 1
1 1
1 1
1 1
0.1 1.64E-06 1.4E-06 1.53E-08 2.12E-07 1.9E-08 1.3E-07 1.25E-07 1.14E-07 8.73E-08 5.72E-08 6.41E-08 4.63E-08 4.37E-08 3.29E-08 2.69E-08 2.45E-08 2.2E-08 1.7E-09 0.00034048 0.001 0.28 0.01 1
0.00034048 0.00034048 0.001 0.01 0.01 0.01 0.01 0.001 0.001 0.001 0.01 0.28 1
5.58E-10 1.4E-09 4.3E-09 2.12E-09 1.9E-08 4.43E-11 4.26E-11 1.14E-10 8.73E-10 5.72E-10 6.41E-10 4.63E-10 4.37E-11 3.29E-11 2.69E-11 2.45E-10 6.16E-09 1.7E-09 See Sensitivity 2 See Sensivity 1
See Sensitivity 3 & 7 See Sensitivity 4 See Sensitivity 6 See Sensitivity 2 See Sensitivity 5 See Sensitivity 1 See Sensitivity 4 See Sensitivity 4 See Sensitivity 4 See Sensitivity 4 See Sensitivity 1 See Sensitivity 1 See Sensitivity 1 See Sensitivity 4 See Sensitivity 3 See Sensitivity 6 Totals 4.51E-06 4.06E-06 3.83E-08 Delta due to modifications = (3.SEE)/(4.51E-e) =
0.009437181 Page 1
She et4 r ATI'ACHMENTD TO PLAA631 Pagc4of12 Credit for Modeling Differences and Modifications Accident NUREG-
- Delta, New Delta With PP&L Sequence 1150 Methods Frequency Modifications Mods note 1
2 3
4 5
6 7
8 9
10 11 12 13 14 15 16 17 18 1.64E-06 1.40E-06 2.79E-07 2.12E-07 1.90E-07 1.30E-07 1.25E-07 1.14E-07 8.73E-08 5.72E-08 6.41E-08 4.63E-08 4.37E-08 3.29E-08 2.69E-08 2.45E-08 2.20E-08 1.70E-08 1
1 0.055 1
0.1 1
1 1
1 1
1 1
1 1
1 1
1 0.1 1.64E-06 1.4E-06 1.53E-08 2.12E-07 1.9E-08 1.3E-07 1.25E-07 1.14E-07 8.73E-08 5.72E-08 6.41E-08 4.63E-08 4.37E-08 3.29E-08 2.69E-08 2.45E-08 2.2E-08 1.7E-09 0.00034048 0.001 0.28 0.01 0.00034048 0.00034048 0.001 0.01 0.01 0.01 0.01 0.001 0.001 0.001 0.01 0.28 1
5.58E-10 1.4E-09 4.3E-09 2.12E-09 1.9E-08 4.43E-11 4.26E-11 1.14E-10 8.73E-10 5.72E-10 6.41E-10 4.63E-10 4.37E-11 3.29E-11 2.69E-11 2.45E-10 6.16E-09 1.7E-09 See Sensitivity 2 See Sensivity 1
See Sensitivity 3 & 7 See Sensitivity 4 See Sensitivity 6 See Sensitivity 2 See Sensitivity 5 See Sensitivity 1 See Sensitivity 4 See Sensitivity 4 See Sensitivity 4 See Sensitivity 4 See Sensitivity 1 See Sensitivity 1 See Sensitivity 1 See Sensitivity 4 See Sensitivity 3 See Sensitivity 6 Totals 4.51E-06 4.06E-06 3.83E-08 Delta due to modifications = ( 3.8E-8)/(4.51 E-6) =
0.009437181 Page 1
Sheet2 ATPACHMENTD TO PLAA631 Page 5 of l2 SLCS sensitivit Sensitivity 1 Impact of Manual Rod Insertion and ATWS Procedure Changes on ATWS CDF NUREG Point 1150 Cut Set NUREG Estimate 1150 P E Frequency Cut Set 1
2 6
9 13 NS-1 8.00E-07 7.98E-07 5.00E-07 5E-07 8.50E-08 8.5E-08 6.10E-08 6.06E-08 3.80E-08 3.8E-08 6.46E-09 1.49E-06 T3A*RPSM*SLCS8 T3A*RPSM*SLCS9 T3A*RPSM*SLCS10 T3C*RPSM*SLCS8 T3C*RPSM*SLCS9 T3C*RPSM*SLCS10 0.005 7.98E-07 1.25E-07 8.5E-08 6.06E-08 9.5E-09 6.46E-09 0.001 7.98E-07 2.5E-08 8.5E-08 6.06E-08 1.9E-09 6.46E-09 1.08E-06 9.76E-07 PP&L Modifications desi ned to miti ate these se uences 1
Add RSCS bypass switch to allow immediate manual rod insertion.
2 Change level control band to -60 to -161 - Frees operator to insert rods.
BWROG procedures requires one operator to control pressure and one to control level 3
Eliminate requirement to depressurize on HCTL & PSP - avoids unnecessary and potentially core damaging depressurization during MRI. Operator has at least 40 minutes in full and 60 minutes in partial ATWS to start SLCS.
These modifications to the equipment and procedures allow the operator to successfully complete MRI.
Impact of Susquehanna Modifications to NUREG 1150 Cut Sets1,2,6,9
& 13 0.001 1.00E-05 0.01 0.1 1,00E-06 co 1.00E-07 1.00E-08
~CDF -0.02
~CDF -005 jp: ii a C
- Operator Error Rate for MRI P MRI CDF-0.02 CDF-005 1
0.1 0.05 0.02 0.001 1.49E-06 1.49E-07 7.44E-08 2.98E-08 1.49E-08 1.49E-09 1.08E-06 1.08E-07 5.42E-08 2.17E-08 1.08E-08 1.08E-09 Page 1
Sheet2 ATTACHMENTD TO PLAA631 I Page 6 of 12 Sensitivity 2 Impact of Susquehanna Modes on Accident Se uence f/1 NUREG Point 1150 Cut Set NUREG Estimate 1150 PE Frequency 14 3.70E-08 3.7E-08 P(CD/SBO) =
0.001832 Modifications
- 1. Early controlled RPV depressurization to allow success of fire main should HPCI/RCIC fail to run (EO-1/200-030).
- 2. Early connection of the fire main, using installed threaded attachment for RPV/PC injection (ES-013-001).
- 3. Early connection of 100kw generator to supply DC power to DC busses (EO-1/200-030 & ES-002-001).
- 4. Elimination of HPCI suction swap from CST to the Suppression Pool on high pool water level, prevents failure of HPCI on high water temperature.
- 5. Early alignment of HPCI in pressure control mode to reduce chance of SORV & multiple starts HPCI and RCIC (EO-1/200-030).
- 6. Installation of a maintenance swing diesel generator that can be substituted into any of the 4 ESS buses (OP-024-004).
E diesel has self-contained DC system.
- 7. Modified Emergency Service Water system so that 4 diesel must fail for SBO rather than two combinations of two diesel.
We have two self contained diesel driven fire pumps and over 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> to connect fire main NUREG-1150 Cut Set 14 FSW-XHE-( ACP-DGE-I ACP-DGE-( INJ F I
(
DGHWN (LOSPNR18H FO-EHS
( FR-EDGB-I FR-EDGC-
~ '
R12HR
)
R INJ-Fails HPCI and RCIC = 0.5, due to either harsh environment or loss of batteries.
Modifications and procedure changes 1, 2, 4, 5 significantly reduce the loss injection.
Based upon these mod INJ-Fails becomes:
INJ-Fails (HPCI and RCIC fail to run 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />) and (Both diesel driven fire pumps fail to start and run 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />)
INJ-Fails (0.1 x 0.1) x ((0.003+ 0.016) x (0.067+ 0.01 + 0.016)) =
1.77E-05 Page 2
Sheet2 I ATrACHMENrD TO PLAA631 Page 7 of 12 Modification 3 significantly reduces the chance of loss of DC power.
Using NUREG 1150 numbers for the charger diesel we get 0.003+ 0.016 = 0.019 These modifications change the NUREG 1150 sequence by replacing the term INJ-Fails with failure:
failure of either the charger diesel or the new injection capability, or (0.019+ 1.8E-5) = 0.019 Therefore the NUREG-1150 sequence becomes:
P(cd cut set 14) = (3.7E-8/0.5) x 0.019 =
1.41E-09 Risk reduction from these modes = 2.07E-9/3.7E-8 =
0.037959 Modification 6 allows onsite AC power to be recovered in less than 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.
Lighting is available to perform the manipulation of these breakers P(swing diesel) = 0.56 Risk reduction from this diesel becomes a straight multiplier of 0.56 P(cd cut set 14) = (3.7E-8/0.5) x 0.019 x 0.56 =
7.87E-10 Risk reduction from 1, 2, 3, 4, 5 & 6 =
0.021257 (NUREG-1150 diesel fails to run)
Modification 7 result in the requirement that all four diesel fail for SBO.
NUREG 1150 does not report common cause failure of 4 diesel to run. Therefore I'l assume a
common cause couple of 1.0 for the fourth given the third.
Risk deduction for third and fourth diesel = 0.016 P(cd cut set 14) = (3.7E-8/0.5) x 0.028 x 0.3 x 0.016 =
1.26E-11 Risk reduction from1,2,3,4,5, 6 & 7=
0.00034 Page 3
Sheet2
" ATTACHMENTD TO PLA t63 l Page 8 of 12 Sensitivity 3 Impact of Susquehanna Design on Accident Sequence 0 3 Analysis of Susquehanna plant scram data shows that the loss of feedwater given plant trip with the MSIVs open is 0.28.
In NUREG-1150 a value of 1.0 was used since the water level is lowered below the MSIVisolation. Susquehanna procedures keep the water level above the level 1 isolation; plus a bypass switch has been installed that bypasses the MSIVisolation on level 1. The MSIVisolation on high drywell pressure has also been removed.
Therefore credit for feedwater is appropriate.
Modifications
- 1. Level control band target above MSIVisolation set point.
- 2. Installation of a bypass switch that bypasses MSIVisolation on Level 1.
- 3. Removal of MSIVisolation on high drywell pressure.
Note: Susquehanna modeling would have all low pressure ATWS events with uncontrolled LPI proceed to core damage.
Risk Reduction from modifications = 0.28 Page 4
Sheet2 ATrACHMENrD TO PLAA63i Pai;c 9 of 12 Modifications:
Sensitivity 4 Impact of Modifications on Accident Sequence ¹ 4
- 1. Installation of a bypass switch that allows the operator to bypass the low pressure permissive
- 2. change to the Aux Load shed (LOCA load shed) scheme that allows the operator to reload the the D condensate pump and inject water into the RPV. Failure of the low pressure permissive has no impact on the ability of the condensate pump to inject to the vessel.
Note: The low pressure permissive circuit consist of two division which forms a one out of two taken twice logic. Division I uses Barksdale pressure sensors, which uses a bordon tube for pressure measurement.
Division II uses a Barton pressure sensor which uses a diaphragm for pressure measurement.
Since different instruments are used for pressure measurement, one would anticipate a less likely incident rate for CCF.
Medium break LOCA calculations demonstrate that the operator has at least 648 seconds after the RPV pressure decays to the HPCI low pressure trip. This provides the operator ample time to establish vessel injection from either condensate of 1 of 8 low pressure ECCS pumps.
Two different operators control condensate and ECCS flow. With 10 minutes to establish flow the operator is at least as likely to initiate injection flow as to inject SLCS. Therefore a conservative value of 0.01 is applied.
Risk reduction from Modifications >
0.01 Page 5
Sheet2 ATTACHMENTD TO PLAA631
- Page 10 of 12 Sensitivity 5 Impact of modifications on Accident ¹ 7.
This sensitivity is just like Sensitivity 2 except in this case HPCI is already failed. Therefore no credit is taken for the risk reduction associated with continued HPCI operation INJ-Fails (1.0 x 0.1) x ((0.003+ 0.016) x (0.067+ 0.01+ 0.016)) =
0.000177 These modifications change the NUREG 1150 sequence by replacing the term INJ-Fails with failure:
failure of either the charger diesel or the new injection capability, or (0.019+ 1.7E-4) = 0.019 Early failure of HPCI has little impact on the injection success rate due to the diversity on injection systems provided by the modifications. Therefore the risk reduction is the same as Sensitivity
¹2.
Page 6
Sheet2
, ATTACHMENTD TO PLAA631
, Page ll of l2 Sensitivity 6 Treatment of Battery Common Cause Failure Development of the battery failure rates used in the Susquehanna IPE are discussed in volume 3 Section C.7.2.3.
The analysis was based upon a review of LER through 6/31/87 and NPRDS data from 1/1/84 through 12/31/89.
Based upon this data'a battery failure rate on demand was estimated to be 2.4E-7/hr. The authors of NUREG/CR-3831 report following values for battery failure from their investigations: 3.8e-8/hr (low), 6.4E-7 (recommended) and 3.0E-6/hr (high). Clearly the Susquehanna value is within this range.
A value of 3.0E-6 was used in NUREG-1150.
Susquehanna did not include a common cause couple for batteries.
A common cause couple of 0.0023 was applied for failure of 4 batteries given failure of the first. This common cause couple is based upon work in NUREG-0666, and is largely attributed to common maintenance errors.
The diesel generators at Susquehanna can utilize DC power from either unit. Maintenance is generally performed on the batteries during refueling outages due to the 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> AOT associated with a battery being inoperable.
Therefore this common cause couple should not apply across units. The batteries used to start the diesel are selected using a selector switch in the diesel bay.
Upon LOOP with failure of the diesel to start a non-licensed operator (NPO) will be dispatched to the diesel bays in alphabetical order to manually initiate the diesel EO-1/200-030).
Time studies show that the no more that 10 minutes is required for: the control room operator to observe the SBO, dispatch the NPO to the diesel bays and have the NPO at the A diesel panel.
BWRSAR calculations show that given power uprate conditions, core damage will occur in 79 minutes following reactor trip and a high pressure boil off. Therefore the NPO has 69 minutes to identify the loss of DC on the engine panel, change the position of the DC power selector switch, place the engine in local and push the start button. The failure to recover offsite power in 68 minutes is estimated to be 0.1 in NUREG-1150. This is considered a conservative estimate for diesel recovery since there are many causes of loop that require many hours to restore, where this recovery action requires positioning two selector switches and pushing the start button.
Based upon this evaluation the NUREG-1150 common mode failure is applied to only one unit and an operator error of 0.1 is applied to the selection of the alternate battery supply.
Page 7
Sheet2 t ATrACHMENTD TO PLA4631 i Page l2ofl2 Sensitivity 7 Impact of Modeling Differences and Low Pressure ECCS Control Logic on Accident Sequence 3
Susquehanna ATWS calculations, as well as BWROG EPG documentation, identify the potential for severe core damage ifthe reactor is depressurized while either unborated or slightly borated.
In the case where SLCS is successful, but low pressure injection cannot be controlled, the injection flow may flush the boron out of the core and cause a power excursion.
For this reason without modification to the ECCS control logic, all low pressure ATWS events which rely on ECCS for core cooling result in core damage.
PP&L has modified the ECCS control logic in a manner that that allows the operator to control the low pressure ECCS flowwithin the requirements of ATWS.
Therefore with success of SLCS, the operator can feed the vessel with 2-3000 gpm using LPCI.
Prior to this modification the operator had to either lockout ECCS flow for five minutes or stop and start pumps.
This modification was required to satisfy defense in depth.
The operator has about 300 seconds in fullATWS and 460 seconds in partial ATWS to initiate a rapid depressurization to avoid core damage.
An error rate of 0.001 was assigned to failure to depressurize the reactor during ATWS based upon the time allowed. The operator can either feed with condensate or LPCI given installation of the control circuit modification. The probability of failure to control low pressure injection is assigned at 0.01, given the ability to control flow and the 101 inch control band.
Crediting the operator for initiating rapid blowdown has allowed us to uncover additional potential significant operator errors during ATWS. Discovery of this error has led to a plant modification to allow the operator to control low pressure flow and a level control band that assures core cooling and reactivity control, while providing the operator with a procedure that can be implemented.
Replace NUREG-1150 operator error -
ESF-XHE-FO-DATWS = 0.2 with (operator fails to depressurize or operator fails control low pressure injection) = (0.001+ 0.01) = 0.011 Risk Reduction becomes: 0.011/0.2 =
0.055 This risk reduction is placed in the modeling column due to the different treatment in low pressure ATWS operation.
Subsequent SABRE calculations show that failure to depressurize during ATWS does not result in core damage ifthe operator initiates SLCS, as indicated in NUREG -1150 Accident Sequence
¹ 3 provided that the RCIC system is successful; Operation of SLCS introduces boron which concentrates in the core and causes reactor shutdown.
RCIC then has sufficient injection to provide for core cooling. This calculation was discussed with the independent reviewer, however at the time of this writing the reviewer had not reviewed the particular ATWS calculation.
Page 8
a
~
~'>eY
~
ATTACHMEYf'YE'~AS~
Page l of.l2.
~,
O~
1 Qarrie
-Vp Wg1 V
P~~X 8t's Orlanle lkbrid Cesar
':.'"'.-"'=:j"-,:
Orlunle, +lorna::P>>
fuse 1 9, 19'P7.:::.,':";"..'.
Jg~h
~ 0+v" 5H
'I~
wPyvf Wt
. l>yg