ML17226A118
Text
RBS USAR Revision 17 15.0-1 CHAPTER 15 ACCIDENT ANALYSES 15.0 GENERAL In this chapter the effects of anticipated process disturbances and postulated component failures are examined to determine their consequences and to evaluate the capability built into the plant
to control or accommodate such failures and events.The scope of the situations analyzed includes anticipated (expected) operational occurrences (e.g., loss of electrical load), off-design abnormal (unexpected) transients that induce system operations condition disturbances, postulated accidents of
low probability (e.g., the sudden loss of integrity of a major component), and finally hypothetical events of extremely low probability (e.g., an anticipated transient without the operation
of the entire control rod drive system). 861Some of the anticipated operational occurrences (AOO's) are cycle dependent and must be re-evaluated for each reload cycle. It has
been determined that only a few of the transients analyzed for
the initial core would result in a significant reduction of the minimum critical power ratio (MCPR) (Ref. 9). The transients
that could produce this limiting condition are:
815141. Turbine Trip without Bypass or Generator Load Rejection without Bypass; 2. Loss of Feedwater Heating; 3. Feedwater Controller Failure; and
- 4. Control Rod Withdrawal Error; Transient events performed for the current cycle are presented in
Appendix 15B.
6The RBS power uprate (PU) program to 3039 MWT rated thermal power included re-evaluation of some of the baseline transient
analysis. The basis for the selection of the transient events for re-analysis is based on a calculation plan mutually developed, revised and agreed to between River Bend Station and the reload fuel vendor. The bases are also documented in Appendix E of
Reference 8 where it stipulates, Analysis will be performed for the limiting transient events. This includes all transient
events that establish the core thermal operating limits and the events that show conformance to the transient vessel protection
criteria (i.e., ASME overpressure limits).
15The transient events that are re-analyzed are labeled at 3039 MWt core power. The other events, which are not re-analyzed, are preserved without any updates. The key input conditions for these 3039 MWt core power cases are listed in Table 15.0-2A along with
the values for the original baseline analysis.
1 14 RBS USAR Revision 17 15.0-1a Rated power at RBS is increased to 3091 MWT through the implementation of the Thermal Power Optimization (TPO) Program (Reference 10). The limiting transient events will be reanalyzed for TPO uprate at the time of normal reload preparation for the first fuel cycle to employ the uprate. That analysis is to include all events that establish the core thermal operating limits and the events that show bounding conformance to the other transient protection criteria. The input parameters and initial conditions for the cycle-specific analyses are given in Attachment B to Appendix 15B. 1These events are evaluated for each reload cycle to determine compliance with the MCPR operating limit. Results of the most
limiting or near limiting events are provided in Appendix 15B.
115106 15 10 615.0.1 Analytical Objective The spectrum of postulated initiating events is divided into categories based upon the type of disturbance and the expected frequency of the initiating occurrence; the limiting events in
each combination of category and frequency are quantitatively
analyzed. The plant safety analysis evaluates the ability of the plant to operate within regulatory guidelines, without undue risk
to the public health and safety.15.0.2 Analytical Categories 14Transient and accident events contained in this report are discussed in individual categories as required by Reference 1.
The results of the events are summarized in Table 15.0-1. Table 15.0-1 is divided into three tables. Table 15.0-1 shows the results from the original power analysis results. Table 15.0-1A lists the results of original Table 15.0-1, but includes a footnote for each re-analyzed event performed at uprated core power. The results of the 5%power uprate cases are tabulated in Table 15.0-1B. Each event evaluated is assigned to one of the
following applicable categories:141. Decrease in core coolant temperature: Reactor vessel water (moderator) temperature reduction results in an increase in core reactivity. This could lead to fuel-cladding damage. 2. Increase in reactor pressure: Nuclear system pressure increases threaten to rupture the reactor coolant pressure boundary (RCPB). Increasing RBS USAR 15.0-1b August 1988 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR Revision 17 15.0-2 pressure also collapses the voids in the core-moderator thereby increasing core reactivity and power level which threaten fuel cladding due to overheating. 3. Decrease in reactor core coolant flow rate: A reduction in the core coolant flow rate threatens to overheat the cladding as the coolant becomes unable to adequately
remove the heat generated by the fuel. 4. Reactivity and power distribution anomalies: Transient events included in this category are those which cause rapid increases in power which are due to increased core
flow disturbance events. Increased core flow reduces the
void content of the moderator increasing core reactivity
and power level. 5. Increase in reactor coolant inventory: Increasing coolant inventory could result in excessive moisture carryover to
the main turbine, etc. 6. Decrease in reactor coolant inventory: Reductions in coolant inventory could threaten the fuel as the coolant becomes less able to remove the heat generated in the
core.7. Radioactive release from a subsystem or component: Loss of integrity of a radioactive containment component is
postulated.8. Anticipated transients without scram: In order to determine the capability of plant design to accommodate an extremely low probability event, a multisystem
maloperation situation is postulated. 15.0.3 Event Evaluation 15.0.3.1 Identification of Causes and Frequency Classification 12Situations and causes which lead to the initiating event analyzed are described within the categories designated previously. The frequency of occurrence of each event is summarized based upon
currently available operating plant history for the transient
event. Events for which inconclusive data exists are discussed
separately within each event section.
12 RBS USAR Revision 17 15.0-3 Each initiating event within the major groups is assigned to one of the following frequency groups.1. Incidents of moderate frequency - These may occur during a calendar year to once per 20 yr for a particular plant.
This event is referred to as an "anticipated (expected)
operational transient."2. Infrequent incidents - These may occur during the life of the particular plant (spanning once in 20 yr to once in 100 yr). This event is referred to as an "abnormal (unexpected) operational transient."3. Limiting faults - These are incidents that are not expected to occur but are postulated because their consequences may result in the release of significant amounts of radioactive material. This event is referred
to as a "design basis (postulated) accident."4. Normal operation - Operations of high frequency are not discussed here, but are examined along with the preceding three frequency groups in the Nuclear Systems
Operational Analyses in Appendix 15A. 15.0.3.1.1 Unacceptable Results for Incidents of Moderate Frequency (Anticipated Operational Transients) The following are considered to be unacceptable safety results
for incidents of moderate frequency (anticipated operational
transients):1. A release of radioactive material to the environs that exceeds the limits of 10CFR20. 2. Reactor operation induced fuel-cladding failure
.3. Nuclear system stresses in excess of those allowed for the transient classification by applicable industry
codes.4. Containment stresses in excess of those allowed for the transient classification by applicable industry codes.
RBS USAR Revision 17 15.0-4 15.0.3.1.2 Unacceptable Results for Infrequent Incidents (Abnormal Operational Transients) The following are considered to be unacceptable safety results for infrequent incidents (abnormal , (unexpected) operational transients):1. Release of radioactivity which results in dose consequences that exceed a small fraction of the criteria
of 10CFR 50.67.2.Failure of fuel cladding which could cause changes in core geometry such that core cooling would be inhibited
.3.Generation of a condition that results in consequential loss of function of the reactor coolant system
.4.Generation of a condition that results in consequential loss of function of a necessary containment barrier
.5. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.15.0.3.1.3 Unacceptable Results for Limiting Faults (Design Basis Accidents) The following are considered to be unacceptable safety results
for limiting faults (design basis accidents - DBA): 1. Radioactive material release which results in dose consequences that exceed the criteria of 10CFR 50.67.2. Failure of fuel cladding which would cause changes in core geometry, such that core cooling would be inhibited. 3. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes. 4. Containment stresses in excess of those allowed for the accident classification by applicable industry codes when
containment is required. 5. Radiation exposure to plant operations personnel in the main control room in excess of 5 rem total effective dose equivalent (TEDE) for the duration of the accident.
RBS USAR 15.0-5 August 1987 15.0.3.2 Sequence of Events and Systems Operations Each transient or accident is discussed and evaluated in terms of:1. Step-by-step sequence of events from initiation to final stabilized condition. 2. Extent to which normally operating plant instrumentation and controls are assumed to function. 3. Extent to which plant and reactor protection systems are required to function. 4. Credit taken for the functioning of normally operating plant systems. 5. Operation of engineered safety systems that is required. 6. Effect of a single failure or an operator error on the event.15.0.3.2.1 Single Failures or Operator Errors
15.0.3.2.1.1 General Chapter 15 contains evaluations of postulated single failures associated with anticipated transients. Plant nuclear safety
operational analysis (NOSA), the system-level qualitative-type failure modes and effects analysis of essential protective sequences in Appendix 15A, shows compliance with single active
component failure or the single operator error criteria.
15.0.3.2.1.2 Initiating Event Analysis 1. The undesired opening or closing of any single valve (a check valve is not assumed to close against normal flow) or 2. Undesired starting or stopping of any single component or RBS USAR 15.0-6 August 1987 3. Malfunction or maloperation of any single control device or
- 4. Any single electrical component failure or
- 5. Any single operator error. Operator error is defined as an active deviation from written operating procedures or nuclear plant standard operating practices. A single operator error is the set of actions that is a direct consequence of a single erroneous decision. The set of
actions is limited as follows:1. Those actions that could be performed by one person. 2. Those actions that would have constituted a correct procedure had the initial decision been correct.3. Those actions that are subsequent to the initial operator error and have an effect on the designed operation of the plant, but are not necessarily directly related to the
operator error.
Examples of single operator errors are as follows:1. Increase in power above the established flow control power limits by control rod withdrawal in the specified
sequences.2. Selection and complete withdrawal of a single control rod out of sequence.3. Incorrect calibration of an average power range monitor (APRM).4. Manual isolation of the main steam lines as a result of operator misinterpretation of an alarm or indication.15.0.3.2.1.3 Single Active Component Failure or Single Operator Failure Analysis This analysis is as follows:
RBS USAR Revision 12 15.0-7 December 1999 1. Undesired action or maloperation of a single active component or 2. Any single operator error where operator errors are defined as in Section 15.0.3.2.1.2. 15.0.3.3 Core and System Performance 12The analysis conditions and results described in this section are for the initial cycle. The analysis conditions and results of
the current cycle are presented in Appendix 15B.
15.0.3.3.1 Introduction 2Section 4.4 describes the various fuel failure mechanisms.
Avoidance of unacceptable results 1 and 2 (Section 4.4.1.4) for incidents of moderate frequency is verified statistically with
consideration given to data, calculation, manufacturing, and operating uncertainties. An acceptable criterion was determined to be that 99.9 percent of the fuel rods in the core would not be expected to experience boiling transition
- 2. This criterion is met by demonstrating that incidents of moderate frequency do not
result in a minimum critical power ratio (MCPR) less than 1.06 (1.07 for Single-Loop Operation) for the initial cycle. The
safety limit for the latest cycle is calculated for each cycle, and the value for both the two-loop operation and the single-loop
operation is given in Appendix 15B. The reactor steady-state CPR operating limit is derived by determining the decrease in MCPR for the most limiting event. All other events result in smaller MCPR decreases and are not reviewed in depth in this chapter. The MCPR during significant abnormal events is calculated using a
transient core heat transfer analysis computer program. The
computer program is based on a multinode, single channel
thermal-hydraulic model which requires simultaneous solution of
the partial differential equations for the conservation of mass, energy, and momentum in the bundle, and which accounts for axial
variation in power generation. The primary inputs to the model
include a physical description of the bundle, and channel inlet flow and enthalpy, pressure, and power generation as functions of
time.A detailed description of the analytical model may be found in Appendix C of Reference 2. The initial condition assumed for all full power transient MCPR calculations is that the bundle is operating at or above the MCPR limit of 1.18 for the initial cycle and an estimated operating limit MCPR for subsequent cycles
of 1.19. Maintaining MCPR greater than 1.06 (1.07 for Single-
Loop Operation) for the initial cycle and greater than the two-
loop operation and the single-loop operation values given in
Appendix 15B for the latest cycle is a sufficient, but not
necessary, condition to 2 12 RBS USAR Revision 2 15.0-7a August 1989 2 assure that no fuel damage occurs. This is discussed in Section 4.4.
2For situations in which fuel damage is sustained, the extent of damage is determined by correlating fuel energy content, RBS USAR 15.0-7b August 1987 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR Revision 17 15.0-8 cladding temperature, fuel rod internal pressure, and cladding mechanical characteristics.These correlations are substantiated by fuel rod failure tests and are discussed in Section 4.4 and Section 6.3.15.0.3.3.2 Input Parameters and Initial Conditions for Analyzed Events14 In general, the events analyzed within this section have values for input parameters and initial conditions as specified in Tables 15.0-2 and 15.0-2A.
The input parameters and initial conditions for the cycle-specific analyses are given in Attachment B to Appendix 15B.
Analyses which assume data inputs different from these values are designated accordingly in the
appropriate event discussion.
14The transient analyses for RBS were performed using nuclear parameters representative of the end of equilibrium cycle (EOEC) nuclear characteristics for the core design before the control cell core (CCC) concept was adopted. Comparisons of the void coefficients and scram characteristics used for these analyses
were made with those for the end of cycle one (EOC1) characteristics of the CCC. These comparisons demonstrated that the analyses results described in this chapter for the EOEC, non-CCC are bounding relative to the EOC1, CCC reactor for all
limiting transients and accidents.
The void coefficients and scram curves were determined from the ODYN code output (see Section 15.1.2.3.1 for additional information on this model). The one-dimensional input to ODYN
was obtained from the three-dimensional BWR core simulator model (see Section 15.4.2.3.1 for additional description of this code).
The void coefficient for the original core at EOEC was found to be 42 percent greater than that for the current design at EOC1,
(-) 11.4¢/percent rated void vs (-) 8.0¢/percent rated voids, respectively.10 The (negative) scram reactivity insertion, as shown on Fig. 15.0-4, similarly favors the current CCC design at EOC1.
Future cycle core loadings and design will be analyzed and
presented in the plant's reload licensing submittal (Appendix
15B).1015.0.3.3.3 Initial Power/Flow Operating Constraints The analysis basis for most of the transient safety analyses is the thermal power at rated core flow (100 percent) corresponding to 105 percent originalnuclear boiler rated (NBR) steam flow. This operating point is the apex of a bounded operating
power/flow map which, in response to any classified abnormal operational transients, yields the RBS USAR 15.0-9 August 1987 minimum pressure and thermal margins of any operating point within the bounded map. Referring to Fig. 15.0-1, the apex of the bounded power/flow map is point A, the upper bound is the design flow control line (104.2 percent rod line A-D), the lower bound is the zero power line H-J, the right bound is the rated core flow line A-H, and the left bound is the natural circulation
line D-J.The power/flow map A-D-J-H-A represents the acceptable operational constraints for abnormal operational transient
evaluations.Any other constraint which may truncate the bounded power/flow map must be observed, such as the recirculation valve and pump cavitation region, the licensed power limit and other restrictions based on pressure and thermal margin criteria. For instance, if the licensed power is 100 percent NBR, the power/flow map is truncated by the line B-C, and reactor operation must be confined within the boundary B-C-D-J-L-K-B. If
the maximum operating power level has to be limited, such as point F, to satisfy pressure margin criteria, the upper constraint on power/flow is correspondingly reduced to the rod line, such as line F-G, which intersects the power/flow
coordinate of the new operating basis. In this case, the operating bounds would be F-G-J-L-K-F. Operation would not be allowed at any point along line F-M, removed from point F, at the derated power but at reduced flow. If, however, operating limitations are imposed by GETAB (3) derived from transient data with an operating basis at point A, the power/flow boundary for 100 percent NBR licensed power would be B-C-D-J-L-K-B. This
power/flow boundary would be truncated by the MCPR operating limit for which there is no direct correlation to a line on the
power/flow map. Operation is allowed within the defined power/flow boundary and within the constraints imposed by GETAB.
If operation is restricted to point F by the MCPR operating
limit, operation at point M would be allowed, provided the MCPR
limit is not violated.Consequently, the upper operating power/flow limit of a reactor is predicated on the operating basis of the analysis and the corresponding constant rod pattern line. This boundary may be
truncated by the licensed power and the GETAB operating limit.
Certain localized events are evaluated at other than the previously mentioned conditions. These conditions are discussed
pertinent to the appropriate event.
RBS USAR Revision 14 15.0-10 September 2001 15.0.3.3.4 Results14The results of analytical evaluations are provided for each event. In addition, critical parameters are listed in Tables 15.0-1, 15.0-1A, and 15.0-1B. From the data in Tables 15.0-1,, 15.0-1A, and 15.0-1B, an evaluation of the limiting event for that particular category and parameter can be made. In Table 15.0-3, a summary of applicable accidents is provided. Table 15.0-3 compares the GE-calculated amount of
failed fuel to that used in worst-case radiological calculations.
1415.0.3.4 Barrier PerformanceThe significant areas of interest for internal pressure damage are the high-pressure portions of the RCPB (the reactor vessel and the high-pressure pipelines attached to the reactor vessel).
The overpressure below which no damage can occur is defined as the pressure increase over design pressure allowed by the
applicable ASME Boiler and Pressure Vessel Code for the reactor vessel and the high-pressure nuclear system piping. Because this ASME code permits pressure transients up to 10 percent over design pressure, the design pressure portion of the RCPB meets the design requirement if peak nuclear system pressure remains below 1,375 psig (110 percent x 1,250 psig). Comparing the events considered in this section with those used in the
mechanical design of equipment reveals that either the accidents are the same, or that the accident in this section results in
less severe stresses than those assumed for mechanical design.
The low-low set (LLS) relief function, armed upon relief actuation of any safety/relief valve (SRV) in the second lowest relief set-point group, causes a greater magnitude blowdown (in the relief mode) for certain specified SRVs and a subsequent cycling of a single low set valve. The effect of the LLS design on reactor coolant pressure is demonstrated (Chapter 5) on the main steam isolation valve (MSIV) closure event. This is considered bounding for all other pressurization events and, therefore, is not simulated in the analysis presented in this
chapter.15.0.3.5 Radiological Consequences In this chapter, the consequences of radioactivity release during the following three types of events are considered:1. Incidents of moderate frequency (anticipated operational transients).
RBS USAR Revision 17 15.0-11 2. Infrequent incidents (abnormal operational transients). 3. Limiting faults (DBA). For all events whose consequences are limiting, a detailed quantitative evaluation is presented. For nonlimiting events, a qualitative evaluation is presented, or results are referenced from a
more limiting or enveloping case or event.For limiting faults (DBA), the quantitative analysis is based on conservative assumptions considered to be acceptable to the NRC for the purposes of worst-case bounding of the event and
determining the adequacy of the plant design to meet 10CFR 50.67 criteria. This analysis is referred to as the "design basis
analysis." Results of the analysis are shown to be within NRC guidelines.
15.0.4 Nuclear Safety Operational Analysis (NSOA) Relationship Appendix 15A is a comprehensive, total plant, system-level, qualitative FMEA, relative to all the Chapter 15 events considered, the protective sequences utilized to accommodate the events and their effects, and the systems involved in the
protective actions.
Interdependency of analysis and cross-referral of protective actions is an integral part of this chapter and Appendix 15A. Contained in Appendix 15A is a summary table which classifies events by frequency only (i.e., not just within a given category, such as decrease in core coolant temperature). 15.0.5 Conformance to Regulatory Guide 1.49 141312Regulatory Guide 1.49 requires that the proposed licensed power level be restricted to a reactor core power level of 3,800 MWt or less, and that analyses and evaluations in support of the application should be made at 1.02 times the proposed licensed
power level. River Bend satisfied Regulatory Guide 1.49 during the plant operating license by performing the safety analysis and overpressure protection analysis at 102% of power or greater.
Model development and NRC approval permits the transient analysis to be performed at 100% power with the conservatism being
accounted for in adders.
The TPO program (Reference 10) obtained NRC approval for the application of a reduced reactor thermal power uncertainty factor, consistent with the design and accuracy of the plant feedwater flow measurement instrumentation.
The rated thermal power for River Bend Station reactor is 30 91 MWt. Some analyses are performed at 100% rated power because the Regulatory Guide 1.49power factor is already accounted for in the analysis methods.
131415 The thermal power used in the current reload licensing analysis is shown in Appendix 15B.
12 15 RBS USAR Revision 17 15.0-12 62 15.0.6 Single-Loop Operation (SLO)
A separate analysis has been performed at different initial conditions as specified in 15.0.3.3.2 to support single
recirculation loop operation (3,4) (Single-Loop Operation). The capability to operate at reduced power in the Single-Loop
Operation mode is highly desirable in the event that a
recirculation pump or other component maintenance renders one
recirculation loop inoperable. 1510 The impact of extending the existing power/flow map to include the MELLL operating region has been evaluated for single loop
operation by a separate analysis (6). To justify SLO, accidents and abnormal operational transients associated with power
operation were reviewed in accordance with previous RBS SLO
analysis (SLO with one pump in operation)
(4). Results of evaluations of the Minimum CPR Fuel Cladding Integrity Safety and Minimum CPR Operating Limits and Loss of Coolant Accident issues against SLO concluded that operation up to the MELLL rod line is acceptable. Results of the current cycle analysis are presented
in Appendix 15B.
2 6 15128 15.0.7 Increased Core Flow (ICF)
A separate analysis has been performed to support operation in a region of Increased Core Flow (5). The analysis supports the expansion of the original operating domain to include the ICF
region up to 107% of rated core flow at rated power.
The ICF analysis was performed in accordance to Reference 3. The analysis includes the normal fuel reload analyses such as AOO and accidents evaluation at ICF conditions and the mechanical
evaluation of reactor internals and fuel assembly. The flow-
induced vibration response of the reactor internals is also
evaluated. The evaluation results conclude that the plant can
increase core flow to operate within the region of the operating
map bounded by the line between 100% power/100% core flow and
10 0% power/107% core flow (5). This operational flexibility will be confirmed on a cycle specific basis in the reload analysis as
presented in Appendix 15B.
815.0.8 Maximum Extended Load Line Limit
10 12 RBS USAR Revision 17 15.0-12a 15.0.8.1 Description 141210The original operating envelope is modified to include the extended operating region bounded by the rod line which passes
through the 100%
TPO power/8 3.4% core flow point (approximately 11 3% rod line), the rated power line and the rated load line, as shown in Figure 4.4-5. The technical analysis is referred to as the Maximum Extended Load Line Limit (MELLL) analysis and the shaded area in Figure 4.4-5 is referred to as the MELLL region.
Operation in the MELLL domain enhances the plant operational flexibility and increases plant capacity factor. GE-NEDC-
32611P (7) presents the results of the safety analyses and system response evaluations performed for operation of RBS in the region
above the rated rod line for fuel Cycle 7.
10 12 14 RBS USAR Revision 14 15.0-12b September 2001 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR Revision 17 15.0-13 1015.0.8.2 Maximum Extended Load Line Limit Analysis (MELLLA) 1413The safety analyses and system evaluations performed to justify operation in the MELLL region consist of a non-fuel dependent portion and fuel dependent portion which is fuel cycle dependent.
In general, the limiting anticipated operational occurrences (AOOs) minimum critical power ratio (MCPR) calculation and the reactor vessel overpressure protection analysis are fuel dependent. Initial analyses, as discussed in this report, are based on the core loading configuration of RBS Cycle 7 at the original rated core thermal power. The non-fuel dependent evaluations such as containment response are based on hardware
design and plant geometry. The limiting anticipated operational occurrences (AOOs), as identified in NEDC-32611P (7), were analyzed for the MELLL region. For fuel-dependent evaluations of reactor
pressurization events, these analyses show that the operating limit minimum critical power ratio (OLMCPR) for operation in the MELLL region remains bounded by the rated condition (100%
upratedpower/100% flow), and the 100%
uprated power and 107% flow condition operating limits. For non-pressurization events, the Fuel Loading Error, is limiting at rated conditions for GE11
fuel. The analyses results show that performance in the MELLL region is within allowable design limits for overpressure
protection, loss-of-coolant accident (LOCA), containment dynamic loads, flow-induced vibration and reactor internals structural
integrity.
13 1415.0.8.3 Cycle Specific Analyses The fuel cycle dependent portion of the MELLL analyses, as stated in 15.0.8.2 including AOOs MCPR calculation and accident
analyses, will be verified as part of the fuel reload analyses for each fuel cycle. Normally, it is not necessary to verify the non-fuel cycle dependent portion of the MELLLA such as the
containment for subsequent cycles after the initial implementation. They will be verified only when there are significant changes in the fuel cycle design, for instance, major
fuel bundle design changes. Cycle specific results are shown in
the SRLR of Appendix 15B.
8 10 RBS USAR Revision 14 15.0-14 September 2001 1015.0.9 Elimination of T-Factor Setdown 15.0.9.1 Initial Analyses
The RBS Technical Specifications prior to Cycle 8 required that the APRM flow-biased scram and control rod block trip setpoints be setdown (lowered) when the T-factor exceeded 1.0 for LHGR protection. The T-Factor Setdown requirements were removed to
reduce the need for manual setpoint adjustment and to allow more direct thermal limits administration. The setdown requirements were replaced by the flow- and power-dependent thermal limits
which are documented on a cycle specific basis in the Core
Operating Limits Report (COLR). A General Electric analyses (NEDC-32489P) was performed to support this change which was implemented prior to Cycle 8 via Amendment No. 100 to the RBS
Technical Specifications. Two areas which can be impacted by the elimination of the setdown requirement are: a) fuel thermal-mechanical integrity, and b) loss-of-coolant accident (LOCA) analysis. The following criteria assure satisfaction of the above requirements and were applied to demonstrate the acceptability of elimination of the APRM trip
setdown requirements: (1) MCPR safety limit shall not be violated as a result of any AOOs (2) All fuel thermal-mechanical design bases shall remain within the licensing limits described in the GE generic fuel licensing report GESTAR-II. (3) Peak cladding temperature and maximum cladding oxidation fraction following a LOCA shall remain with the limits defined in 10CFR50.46. 14 The power- and flow-dependent MCPR and LHGR limits for T-factor setdown elimination were developed as part of the Maximum Extended Operating Domain (MEOD) performance improvement program for the BWR/6 class of plants (GESTAR Section S.5.2.7, S.5.2.6 and 4.3.1.2.7). The MEOD program determined that the power-dependent severity trends must be examined in two power ranges.
The first range is between rated power and the power level (P-BYPASS) where reactor scram on turbine stop valve closure or
turbine control valve fast closure is bypassed. P-BYPASS for RBS
is 40% of rated power. The second power range is between P-
bypass and 23.8% of rated power. No thermal monitoring is required below 23.8% power because of the substantial margin that
exists to MCPR and LHGR limits below 23.8% thermal power.
10 14 RBS USAR Revision 21 15.0-15 10 For the initial analyses (6), plant-specific power-dependent MCPR and LHGR limits were developed for use in the first power range. These power-dependent limits must be updated or the current limits validated for future operating cycles to account for changes in fuel designs, analyses methodology and/or plant
operating parameters. 14 For the initial analyses (6), plant-specific evaluations were performed in accordance with GE-Nuclear Energy procedures to confirm the applicability of these limits to RBS. These limits
are established on a cycle-independent basis but must be validated or updated for 23.8-40% rated thermal power to account for changes in future fuel designs, analysis methodology and/or
plant operating parameters.
14 The flow-dependent LHGR limits are also verified against the LOCA analysis to demonstrate that these flow-dependent LHGR limits also provide more than adequate fuel protection for postulated
LOCA events.
Prior to the implementation of the T-Factor setdown elimination
at Cycle 8, the power and flow-dependent limits were verified and updated as documented in the SRLR which is generated in
accordance with GESTAR. The flow and power-dependent limits
assure that no safety limit will be exceeded.
15.0.9.2 Cycle Specific Analyses and Results 15 14 The plant-specific MCPR and LHGR limits will be verified or updated each reload cycle using applicable approved methods as described in NEDE-24011-P-A (GESTAR II).
12 The verification of the power and flow-dependent limits including the MCPR and LHGR limits was performed for current cycle and the updated limits as described in Appendix 15B. These limits are included in the Core Operating Limits Report.
10 12 14 15 RBS USAR Revision 15 15.0-16 May 2002 1510 10 15 RBS USAR Revision 22 15.0-17 Reference - 15.0 8A 8 1. U.S. NRC Regulatory Guide 1.70, Revision 3, November 1978, "Standard Format and Content of Safety Analysis Reports for Nuclear Power Plants, Light Water Reactor Edition." 8A 12 2. "General Electric BWR Thermal Analysis Basis (GETAB): Data, Correlation, and Design Application," November 1978 (NEDO-10959 and NEDE 10958).
12 6 4 1 3. "General Electric Standard Application for Reactor Fuel," NEDE-24011-P-A, latest approved revision.
- 4. "Single-loop Operation Analysis for River Bend Station, Unit 1," NEDO-31441, May 1987.
- 5. "Safety Review for River Bend Station Increased Core Flow Operation Throughout Cycle 6," NEDC-32467P Revision 1, September 1995 10 6. T-Factor Setdown Elimination for River Bend Station, "NEDC-32489P, April 1996.
- 7. "Maximum Extended Load Line Limit Analyses for River Bend Station Reload 6 Cycle 7," NEDC-32611P, Revision 0, November
1996 1 4 6 8 10 14 8. GE Nuclear Energy, "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate," Licensing Topical
Report NEDO-31897P-A, Class III (Proprietary), May 1992.
14 15 9. "River Bend Station Disposition of Events", RBC-49457, May 9, 2001. 15 10. GE Nuclear Energy, "Generic Guidelines and Evaluations for General Electric Boiling Water Reactor Thermal Power
Optimization," Licensing Topical Report NEDC-32938P, Class
III (Proprietary), July 2000.
- 11. GEH-0000-0118-2907-R0, "GNF2 Fuel Design Cycle-Independent Analyses For Entergy River Bend," Revision 0, November 2010 with errata. (Entergy Report # ECH-NE-10-00066, Revision 1).
RBS USAR Revision 15 15.1-1 May 2002 15.1 DECREASE IN REACTOR COOLANT TEMPERATURE 15.1.1 Loss of Feedwater Heating 1This event is evaluated for each reload cycle and the results are given in Appendix 15B if the event is determined to be a limiting
or near limiting event.
11514 The initial cycle analysis used a point model methodology and the results concluded that the Loss of Feedwater Heating event with automatic flow control is less severe than the manual flow
control. The re-analysis of this event at rated thermal power is performed with the 3-dimensional nuclear-thermal hydraulics core simulator computer model, consistent with the analyses reported
and described in Appendix 15.B.
14 1515.1.1.1 Identification of Causes and Frequency Classification 15.1.1.1.1 Identification of Causes
A feedwater heater can be lost in at least two ways: 1. Steam extraction line to heater is closed,
- 2. Feedwater/condensate is bypassed around heater. The first case produces a gradual cooling of the feedwater. In the second case, the feedwater/condensate bypasses the heater and no heating of that feedwater occurs. In either case the reactor
vessel receives cooler feedwater. The maximum number of
feedwater heaters which can be tripped or bypassed by a single event represents the most severe transient for analysis
considerations. This event has been conservatively estimated to incur a loss of up to 100°F of the feedwater heating capability
of the plant and causes an increase in core inlet subcooling.
This increases core power due to the negative void reactivity coefficient. The event can occur with the reactor in either the automatic or manual control mode. In automatic control, some compensation of core power is realized by modulation of core
flow, so the event is less severe than in manual control. 15.1.1.1.2 Frequency Classification
The probability of this event is considered low enough to warrant its being categorized as an infrequent incident. However, because
of the lack of a sufficient frequency data base, this transient
disturbance is analyzed as an incident of moderate frequency.
RBS USAR Revision 14 15.1-2 September 2001 This event is analyzed assuming conditions of a 100°F loss and full power. The probability of occurrence of this event is
regarded as small. 15.1.1.2 Sequence of Events and Systems Operation 15.1.1.2.1 Sequence of Events 14 Tables 15.1-1 and 15.1-2 list the sequence of events for the original transient and its effect on various parameters is shown
on Fig. 15.1-1 and 15.1-2.
14In the automatic flux/flow control mode, the reactor settles out at a lower recirculation flow with no change in steam output. An average power range monitor (APRM) neutron flux or thermal power
alarm alerts the operator that he should insert control rods to get back down to the rated flow control line, or that he should reduce flow if in the manual mode. The operator should determine from existing tables the maximum allowable T-G output with feedwater heaters out of service. If reactor scram occurs, as it
does in manual flow control mode, the operator should monitor the reactor water level and pressure controls and the T-G auxiliaries
during coastdown. 15.1.1.2.2 Systems Operation In establishing the expected sequence of events and simulating the plant performance, it was assumed that normal functioning occurred in the plant instrumentation and controls, plant
protection, and reactor protection systems.
The high simulated thermal power trip (STPT) scram is the primary protection system trip in mitigating the consequences of this
event.Required operation of engineered safeguard features (ESF) is not expected for either of these transients. 15.1.1.2.3 The Effect of Single Failures and Operator Errors
These two events generally lead to an increase in reactor power level. The STPT mentioned in Section 15.1.1.2.2 is the mitigating system and is designed to be single failure proof.
Therefore, single failures are not expected to result in a more
severe event than analyzed. See Appendix 15A for a detailed
discussion of this subject.
RBS USAR 15.1-3 August 1987 15.1.1.3 Core and System Performance 15.1.1.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical model of a generic direct-cycle BWR. This model is described in detail in Reference 1. This
computer model has been verified through extensive comparison of
its predicted results with actual BWR test data.
The nonlinear, computer-simulated, analytical model is designed to predict associated transient behavior of this reactor. Some
of the significant features of the model are: 1. A point kinetic model is assumed with reactivity feedbacks from control rods (absorption), voids (moderation) and Doppler (capture) effects. 2. The fuel is represented by three four-node cylindrical elements, each enclosed in a cladding node. One of the cylindrical elements is used to represent core average power and fuel temperature conditions, providing the
source of Doppler feedback. The other two are used to represent "hot spots" in the core, to simulate peak fuel
center temperature and cladding temperature. 3. Four primary system pressure nodes are simulated. The nodes represent the core exit pressure, vessel dome
pressure, steam line pressure (at a point representative of the safety/relief valve location), and turbine inlet
pressure.4. The active core void fraction is calculated from a relationship between core exit quality, inlet subcooling, and pressure. This relationship is generated from
multinode core steady-state calculations. A second-order void dynamic model with the void boiling sweep time calculated as a function of core flow and void conditions
is also utilized. 5. Principal controller functions such as feedwater flow, recirculation flow, reactor water level, pressure, and
load demand are represented together with their dominant
nonlinear characteristics. 6. The ability to simulate necessary reactor protection system functions is provided.
RBS USAR Revision 21 15.1-415.1.1.3.2 Input Parameters and Initial Conditions14 These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Tables 15.0-2 and 15.0-2A. The input parameters and initial conditions for the cycle-specific
analyses are described in Appendix 15B. In the initial cycleanalysis, the plant is assumed to be operating at 105 percent of
original NBR steam flow and at thermally limited conditions.
Both automatic and manual modes of flow control are considered.
14The analysis is provided for the end-of-equilibrium cycle (EOEC)
condition since the void reactivity coefficient at EOEC is more
negative than at the beginning-of-cycle condition. In addition, the EOEC case provides the highest power increase.
The same void reactivity coefficient conservatism used for power increase transients is applied since a more negative value conservatively increases the severity of the power increase.
The values for both the feedwater heater time constant and the feedwater time volume between the heaters and the spargers are adjusted to reduce the time delays since they are not critical to the calculation of this transient. The transient is simulated by programming a change in feedwater enthalpy
corresponding to a 100°F loss in feedwater heating.5 515.1.1.3.3 ResultsIn the automatic flux/flow control mode, the recirculation flowcontrol system responds to the power increase by reducing core flow so that steam flow from the reactor vessel to the turbine
remains essentially constant. In order to maintain the initial
steam flow with the reduced inlet temperature, reactor thermal power increases above the initial value and settles at about 111 percent NBR original (106 percent of initial power), below the flow-referenced APRM simulated thermal power scram setting and core flow is reduced to approximately 89 percent of rated flow. The minimum critical power ratio (MCPR) reached in the automatic control mode is greater than for the more limiting
manual flow control mode.The increased core inlet subcooling aids thermal margins, andsmaller power increase makes this event less severe than the manual flow control case given below. Nuclear system pressure does not change and consequently the reactor coolant pressure boundary (RCPB) is not threatened. If scram occurs, the results become very similar to the manual flow control case. This
transient is illustrated on Fig. 15.1-1.
In manual mode, no compensation is provided by core flow andthus the power increase simulated is greater than in the
automatic mode. A scram on high APRM thermal power may RBS USAR Revision 4 15.1-5 August 1991 occur. Vessel steam flow increases and the initial system pressure increase is slightly larger. Peak heat flux is 114 percent of its initial value and peak fuel center temperature
increases 486°F. The increased core inlet subcooling aids core thermal margins and minimum MCPR is right on the safety limit.
Therefore, the design basis is satisfied. The transient
responses of the key plant variables for this mode of operation
are shown on Fig. 15.1-2. After the reactor scram, water level drops to the low level trip point. This initiates recirculation pump trip (RPT) as shown in
Table 15.1-2.
This transient is less severe from lower initial power levels for two main reasons: 1. Lower initial power levels have initial values of critical power ratio (CPR) greater than the limiting
initial CPR value assumed, and 2. The magnitude of the power rise decreases with lower initial power conditions. Therefore, transients from
lower power levels are less severe. 15.1.1.3.4 Considerations of Uncertainties Important factors (such as reactivity coefficient, scram characteristics, and magnitude of the feedwater temperature change) are assumed to be at the worst configuration so that any deviations seen in the actual plant operation reduce the severity
of the event. 15.1.1.4 Barrier Performance As noted above and shown on Fig. 15.1-1 and 15.1-2, the consequences of this event do not result in any temperature or
pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these
barriers maintain their integrity and function as designed. 415.1.1.5 Radiological Consequences Since this event does not result in any additional fuel failures or any release of primary coolant to either the secondary containment or to the environment there are no radiological consequences associated with this event.
RBS USAR Revision 21 15.1-615.1.2 Feedwater Controller Failure - Maximum Demand1This event is evaluated for each reload cycle and the results are given in Appendix 15B if the event is determined to be a
limiting or near limiting event.14This event was re-analyzed at 3091 MWt core power at conditions described in Appendix 15B, at normal and reduced feedwater temperature conditions. The limiting normal feedwater temperature case results are reported here, consistent with the
results described and reported in Appendix 15B.
1 1415.1.2.1 Identification of Causes and Frequency Classification15.1.2.1.1 Identification of Causes4This event is postulated on the basis of a single failure of a control device, specifically one which can directly cause an increase in coolant inventory by increasing the feedwater flow.
The most severe applicable event is a feedwater controller failure during maximum flow demand. The feedwater controller is
forced to its upper limit at the beginning of the event.15.1.2.1.2 Frequency Classification
This event is considered to be an incident of moderate frequency.15.1.2.2 Sequence of Events and Systems Operation 15.1.2.2.1 Sequence of Events With excess feedwater flow the water level rises to thehigh-level reference point at which time the feedwater pumps and the main turbine are tripped and a scram is initiated. Table 15.1-3 lists the sequence of events for Fig. 15.1-3. The figure
shows the changes in important variables during this transient.
The operator should:1. Observe that high reactor water level feedwater pump trip has terminated the failure event.2. Switch the feedwater controller from auto to manualcontrol in order to try to regain a correct output signal.3. Identify causes of the failure and report all key plant parameters during the event.
4121 1 12 RBS USAR 15.1-7 August 1987 15.1.2.2.2 Systems Operation In order to properly simulate the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection, and RPSs.
Important system operational actions for this event are high
level scram and tripping of the main turbine and feedwater pumps, RPT, and low water level initiation of the reactor core isolation cooling (RCIC) system and the high pressure core spray (HPCS) system to maintain long term water level control following
tripping of feedwater pumps.15.1.2.2.3 The Effect of Single Failures and Operator Errors In Table 15.1-3, the first sensed event to initiate corrective action to the transient is the vessel high water level (L8) scram. Scram trip signals from Level 8 are designed such that a single failure neither initiates nor impedes a reactor scram trip initiation. Therefore, single failures are not expected to result in a more severe event than analyzed. See Appendix 15A
for a detailed discussion of this subject. 15.1.2.3 Core and System Performance 15.1.2.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical model of a generic direct-cycle BWR. This model is described in detail in Reference 2. This computer model has been improved and verified through extensive
comparison of its predicted results with actual BWR test data.
The nonlinear computer simulated analytical model is designed to predict associated transient behavior of this reactor. Some of
the significant features of the model are: 1. An integrated one-dimensional core model is assumed which includes a detailed description of hydraulic feedback effects, axial power shape changes, and reactivity
feedbacks.2. The fuel is represented by an average cylindrical fuel and cladding model for each axial location in the core.
3.The steam lines are modeled by eight pressure nodes
incorporating mass and momentum balances which predict any wave phenomenon present in the steamline during
pressurization transient.
RBS USAR Revision 21 15.1-84. The core average axial water density and pressure distribution is calculated using a single channel torepresent the heated active flow and a single channel to represent bypass flow. A model, representing liquid and
vapor mass and energy conservation and mixture momentum conservation, is used to describe the thermal-hydraulic behavior. Changes in the flow split between the bypasses
and active channel flow are accounted for during
transient events.5. Principal controller functions such as feedwater flow,recirculation flow, reactor water level, pressure, and
load demand are represented together with their dominant
nonlinear characteristics.6. The ability to simulate necessary RPS functions is provided.7. The control systems and RPS models are, for the mostpart, identical to those employed in the point reactor model, which is described in detail in Reference 2 of
Section 15.0 and used in analysis for other transients.15.1.2.3.2 Input Parameters and Initial Conditions14 These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Tables 15.0-2 and 15.0-2A.
The input parameters and initial conditions for the cycle-
specific analyses are described in Appendix 15B.End of equilibrium cycle (all rods out) nuclear characteristics
are assumed. The safety-relief valve action is conservatively assumed to occur with higher than nominal set points. The
transient is simulated by programming an upper limit failure in the feedwater system such that 108 percent NBR feedwater flow
occurs at a system design pressure of 1,065 psig.15.1.2.3.3Results The simulated feedwater controller transient is shown onFig. 15.1-3. The high water level turbine trip and feedwater pump trip are initiated at approximately 32 sec. Scram occurs simultaneously, and limits the neutron flux peak and fuel thermal transient so that no fuel damage occurs. MCPR remains above the safety limit. The turbine bypass system opens to limit peak pressure in the steam line near the safety/relief
valves to 1,244 psig and the pressure at the bottom of the
vessel to about 1,268 psig.
14 RBS USAR Revision 25 15.1-9 The level gradually drops to the low level reference point (Level 2), activating the RCIC/HPCS systems for long term level control.
15.1.2.3.4 Consideration of Uncertainties
All systems utilized for protection in this event were assumed to have the most conservative allowable response (e.g., relief set points, scram stroke time, and reactivity characteristics).
Plant behavior is, therefore, expected to lead to a less severe
15.1.2.4 Barrier Performance
As noted above the consequences of this event do not result in
any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function
as designed.
15.1.2.5 Radiological Consequences
While the consequences of this event do not result in any fuel
failures, radioactivity is nevertheless discharged to the suppression pool as a result of safety relief valve (SRV) actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5 for Type 2 events. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the consequences of
this event.
15.1.3 Pressure Regulator Failure - Open
15.1.3.1 Identification of Causes and Frequency Classification
15.1.3.1.1 Identification of Causes
The total steam flow rate to the main turbine resulting from a pressure regulator malfunction is limited by a maximum flow limiter imposed at the turbine controls. This limiter is normally set to limit maximum steam flow to approximately
115 percent NBR.
If one pressure controller fails, an alarm will be generated and result in a bumpless failover to the backup controller. The Ovation Turbine Control and Protection System (TCPS) will continue to regulate pressure and will maintain control of the bypass valves and turbine control valves. A single controller failure and a subsequent failure of the backup pressure controller in the open direction will cause the full opening of the turbine control valves and the bypass valves.
RBS USAR Revision 25 15.1-10 15.1.3.1.2 Frequency Classification
This transient disturbance is categorized as an incident of
moderate frequency.
15.1.3.2 Sequence of Events and Systems Operation
15.1.3.2.1 Sequence of Events
Table 15.1-4 lists the sequence of events for Fig. 15.1-4.
Loss of a single pressure controller will not result in the loss of pressure control A single controller failure has no effect on operation due to the bumpless failover to the backup controller.
A failure of the single controller and a subsequent failure of the backup controller will result in the full opening of the turbine control valves and the bypass valves. This transient leads to a loss of pressure control such that the increased steam flow demand causes a depressurization.
The pressure regulator failure-open is no longer a postulated single failure scenario; no Ovation TCPS single failure scenarios are postulated that could result in all valves open. This USAR section maintained for historical purposes. If the reactor scrams as a result of the isolation caused by the low pressure at the turbine inlet (825 psig) in the run mode, the following is the sequence of operator actions expected during the course of
the event. Once isolation occurs the pressure increases to a
point where the relief valves open. The operator should:
- 1. Monitor that all rods are in.
- 2. Monitor reactor water level and pressure.
- 3. Observe turbine coastdown and break vacuum before the loss of steam seals. Check turbine auxiliaries.
- 4. Observe that the reactor pressure relief valves open at their set point.
- 7. Monitor reactor water level and continue cooldown in accordance with the normal procedure.
8.Complete the scram report and initiate a maintenance survey of pressure regulator before reactor restart.
RBS USAR Revision 25 15.1-11 15.1.3.2.2 Systems Operation
In order to properly simulate the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection, and RPSs except
as otherwise noted.
Initiation of HPCS and RCIC system functions occurs when the vessel water level reaches the L2 set point. Normal startup and actuation can take up to 30 sec before effects are realized. If these events occur, they follow sometime after the primary concerns of fuel thermal margin and overpressure effects have
occurred, and are expected to be less severe than those already
experienced by the system.
15.1.3.2.3 The Effect of Single Failures and Operator Errors
Loss of a single pressure controller will not result in the loss of pressure control A single controller failure has no effect on operation due to the bumpless failover to the backup controller.
A failure of the single controller and a subsequent failure of the backup controller will result in the full opening of the turbine control valves and the bypass valves. This transient leads to a loss of pressure control such that the increased steam flow demand causes a depressurization.
This transient leads to a loss of pressure control such that the
increased steam flow demand causes a depressurization.
Instrumentation for pressure sensing of the turbine inlet
pressure is designed to be single failure proof for initiation of
main steam isolation valve (MSIV) closure.
Reactor scram sensing, originating from limit switches on the MSIV, is designed to be single failure proof. It is therefore
concluded that the basic phenomenon of pressure decay is adequately terminated. See Appendix 15A for a detailed
discussion of this subject.
15.1.3.3 Core and System Performance
15.1.3.3.1 Mathematical Model
The nonlinear dynamic model described briefly in Section
15.1.1.3.1 is used to simulate this event.
15.1.3.3.2 Input Parameters and Initial Conditions
The transient can only be simulated by forcing high value on all the controllers, which causes the turbine admission valves and the turbine bypass valves to open fully. A regulator failure with 130 percent steam flow demand was simulated as a worst case
since 115 percent is the normal maximum flow limit.
RBS USAR Revision 17 15.1-12 A 5-sec isolation valve closure instead of a 3-sec closure is assumed when the turbine pressure decreases below the turbine inlet low pressure set point for main steam isolation initiation.
This is within the specification limits of the valve and
represents a conservative assumption. Reactor scram is initiated when the isolation valves reach the 15 percent closed position. This is the maximum travel from the
full open position allowed by design specification. This analysis has been performed, unless otherwise noted, with the plant conditions listed in Table 15.0-2.
15.1.3.3.3 Results Fig. 15.1-4 shows graphically how the isolation valve closure stops vessel depressurization and produces a normal shutdown of
the isolated reactor. Depressurization results in formation of voids in the reactor coolant and causes a decrease in reactor power almost immediately. The pressure continues to drop until turbine inlet pressure is below the low turbine pressure isolation set point
when main steam isolation finally terminates the depressurization. The isolation limits the duration and severity of the depressurization so that no significant thermal stresses
are imposed on the RCPB. No significant reductions in fuel
thermal margins occur. 15.1.3.3.4 Considerations of Uncertainties If the maximum flow limiter were set higher or lower than normal, there would result a faster or slower loss in nuclear steam
pressure. The rate of depressurization may be limited by the
bypass capacity. For example, the turbine control valves open to the valves-wide-open state admitting slightly more than the rated steam flow. With the limiter in this analysis set to fail at 130 percent we would expect all bypass valves to be fully open utilizing the completebypass capacity.
Depressurization rate has a proportional effect upon the voiding action of the core. If it is large enough, the sensed vessel
water level trip set point (L8) may be reached initiating scram and turbine and feedwater pump trip early in the transient.
Since the main turbine is tripped, the depressurization is
terminated.
RBS USAR 15.1-13 August 1987 15.1.3.4 Barrier Performance Barrier performance analyses were not required since the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which fuel, pressure vessel, or containment are designed. Peak pressure in the bottom of the vessel reaches 1,158 psig which is below the ASME code limit of 1,375 psig for the RCPB. Vessel dome pressure reaches 1,126 psig. Minimum vessel dome pressure of 905 psig
occurs at about 21 sec. 15.1.3.5 Radiological Consequences While the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the
suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the
consequences of this event. 15.1.4 Inadvertent Safety/Relief Valve Opening 15.1.4.1 Identification of Causes and Frequency Classification 15.1.4.1.1 Identification of Causes The cause of inadvertent opening is attributed to malfunction of the valve or an operator-initiated opening. Opening and closing
circuitry at the individual valve level (as opposed to groups of valves) is subject to a single failure. It is therefore simply postulated that a failure occurs and the event is analyzed accordingly. Detailed discussion of the valve design is provided
in Chapter 5. 15.1.4.1.2 Frequency Classification This transient disturbance is categorized as an infrequent incident but due to a lack of a comprehensive data basis, it is
being analyzed as an incident of moderate frequency. 15.1.4.2 Sequence of Events and Systems Operation 15.1.4.2.1 Sequence of Events
Table 15.1-5 lists the sequence of events for this event.
RBS USAR Revision 17 15.1-14 The plant operator must reclose the valve as soon as possible and check that reactor and T-G output return to normal. If the valve
cannot be closed, plant shutdown is initiated. 15.1.4.2.2 Systems Operation This event assumes normal functioning of normal plant instrumentation and controls, specifically the operation of the
pressure regulator and level control systems. 15.1.4.2.3 The Effect of Single Failures and Operator Errors Failure of additional components (e.g., pressure regulator, feedwater flow controller) is discussed elsewhere in Chapter 15.
In addition a detailed discussion of such effects is given in
Appendix 15A. 15.1.4.3 Core and System Performance 15.1.4.3.1 Mathematical Model The reactor model briefly described in Section 15.1.1.3.1 was previously used to simulate this event in earlier FSARs. This model is discussed in detail in Reference 1. It was determined that this event is not limiting from a core performance standpoint. Therefore a qualitative presentation of results is
described below. 15.1.4.3.2 Input Parameters and Initial Conditions
In the initial cycle analysis, it is assumed that the reactor is operating at an initial power level corresponding to 105 percent of original rated steam flow conditions when an SRV is inadvertently opened. Manual recirculation flow control is assumed. Flow through the valve at normal plant operating conditions stated above is approximately 7 percent NBR steam
flow.15.1.4.3.3 Qualitative Results The opening of an SRV allows steam to be discharged into the suppression pool. The sudden increase in the rate of steam flow leaving the reactor vessel causes a mild depressurization
transient.The pressure regulator senses the nuclear system pressure decrease and within a few seconds closes the turbine control valve far enough to stabilize reactor vessel pressure at a slightly lower value and reactor power settles at nearly the RBS USAR Revision 8 15.1-15 August 1996 initial power level. Thermal margins decrease only slightly through the transient, and no fuel damage results from the transient. MCPR is essentially unchanged and therefore the
safety limit margin is unaffected. 15.1.4.4 Barrier Performance As discussed above, the transient resulting from a stuck open relief valve is a mild depressurization which is within the range of normal load following and therefore has no significant effect
on RCPB and containment design pressure limits. 815.1.4.5 Radiological Consequences While the consequence of this event does not result in fuel failure it does result in the discharge of normal coolant
activity to the suppression pool via SRV operation. Since the activity is contained in the primary containment there is no significant exposure to operating personnel and the activity is
retained in the containment. Discharges to the environment may
be made under controlled release conditions. If purging of the containment is chosen the release is in accordance with the established technical requirements; therefore, this event, at the
worst, would only result in a small increase in the yearly integrated exposure level. The radiological exposures noted in
Section 15.2.4.5 cover the consequences of this event.
815.1.5 Spectrum of Steam System Piping Failures Inside and Outside of Containment in a PWR This event is not applicable to BWR plants. 15.1.6 Inadvertent RHR Shutdown Cooling Operation 15.1.6.1 Identification of Causes and Frequency Classification 15.1.6.1.1 Identification of Causes
At design power conditions no conceivable malfunction in the shutdown cooling system could cause temperature reduction.
In startup or cooldown operation, if the reactor were critical or near critical, a very slow increase in reactor power could result. A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for the RHR heat exchangers. The
resulting temperature decrease would cause RBS USAR 15.1-16 August 1987 a slow insertion of positive reactivity into the core. If the operator did not act to control the power level, a high neutron flux reactor scram would terminate the transient without violating fuel thermal limits and without any measurable increase
in nuclear system pressure. 15.1.6.1.2 Frequency Classification Although no single failure could cause this event, it is conservatively categorized as an event of moderate frequency. 15.1.6.2 Sequence of Events and Systems Operation 15.1.6.2.1 Sequence of Events A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water
controls for RHR heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. Scram occurs before any thermal limits are reached if the operator does not take action. The sequence of events for this
event is shown in Table 15.1-6. 15.1.6.2.2 System Operation A shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this event is not considered while at power operation since the
nuclear system pressure is too high to permit operation of the
shutdown cooling (RHR). No unique safety actions are required to avoid unacceptable safety results for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers. In startup or cooldown operation, where
the reactor is at or near critical, the slow power increase resulting from the cooler moderator temperature would be
controlled by the operator in the same manner normally used to
control power in the source or intermediate power ranges. 15.1.6.2.3 Effect of Single Failures and Operator Action No single failures can cause this event to be more severe. If the operator takes action, the slow power rise is controlled in the
normal manner. If no operator action is taken, a scram terminates the power increase before thermal limits are reached.
(See Appendix 15A for details.)
RBS USAR Revision 17 15.1-1715.1.6.3 Core and System Performance The increased subcooling caused by misoperation of the RHR shutdown cooling mode could result in a slow power increase due
to the reactivity insertion. This power rise would be terminated by a flux scram before fuel thermal limits are approached.
Therefore, only qualitative description is provided here. 15.1.6.4 Barrier Performance As noted above, the consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed, therefore, these barriers maintain their integrity and function
as designed. 15.1.6.5 Radiological Consequences
Since this event does not result in any fuel failures, no analysis of radiological consequences is required for this event. 14515.1.7 Feedwater Heater(s) Out-of-Service (FWHOS) / Final Feedwater Temperature Reduction (FFWTR) The capability of operation with feedwater heater(s) out-of-service (FWHOS) is highly desirable in the event that certain feedwater heater(s) or string(s) of heaters become inoperable during a reactor fuel cycle. Reduction of the feedwater temperature generally results in less severe transients. The peak pressures are lower because of the reduced steam production. The basis for the 40-year average number of days per year allowed to operate with a feedwater temperature reduction due to partial feedwater heating is that the temperature reduction should not result in thermal stress, which would exceed the fatigue usage factor of 1.0 for the feedwater nozzle and spargers. The limit is calculated as the annualized number of days the plant can be operated with FWHOS for the licensed plant lifetime. As a result of a modification made to the feedwater spargers per MR89-0075, the fatigue usage factors were projected to reach 1.0 and the repaired area of the sparger shall be visually examined at each refueling outage. The analysis to support continued operation with FWHOS during normal fuel cycle is given in current FFWTR (final feedwater temperature reduction) and / or FWHOS reports Reference 15.1.3 and 15.1.4. 105% power uprate evaluation report Reference 15.1.5 evaluated the impact of the power uprate on the feedwater sparger. Cycle specific initial conditions and analyses results can be found in Appendix 15B.
5 14 RBS USAR Revision 17 15.1-18 References - 15.11. Linford, R.B. Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor.
April 1973 (NEDO-10802). 2. Qualification of the One-Dimensional Core Transient Model for BWR, October 1978 (NEDO-24154). 53. Feedwater heater(s) out-of-service analysis for River Bend Station, Unit 1, May 1988, (NEDO-31583).
5144. Safety Review for River Bend Station Cycle 7 Final Feedwater Temperature Reduction, NEDC-32549P,Rev. 1 October 1998.
145. 105% Power Evaluation Report for GE Task No. 10.1, Non Core Support Structure Reactor Internals Evaluation, GE-NE-A22-00081-10.1.
RBS USAR Revision 25 15.2-1 15.2 INCREASE IN REACTOR PRESSURE If one pressure controller fails, an alarm will be generated and result in a bumpless failover to the backup regulator. The Ovation TCPS will continue to regulate pressure and will maintain control of the turbine control valves and bypass valves. Loss of the backup pressure controller will cause the turbine control valves and the bypass valves to close.
15.2.1 Pressure Regulator Failure - Closed 14 This event was re-analyzed at 3091 MWt core power at conditions described in Appendix 15B. The results of the analysis of this
event are described in Appendix 15.B.
14 1 1 13 Prior to Cycle 10, this event was evaluated for each reload cycle and the results were given in Appendix 15B if the event was
determined to be a limiting or near limiting event. However, with the NRC approval of GESTAR II Amendment 26 (incorporated
into Rev. 14), an analysis for the pressure regulator - closed event is no longer required for BWR 6 plants with MEOD (or MELLL). Therefore, starting with Reload 9, Cycle 10, the standard pressure regulator - closed event analysis is not performed; however in order to support the operation without the
backup pressure regulator, MCPR(p) and LHGR(p) with the pressure
regulator - closed event are analyzed, see Appendix 15B.
13 15.2.1.1 Identification of Causes and Frequency Classification
15.2.1.1.1 Identification of Causes
If one pressure controller fails, an alarm will be generated and result in a bumpless failover to the backup controller. The Ovation TCPS will continue to regulate pressure and will maintain control of the turbine control valves and bypass valves. Failure of one controller and a subsequent failure of the backup controller in the close direction will cause closure of the turbine control valves and bypass valves.
RBS USAR Revision 25 15.2-1a When this occurs, reactor scram is initiated when high neutron flux scram set point is reached.
15.2.1.1.2 Frequency Classification
15.2.1.1.2.1 One Pressure Regulator Failure - Closed
This event is treated as a moderate frequency event.
13 15.2.1.1.2.2 Pressure Regulation Downscale Failure
The expected frequency of occurrence of the PRFDS is conservatively estimated to be once in greater than 570 plant-years, which is below the probability of an AOO.
13 RBS USAR Revision 13 15.2-1b September 2000 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR Revision 25 15.2-2 15.2.1.2 Sequence of Events and System Operation
15.2.1.2.1 Sequence of Events
15.2.1.2.1.1 One Pressure Regulator Failure - Closed
Failure of a single pressure controller will cause a bumpless failover. Failure of a single pressure controller will not cause a transient on the reactor.
15.2.1.2.1.2 Pressure Regulation Downscale Failure
Table 15.2-1 lists the sequence of events for Figure 15.2-1.
15.2.1.2.1.3 Identification of Operator Actions
15.2.1.2.1.3.1 One Pressure Regulator Failure - Closed
The operator should verify the loss of one pressure controller and that the backup regulator assumes proper control. However these actions are not required to terminate the event as
discussed in Section 15.2.1.2.3.2.
15.2.1.2.1.3.2 Pressure Regulation Downscale Failure
The operator should:
- 1. Monitor that all rods are in.
- 2. Monitor reactor water level and pressure.
- 3. Observe turbine coastdown and break vacuum before the loss of steam seals. Check turbine auxiliaries.
- 4. Observe that the reactor pressure relief valves open at their set point.
- 5. Monitor reactor water level and continue cooldown per the normal procedure.
- 6. Complete the scram report and initiate a maintenance survey of pressure regulator before reactor restart.
RBS USAR Revision 25 15.2-3 15.2.1.2.2 Systems Operation
15.2.1.2.2.1 One Pressure Regulator Failure - Closed
Normal plant instrumentation and controls are assumed to function. This event requires no protection system or safeguard
systems operation.
15.2.1.2.2.2 Pressure Regulation Downscale Failure
Analysis of this event assumes normal functioning of plant
instrumentation and controls, and plant protection and RPSs.
Specifically this transient takes credit for high neutron flux scram to shut down the reactor. High system pressure is limited
by the pressure relief valve system operation.
15.2.1.2.3 The Effect of Single Failures and Operator Errors
15.2.1.2.3.1 One Pressure Regulation Failure - Closed
The nature of the first assumed failure results in a failover to the backup controller. If the backup regulator fails at this time, the second assumed failure, the control valves start to
close, raising reactor pressure to the point where a flux scram trip is initiated to shut down the reactor. This event is
similar to that described in Section 15.2.1.2.1.1. Detailed
discussions on this subject can be found in Appendix 15A.
15.2.1.2.3.2 Pressure Regulation Downscale Failure
This transient leads to a loss of pressure control so that the
zero steam flow demand causes a pressurization. The high neutron flux scram is the mitigating system and is designed to be single failure proof. Therefore, single failures are not expected to
result in a more severe event than analyzed. Detailed
discussions on this subject can be found in Appendix 15A.
15.2.1.3 Core and System Performance
15.2.1.3.1 Mathematical Model
The nonlinear, dynamic model described briefly in Section
15.1.2.3.1 is used to simulate this event.
RBS USAR Revision 25 15.2-4 15.2.1.3.2 Input Parameters and Initial Conditions 14 These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Tables 15.0-2 and 15.0-2A. The input parameters and initial conditions for the cycle-specific
analyses are described in Appendix 15B.
14 15.2.1.3.3 Results 15.2.1.3.3.1 One Pressure Regulator Failure - Closed Qualitative evaluation is provided only.
Pressure regulation and turbine control valve position are maintained for the failure of a single pressure controller. This postulated failure will not cause a transient on the reactor. 15.2.1.3.3.2 Pressure Regulation Downscale Failure 14 13 This event is classified as Limiting Faults and analyzing this event is no longer required. See Section 15.2.1. Typical sequence of events is discussed as follows.
Neutron flux increases rapidly because of the void reduction caused by the pressure increase. When the sensed neutron flux reaches the high neutron flux scram set point, a reactor scram is initiated. The neutron flux increase is limited to 147 percent original NBR by the reactor scram. Peak fuel surface heat flux does not exceed 105.7 percent of its initial value. MCPR for
this transient is still above the safety MCPR limit. Therefore, the design basis is satisfied.
13 14 15.2.1.3.4 Consideration of Uncertainties All systems utilized for protection in this event were assumed to have the most conservative allowable response (e.g., relief set
points, scram stroke time, and worth characteristics). Expected plant behavior is, therefore, expected to reduce the actual
severity of the transient.
15.2.1.4 Barrier Performance
15.2.1.4.1 One Pressure Regulator Failure - Closed As noted above, the consequences of this event do not result in any temperature or pressure transient in excess of the criteria
for which the fuel, pressure vessel or containment RBS USAR Revision 14 15.2-5 September 2001 are designed; therefore, these barriers maintain their integrity and function as designed.
15.2.1.4.2 Pressure Regulation Downscale Failure14Peak pressure at the SRVs reaches 1,256 psig. The peak nuclear system pressure reaches 1,277 psig at the bottom of the vessel, well below the nuclear barrier transient pressure limit of
1,375 psig.
1415.2.1.5 Radiological ConsequencesWhile the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the
consequences of this event.
15.2.2 Generator Load Rejection 15.2.2.1 Identification of Causes and Frequency Classification
15.2.2.1.1 Identification of Causes Fast closure of the turbine control valves (TCV) is initiated whenever electrical grid disturbances occur which result in
significant loss of electrical load on the generator. The TCVs
are required to close as rapidly as possible to prevent excessive
overspeed of the turbine-generator (T
-G) rotor. Closure of the main TCVs causes a sudden reduction in steam flow which results
in an increase in system pressure and reactor shutdown.
15.2.2.1.2 Frequency Classification
15.2.2.1.2.1 Generator Load Rejection
This event is categorized as an incident of moderate frequency.
15.2.2.1.2.2 Generator Load Rejection with Bypass Failure121The generator load rejection without bypass event is evaluated for each reload cycle and the results are given in Appendix 15B.
1 12 RBS USAR Revision 21 15.2-5a12114This event was re-analyzed at 3091 MWt core power at conditions described in Appendix 15B, at normal and reduced feedwater temperature conditions. The limiting normal feedwater temperature case results are reported here, consistent with the
results described and reported in Appendix 15.B.
1 12 14This event is categorized as an incident of moderate frequency.
Frequency is expected to be as follows:Frequency: 0.0036/plant year MTBE:278 yr RBS USAR 15.2-5b August 1987 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR 15.2-6 August 1987 Frequency Basis: Thorough searches of domestic plant operating records have revealed three instances of bypass failure during
628 bypass system operations. This gives a probability of bypass
failure of 0.0048. Combining the actual frequency of a generator
load rejection with the failure rate of the bypass yields a frequency of a generator load rejection with bypass failure of
0.0036 event/plant year, or a mean time between events (MTBE) of
278 yr.15.2.2.2 Sequence of Events and System Operation
15.2.2.2.1 Sequence of Events 15.2.2.2.1.1 Generator Load Rejection - Turbine Control Valve Fast Closure A loss of generator electrical load from high power conditions produces the sequence of events listed in Table 15.2-2.
15.2.2.2.1.2 Generator Load Rejection with Failure of Bypass A loss of generator electrical load at high power with bypass failure produces the sequence of events listed in Table 15.2-3.
15.2.2.2.1.3 Identification of Operator Actions
The operator should: 1. Verify proper bypass valve performance.
- 2. Observe that the feedwater/level controls have maintained the reactor water level at a satisfactory value. 3. Observe that the pressure regulator is controlling reactor pressure at the desired value. 4. Record peak power and pressure.
- 5. Verify relief valve operation.
15.2.2.2.2 System Operation
15.2.2.2.2.1 Generator Load Rejection with Bypass In order to simulate properly the expected sequence of events, the analysis of this event assumes normal RBS USAR Revision 21 15.2-7functioning of plant instrumentation and controls, plant protection, and RPS unless stated otherwise.TCV fast closure initiates a scram trip signal for power levelsgreater than 40 percent NBR. In addition RPT is initiated unless otherwise stated. Both these trip signals satisfy single failure criterion and credit is taken for these protection
features.The pressure relief system, which operates the relief valvesindependently when system pressure exceeds relief valve instrumentation set points, is assumed to function normally
during the time period analyzed.
15.2.2.2.2.2 Generator Load Rejection with Failure of Bypass Same as Section 15.2.2.2.2.1 except that failure of the main turbine bypass valves is assumed for the entire transient.
15.2.2.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase, the basic nature of thistransient, is accomplished by the RPS functions. TCV trip scram and RPT are designed to satisfy the single failure criterion.
An evaluation of the most limiting single failure (i.e., failure of the bypass system) was considered in this event. Details of
single failure analysis can be found in Appendix 15A.
15.2.2.3 Core and System Performance
15.2.2.3.1 Mathematical Model The computer model described in Section 15.1.2.3.1 was used to simulate this event.
15.2.2.3.2 Input Parameters and Initial Conditions14 These analyses have been performed, unless otherwise noted, withthe plant conditions tabulated in Tables 15.0-2, and 15.0-2A.
The input parameters and initial conditions for the cycle-
specific analyses are described in Appendix 15B.
14 The turbine electrohydraulic control (EHC) system detects load
rejection before a measurable speed change takes place.12Prior to Cycle 9, the closure characteristics of the TCVs areassumed such that the valves operate in the full arc (FA) mode and have a full stroke closure time, from fully open to fully closed, of 0.15 sec. A partial open position with closure time
of 0.07 sec is assumed in this analysis.For Cycle 9 and beyond, partial arc mode of TCVs control wasassumed, and is consistent with the turbine control design so that normally, at rated power, three valves are fully open and the fourth valve is the only valve controlling, or throttling, steam flow at some mid position. The cycle specific transients
analyses results for partial arc control can be found in 15B.
12 RBS USAR Revision 17 15.2-8 Auxiliary power would normally be independent of any T-G overspeed effects and continuously supplied at rated frequency, assuming automatic fast transfer to auxiliary power supplies.
For the purpose of worst case analysis, the recirculation pumps
are assumed to remain tied to the main generator and thus increase in speed with the T-G overspeed until tripped by the RPT
system.The reactor is operating in the manual flow-control mode when load rejection occurs. Results do not significantly differ if
the plant has been operating in the automatic flow-control mode.
The bypass valve opening characteristics are simulated using the specified delay together with the specified opening
characteristic required for bypass system operation.
Events caused by low water level trips, including initiation of HPCS and RCIC core cooling system functions are not included in the simulation. Should these events occur, they follow sometime after the primary concerns of fuel thermal margin and
overpressure effects have occurred, and are expected to be less
severe than those already experienced by the system.
15.2.2.3.3 Results
15.2.2.3.3.1 Generator Load Rejection with Bypass Fig. 15.2-2 shows the results of the generator trip from 105 percent original rated steam flow. Peak neutron flux rises to 192 percent original NBR conditions. The average surface heat flux shows an increase of 2.6 percent
from its initial value and MCPR does not significantly decrease
below its initial value.
15.2.2.3.3.2 Generator Load Rejection with Failure of Bypass14Fig. 15.2-3 shows that, for the case of bypass failure, peak neutron flux reaches about 430 percent of original rated, average surface heat flux reaches 116.8 percent of its initial value.
Since this event is classified as an infrequent incident, it is not limited by the GETAB criteria and the MCPR limit is permitted
to fall below the safety limit for the incidents of moderate
frequency. MCPR stays above the safety limit for this event.
14 RBS USAR Revision 14 15.2-9 September 2001 15.2.2.3.4 Consideration of UncertaintiesThe full stroke closure time of the TCV of 0.15 sec is conservative. Typically, the actual closure time is more like 0.19 sec. Clearly the less time it takes to close, the more
severe the pressurization effect.
All systems utilized for protection in this event were assumed to have the most conservative allowable response (e.g., relief set points, scram stroke time, and worth characteristics).
Anticipated plant behavior is, therefore, expected to reduce the
actual severity of the transient.15.2.2.4 Barrier Performance
15.2.2.4.1 Generator Load Rejection Peak pressure remains within normal operating range and no threat to the barrier exists.
15.2.2.4.2 Generator Load Rejection with Failure of Bypass14Peak pressure at the SRVs reaches 1,270 psig. The peak nuclear system pressure reaches 1,296 psig at the bottom of the vessel, well below the nuclear barrier transient pressure limit of 1,375
psig.1415.2.2.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation.
However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the calculated radiological exposures noted in Section 15.2.4.5 are higher than the consequences of this
event.15.2.3 Turbine Trip
15.2.3.1 Identification of Causes and Frequency Classification
15.2.3.1.1 Identification of Causes7A variety of turbine or nuclear system malfunctions initiate a turbine trip. Some examples are moisture separator high level, operator lock out, loss of control fluid pressure, low condenser
vacuum, and reactor high water level.
7 RBS USAR Revision 21 15.2-10 15.2.3.1.2 Frequency Classification 15.2.3.1.2.1 Turbine Trip
This transient is categorized as an incident of moderatefrequency. In defining the frequency of this event, turbine
trips which occur as a byproduct of other transients such as loss of condenser vacuum or reactor high level trip events are not included. However, spurious low vacuum or high level trip
signals which cause an unnecessary turbine trip are included in defining the frequency. In order to get an accurate event-by-event frequency breakdown, this type of division of
initiating causes is required.
15.2.3.1.2.2 Turbine Trip with Failure of the Bypass1The turbine trip without bypass event is evaluated for eachreload cycle and the results are given in Appendix 15B if the
event is determined to be a limiting or near limiting event.
114This event was re-analyzed at 3091 MWt core power at conditions described in Appendix 15B, at normal and reduced feedwater temperature conditions. The limiting normal feedwater temperature case results are reported here, consistent with the
results described in Appendix 15.B.
14 This transient disturbance is categorized as an infrequent incident of moderate frequency. Frequency is expected to be as
follows:Frequency:0.0064/plant year
MTBE: 156 yrFrequency Basis: As discussed in Section 15.2.2.1.2.2, the failure rate of the bypass is 0.0048. Combining this with the turbine trip frequency of 1.33 events/plant year yields the frequency of 0.0064/plant year, or a mean time between events (MTBE) of 156 yr.
15.2.3.2 Sequence of Events and Systems Operation
15.2.3.2.1 Sequence of Events
15.2.3.2.1.1 Turbine Trip Turbine trip at high power produces the sequence of events listed in Table 15.2-4.
15.2.3.2.1.2 Turbine Trip with Failure of the Bypass Turbine trip at high power with bypass failure produces the sequence of events listed in Table 15.2-5.
RBS USAR 15.2-10a August 1988 15.2.3.2.1.3 Identification of Operator Actions The operator should: 1. Verify auto transfer of buses supplied by generator to incoming power; if automatic transfer does not occur, manual transfer must be made.
RBS USAR 15.2-10b August 1988 THIS PAGE LEFT INTENTIONALLY BLANK RBS USAR Revision 21 15.2-112. Monitor and maintain reactor water level at required level.3. Check turbine for proper operation of all auxiliaries during coastdown.4. Depending on conditions, initiate normal operatingprocedures for cool-down, or maintain pressure for restart purposes.5. Put the mode switch in the startup position before the reactor pressure decays to <850 psig.6. Secure RCIC operation if auto initiation occurred due to low water level.7. Ensure reactor vessel water level does not drop to a point of isolating the MSIVs.8. Monitor control rod drive (CRD) positions and insert both the intermediate range neutron monitors (IRM) and the source range monitors (SRM).9. Investigate the cause of the trip, make repairs as necessary, and complete the scram report.10. Cool down the reactor per standard procedure if a restart is not intended.
15.2.3.2.2 Systems Operation 15.2.3.2.2.1 Turbine Trip All plant control systems maintain normal operation unless specifically designated to the contrary.Turbine stop valve closure initiates a reactor scram trip viaposition signals to the protection system. Credit is taken for
successful operation of the RPS.
Turbine stop valve closure initiates a RPT , if assumed operable, thereby terminating the jet pump drive flow.
The pressure relief system which operates the relief valvesindependently when system pressure exceeds relief valve instrumentation set points is assumed to function normally
during the time period analyzed.
RBS USAR Revision 14 15.2-12 September 2001 15.2.3.2.2.2 Turbine Trip with Failure of the BypassSame as Section 15.2.3.2.2.1 except that failure of the main turbine bypass system is assumed for the entire transient time
period analyzed.
15.2.3.2.2.3 Turbine Trip at Low Power
Same as Section 15.2.3.2.2.1.14It should be noted that below 40 percent NBR power level, a main stop valve scram trip inhibit signal derived from the first stage
pressure of the turbine is activated. This is done to eliminate the stop valve scram trip signal from scramming the reactor provided the bypass system functions properly. All other protection system functions remain operational as before and
credit is taken for those protection system trips.
1415.2.3.2.3 The Effect of Single Failures and Operator Errors 15.2.3.2.3.1 Turbine Trips at Power Levels Greater Than 40 Percent NBR Mitigation of pressure increase, the basic nature of this transient, is accomplished by the RPS functions. Main stop valve
closure scram trip and RPT are designed to satisfy single failure
criterion.15.2.3.2.3.2 Turbine Trips at Power Levels Less Than 40 Percent NBRSame as Section 15.2.3.2.3.1 except RPT and stop valve closure scram trip is normally inoperative. Since protection is still
provided by high flux, high pressure, etc, these also continue to
function and scram the reactor should a single failure occur.
15.2.3.3 Core and System Performance
15.2.3.3.1 Mathematical Model The computer model described in Section 15.1.2.3.1 was used to simulate these events.
RBS USAR Revision 21 15.2-13 15.2.3.3.2 Input Parameters and Initial Conditions14 These analyses have been performed, unless otherwise noted, withplant conditions tabulated in Tables 15.0-2 and 15.0-2A. The input parameters and initial conditions for the cycle-specific
analyses are described in Appendix 15B.
14 Turbine stop valves full stroke closure time is 0.1 sec.A reactor scram is initiated by position switches on the stopvalves when the valves are less than 90 percent open. This stop
valve scram trip signal is automatically bypassed when the
reactor is below 40 percent NBR power level.Reduction in core recirculation flow is initiated by positionswitches on the main stop valves, which actuate trip circuitry
which trips the recirculation pumps.
15.2.3.3.3 Results 15.2.3.3.3.1 Turbine Trip A turbine trip with the bypass system operating normally issimulated at 105 percent original NBR steam flow conditions in
Fig. 15.2-4.Neutron flux increases because of the void reduction caused bythe pressure increase. However, the flux increase is limited to 166.7 percent of original rated by the stop valve scram and the RPT system. Peak fuel surface heat flux does not exceed 101 percent of its initial value. MCPR for the transient is
still above the safety limit.15.2.3.3.3.2 Turbine Trip with Failure of Bypass14A turbine trip with failure of the bypass system is simulated at100 percent Power Uprate NBR steam flow conditions as shown in
Fig. 15.2-5.Peak neutron flux reaches 407 percent of its Power Uprate ratedvalue, and average surface heat flux reaches 115 percent of its initial value. Since this event is classified as an infrequent incident, it is not limited by the GETAB criteria and the MCPR limit is permitted to fall below the safety limit for incidents of moderate frequency. However, the MCPR for this transient is
above the safety limit for incidents of moderate frequency and, therefore, the design basis is satisfied.
14 RBS USAR 15.2-14 August 1987 15.2.3.3.3.3 Turbine Trip with Bypass Valve Failure, Low Power This transient is less severe than a similar one at high power. Below 40 percent of rated power, the turbine stop valve closure
and TCV closure scrams and RPT are automatically bypassed. At
these lower power levels, turbine first stage pressure is used to
initiate the scram logic bypass. The scram which terminates the transient is initiated by high neutron flux or high vessel pressure. The bypass valves are assumed to fail; therefore, system pressure increases until the pressure relief set points are reached. At this time, because of the relatively low power of this transient event, relatively few relief valves open to limit reactor pressure. Peak pressures are not expected to greatly exceed the pressure relief valve set points and are
significantly below the RCPB transient limit of 1,375 psig. Peak surface heat flux and peak fuel center temperature remain at relatively low values and MCPR remains well above the GETAB
safety limit.
15.2.3.3.4 Considerations of Uncertainties
Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics.
In all cases, the most conservative values are used in the
analyses. For example: 1. Slowest allowable control rod scram motion is assumed. 2. Nuclear characteristics for all-rods-out end of equilibrium cycle (EOEC) conditions are assumed. 3. Minimum specified valve capacities are utilized for over-pressure protection. 4. Set points of the SRVs are 1 to 2 percent higher than the valve's nominal set point.
15.2.3.4 Barrier Performance
15.2.3.4.1 Turbine Trip Peak pressure in the bottom of the vessel reaches 1,217 psig, which is below the ASME code limit of 1,375 psig for the RCPB.
Vessel dome pressure does not exceed 1,189 psig. The severity of turbine trips from lower initial power levels decreases to the
point where a scram can be avoided if auxiliary power is
available from an RBS USAR Revision 14 15.2-15 September 2001 external source and the power level is within the bypass capability.
15.2.3.4.2 Turbine Trip with Failure of the Bypass14 The SRVs open and close sequentially as the stored energy is dissipated and the pressure falls below the set points of the
valves. Peak nuclear system pressure reaches 1,295 psig at the vessel bottom, therefore, the overpressure transient is clearly below the RCPB transient pressure limit of 1,375 psig. Peak dome
pressure does not exceed 1,269 psig.
14A qualitative discussion of this event at low power is provided in Section 15.2.3.3.3.3.
15.2.3.5 Radiological Consequences While the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the
suppression pool as a result of SRV actuation. However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the calculated radiological exposures noted in Section 15.2.4.5
are higher than the consequences of this event.
15.2.4 MSIV Closures
15.2.4.1 Identification of Causes and Frequency Classification
15.2.4.1.1 Identification of Causes 8Various steam line and nuclear system malfunctions, or operator actions, can initiate MSIV closure. Examples are low steam line pressure, high steam line flow, low water level, or manual
action.815.2.4.1.2 Frequency Classification 15.2.4.1.2.1 Closure of All Main Steam Isolation Valves This event is categorized as an incident of moderate frequency. To define the frequency of this event as an initiating event and not the byproduct of another transient, only the following contribute to the frequency: manual action (purposely or
inadvertent); spurious signals such as low pressure, low reactor water level, low condenser vacuum and finally, equipment malfunctions such as faulty valves or operating mechanisms. A closure of one MSIV may cause an RBS USAR Revision 24 15.2-16 14 immediate closure of all the other MSIVs depending on reactor conditions. If this occurs, it is also included in this
category. During MSIV closure, position switches on the valves provide a reactor scram if the valves in 3 or more main steam lines are less than an instrument setpoint normally set within
the range between the nominal setpoint of 92% open and the allowable setpoint of 88% open (except for interlocks which permit proper plant startup). Protection system logic, however, permits the test closure of one valve without initiating scram
from the position switches.
14 15.2.4.1.2.2 Closure of One Main Steam Isolation Valve 16 This event is categorized as an incident of moderate frequency. One MSIV may be closed at a time for testing purposes; this is done manually. Operator error or equipment malfunction may cause a single MSIV to be closed inadvertently. If reactor power is greater than about 75 percent when this occurs, a high flux scram or high steam line flow isolation may result (if all MSIVs close as a result of the single closure, the event is considered a closure of all MSIVs). Operation with one Main Steam Line out of
service is allowed at less than or equal to 75% rated power.
16 15.2.4.2 Sequence of Events and Systems Operation
15.2.4.2.1 Sequence of Events
Table 15.2-6 lists the sequence of events for Figure 15.2-6.
15.2.4.2.1.1 Identification of Operator Actions
The following is the sequence of operator actions expected during the course of the event assuming no restart of the reactor. The
operator should:
- 1. Observe that all rods have inserted.
- 2. Observe that the relief valves have opened for reactor pressure control.
3 Check that RCIC/HPCS auto starts on the impending low reactor water level condition.
4.Switch the feedwater controller to the manual position. 4 5. DELETED 4 6. When the reactor vessel level has recovered to a satisfactory level, secure RCIC/HPCS.
RBS USAR 15.2-17 August 1987 7. When the reactor pressure has decayed sufficiently for RHR operation, put the RHR into service according to procedure.8. Before resetting the MSIV isolation, determine the cause of valve closure.9. Observe turbine coastdown and break vacuum before the loss of sealing steam. Check T-G auxiliaries for proper
operation.10. Do not reset and open MSIVs unless conditions warrant and be sure the pressure regulator set point is above vessel
pressure.11. Survey maintenance requirements and complete the scram report.15.2.4.2.2 Systems Operation 15.2.4.2.2.1 Closure of All Main Steam Isolation Valves MSIV closures initiate a reactor scram trip via position signals to the protection system. Credit is taken for successful
operation of the protection system.The pressure relief system which initiates opening of the relief valves when system pressure exceeds relief valve instrumentation
set points is assumed to function normally during the time period
analyzed.All plant control systems maintain normal operation unless specifically designated to the contrary.
15.2.4.2.2.2 Closure of One Main Steam Isolation Valve A closure of a single MSIV at any given time does not initiate a reactor scram. This is because the valve position scram trip logic is designed to accommodate single valve operation and testability during normal reactor operation at limited power levels. Credit is taken for the operation of the pressure and
flux signals to initiate a reactor scram.All plant control systems maintain normal operation unless specifically designated to the contrary.
RBS USAR Revision 25 15.2-18 15.2.4.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase is accomplished by initiation of the reactor scram via MSIV position switches and the protection system. Relief valves also operate to limit system pressure.
All these aspects are designed to single failure criterion and additional single failures would not alter the results of this
analysis.
Failure of a single relief valve to open is not expected to have any significant effect. Such a failure is expected to result in less than a 5 psi increase in the maximum vessel pressure rise.
The peak pressure still remains considerably below 1,375 psig.
The design basis and performance of the pressure relief system is
discussed in Section 5.0.
15.2.4.3 Core and System Performance 15.2.4.3.1 Mathematical Model The computer model described in Section 15.1.2.3.1 was used to
simulate these transient events.
15.2.4.3.2 Input Parameters and Initial Conditions 14 These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Tables 15.0-2 and 15.0-2A. The input parameters and initial conditions for the cycle-specific
analyses are described in Appendix 15B.
14 The MSIVs close in 3 to 5 sec. The worst case, the 3-sec closure
time, is assumed in this analysis.
Position switches on the valves initiate a reactor scram when the valves are less than the analytical limits of 85 percent open.
The delay time includes 0.01 sec for the position switches to change state and 0.14 sec for reactor protection system logic delay for a total delay of 0.15 sec. 8 8 15.2.4.3.3 Results 15.2.4.3.3.1 Closure of All Main Steam Isolation Valves Fig. 15.2-6 shows the changes in important nuclear system variables for the simultaneous isolation of all main steam lines while the reactor is operating at 100 percent of NBR steam flow.
Peak neutron flux reaches 118.9 percent of rated after approximately 2.0 sec. 8 8 14 The results of this event demonstrate that this event remains bounded by other pressurization events and is therefore not
required to be analyzed each reload.
14 RBS USAR Revision 24 15.2-19 15.2.4.3.3.2 Closure of One Main Steam Isolation Valve 16 Only one isolation valve is permitted to be closed at a time for testing purposes to prevent scram. Normal test procedure requires an initial power reduction to 75 percent of design conditions in order to avoid high flux scram, high pressure
scram, or full isolation from high steam flow in the "live" lines. With a 3-sec closure of one MSIV during 105 percent original rated power conditions, the steam flow disturbance raises vessel pressure and reactor power enough to initiate a
high neutron flux scram. This transient is considerably milder
than closure of all MSIVs at full power. No quantitative analysis is furnished for this event. However, no significant change in thermal margins is experienced and no fuel damage
occurs. Peak pressure remains below SRV set points.
16 Inadvertent closure of one or all of the isolation valves while the reactor is shut down (such as operating state C, as defined in Appendix 15A) produces no significant transient. Closures
during plant heatup (operating state D) are less severe than the maximum power cases (maximum stored and decay heat) discussed in
Section 15.2.4.3.3.1.
15.2.4.3.4 Considerations of Uncertainties
Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics.
In all cases, the most conservative values are used in the
analyses. For example:
- 1. Slowest allowable control rod scram motion is assumed.
- 2. Nuclear characteristics for all-rods-out EOEC conditions are assumed.
- 3. Minimum specified valve capacities are utilized for over pressure protection.
- 4. All setpoints are taken at their analytical limits.
5.Credit is taken only for the minimum SRVs required to be operable by Technical Specifications.
RBS USAR Revision 25 15.2-20 15.2.4.4 Barrier Performance
15.2.4.4.1 Closure of All Main Steam Line Isolation Valves
The nuclear system relief valves begin to open at approximately 3.6 sec after the start of isolation. The valves close sequentially as the stored heat is dissipated but continue to discharge the decay heat intermittently. Peak pressure at the vessel bottom reaches 1,262 psig, clearly below the pressure limits of the RCPB. Peak pressure in the main steam line is
1,228 psig.
15.2.4.4.2 Closure of One Main Steam Line Isolation Valve
No significant effect is imposed on the RCPB, since if closure of
the valve occurs at an unacceptably high operating power level, a flux or pressure scram will result. The main turbine bypass system will continue to regulate system pressure via the other
three "live" steam lines.
15.2.4.5 Radiological Consequences
At the time of MSIV closure the containment is being purged at a rate of 7,000 cfm. Upon receipt of a high-high radiation signal from the containment purge ventilation exhaust monitor, the containment purge fans are shut down and the isolation dampers
are closed. No significant amount of radioactivity is released
during this time period.
A conservative estimate of the maximum radioactivity
concentrations which could result from MSIV closure is presented in Table 15.2-7. The analysis shows that concentrations are well within 10CFR20, Appendix B, Table II limits. The following
conservative assumptions are used:
- 1. Steam is released to the suppression pool at a time-dependent release rate until a total of 834,300 lb
has been released. This represents the total mass
release from the SRVs during the MSIV closure event.
- 2. Iodines are released to the containment atmosphere via the suppression pool with a partition coefficient of
8.4 x 10-4. 3. Reactor coolant iodine concentration of 4.0 Ci/gm I-131 dose equivalent is used to account for the spiking.
RBS USAR 15.2-21 August 1987 4. Design iodine and noble gas activities from Table 11.1-1 are used. 5. An annual average X/Q of 3.29 x 10
-6 sec/cu m for the restricted area boundary in the most conservative sector (west-northwest) due to a release from the plant exhaust
duct is used. 6. The containment purge ventilation exhaust filtration efficiency for iodines is 99 percent.
15.2.4.5.1 Fission Product Release from Fuel While no fuel rods are damaged as a consequence of this event, fission product activity associated with normal coolant activity
levels as well as that released from previously defective rods is released to the suppression pool as a consequence of SRV actuation and vessel depressurization. The release of activity from previously defective rods is based in part upon measurements
obtained from operating BWR plants (1).Since each of those transients identified previously which cause SRV actuation results in various vessel depressurization and
steam blow- down rates, the transient evaluated in this section is that one which maximizes the radiological consequences for all
transients of this nature. This transient is the closure of all MSIVs. The activity airborne in the containment is based on the
analysis presented in Section 12.2.
15.2.4.5.2 Fission Product Release to Environment
For this event, it is assumed that purging of the containment through the containment filter occurs under average annual
meteorological conditions and continues immediately after initiation of the event until receipt of a high-high radiation signal from the containment purge ventilation exhaust monitor.
The containment filter efficiency for iodine is 99 percent.
Reference 2 contains a description of the containment purge
release model used.
RBS USAR 15.2-22 August 1987 15.2.5 Loss of Condenser Vacuum 15.2.5.1 Identification of Causes and Frequency Classification
15.2.5.1.1 Identification of Causes
Various system malfunctions which can cause a loss of condenser vacuum due to some single equipment failure are designated in
Table 15.2-8.
15.2.5.1.2 Frequency Classification
This event is categorized as an incident of moderate frequency.
15.2.5.2 Sequence of Events and Systems Operation
15.2.5.2.1 Sequence of Events
Table 15.2-9 lists the sequence of events for Fig. 15.2-7.
The operator should: 1. Verify auto transfer of buses supplied by generator to incoming power - if automatic transfer has not occurred, manual transfer must be made. 2. Monitor and maintain reactor water level at required level.3. Check turbine for proper operation of all auxiliaries during coastdown. 4. Depending on conditions, initiate normal operating procedures for cooldown, or maintain pressure for restart
purposes.5. Put the mode switch in the STARTUP position before the reactor pressure decays to <850 psig. 6. Secure RCIC operation if auto initiation occurred due to low water level.7. Monitor CRD positions and insert both the IRMs and SRMs. 8. Investigate the cause of the trip, make repairs as necessary, and complete the scram report.
RBS USAR 15.2-23 August 1987 9. Cooldown the reactor per standard procedure if a restart is not intended.
15.2.5.2.2 Systems Operation In establishing the expected sequence of events and simulating plant performance, it was assumed that normal functioning occurred in the plant instrumentation and controls, plant
protection, and RPS.
Tripping functions incurred by sensing main turbine condenser vacuum pressure are designated in Table 15.2-10.
15.2.5.2.3 The Effect of Single Failures and Operator Errors This event does not lead to a general increase in reactor power level. Mitigation of power increase is accomplished by the
protection system initiation of scram.
Failure of the integrity of the condenser gas treatment system is considered to be an accident situation and is described in
Section 15.7.1.
Single failures do not effect the vacuum monitoring and turbine trip devices which are redundant. The protective sequences of
the anticipated operational transient are shown to be single
failure proof. See Appendix 15A for details.
15.2.5.3 Core and System Performance
15.2.5.3.1 Mathematical Model The computer model described in Section 15.1.2.3.1 was used to simulate this transient event.
15.2.5.3.2 Input Parameters and Initial Conditions This analysis was performed with plant conditions tabulated in Table 15.0-2 unless otherwise noted.
Turbine stop valves full stroke closure time is 0.1 sec.
A reactor scram is initiated by position switches on the stop valves when the valves are less than 90 percent open. This stop valve scram trip signal is automatically bypassed when the
reactor is below 40 percent NBR power level.The analysis presented here is a hypothetical case with a conservative 2 in Hg/sec vacuum decay rate. Thus, the RBS USAR Revision 17 15.2-24 bypass system is available for several seconds since the bypass is signaled to close at a vacuum level of about 10 in Hg less
than the stop valve closure. 15.2.5.3.3 Results
Under this hypothetical 2 in Hg per sec vacuum decay condition, the turbine bypass valve and MSIV closure would follow main
turbine trip about 5 sec after they initiate the transient. This
transient, therefore, is similar to a normal turbine trip with
bypass. The effect of MSIV closure tends to be minimal since the
closure of main turbine stop valves and subsequently the bypass
valves have already shut off the main steam line flow. Fig.
15.2-7 shows the transient expected for this event. It is assumed that the plant is initially operating at 105 percent of
original NBR steam flow conditions. Peak neutron flux reaches 168.72 percent of originalNBR power while average fuel surface heat flux reaches 101 percent of initial value. SRVs open to limit the pressure rise, then sequentially reclose as the stored
energy is dissipated. 15.2.5.3.4 Considerations of Uncertainties
The reduction or loss of vacuum in the main turbine condenser sequentially trips the main turbine and closes the MSIVs and
bypass valves. While these are the major events occurring, other
resultant actions include scram (from stop valve closure) and
bypass opening with the main turbine trip. Because the protective actions are actuated at various levels of condenser
vacuum, the severity of the resulting transient is directly dependent upon the rate at which the vacuum pressure is lost.
Normal loss of vacuum due to loss of cooling water pumps or steam
jet air ejector problem produces a very slow rate of loss of
vacuum (minutes, not seconds) (Table 15.2-8). If corrective
actions by the reactor operators are not successful, then simultaneous trips of the main turbine, and ultimately complete isolation by closing the bypass valves (opened with the main
turbine trip) and the MSIVs, occur.
A faster rate of loss of the condenser vacuum would reduce the anticipatory action of the scram and the overall effectiveness of
the bypass valves since they would be closed more quickly. Other uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics.
In all cases, the most conservative values are used in the
analyses. For example:
RBS USAR 15.2-25 August 1987 1. Slowest allowable control rod scram motion is assumed. 2. Nuclear characteristics for all-rods-out EOEC conditions are assumed. 3. Minimum specified valve capacities are utilized for over-pressure protection. 4. Set points of the SRVs are assumed to be 1 to 2 percent higher than the valves' nominal set points. 15.2.5.4 Barrier Performance Peak nuclear system pressure is 1,217.3 psig at the vessel bottom. Clearly, the overpressure transient is below the RCPB transient pressure limit of 1,375 psig. Vessel dome pressure does not exceed 1,190 psig. A comparison of these values to those for turbine trip at high power shows the similarities
between these two transients. The prime differences are the loss
of feedwater and main steam isolation. 15.2.5.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation.
However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5; therefore, the calculated radiological exposures noted in Section 15.2.4.5 are higher than the consequences of this
event.15.2.6 Loss of AC Power 15.2.6.1 Identification of Causes and Frequency Classification 15.2.6.1.1 Identification of Causes 15.2.6.1.1.1 Loss of Normal and Preferred Station Service TransformersCauses for interruption or loss of the normal and preferred station service transformers can arise from normal operation or malfunctioning of transformer protection circuitry. These can include high transformer oil temperature, reverse or high current operation, as well as operator error which trips the transformer
breakers.
RBS USAR Revision 4 15.2-26 August 1991 15.2.6.1.1.2 Loss of All Grid Connections Loss of all grid connections can result from major shifts in electrical loads, loss of loads, lightning, storms, wind, etc, which contribute to electrical grid instabilities. These instabilities may cause equipment damage if unchecked. Protective relay schemes automatically disconnect electrical sources and
loads to mitigate damage and regain electrical grid stability. 15.2.6.1.2 Frequency Classification 15.2.6.1.2.1 Loss of Normal and Preferred Station Service TransformersThis transient disturbance is categorized as an incident of moderate frequency. 15.2.6.1.2.2 Loss of All Grid Connections This transient disturbance is categorized as an incident of moderate frequency. 15.2.6.2 Sequence of Events and Systems Operation 15.2.6.2.1 Sequence of Events 15.2.6.2.1.1 Loss of Normal and Preferred Station Service Transformers Table 15.2-11 lists the sequence of events for Fig. 15.2-8.
15.2.6.2.1.2 Loss of All Grid Connections
Table 15.2-12 lists the sequence of events for Fig. 15.2-9.
15.2.6.2.1.3 Identification of Operator Actions 4 The operator should maintain the reactor water level by use of the RCIC or HPCS system, and control reactor pressure by use of the relief valves. He should verify that the turbine dc oil pump is operating satisfactorily to prevent turbine bearing damage.
Also, he should verify proper switching and loading of the
4The following is the sequence of operator actions expected during the course of the events when no immediate restart is assumed.
The operator should:
RBS USAR 15.2-27 August 1987 1. Following the scram, verify all rods in. 2. Check that diesel generators start and carry the vital loads.3. Check that relays on the RPS drop out.
- 4. Check that both RCIC and HPCS start when reactor vessel level drops to the initiation point after the relief valve opens. 5. Check T-G auxiliaries during coastdown. 6. When both the reactor pressure and level are under control, secure both HPCS and RCIC as necessary. 7. Continue cooldown in accordance with the normal procedure.8. Complete the scram report and survey the maintenance requirements.15.2.6.2.2 Systems Operation 15.2.6.2.2.1 Loss of Normal and Preferred Station Service TransformersThis event, unless otherwise stated, assumes and takes credit for normal functioning of plant instrumentation and controls, plant
protection, and RPS. The reactor is subjected to a complex sequence of events when the plant loses all auxiliary power. Estimates of the responses of the various reactor systems (assuming loss of the transformers)
provide the following simulation sequence: 1. All electrical pumps are tripped at a reference time, t=0, with normal coastdown times for the recirculation
pumps.2. River Bend Station with relay-type RPS circuitry generates an independent reactor scram and MSIV closure
signal in 2 sec.
Operation of the HPCS and RCIC system functions are not simulated in this analysis. Their operation occurs at some time beyond the
primary concerns of fuel thermal margin and overpressure effects
of this analysis.
RBS USAR 15.2-28 August 1987 15.2.6.2.2.2 Loss of All Grid Connections Same as Section 15.2.6.2.2.1 with the following additional concern.The loss of all grid connections is another feasible, although improbable, way to lose all auxiliary power. This event would
add a generator load rejection to the above sequence at time, t=0. The load rejection immediately forces the turbine control valves closed, causes a scram and initiates RPT (already tripped
at reference time t=0).
15.2.6.2.3 The Effect of Single Failures and Operator Errors Loss of the normal and preferred station service transformers in general leads to a reduction in power level due to rapid pump coastdown with pressurization effects due to turbine trip occurring after the reactor scram has occurred. Additional failures of the other systems assumed to protect the reactor would not result in an effect different from those reported.
Failures of the protection systems have been considered and
satisfy single failure criteria and as such no change in analyzed
consequences is expected. See Appendix 15A for details on single
failure analysis.
15.2.6.3 Core and System Performance
15.2.6.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate the "loss of normal and preferred station service transformers" event and the computer model described in Section 15.1.2.3.1 was used to simulate the "loss of all grid
connections" event.Operation of the RCIC or HPCS systems is not included in the simulation of this transient, since startup of these pumps does
not permit flow in the time period of this simulation.
15.2.6.3.2 Input Parameters and Initial Conditions 15.2.6.3.2.1 Loss of Normal and Preferred Station Service Transformers These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2 and under the assumed
systems constraints described in Section 15.2.6.2.2.
RBS USAR Revision 4 15.2-29 August 1991 15.2.6.3.2.2 Loss of All Grid Connections Same as Section 15.2.6.3.2.1.
15.2.6.3.3 Results 15.2.6.3.3.1 Loss of Normal and Preferred Station Service TransformersFig. 15.2-8 shows graphically the simulated transient. The initial portion of the transient is similar to the recirculation pump trip transient. Within 2 sec, reactor scram and main steam
isolation valve closure occur.4Sensed level drops to the RCIC and HPCS initiation set point at approximately 20.4 sec after loss of auxiliary power.
4There is no significant increase in fuel temperature or decrease in the operating MCPR value; the fuel thermal margins are not
threatened and the design basis is satisfied.
15.2.6.3.3.2 Loss of All Grid Connections Loss of all grid connections is a more general form of loss of auxiliary power. It essentially takes on the characteristic response of the standard full load rejection discussed in Section
15.2.2. Fig. 15.2-9 shows graphically the simulated event.
15.2.6.3.4 Consideration of Uncertainties The most conservative characteristics of protection features are assumed. Any actual deviations in plant performance are expected
to make the results of this event less severe.Operation of the RCIC or HPCS systems is not included in the simulation of the first 50 sec of this transient. Startup of these pumps occurs in the latter part of this time period but
these systems have no significant effect on the results of this
transient.Following main steam isolation the reactor pressure is expected to increase until the SRV set points are reached. During this time the valves operate in a cyclic manner to discharge the decay
heat to the suppression pool.
RBS USAR 15.2-30 August 1987 15.2.6.4 Barrier Performance 15.2.6.4.1 Loss of Normal and Preferred Station Service Transformers The consequences of this event do not result in any significant temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function
as designed.
15.2.6.4.2 Loss of All Grid Connections
SRVs open in the pressure relief mode of operation as the pressure increases beyond their set points. The pressure in the dome is limited to a maximum value of 1,187 psig, well below the
vessel pressure limit of 1,375 psig.
15.2.6.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation.
However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5; therefore, the calculated radiological exposures noted in Section 15.2.4.5 are higher than the consequences of this
event.15.2.7 Loss of Feedwater Flow
15.2.7.1 Identification of Causes and Frequency Classification
15.2.7.1.1 Identification of Causes A loss of feedwater flow could occur from pump failures, feedwater controller failures, operator errors, or reactor system
variables such as high vessel water level (L8) trip signal.
15.2.7.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.
RBS USAR Revision 4 15.2-31 August 1991 15.2.7.2 Sequence of Events and Systems Operation 15.2.7.2.1 Sequence of Events
Table 15.2-13 lists the sequence of events for Fig. 15.2-10. 4 The operator should ensure RCIC and HPCS actuation so that water inventory is maintained in the reactor vessel. Monitor reactor
water level and pressure control, and T-G auxiliaries during
shutdown.4The following is the sequence of operator actions expected during the course of the event when no immediate restart is assumed.
The operator should: 1. Verify all rods in, following the scram. 2. Verify HPCS and RCIC initiation.
- 3. Verify that the recirculation pumps trip on reactor low-low level. 4. Secure HPCS when reactor level and pressure are under control.5. Continue operation of RCIC until decay heat diminishes to a point where the RHR system can be put into service. 6. Monitor turbine coastdown, break vacuum as necessary.
- 7. Complete scram report and survey maintenance requirements.
15.2.7.2.2 Systems Operation Loss of feedwater flow results in a proportional reduction of vessel inventory causing the vessel water level to drop. The first corrective action is the low level (L3) scram trip actuation. The RPS responds within 1 sec after this trip to scram the reactor. The low level (L3) scram trip function meets
single failure criterion.Containment isolation, when it occurs, would also initiate a MSIV position scram trip signal as part of the normal isolation event.
The reactor, however, is already scrammed and shut down by this
time.
RBS USAR 15.2-32 August 1987 15.2.7.2.3 The Effect of Single Failures and Operator Errors The nature of this event, as explained above, results in a lowering of vessel water level. Key corrective efforts to shut down the reactor are automatic and designed to satisfy single
failure criterion; therefore, any additional failure in these
shutdown methods would not aggravate or change the simulated
transient. See Appendix 15A for details.
15.2.7.3 Core and System Performance
15.2.7.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate this event.
15.2.7.3.2 Input Parameters and Initial Conditions
These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2.
15.2.7.3.3 Results The results of this transient simulation are shown on Fig. 15.2-10. Feedwater flow terminates at approximately 5 sec.
Subcooling decreases, causing a reduction in core power level and
pressure. As power level is lowered, the turbine steam flow
starts to drop off because the pressure regulator is attempting to maintain pressure for the first 5 sec or so. Water level
continues to drop until the vessel level (L3) scram trip set
point is reached, whereupon the reactor is shut down and the recirculation pumps are tripped. Vessel water level continues to drop to the L2 trip. At this time, the HPCS and RCIC operation
is initiated. MCPR remains considerably above the safety limit
since increases in heat flux are not experienced.
15.2.7.3.4 Considerations of Uncertainties
End-of-cycle scram characteristics are assumed.
This transient is most severe from high power conditions, because the rate of level decrease is greatest and the amount of stored
and decay heat to be dissipated are highest.Operation of the RCIC or HPCS systems is not included in the simulation of the first 50 sec of this transient since startup of these pumps occurs in the latter part of this RBS USAR Revision 17 15.2-33 time period and therefore these systems have no significant effects on the results of this transient except perhaps as
discussed in Section 15.2.7.2.3.
15.2.7.4 Barrier Performance
The consequences of this event do not result in any temperature or pressure transient in excess of the criteria for which the
fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function as designed.
15.2.7.5 Radiological Consequences The consequences of this event do not result in any fuel failure.
Therefore, no analysis of the radiological consequences is
required.15.2.8 Feedwater Line Break
Refer to Section 15.6.6.
15.2.9 Failure of RHR Shutdown Cooling
Normally, in evaluating component failure associated with the RHR system in the shutdown cooling mode, active pumps or
instrumentation (all of which are redundant for safety system
portions of the RHR system) are assumed to fail. For purposes of
the worst-case analysis, the single recirculation loop suction
valve to the redundant RHR loops is assumed to fail. This
failure would still leave two complete RHR loops for LPCI and pool cooling minus the normal RHR shutdown cooling loop
connection. Although the valve could be manually opened, it is
assumed to fail.15.2.9.1 Identification of Causes and Frequency Classification
15.2.9.1.1 Identification of Causes The plant is operating at 3100 MWt (10 0.3-percent rated power
)when a loss of offsite power occurs, causing multiple safety-relief valve actuation and subsequent heatup of the suppression pool. Reactor vessel depressurization is initiated to bring the reactor pressure to approximately 100 psig.
Concurrent with the loss of offsite power an additional single
failure occurs which prevents the operator from establishing the
normal shutdown cooling path through the RHR shutdown cooling
lines. The operator then establishes a shutdown RBS USAR Revision 14 15.2-34 September 2001 cooling path for the vessel through the ADS valves and vessel inventory makeup.
15.2.9.1.2 Frequency Classification
Recent analytical evaluations of this event have used additional worst-case assumptions. These included:1. Loss of all offsite ac power. 2. Utilization of safety-grade equipment only.
- 3. Operator action after 10 minutes. These assumptions change the initial incident (malfunction of RHR suction valve) from a moderate-frequency incident to a
classification in the design basis accident status. However, the
event is evaluated as a moderate frequency event.
15.2.9.2 Sequence of Events and System Operation
15.2.9.2.1 Sequence of Events14 The sequence of events is shown in Tables 15.2-14 and 15.2-14a.
14The following is the sequence of operator actions expected during the course of the events when no immediate restart is assumed.
The operator should:1. Following the scram, verify all rods in. 2. Check that diesel generators start and carry the vital loads.3. Check that relays on the RPS drop out.
- 4. Check that both RCIC and HPCS start when reactor vessel level drops to the initiation point after the relief valve opens.5. Break vacuum before the loss of sealing steam occurs. 6. Check T-G auxiliaries during coastdown.
- 7. When both the reactor pressure and level are under control, secure both HPCS and RCIC as necessary.
RBS USAR 15.2-35 August 1987 8. At 10 minutes into the transient, initiate suppression pool cooling (again for purposes of this analysis, it is assumed that only one RHR heat exchanger is available).9. Initiate RPV shutdown depressurization by manual actuation of seven ADS valves.10. After the RPV is depressurized to approximately 100 psig, attempt to open one of the two RHR shutdown cooling
suction valves. These attempts are assumed unsuccessful.11. At 100 psig RPV pressure, use ADS to establish a closed cooling path as described in the notes for Fig. 15.2-12.12. Complete the scram report and survey the maintenance requirements.
15.2.9.2.2 System OperationPlant instrumentation and control is assumed to function normally except as noted. In this evaluation, credit is taken for the
plant and reactor protection systems and/or the use of ESF.
15.2.9.3 Core and System Performance
15.2.9.3.1 Methods, Assumptions, and Conditions An event that can directly cause reactor vessel water temperature to increase is one in which the energy removal rate is less than the decay heat rate. The applicable event is loss of RHR
shutdown cooling. This event can occur only during the low pressure portion of a normal reactor shutdown and cooldown, when the RHR system is operating in the shutdown cooling mode. During this time the critical power ratio remains high and nucleate
boiling heat transfer is not exceeded at any time. Therefore, the core thermal safety margin remains essentially unchanged.
The 10-minute time period assumed for operator action is an estimate of how long it would take the operator to initiate the necessary actions; it is not a time by which he must initiate
action.15.2.9.3.2 Mathematical Model In evaluation of this event, the important parameters to consider are reactor depressurization rate and suppression RBS USAR 15.2-36 August 1987 pool temperature. Models used for this evaluation are described in References 4 and 5.
15.2.9.3.3 Input Parameters and Initial Conditions Table 15.2-15 shows the input parameters and initial conditions used in evaluation of this event.
15.2.9.3.4 Results
For most single failures that could result in loss of shutdown cooling, no unique safety actions are required. In these cases, shutdown cooling is simply reestablished using other normal
shutdown cooling equipment. In cases where both of the RHR shutdown cooling suction valves cannot be opened, alternate paths are available to accomplish the shutdown cooling function (Fig. 15.2-11).The analysis demonstrates the capability to safely transfer fission product decay heat and other residual heat from the
reactor core at a rate such that the specified acceptable fuel design limits and the design conditions of the reactor coolant pressure boundary are not exceeded. The evaluation ensures that the safety function can be accomplished assuming a worst-case
single failure.The alternate cooldown path chosen to accomplish the shutdown cooling function utilizes the RHR and ADS or normal relief valve
systems. For more detail, see Reference 3 and Fig. 15.2-12.
The alternate shutdown systems are capable of performing the function of transferring heat from the reactor to the environment using only safety-grade systems. Even if it is additionally
postulated that all of the ADS or relief valves discharge piping
break, the shutdown cooling function can eventually be accomplished as the cooling water runs directly out of the ADS or safety/relief valves, flooding into the drywell and then into the
suppression pool.These systems also have suitable redundancy in components such that their safety function can be accomplished assuming an
additional single failure in either power mode. This applies for both onsite electrical power operation, assuming offsite power is not available, and offsite electrical power operation, assuming onsite power is not available. The system can be fully operated
from the main control room.The evaluation is divided into two phases; 1) full power operation to approximately 100 psig vessel pressure, and 2)
RBS USAR 15.2-37 August 1987 approximately 100 psig vessel pressure to cold shutdown (14.7 psia and 200°F) conditions.
15.2.9.3.4.1 Full Power to Approximately 100 psig Independent of the event that initiated plant shutdown (a normal plant shutdown or a forced plant shutdown) the reactor is normally brought to approximately 100 psig using either the main condenser or, if the main condenser is unavailable, the RCIC/HPCS
systems, together with the SRVs.For evaluation purposes, however, it is assumed that plant shutdown is initiated by a transient event, such as loss of
offsite power, which results in reactor isolation and subsequent relief valve actuation and suppression pool heatup. For this postulated condition, the reactor is shut down and the reactor vessel pressure and temperature are reduced to and maintained at saturated conditions at approximately 100 psig. The reactor vessel is depressurized by manually opening selected SRVs.
Reactor vessel makeup water is automatically provided by the RCIC/HPCS systems. The RHR system in suppression pool cooling mode is used to maintain the suppression pool temperature within
shutdown limits.These systems are designed to routinely perform their functions for both normal and forced plant shutdown. Since the RCIC/HPCS and RHR systems are divisionally separated, no single failure, together with the loss of offsite power, is capable of preventing
the vessel pressure from reaching the 100 psig level.
15.2.9.3.4.2 Approximately 100 psig to Cold Shutdown The following assumptions are used for the analyses of the procedures for attaining cold shutdown from a pressure of
approximately 100 psig:1. The vessel is at 100 psig and saturated conditions. 2. A worst-case single failure is assumed to have occurred (i.e., loss of a division of emergency power).3. No offsite power is available. In the event that the RHR shutdown suction line is not available because of single failure, personnel must gain access and attempt
to effect repairs. For example, if a single electrical failure
caused the suction valve to fail RBS USAR 15.2-38 August 1987 in the closed position, a hand wheel is provided on the valve to allow manual operation. If for some reason the normal shutdown cooling suction line cannot be repaired, the capabilities described below will satisfy the normal shutdown cooling
requirements in accordance with GDC 34.The RHR shutdown cooling lines valves are in two divisions (Division 1 = the outboard valve, and Division 2 = the inboard valve) to satisfy containment isolation criteria. For evaluation purposes, the worst-case failure is assumed to be the loss of a division of emergency power, since this also prevents actuation of one shutdown cooling line valve. Engineered safety feature equipment available for accomplishing the shutdown cooling
function for the selected path includes: ADS (DC Division 1 and DC Division 2)
RHR Loop A (Division 1)
HPCS (Division 3)
LPCS (Division 1)
Since availability or failure of Division 3 equipment does not affect the normal shutdown mode, normal shutdown cooling is available through equipment powered from only Divisions 1 and 2.
It should be noted that, conversely, the HPCS system is always available if either of the other two divisions fail. For failure
of Division 1 or 2, the following systems are assumed functional:1. Division 1 fails, Divisions 2 and 3 function Failed Systems Functional Systems RHR Loop A HPCS LPCS ADS
RHR Loops B and C RCIC Assuming the single failure is a failure of Division 1 emergency power, the safety function is accomplished by establishing one of the cooling loops described in
Activity C1 of Fig. 15.2-12.
2.Division 2 fails, Divisions 1 and 3 function RBS USAR Revision 14 15.2-39 September 2001 Failed Systems Functional Systems RHR Loops B and C HPCS ADS RHR Loop A RCIC LPCS Assuming the single failure is the failure of Division 2, the safety function is accomplished by establishing one of the cooling loops described by Activity C2 in the notes of
Fig. 15.2-12.14Using the above assumptions and following the depressurization rate shown in Figs. 15.2-13 and 15.2-13a, the suppression pool
temperature is shown in Figs. 15.2-14 and 15.2-14a.
1415.2.9.4 Barrier PerformanceThis event does not result in any temperature or pressure transient in excess of the design criteria for the fuel, pressure
vessel, or containment. Coolant is released to the containment
by SRV actuation.
15.2.9.5 Radiological Consequence
The radiological consequences of this event are enveloped by those described in Section 15.2.4.5.
RBS USAR Revision 14 15.2-40 September 2001 References - 15.21. Brutschy, F. G., et al. Behavior of Iodine in Reactor Water During Plant Shutdown and Startup. August 1972 (NEDO-10585).2. Nguyen, D. Realistic Accident Analysis - The RELAC Code.
October 1977 (NEDO-21142).3. Letter from R. S. Boyd to I. F. Stuart dated November 12, 1975.
Subject:
Requirements Delineated for
RHRS - Shutdown Cooling System--Single Failure Analysis.144. Bilanin, W. I.; Bodily, R. J.; and Cruz, G. A. The General Electric Mark III Pressure Suppression Containment System Analytical Model (Supplement 1).
September 1975 (NEDO-20533, Supplement 1). 5. 105% Power Uprate Evaluation Report for GE Task No.
13.0, Containment Analysis.
14 RBS USAR 15.3-1 August 1987 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 Recirculation Pump Trip
15.3.1.1 Identification of Causes and Frequency Classification
15.3.1.1.1 Identification of Causes
Recirculation pump motor operation can be tripped off by design for intended reduction of other transient core and RCPB effects as well as randomly by unpredictable operational failures.
Intentional tripping occurs in response to: 1. Reactor vessel water level L2 set point trip
- 2. TCV fast closure or stop valve closure
- 3. Failure to scram high pressure set point trip
- 4. Motor branch circuit over-current protection
- 5. Motor overload protection
- 6. Suction block valve not fully open.
Random tripping occurs in response to:
- 1. Operator error
- 2. Loss of electrical power source to the pumps
- 3. Equipment or sensor failures and malfunctions which initiate the above intended trip response.
15.3.1.1.2 Frequency Classification
15.3.1.1.2.1 Trip of One Recirculation Pump
This transient event is categorized as one of moderate frequency.
15.3.1.1.2.2 Trip of Two Recirculation Pumps
This transient event is categorized as one of moderate frequency.
RBS USAR 15.3-2 August 1987 15.3.1.2 Sequence of Events and Systems Operation 15.3.1.2.1 Sequence of Events
15.3.1.2.1.1 Trip of One Recirculation Pump
Table 15.3-1 lists the sequence of events for Fig. 15.3-1.
15.3.1.2.1.2 Trip of Two Recirculation Pumps
Table 15.3-2 lists the sequence of events for Fig. 15.3-2.
15.3.1.2.1.3 Identification of Operator Actions
15.3.1.2.1.3.1 Trip of One Recirculation Pump
Since no scram occurs for trip of one recirculation pump, no immediate operator action is required. As soon as possible, the operator should verify that no operating limits are being exceeded, and reduce flow of the operating pump to conform to the
single pump flow criteria. Also, the operator should determine the cause of failure prior to returning the system to normal and
follow the restart procedure.
15.3.1.2.1.3.2 Trip of Two Recirculation Pumps The operator should ascertain that the reactor scrams with the turbine trip resulting from reactor water level swell. The operator should regain control of reactor water level through RCIC operation, monitoring reactor water level, and pressure
control after shutdown. When both reactor pressure and level are
under control, the operator should secure both HPCS and RCIC as
necessary. The operator should also determine the cause of the
trip prior to returning the system to normal.
15.3.1.2.2 Systems Operation
15.3.1.2.2.1 Trip of One Recirculation Pump Tripping a single recirculation pump requires no protection system or safeguard system operation. This analysis assumes
normal functioning of plant instrumentation and controls.
15.3.1.2.2.2 Trip of Two Recirculation Pumps Analysis of this event assumes normal functioning of plant instrumentation and controls, and plant protection and reactor
protection systems. Specifically this transient RBS USAR 15.3-3 August 1987 takes credit for vessel level (L8) instrumentation to trip the reactor and the turbine. High system pressure is limited by the
pressure relief valve system operation.
15.3.1.2.3 The Effect of Single Failures and Operator Errors
15.3.1.2.3.1 Trip of One Recirculation Pump Since no corrective action is required according to Section 15.3.1.2.2.1, no additional effects of single failures need be discussed. If an additional SEF or SOE is assumed (for envelope purposes the other pump is assumed tripped) then the
following two pump trip analysis is provided. Refer to Appendix
15A for specific details.
15.3.1.2.3.2 Trip of Two Recirculation Pumps
Table 15.3-2 lists the vessel level (L8) scram as the first response to initiate corrective action in this transient. This
scram trip signal is designed such that a single failure neither initiates nor impedes a reactor scram trip initiation. See
Appendix 15A for specific details.
15.3.1.3 Core and System Performance
15.3.1.3.1 Mathematical Model The nonlinear, dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this event.
15.3.1.3.2 Input Parameters and Initial Conditions
These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. Pump motors and pump rotors are simulated with minimum specified rotating inertias.
15.3.1.3.3 Results
15.3.1.3.3.1 Trip of One Recirculation Pump Fig. 15.3-1 shows the results of losing one recirculation pump. The tripped loop diffuser flow reverses in approximately 5 sec.
However, the ratio of diffuser mass flow to pump mass flow in the active jet pumps increases considerably and produces approximately 130 percent of normal diffuser flow and 55 percent of rated core flow. MCPR remains above the safety limit, thus
the fuel thermal RBS USAR 15.3-4 August 1987 limits are not violated. During this transient, level swell is not sufficient to cause turbine trip and scram.
15.3.1.3.3.2 Trip of Two Recirculation Pumps Figure 15.3-2 shows graphically this transient with minimum specified rotating inertia. The MCPR remains unchanged. No scram is initiated directly by pump trip. The vessel water level swell due to rapid flow coastdown is expected to reach the high level trip thereby shutting down the main turbine, the feedwater pumps, and scramming the reactor. Subsequent events, such as main steam isolation and initiation of RCIC and HPCS systems
occurring late in this event, have no significant effect on the
results.15.3.1.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than expected
under actual plant conditions. Actual pump and pump-motor drive line rotating inertias are expected to be somewhat greater than the minimum design values assumed in this simulation. Actual plant deviations regarding
inertia are expected to lessen the severity as analyzed. Minimum
design inertias were used as well as the least negative void
coefficient since the primary interest is in the flow reduction.
15.3.1.4 Barrier Performance
15.3.1.4.1 Trip of One Recirculation Pump
Fig. 15.3-1 results indicate a basic reduction in system pressures from the initial conditions. Therefore, the RCPB
barrier is not threatened.
15.3.1.4.2 Trip of Two Recirculation Pumps The results shown in Fig. 15.3-2 indicate peak pressures stay well below the 1,375 psig limit allowed by the applicable code.
Therefore, the barrier pressure boundary is not threatened.
15.3.1.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation.
However, the mass input, and hence RBS USAR Revision 21 15.3-5 activity input, for this event is much less than thoseconsequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section 15.2.4.5 cover the
consequences of this event.
15.3.2 Recirculation Flow Control Failure - Decreasing Flow
15.3.2.1 Identification of Causes and Frequency Classification
15.3.2.1.1 Identification of Causes Master controller malfunctions can cause a decrease in corecoolant flow. A downscale failure of either the master power controller or the flux controller generates a zero flow demand signal to both recirculation flow controllers.
Each individual valve actuator circuitry has a velocity limiter which limitsmaximum valve stroking rate to 11 percent per sec. The analysisis conservatively analyzed at a stroke rate of 13 percent per sec.A postulated failure of the input demand signal, which isutilized in both loops, can decrease core flow at the maximum valve stroking rate established by the loop limiter. Failure within either loop's controller can result in a maximum valve stroking rate as limited by the capacity of the valve
hydraulics.
15.3.2.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.
15.3.2.2 Sequence of Events and Systems Operation
15.3.2.2.1 Sequence of Events
15.3.2.2.1.1 Fast Closure of One Main Recirculation Valve
Table 15.3-3 lists the sequence of events for Fig. 15.3-3.
15.3.2.2.1.2 Fast Closure of Two Main Recirculation Valves
Table 15.3-4 lists the sequence of events for Fig. 15.3-4.
15.3.2.2.1.3 Identification of Operator Actions
15.3.2.2.1.3.1 Fast Closure of One Main Recirculation Valve As soon as possible, the operator should verify that nooperating limits are being exceeded. The operator should determine the cause of failure prior to returning the system to
normal.
RBS USAR 15.3-6 August 1987 15.3.2.2.1.3.2 Fast Closure of Two Main Recirculation Valves As soon as possible, the operator must verify that no operating limits are being exceeded. If they are, corrective actions must
be initiated. Also, the operator must determine the cause of the
trip prior to returning the system to normal.
15.3.2.2.2 Systems Operation
15.3.2.2.2.1 Fast Closure of One Main Recirculation Valve
Normal plant instrumentation and control is assumed to function.
Credit is taken for scram in response to vessel high water level (L8) trip.
15.3.2.2.2.2 Fast Closure of Two Main Recirculation Valves
Normal plant instrumentation and control is assumed to function.
Credit is taken for scram in response to vessel high water level (L8) trip.
15.3.2.2.3 The Effect of Single Failures and Operator Errors
The single failure and operator error considerations for this event are the same as discussed in Section 15.3.1.2.3.2. The
fast closure of two recirculation valves instead of one would be
the envelope case for the additional SEF or SOE. Refer to
Appendix 15A for details.
15.3.2.3 Core and System Performance
15.3.2.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate these transient events.
15.3.2.3.2 Input Parameters and Initial Conditions
These analyses have been performed, unless otherwise noted, with plant conditions listed in Table 15.0-2.
The less negative void coefficient in Table 15.0-2 was used for these analyses.
RBS USAR Revision 13 15.3-7 September 2000 15.3.2.3.2.1 Fast Closure of One Main Recirculation Valve Failure within either loop controller can result in a maximum stroking rate of 60 percent per sec as limited by the valve
hydraulics.
15.3.2.3.2.2 Fast Closure of Two Main Recirculation Valves 13 A downscale failure of either the master power controller or the flux controller generates a zero flow demand signal to both recirculation flow controllers. Each individual valve actuator circuitry has a velocity limiter which limits maximum valve stroking rate to 11 percent per sec. The analysis is conservatively analyzed at stroke rate of 13%/sec. Recirculation loop flow is allowed to decrease to approximately 35 percent of rated. This is the flow expected when the flow control valves
are maintained at a minimum open position.
1315.3.2.3.3 Results 15.3.2.3.3.1 Fast Closure of One Recirculation Valve Fig. 15.3-3 illustrates the maximum valve stroking rate which is limited by hydraulic means. It is similar in most respects to
the trip of one recirculation pump transient. Design of the hydraulic limit on maximum valve stroking rate is intended to make this transient event less severe than the one pump trip, and
fuel thermal limits are not threatened.
15.3.2.3.3.2 Fast Closure of Two Recirculation Valves Fig. 15.3-4 illustrates the expected transient which is similar to a two-pump trip. This analysis is very similar to the
two-pump trip described in Section 15.3.1. Design of limiter
operation is intended to render this transient to be less severe
than the two-pump trip. MCPR remains greater than the safety
limit; therefore, no fuel damage occurs.
15.3.2.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than otherwise
expected.These analyses, unlike the pump trip series, are unaffected by deviations in pump/pump motor and driveline inertias since it is
the main valve that causes rapid recirculation decreases.
RBS USAR Revision 15 15.3-8 May 2002 15.3.2.4 Barrier Performance 15.3.2.4.1 Fast Closure of One Recirculation Valve Peak pressures are less than those for the fast closure of two recirculation valves given in Section 15.3.2.4.2.
15.3.2.4.2 Fast Closure of Two Recirculation Valves
The narrow-range level rises to the high level trip set point causing scram and trip of the feedwater pumps and main turbine.
SRVs open in the pressure relief mode and briefly discharge steam
to the suppression pool. Pressure in the vessel bottom is limited to 1,188 psig, well below the ASME code limit. At approximately 17 sec, the wide range level falls to the low water level trip set point, causing initiation of HPCS and RCIC systems. However, there is a delay of up to 30 sec before the
water supply from HPCS and RCIC systems enters the vessel.
15.3.2.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV actuation.
However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section
15.2.4.5 cover the consequences of this event.
15.3.3 Recirculation Pump Seizure15The recirculation pump seizure event is evaluated for the current cycle. The results are given in Appendix 15B.
1515.3.3.1 Identification of Causes and Frequency Classification The seizure of a recirculation pump is considered as a DBA event. It has been evaluated as being a very mild event in relation to other DBAs such as the LOCA. The analysis has been conducted
with consideration to a single or two-loop operation. Refer to Section 5.1 for specific mechanical considerations and Chapter 7 for electrical aspects.
15.3.3.1.1 Identification of Causes The case of recirculation pump seizure represents the extremely unlikely event of instantaneous stoppage of the pump motor shaft of one recirculation pump. This event RBS USAR 15.3-9 August 1987 produces a very rapid decrease of core flow as a result of the large hydraulic resistance introduced by the stopped rotor.
15.3.3.1.2 Frequency Classification This event is considered to be a limiting fault but results in effects which can easily satisfy an event of greater probability (i.e., infrequent incident classification).
15.3.3.2 Sequence of Events and Systems Operations
15.3.3.2.1 Sequence of Events
Table 15.3-5 lists the sequence of events for Fig. 15.3-5.
The operator should ascertain that the reactor scrams from reactor water level swell. The operator should regain control of
reactor water level through RCIC operation or by restart of a feedwater pump, and he should monitor reactor water level and
pressure control after shutdown.
15.3.3.2.2 Systems Operation In order to simulate properly the expected sequence of events, the analysis of this event assumes normal functioning of plant instrumentation and controls, plant protection, and reactor
protection systems. Operation of safe shutdown features, though not included in this simulation, is expected to be utilized in order to maintain
adequate water level. 15.3.3.2.3 The Effect of Single Failures and Operator Errors Single failures in the scram logic originating via the high vessel level (L8) trip are similar to the considerations in
Section 15.3.1.2.3.2. Refer to Appendix 15A for further details.
15.3.3.3 Core and System Performance
15.3.3.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this event.
RBS USAR Revision 17 15.3-10 15.3.3.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. For the purpose of evaluating consequences to the fuel thermal limits, this transient event is assumed to occur as a consequence of an unspecified, instantaneous stoppage of one recirculation pump shaft while the reactor is operating at 105 percent originalNBR steam flow. Also, the reactor is assumed to be operating at thermally limited conditions. The void coefficient is adjusted
to the most conservative value, that is, the least negative value
in Table 15.0-2.
15.3.3.3.3 Results
Figure 15.3-5 presents the results of the accident. Core coolant flow drops rapidly, reaching its minimum value in approximately 1.5 sec. MCPR does not decrease significantly before fuel surface heat flux begins dropping enough to restore greater thermal margins. The level swell produces a trip of the main turbine and feedwater pumps and scram at 3.1 sec into the transient. The scram conditions impose no threat to thermal limits. Additionally, the momentary opening of the bypass valves and some of the SRVs limit the pressure well within the range allowed by the ASME Code. Therefore, the RCPB is not threatened
by overpressure.
Failure of nonsafety grade equipment during a recirculation pump seizure event does not cause MCPR to drop below 1.06. Therefore, the consequences of the event are bounded not only by those of the design basis accident, but also by those of the most limiting
anticipated transient.
Two nonsafety grade pieces of equipment are assumed to work in the USAR analysis. They are the turbine bypass valves and the Level 8 trip of the turbine and feedwater pumps. It is appropriate to assume the Level 8 trip works because it makes the event more severe by turning it into a pressurization event (turbine trip). If the turbine did not trip, the event would be
a mild decrease in core power with insignificant effect on fuel. 7RBS endorses LRG-II Issue 11-RSB. The most limiting combination of failures is a proper functioning of the Level 8 trip with failure of the bypass valves to open. The sequence of events would be as follows. The pump seizes causing the core power to
decrease due to decreased core flow. Water level swells until the Level 8 trips the turbine and feedwater pumps. The event
then resembles a 7
RBS USAR 15.3-11 August 1987 turbine trip without bypass but is less severe than the one presented because of the reduced core power at the time of the trip. The MCPR for the turbine trip without bypass is above
1.06. This discussion shows the analysis bounds the
recirculation pump seizure event so the MCPR for this event is
also above 1.06.
15.3.3.3.4 Considerations of Uncertainties Considerations of uncertainties are included in the GETAB analysis.15.3.3.4 Barrier Performance The bypass valves and momentary opening of some of the SRVs limit the pressure well within the range allowed by the ASME Code.
Therefore, the RCPB is not threatened by overpressure.
15.3.3.5 Radiological Consequences While the consequences of the events identified previously do not result in any fuel failures, radioactivity is nevertheless discharged to the suppression pool as a result of SRV activation.
However, the mass input, and hence activity input, for this event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section
15.2.4.5 cover the consequences of this event.
15.3.4 Recirculation Pump Shaft Break
15.3.4.1 Identification of Causes and Frequency Classification The breaking of the shaft of a recirculation pump is considered a DBA event. It has been evaluated as a very mild event in relation to other DBAs such as the LOCA. The analysis has been conducted with consideration of single or two-loop operation.
Refer to Chapter 5 for specific mechanical considerations and Chapter 7 for electrical aspects. This postulated event is bounded by the more limiting case of recirculation pump seizure.
Quantitative results for this more limiting case are presented in
Section 15.3.3.
15.3.4.1.1 Identification of Causes
The case of recirculation pump shaft breakage represents the extremely unlikely event of instantaneous stoppage of the RBS USAR 15.3-12 August 1987 pump motor operation of one recirculation pump. This event produces a very rapid decrease of core flow as a result of the
break of the pump shaft.
15.3.4.1.2 Frequency Classification
This event is considered a limiting fault but results in effects which can easily satisfy an event of greater probability (i.e.,
infrequent incident classification).
15.3.4.2 Sequence of Events and Systems Operations
15.3.4.2.1 Sequence of Events
A postulated instantaneous break of the pump motor shaft of one recirculation pump as discussed in Section 15.3.4.1.1 causes the
core flow to decrease rapidly resulting in water level swell in the reactor vessel. When the vessel water level reaches the high
water level set point (Level 8), scram, main turbine trip, and feedwater pump trip are initiated. Subsequently, the remaining recirculation pump trip is initiated due to the turbine trip.
Eventually, the vessel water level is controlled by HPCS and RCIC
flow.15.3.4.2.1.1 Identification of Operator Actions The operator should ascertain that the reactor scrams resulting from reactor water level swell. The operator should regain control of reactor water level through RCIC operation or by
restart of a feedwater pump, and he should monitor reactor water
level and pressure control after shutdown.
15.3.4.2.2 Systems Operation Normal operation of plant instrumentation and control is assumed. This event takes credit for vessel water level (L8) instrumentation to scram the reactor and trip the main turbine
and feedwater pumps. High system pressure is limited by the
pressure relief system operation. Operation of the HPCS and RCIC systems is expected in order to maintain adequate water level
control.15.3.4.2.3 The Effect of Single Failures and Operator Errors Effects of single failures in the high vessel level (L8) trip are similar to the considerations in Section 15.3.1.2.3.2.
RBS USAR 15.3-13 August 1987 Assumption of an SEF or SOE in other equipment has been examined and this has led to the conclusion that no other credible failure
exists for this event. Therefore the bounding case has been
considered. Refer to Appendix 15A for more details.
15.3.4.3 Core and System Performance
Since this event is less limiting than the event described in Section 15.3.3, only qualitative evaluation is provided.
Therefore no discussion of mathematical model, input parameters, and consideration of uncertainties, etc, is necessary. If this extremely unlikely event occurs, core coolant flow drops rapidly. The level swell produces a reactor scram and trip of
the main turbine and the feedwater pumps. Since heat flux
decreases much more rapidly than the rate at which heat is
removed by the coolant, there is no threat to thermal limits. The severity of this pump shaft break event is bounded by the pump seizure event (Section 15.3.3). This can be demonstrated easily by consideration of these two events. In either of these two events, the recirculation drive flow of the affected loop decreases rapidly. In the case of the pump seizure event, the
loop flow decreases faster than the normal flow coastdown as a result of the large hydraulic resistance introduced by the
stopped rotor. For the pump shaft break event, the hydraulic resistance caused by the broken pump shaft is less than that of
the stopped rotor for the pump seizure event. Therefore, the
core flow decrease following a pump shaft break effect is slower than the pump seizure event. Thus, it can be concluded that the potential effects of the hypothetical pump shaft break accident
are bounded by the effects of the pump seizure event.
15.3.4.4 Barrier Performance The bypass valves and momentary opening of some of the SRVs limit the pressure well within the range allowed by the ASME Code.
Therefore, the RCPB is not threatened by overpressure.
15.3.4.5 Radiological Consequences While the consequences of this event do not result in any fuel failures, radioactivity is nevertheless discharged to the
suppression pool as a result of SRV activation. However, the
mass input, and hence activity input, for this RBS USAR 15.3-14 August 1987 event is much less than those consequences identified in Section 15.2.4.5. Therefore, the radiological exposures noted in Section
15.2.4.5 cover the consequences of this event.
RBS USAR Revision 17 15.4-1 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 Rod Withdrawal Error - Low Power 14This transient accident event, which is re-analyzed for PU at 3039 MWtcore power, has been determined to be less limiting than the RWE at full power and bounded by other transients. A reasonable increase in operating power level does not affect the
generic Rod Withdrawal Error analysis performed for the start-up range; therefore, reload analysis is not needed, but it continues
to be analyzed at higher power (at > 70% power).
1415.4.1.1 Control Rod Removal Error During Refueling 15.4.1.1.1 Identification of Causes and Frequency Classification
The event considered here is inadvertent criticality due to the complete withdrawal or removal of the most reactive rod during refueling. The probability of the initial causes alone is considered low enough to warrant its being categorized as an
infrequent incident, since there is no postulated set of circumstances which result in an inadvertent rod withdrawal error (RWE) while in the REFUEL mode. 13 15.4.1.1.2Sequence of Events and Systems Operation Operations that involve control rod removal withdrawal during other than normal refueling operations are addressed in Technical
Specifications Section 3.10, Special Operations. These types of
refueling evolutions require additional controls, per the applicable Limiting Condition of Operation, in order to provide an assurance equivalent to that provided by the safety system interlocks during normal refueling operations. Details of the analyses relevant to these special operations are provided in the applicable technical specification bases. Analyses pertaining to
normal refueling operations are presented below. 15.4.1.1.2.1 Initial Control Rod Removal or Withdrawal During normal refueling operations safety system interlocks provide assurance that inadvertent criticality does not occur
because a control rod has been removed or is withdrawn in
coincidence with another control rod.
13 RBS USAR 15.4-2 August 1987 15.4.1.1.2.2 Fuel Insertion With Control Rod Withdrawn To minimize the possibility of loading fuel into a cell containing no control rod, it is required that all control rods are fully inserted when fuel is being loaded into the core. This requirement is backed up by refueling interlocks on rod withdrawal and movement of the refueling platform. When the mode switch is in the REFUEL position, the interlocks prevent the platform from being moved over the core if a control rod is
withdrawn and fuel is on the hoist. Likewise, if the refueling platform is over the core and fuel is on the hoist, control rod
motion is blocked by the interlocks. 15.4.1.1.2.3 Second Control Rod Removal or Withdrawal When the platform is not over the core (or fuel is not on the hoist) and the mode switch is in the REFUEL position, only one control rod can be withdrawn. Any attempt to withdraw second rod results in a rod block by the refueling interlocks. Since the
core is designed to meet shutdown requirements with the highest
worth rod withdrawn, the core remains subcritical even with one
rod withdrawn. 15.4.1.1.2.4 Control Rod Removal Without Fuel Removal Finally, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal
of the control rod without the simultaneous or prior removal of the four adjacent fuel bundles. This precludes any hazardous
condition.15.4.1.1.2.5 Identification of Operator Actions
No operator actions are required to preclude this event since the plant design as discussed above prevents its occurrence.15.4.1.1.2.6 Effect of Single Failure and Operator Errors If any one of the operations involved in initial failure or error is followed by any other single equipment failure (SEF) or single
operator error (SOE), the necessary safety actions are taken (e.g., rod block or scram) automatically prior to limit
violation. Refer to Appendix 15A for details.
RBS USAR 15.4-3 August 1987 15.4.1.1.3 Core and System Performances Since the probability of inadvertent criticality during refueling is precluded, the core and system performances were not analyzed.
The withdrawal of the highest worth control rod during refueling does not result in criticality. This is verified experimentally by performing shutdown margin checks. (See Section 4.3.2 for a description of the methods and results of the shutdown margin analysis.) Additional reactivity insertion is precluded by interlocks (Section 7.7.1.5). As a result, no radioactive
material is ever released from the fuel making it unnecessary to
assess any radiological consequences. No mathematical models are involved in this event. The need for input parameters or initial conditions is eliminated as there are no results to report. Consideration of uncertainties is not
appropriate.15.4.1.1.4 Barrier Performance
An evaluation of the barrier performance was not made for this event since there is not a postulated set of circumstances for
which this event could occur. 15.4.1.1.5 Radiological Consequences
An evaluation of the radiological consequences was not made for this event since no radioactive material is released from the
fuel.15.4.1.2 Continuous Rod Withdrawal During Reactor Startup 15.4.1.2.1 Identification of Causes and Frequency Classification
The probability of the initial causes of error for this event alone is considered low enough to warrant its being categorized as an infrequent incident. The probability of further single failures postulated for this event is even considerably lower because it is contingent upon the simultaneous failure of two redundant inputs to the rod control and information system (RCIS), concurrent with a high worth rod, out-of-sequence rod selection, plus the lack of operator acknowledgment of continuous
alarm annunciations prior to safety system actuations.
RBS USAR 15.4-4 August 1987 15.4.1.2.2 Sequence of Events and Systems Operation 15.4.1.2.2.1 Sequence of Events Control rod withdrawal errors are not considered credible in the startup and low power ranges. The RCIS prevents the operator from selecting and withdrawing an out-of-sequence control rod.
Continuous control rod withdrawal errors during reactor startup are precluded by the RCIS. The RCIS prevents the withdrawal of an out-of-sequence control rod in the 100 to 75 percent control
rod density range and limits rod movement to the banked position mode of rod withdrawal from the 75 percent rod density to the preset power level. Since only in-sequence control rods can be withdrawn in the 100 to 75 percent control rod density and
control rods are withdrawn in the banked position mode from the 75 percent control rod density point to the preset power level, there is no basis for the continuous control rod withdrawal error in the startup and low power range. See Section 15.4.2 for description of continuous control rod withdrawal above the preset power level. The bank position mode of the RCIS is described in
Reference 1. 15.4.1.2.2.2 Identification of Operator Actions
No operator actions are required to preclude this event since the plant design as discussed above prevents its occurrence. 15.4.1.2.2.3 Effects of Single Failure and Operator Errors
If any one of the operations involved the initial failure or error and is followed by another SEF or SOE, the necessary safety
actions are automatically taken (e.g., rod blocks) prior to any
limit violation. Refer to Appendix 15A for details. 15.4.1.2.3 Core and System Performance
The performance of the RCIS prevents erroneous selection and withdrawal of an out-of-sequence control rod. Thus, the core and
system performance is not affected by such an operator error. No mathematical models are involved in this event. The need for input parameters or initial conditions is not required as there
are no results to report. Consideration of uncertainties is not
appropriate.
RBS USAR Revision 21 15.4-515.4.1.2.4 Barrier PerformanceAn evaluation of the barrier performance was not made for thisevent since there is no postulated set of circumstances for
which this error could occur.15.4.1.2.5 Radiological Consequences
An evaluation of the radiological consequences is not requiredfor this event since no radioactive material is released from
the fuel.15.4.2 Rod Withdrawal Error at Power1This event is evaluated for each reload cycle and the results are given in Appendix 15B if the event is determined to be a
limiting or near limiting event.
114This event was re-analyzed at 3091 MWt core power at conditions describedin Appendix 15B. The results are reported here, consistent with the results described and reported in Appendix
15B.A reasonable increase in operating power level should not affect the generic Rod Withdrawal Error analysis performed for the uprated condition. However, a reload-specific analysis is still
needed.1415.4.2.1 Identification of Causes and Frequency Classification15.4.2.1.1 Identification of Causes The RWE transient results from a procedural error by theoperator in which a single control rod or a gang of control rods
is withdrawn continuously until the rod withdrawal limiter (RWL)
mode of the RCIS blocks further withdrawal.15.4.2.1.2 Frequency Classification The frequency of occurrence for the RWE is conservativelyassumed to be moderate, since definitive data do not exist. The frequency of occurrence diminishes as the reactor approaches full power by virtue of the reduced number of control rod movements. A statistical approach, using appropriate conservative acceptance criteria, shows that consequences of the
majority of RWEs are not significant.
RBS USAR 15.4-6 August 1987 15.4.2.2 Sequence of Events and Systems Operation 15.4.2.2.1 Sequence of Events
The sequence of events for this transient is presented in Table 15.4-1.15.4.2.2.2 System Operations
While operating in the power range, in a normal mode of operation, the reactor operator makes a procedural error and
withdraws the maximum worth control rod or gang of control rods continuously until the RWL inhibits further withdrawal. The RWL
utilizes rod position indications of the selected rod or gang as
input.During the course of this event, normal operation of plant instrumentation and controls is assumed, although no credit is
taken for this except as described above.
No operation of any ESF is required during this event.
15.4.2.2.3 Single Failure or Single Operator Error The effect of operator errors has been discussed above. It was shown that operator errors (which initiated this transient)
cannot impact the consequences of this event due to the RCIS system. The RCIS system is designed to be single failure proof; therefore, termination of this transient is assured. See
Appendix 15A for details.
15.4.2.3 Core and System Performance 15.4.2.3.1 Mathematical Model The consequences of an RWE are calculated utilizing a three- dimensional, coupled nuclear-thermal-hydraulics computer
program (2). This model calculates the changes in power level, power distribution, core flow, and CPR under steady-state
conditions, as a function of control blade position. For this transient, the time for reactivity insertion is greater than the fuel thermal time constant and core-hydraulic transport times, so
that the steady-state assumption is valid.
RBS USAR Revision 15 15.4-7 May 2002 15.4.2.3.2 Input Parameters and Initial ConditionsA statistical analysis of the rod withdrawal error results (Reference 3) initiated from a wide range of operating conditions (exposure, power, flow, rod patterns, xenon conditions, etc.) has been performed, establishing allowable rod withdrawal increments applicable to all BWR/6 plants. These rod withdrawal increments were determined such that the design basis CPR (change in the critical power ratio) for rod withdrawal errors initiated from the technical specification operating limit and mitigated by the RWL system provides a 95 percent probability at the 95 percent confidence level that any randomly occurring RWE does not result in a larger CPR. MCPR was verified to be the limiting thermal performance parameter and therefore was used to establish the allowable withdrawal increments. The 1 percent plastic strain
limit on the clad was always a less limiting parameter.
15.4.2.3.3 Results
The calculated results demonstrate that, should a rod or gang be withdrawn a distance equal to the allowable rod withdrawal increments, there exists a 95 percent probability at the 95 percent confidence level that the resultant CPR is not greater than the design basis CPR. Furthermore, the peak LHGR is substantially less than that calculated to yield 1 percent plastic strain for the fuel clad. 15The results of the generic analyses in Reference 3 show that a control rod or gang can be withdrawn in increments of 12 in at power levels above 70 percent of rated, and 24 in at power levels ranging from 10-70 percent. See Section 15.4.1.2 for RWEs below 20 percent reactor power. The 10 percent and 70 percent reactor core power levels correspond to the low power set point (LPSP)
and high power set point (HPSP) of the RWL.
1515.4.2.3.4 Consideration of Uncertainties The most significant area of uncertainty for this transient is the initial control rod pattern and the location of the rod or gang improperly selected and withdrawn. Because of the large number of combinations of control patterns and reactor states, all possible states cannot be analyzed. However, enough states have been evaluated so as to clearly establish the 95 percent probability/95 percent confidence level. Only high worth gangs were included in the statistical analysis, therefore, this effectively bounds the results from any actual operator error of
this type with the indicated probabilities.
RBS USAR 15.4-8 August 1987 15.4.2.4 Barrier Performance An evaluation of the barrier performance was not made for this event since this is a localized event with very little change in the gross core characteristics. Typically, an increase in total
core power for RWEs initiated from rated conditions is less than
4 percent and the changes in pressure are negligible.
15.4.2.5 Radiological Consequences
An evaluation of the radiological consequences was not made for this event since no radioactive material is released from the
fuel.15.4.3 Control Rod Maloperation (System Malfunction or Operator Error)This event is covered with evaluation cited in Sections 15.4.1 and 15.4.2.
15.4.4 Abnormal Startup of Idle Recirculation Pump 15.4.4.1 Identification of Causes and Frequency Classification
15.4.4.1.1 Identification of Causes This action results directly from the operator's manual action to initiate pump operation. It assumes that the remaining loop is
already operating.
15.4.4.1.1.1 Normal Restart of Recirculation Pump at Power
This transient is categorized as an incident of moderate frequency.
15.4.4.1.1.2 Abnormal Startup of Idle Recirculation Pump
This transient is categorized as an incident of moderate frequency.
15.4.4.2 Sequence of Events and Systems Operation
15.4.4.2.1 Sequence of Events
Table 15.4-2 lists the sequence of events for Fig. 15.4-1.
RBS USAR Revision 17 15.4-9 The normal sequence of operator actions expected in starting the idle loop is as follows. The operator should: 1. Adjust rod pattern as necessary for new power level following idle loop start. 2. Determine that the idle recirculation pump suction and discharge block valves are open and that the flow control
valve in the idle loop is at minimum position, and, if
not, place them in this configuration. 3. Readjust flow of the running loop downward to less than half the rated flow. 4. Determine that the temperature difference between the two loops is no more than 50°F apart. 5. Start the idle loop pump and adjust flow to match the adjacent loop flow. Monitor reactor power. 6. Readjust power, as necessary, to satisfy plant requirements according to standard procedure.
15.4.4.2.2 Systems Operation This event assumes and takes credit for normal functioning of plant instrumentation and controls. No protection systems action is anticipated. No ESF action occurs as a result of the
transient.12 15.4.4.2.3 The Effect of Single Failures and Operator Errors 12Attempts by the operator to start the pump at higher power levels results in a reactor scram on flux. See Appendix 15A for
details.15.4.4.3 Core and System Performance
15.4.4.3.1 Mathematical Model
The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this event.
15.4.4.3.2 Input Parameters and Initial Conditions 131 This analysis has been performed unless otherwise noted with plant conditions tabulated in Table 15.
0-2. The original analysis was based on the assumption that one recirculation loop
is idle and filled with cold water (100°F). (Normal procedure
when starting an idle loop with one pump already running requires
that the indicated idle loop temperature be no more than 50°F
lower than the indicated active loop temperature.) Subsequent GE generic analysis (Supplement 1 to SIL 517) assumed a T of 50°F between the active loop and the idle loop.
1 13 RBS USAR Revision 17 15.4-10 The active recirculation loop is operating with the flow control valve position that produces about 85 percent of normal rated jet
pump diffuser flow in the active jet pumps. The core is receiving 34 percent of its normal rated flow. The remainder of the coolant flows in the reverse direction through the inactive jet pumps. Reactor power is 55 percent original NBR.The idle recirculation pump suction and discharge block valves are open and the recirculation flow control valve is closed to its minimum open position. (Normal procedure requires leaving an idle loop in this condition to maintain the loop temperature
within the required limits for restart.)
15.4.4.3.3 Results
The transient response to the incorrect startup of a cold, idle recirculation loop is shown on Fig. 15.4-1. Shortly after the pump begins to move, a surge in flow from the started jet pump diffusers causes the core inlet flow to rise sharply. The motor approaches synchronous speed in approximately 3 sec because of
the assumed minimum pump and motor inertia.
A short-duration neutron flux peak to just below the scram set point is produced as the colder, increasing core flow reduces the
void volume. Surface heat flux follows the slower response of the fuel and peaks at 89 percent of original rated before decreasing after the cold water washed out of the loop at about 22 sec. No damage occurs to the fuel barrier and MCPR remains above the safety limit as the reactor settles out at its new
steady-state condition.
15.4.4.3.4 Consideration of Uncertainties This particular transient is analyzed for an initial power level that is much higher than that expected for the actual event. The
much slower thermal response of the fuel mitigates the effects of the rather sharp neutron flux spike and even in this high range
of power, no threat to thermal limits is possible.
15.4.4.4 Barrier Performance
No evaluation of barrier performance is required for this event since no significant pressure increases are incurred during this
transient (Fig. 15.4-1).
RBS USAR Revision 21 15.4-11 15.4.4.5 Radiological Consequences An evaluation of the radiological consequences is not requiredfor this event since no radioactive material is released from
the fuel.15.4.5 Recirculation Flow Control Failure with Increasing Flow15Core flow increases resulting from recirculation controlfailures can be due to either fast or slow opening of the
recirculation valves. Analyses performed for the initial reloadcycle, as described in the following sections, showed that the fast opening of one or both recirculation valves is a relatively mild transient. The current reload licensing analysis includes an evaluation of the slow opening of both recirculation valves
to determine appropriate flow dependent thermal limits using the
approved analysis methods. The results are described in Appendix 15B.
1515.4.5.1 Identification of Causes and Frequency Classification 15.4.5.1.1 Identification of Causes
Failure of the master controller or neutron flux controller cancause an increase in the core coolant flow rate. Failure within a loop's flow controller can also cause an increase in core
coolant flow rate.
15.4.5.1.2 Frequency Classification
This transient disturbance is classified as an incident of moderate frequency.
15.4.5.2 Sequence of Events and Systems Operation
15.4.5.2.1 Sequence of Events
15.4.5.2.1.1 Fast Opening of One Recirculation Valve
Table 15.4-3 lists the sequence of events for Fig. 15.4-2.
15.4.5.2.1.2 Fast Opening of Two Recirculation Valves
Table 15.4-4 lists the sequence of events for Figure 15.4-3.
RBS USAR 15.4-12 August 1987 15.4.5.2.1.3 Identification of Operator Actions Initial action by the operator should include: 1. Transfer flow control to manual and reduce flow to minimum.2. Identify cause of failure.
Reactor pressure is controlled as required, depending on whether a restart or cooldown is planned. In general, the corrective
action would be to hold reactor pressure and condenser vacuum for restart after the malfunctioning flow controller has been repaired. The following is the sequence of operator actions
expected during the course of the event, assuming restart. The
operator should: 1. Observe that all rods are in. 2. Check the reactor water level and maintain above low-low low level (L1) trip to prevent MSIVs from isolating. 3. Switch the reactor mode switch to the startup position.
- 4. Continue to maintain vacuum and turbine seals.
- 5. Transfer the recirculation flow controller to the manual position and reduce set point to zero. 6. Survey maintenance requirements and complete the scram report.7. Monitor the turbine coastdown and auxiliary
- 8. Establish a restart of the reactor according to the normal procedure. 15.4.5.2.2 Systems Operation The analysis of this transient assumes and takes credit for normal functioning of plant instrumentation and controls, and the
RPS. Operation of engineered safeguards is not expected. 15.4.5.2.3 The Effect of Single Failures and Operator Errors
Both these transients lead to a quick rise in reactor power level. Corrective action first occurs in the high flux trip
which, being part of the RPS, is designed to single failure criteria. (See Appendix 15A for details.) Therefore, shutdown is assured. Operator errors are not of concern here in view of the
fact that automatic shutdown events follow so quickly after the
postulated failure.
RBS USAR Revision 17 15.4-13 15.4.5.3 Core and System Performance 15.4.5.3.1 Mathematical Model
The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this event. 15.4.5.3.2 Input Parameters and Initial Conditions
These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2. In each of these transient events the most severe transient results when initial conditions are established for operation at
the low end of the rated flow control rod line. Specifically, this is 56 percent originalNBR power and 37 percent core flow.
The maximum stroking rate of the recirculation loop valves for a master controller failure driving two loops is limited by individual loop controls to 11 percent per sec; however, a
conservative value of 13 percent per sec is used in the analysis.
Maximum stroking rate of a single recirculation loop valve for a loop controller failure is limited by hydraulics to 30 percent
per sec; this conservative value is used in the analysis.
15.4.5.3.3 Results 15.4.5.3.3.1 Fast Opening of One Recirculation Valve Figure 15.4-2 shows the analysis of a failure where one recirculation loop main valve is opened at its maximum stroking
rate of 30 percent per sec. The rapid increase in core flow causes a sharp rise in neutron flux initiating a reactor scram at approximately 0.97 sec. The peak neutron flux reached was 472 percent of original NBR value, while the accompanying average fuel surface heat flux reaches 84 percent of originalNBR at approximately 1.8 sec. MCPR remains above the safety limit and fuel center temperature increases only
425°F. Reactor pressure is discussed in Section 15.4.5.4.
15.4.5.3.3.2 Fast Opening of Two Recirculation Valves Figure 15.4-3 illustrates the failure where both recirculation loop main valves are opened at a maximum stroking rate of 13 percent per sec. It is very similar to the above transient.
Flux scram occurs at approximately 1.0 sec, peaking at 355 percent of NBR while the average surface heat flux reaches 79 percent of NBR at approximately 1.9 sec. MCPR remains above
the safety limit, and fuel center temperature increases 351°F.
RBS USAR Revision 21 15.4-14As indicated above, this is the most severe set of conditionsunder which this transient may occur. The results expected from an actual occurrence of this transient are less severe than
those calculated.
15.4.5.3.4 Considerations of Uncertainties
Some uncertainties in void reactivity characteristics, scramtime, and worth are expected to be more optimistic and therefore lead to reducing the actual severity over that which is
simulated herein.
15.4.5.4 Barrier Performance
15.4.5.4.1 Fast Opening of One Recirculation Valve This transient results in a very slight increase in reactor vessel pressure as shown on Fig. 15.4-2 and therefore represents
no threat to the RCPB.
15.4.5.4.2 Fast Opening of Two Recirculation Valves This transient results in a very slight increase in reactor vessel pressure as shown on Fig. 15.4-3 and therefore represents
no threat to the RCPB.15.4.5.5 Radiological ConsequencesAn evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel.15.4.6 Chemical and Volume Control System Malfunctions
Not applicable to BWRs. This is a PWR event.1315.4.7Misplaced Bundle Accident 15Theanalysismethods and resultsfor the currentcycle are d iscussedin Appendix 15B. This subsection below describes the analysis and results performed prior to Cycle 11.
1515.4.7.1 Identification of Causes and Frequency Classification 13 RBS USAR Revision 13 15.4-15 September 2000 1315.4.7.1.1 Identification of Causes The event discussed in this section is the improper loading of a fuel bundle and subsequent operation of the core. Two types of loading errors are possible, the mislocation of an assembly and the
misorientation (rotation) of the assembly. Three errors must occur for this event to take place. First, a bundle must be misloaded into a wrong location in the core. Second, the bundle which was supposed to be loaded where the mislocation occurred would have to be overlooked and also put in an incorrect location. Third, the misplaced bundles would have to be overlooked during the core verification performed following initial core
loading.For the misoriented event, two things must take place. First, the assembly must be rotated while being lowered into position. Second, the misoriented bundle would have to be overlooked during the core
verification performed following the core loading. 15.4.7.1.2 Frequency of Occurrence
This event occurs either when a fuel bundle is loaded into the wrong location in the core or when the orientation with respect to the control blade corner is misaligned while being loaded. It is assumed the bundle is misplaced to the worst possible location, and the plant is operated with the misplaced bundle. This event is
categorized as an infrequent incident based on the following data.
Expected Frequency: 0.004 events/operating cycle The above number is based upon past experience.
1315.4.7.2 Sequence of Events and Systems Operation The postulated sequence of events for the misplaced bundle accident (MBA) is presented in Table 15.4-5. Fuel loading
errors, undetected by in-core instrumentation following fueling operations, may result in undetected reductions in thermal margins during power operations. No detection is assumed, therefore, no corrective operator action or automatic protection
system functioning occurs. This analysis represents the worst case (i.e., operation of a misplaced bundle with three SEF or SOE). 15.4.7.3 Core and System Performance 15.4.7.3.1 Mathematical Model A three-dimensional BWR simulator model is used to calculate the core performance resulting from this event. This model is
described in detail in Reference 2.
RBS USAR Revision 13 15.4-16 September 2000 15.4.7.3.2Input Parameters and Initial Conditions The initial core consists of five bundle types with average enrichments in the range of high, medium, and low with correspondingly different gadolinia concentrations. The fuel bundle loading error involves interchanging a bundle of one enrichment range with another bundle of a different enrichment
range.8The fuel bundle loading error with greatest impact on thermal margin occurs when a high-enrichment bundle is interchanged with
a medium-enrichment bundle located away from an LPRM. Since the medium- and high-enrichment bundles have corresponding medium and high gadolinia contents, the maximum reactivity difference occurs at the EOC when the gadolinia has burned out. If the loading errors were made and have gone undetected, the operator would
assume that the mislocated bundle would operate at the same power as the instrumented bundle in the mirror-image location and would operate the plant until EOC. For the purpose of conservatism, it
is assumed that the mirror-image bundle is on thermal limits as
recorded by the LPRM. 13For the reload core, a very conservative assessment for the misplaced bundle accident (mislocated and misoriented) was
performed. It is assumed that the misplaced bundle is not
monitored and that it operates through the cycle with the fuel rods above the thermal-mechanical limit. The potential exists that one or more fuel rods will experience cladding failure. If
this were to occur, the adverse consequences are detectable and
can be suppressed during operation similar to leaking fuel rods
resulting from the other failure mechanisms. For the misplaced bundle, the initial adverse consequences would consist of perforation of a small number of fuel rods in the assembly. Any perforations fuel cladding that may occur would be localized and
not propagate to other assemblies.
13A summary of input parameters for the initial core is given in Table 15.4-6. Subsequent fuel loading errors analyses for the
reload core are summarized in Appendix 15B.
815.4.7.3.3 Results Results of analyzing the worst fuel bundle loading error are reported in Table 15.4-7. As can be seen, MCPR remains well above the point where boiling transition would be expected to occur, and the MLHGR does not exceed the 1 percent plastic strain
limit for the clad. Therefore, no violation of fuel design
limits occurs as a result of this event.
RBS USAR Revision 21 15.4-171513 13 1515.4.7.3.4 Considerations of Uncertainties13In order to assure the conservatism of this analysis for bundlemislocation, the worst case bundle is misloaded into its most
limiting location and the CPR is conservatively estimated by ensuring the initial MCPR remains at or above the operating limit. Additionally, LPRM readings that are used in the core monitoring system's thermal limit calculations (that would partially correct for changes in the power distribution due to the mislocated bundle) are not credited in the analysis. For the misoriented bundle, the worst case occurs when the highestpowered (least MCPR margin) bundle is rotated 180 with respectto the control blade. Again, no LPRM readings which could correct for changes in power distributions are credited.
1315.4.7.4 Barrier PerformanceAn evaluation of the barrier performance was not made for thisevent since it is a very mild and highly localized event. No
perceptible change in the core pressure would be observed.15.4.7.5 Radiological Consequences
An evaluation of the radiological consequences is not requiredfor this event since no radioactive material is released from
the fuel.15.4.8 Spectrum of Rod Ejection Assemblies
Not applicable to BWRs. This is a PWR event.
The BWR has precluded this event by incorporating into itsdesign mechanical equipment which restricts any movement of the CRD system assemblies. The CRD housing support assemblies are
described in Chapter 4.15.4.9 Control Rod Drop Accident (CRDA)15The control rod drop accident is analyzed for the current cycle.
The results are presented in Appendix 15B.15 RBS USAR Revision 13 15.4-18 September 2000 15.4.9.1 Identification of Causes and Frequency Classification 15.4.9.1.1 Identification of Causes 13 The CRDA is the result of a postulated event in which a high worth control rod, within the constraints of the banked position RCIS, drops from the fully inserted position in the core. The
high worth rod becomes decoupled from its drive mechanism. The mechanism is fully withdrawn but the decoupled control rod is assumed to be stuck in place. At a later moment, the control rod suddenly falls free and drops to the CRD position. This results
in the removal of large negative reactivity from the core and results in a localized power excursion. A more detailed
discussion is given in Reference 4.
1315.4.9.1.2 Frequency of Classification The CRDA is categorized as a limiting fault because it is not expected to occur during the lifetime of the plant; but if postulated to occur, it has consequences that include the
potential for the release of radioactive material from the fuel. 15.4.9.2 Sequence of Events and System Operation 15.4.9.2.1 Sequence of Events
Before the CRDA is possible, the sequence of events presented in Table 15.4-8 must occur. No operator actions are required to
terminate this transient. 15.4.9.2.2 Systems Operation The unlikely set of circumstances referenced above makes possible the rapid removal of a control rod. The dropping of the rod results in high reactivity in a small region of the core. For large, loosely coupled cores, this would result in a highly peaked power distribution and subsequent operation of shutdown mechanisms. Significant shifts in the spatial power generation
would occur during the course of the excursion. The RCIS limits the worth of any control rod which could be dropped by regulating the withdrawal sequence. This system
prevents the movement of an out-of-sequence rod in the 100 to 75 percent rod density range, and from the 75 percent rod density
point to the preset power level the RCIS only allows bank position mode rod withdrawals or insertions. The banked position mode of this system is described in Reference 1 for a typical
BWR.
RBS USAR 15.4-19 August 1987 The RCIS uses redundant input to provide absolute assurance on CRD position. If either of the diverse inputs were to fail the other would provide the necessary information. The termination of this excursion is accomplished by automatic safety features of inherent shutdown mechanisms. Therefore, no operator action during the excursion is required. Although other normal plant instrumentation and controls are assumed to function, no credit
for their operation is taken in the analysis of this event. 15.4.9.2.3 Effect of Single Failures and Operator Errors Systems mitigating the consequences of this event are RCIS and APRM scram. The RCIS is designed as a redundant system network
and therefore provides single failure protection. The APRM scram system is designed to single failure criteria. Therefore, termination of this transient within the limiting results
discussed below is assured.
No operator error (in addition to the one that initiates this event) can result in a more limiting case since the RPS
automatically terminates the transient.
Appendix 15A provides a detailed discussion on this subject.
15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model The analytical methods, assumptions, and conditions for evaluating the excursion aspects of the CRDA are described in detail in References 4, 5, and 6. They are considered to provide a realistic yet conservative assessment of the associated consequences. The data presented in Reference 1 shows that the
RCIS banked position mode reduces the control rod worths to the degree that the detailed analyses presented in References 4, 5, and 6 or the bounding analyses presented in Reference 7 are not necessary. References 1, 4, 5, and 6 provide sensitivity studies
indicating large margins in peak enthalpy for rod worths below 1 percent k. Since this margin is sufficiently large that changes in Doppler coefficients, scram curves, reactivity insertion shape, etc, will not significantly reduce this margin, no unique bounding analysis is needed. Compliance checks are instead made to verify that the maximum rod worth does not exceed 1 percent k. If this criterion is not met, then the bounding analysis is performed. The rod worths are determined using the BWR simulator
model (2). Detailed evaluations, if necessary, are made using the methods described in References 4, 5, and 6.
RBS USAR Revision 17 15.4-20 15.4.9.3.2 Input Parameters and Initial Conditions The core at the time of CRDA is assumed to be at the point in cycle which results in the highest incremental rod worth, to contain no xenon, to be in a hot-startup condition, and to have
the control rods at 50 percent rod density (groups 1-4
withdrawn). Removing xenon, which competes well for neutron absorptions, increases the fractional absorptions, or worth, of the control rods. The 50 percent control rod density ("black and white" rod pattern), which nominally occurs at the hot-startup condition, ensures that withdrawal of a rod results in the
maximum increment of reactivity.
Since the maximum incremental rod worth is maintained at very low values, the postulated CRDA cannot result in peak enthalpies in excess of 280 calories per gram for any plant condition. The data presented in Section 15.4.9.3.3 show the maximum control rod
worth. Other input parameters and initial conditions are shown
in Table 15.4-9.
15.4.9.3.3 Results 1514The radiological evaluations are based on the assumed failure of 850 fuel rods of the initial fuel type (8x8) which is equivalent to 13 bundles of all fuel types in the current core. The number of rods which exceed the damage threshold is less than 850 for all plant operating conditions or core exposure, provided the peak enthalpy is less than the 280 cal/gm design limit. The
results of the compliance check calculation, as shown in Table 15.4-10, indicate that the maximum incremental rod worth is well below the worth required to cause a CRDA which would result in 280 cal/gm peak fuel enthalpy (References 4, 5, and 6). The conclusion is that the 280 cal/gm design limit is not exceeded and the assumed failure of the equivalent of GE8x8 of 850 pins
for the radiological evaluation is conservative.
14 1515.4.9.4 Barrier Performance An evaluation of the barrier performance was not made for this accident since this is a highly localized event with no
significant change in the gross core temperature or pressure. 15.4.9.5 Radiological Consequences The plant design basis Control Rod Drop Accident (CRDA) is a postulated event in which a high worth control rod drops from its fully inserted or intermediate position in the core. The removal of large negative reactivity from the core, results in a localized power excursion. For the CRDA accident scenario GE8 fuel was found to be bounding. Based on conservative and limiting assumptions consistent with USNRC Regulatory Guide 1.183, the RBS postulated CRDA at fu1l power results in a total of 850 GE8 fuel rods damaged.
RBS USAR Revision 22 15.4-21 Specific parametric values used in the evaluation are presented in Table 15.4-11 and 15.4-11B. These inputs are consistent with
the requirements of RG 1.183.
15.4.9.5.1 Fission Product Release from Fuel 15 14 The failure of 850 fuel rods of the initial fuel type (8x8) which is equivalent to 13 bundles of all fuel types in the current core is used for this analysis. The mass fraction of the fuel in the
damaged rods which reaches or exceeds the initiation temperature of fuel melting (taken as 2804°C) is estimated to be 0.0077.
Fuel reaching melt conditions is assumed to release 100 percent of the noble gas inventory and 50 percent of the iodine
inventory.
15 A maximum equilibrium inventory of fission products in the core is based on 3.2 yr of continuous operation at 3,100 MWT. No
delay time is considered between departure from the above power
condition and the initiation of the accident.
14 15.4.9.5.2 Fission Product Transport to the Environment 8 The postulated accident activity is released at ground level from the plant condenser and dispersed to offsite and control room
receptors according to plant specific atmospheric dispersion factors. These plant specific offsite dispersion factors were determined in accordance with Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," and NUREG/CR-2858, "PAVAN:
An Atmospheric Dispersion Program for Evaluating Design Basis
Accident Releases of Radioactive Materials from Nuclear Power
Stations" (PAVAN) guidance. The plant specific control room dispersion factors were determined in accordance with Draft
Regulatory Guide DG-1111, "Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear
Power Plants," and NUREG/CR-6331, "Atmospheric Relative
Concentrations in Building Wakes" (ARCON96) guidance. 8 The cumulative release of activity to the environment is presented in Table 15.4-12.
15.4.9.5.3 Results
The radiological consequences for the postulated RBS CRDA events
are summarized in Table 15.4-13.
15.4.9.5.4 Main Control Room
Data used for calculation of main control room doses are listed in Table 15.4-11. The control room doses are listed in Table 15.4-13. The Full Power and Low Power CRDA events result in offsite and control room doses within the regulatory limits of 10CFR50.67. No exceptions to Regulatory Guide 1.183 guidance were taken.
RBS USAR Revision 22 15.4-22 References - 15.4 7 1. Paone, C.J. Banked Position Withdrawal Sequence. January 1977 (NEDO-21231).
7 2. NEDE-30130-P-A, Steady-State Methods, April 1985.
- 3. Klapproth, J.F., BWR/6 Generic Rod Withdrawal/Error Analysis.
March 1980 (Appendix 15B, GESSAR II).
- 4. Stirn, R.C., et al. Rod Drop Accident Analysis for Large BWRs. March 1972 (NEDO-10527).
- 5. Stirn, R.C., et al. Rod Drop Accident Analysis for Large BWRs. July 1972 Supplement 1 (NEDO-10527).
- 6. Stirn, R.C., et al. Rod Drop Accident Analysis for Large BWRs. January 1973 Supplement 2 (NEDO-10527).
- 7. GE BWR Generic Reload Application for 8x 8 Fuel. September 1975 Supplement 3 to Revision 1 (NEDO-20360). 2 8. USNRC Standard Review Plan, NUREG-0800, Washington, DC, July 1981. 2 RBSUSAR 15.5-1August198715.5INCREASEINREACTORCOOLANTINVENTORY15.5.1InadvertentHPCSStartup 15.5.1.1IdentificationofCausesandFrequency Classification15.5.1.1.1IdentificationofCauses ManualstartupoftheHPCSsystemispostulatedforthisanalysis,i.e.,operatorerror.15.5.1.1.2FrequencyClassification Thistransientdisturbanceiscategorizedasanincidentofmoderate frequency.15.5.1.2SequenceofEventsandSystemsOperation 15.5.1.2.1SequenceofEvents Table15.5-1liststhesequenceofeventsforFig.15.5-1.
Withtherecirculationsystemineithertheautomaticormanualmode,relativelysmallchangeswouldbeexperiencedinplantconditions.The operatorshould,afterhearingthealarmthattheHPCShascommenced operation,checkreactorwaterlevelanddrywellpressure.If conditionsarenormal,theoperatorshouldshutdownthesystem.15.5.1.2.2SystemOperation Inordert oproperlysimulatetheexpectedsequenceofeventstheanalysisofthiseventassumesnormalfu nctioningofplantinstrumentationandcontrols,specifically,thepressureregulatorandthevessellevelcontrolwhichresponddirectlytothisevent.Requiredoperationofengineeredsafeguardsotherthanwhatisdescribedisnotexpectedfort histransientevent.Thesystemisassumedtobeinthemanualflowcontrolmodeofoperation.15.5.1.2.3TheEffecto fSingleFailuresandOperatorErrorsInadvertentoperationoftheHPCSresultsinamilddepressurization.Correctiveactionbythepressureregulatorand/orlevelcontrolis expectedtoestablishanewstableoperatingstate.Theeffectofa singlefailure RBS USAR (1) Actual HPCS flow rate may be greater. However, this would remain a very mild transient and increased HPCS flow would not significantly change the results of this event.
Revision 20 15.5-2in the pressure regulator aggravates the transient depending upon the nature of the failure. Pressure regulator failures are
discussed in Sections 15.1.3 and 15.2.1. The effect of a single failure in the level control system has rather straightforward consequences including level rise or fall by improper control of the feedwater system. Increasing level trips the turbine and automatically trips the HPCS system off. This trip signature is already described in the failure of feedwater controller with increasing flow. Decreasing level automatically
initiates a scram at the L3 level trip and has a signature similar
to loss of feedwater control - decreasing flow.
15.5.1.3 Core and System Performance
15.5.1.3.1 Mathematical Model
The detailed nonlinear dynamic model described briefly in Subsection 15.2.2.3.1 is used to simulate this transient.
15.5.1.3.2 Input Parameter and Initial Conditions This analysis has been performed unless otherwise noted with plant conditions tabulated in Table 15.0-2. The water temperature of the
HPCS system was assumed to be 40°F with an enthalpy of 11 Btu/lb.
Inadvertent startup of the HPCS system was chosen to be analyzed since it provides the greatest auxiliary source of cold water into
the vessel.
15.5.1.3.3 Results
Fig. 15.5-1 shows the simulated transient event for the manual flow control mode. It begins with the introduction of cold water into the upper core plenum. Within 3 sec the full HPCS flow is established at approximately 7.8 percent of the rated feedwater flow
rate. This flow is nearly 138 percent of the HPCS flow at rated pressure.(1) No delays were considered because they are not relevant to the analysis. Addition of cooler water to the upper plenum causes a reduction in steam flow which results in some depresssurization as the pressure
regulator responds to the event. In the automatic flow control
mode, following a momentary decrease, neutron power settles out at a
level slightly above operating level. In manual mode, the flux
level settles out slightly below operating level. In either case, pressure and thermal variations are relatively small RBSUSAR 15.5-3August1987andnosignificantconsequencesareexperienced.MCPRremainsabovethesafetylimitandthereforefuelthermalmarginsaremaintained.Importantanalyticalfactorsincludingreactivitycoefficientandfeedwatertemperaturechangehavebeenassumedtobeattheworst conditionssothatanydeviationsintheactualplantparameters producealessseveretransient.15.5.1.4BarrierPerformance Fig.15.5-1indicatesaslightpressurereductionfrominitialconditions,therefore,nofurtherevaluationisrequiredasRCPB pressuremarginsaremaintained.15.5.1.5RadiologicalConsequences Sincenoactivityisreleasedduringthisevent,adetailedevaluationisnotrequired.15.5.2ChemicalVolumeControlSystemMalfunction(orOperatorError)ThissectionisnotapplicabletoBWR.ThisisofPWRinterest.
15.5.3BWRTransientsWhichIncreaseReactorCoolant InventoryTheseeventsarediscussedandconsideredinSections15.1and15.2.
RBS USAR 15.6-1 August 1987 15.6 DECREASE IN REACTOR COOLANT INVENTORY 15.6.1 Inadvertent Safety Relief Valve Opening
This event is discussed and analyzed in Section 15.1.4.
15.6.2 Instrument Line Pipe Break
This section is not applicable since RBS plant design does not have instrument lines containing primary coolant outside the
containment.
15.6.3 Steam Generator Tube Failure This section is not applicable to the direct cycle BWR. This is a PWR-related event.
15.6.4 Steam System Piping Break Outside Containment
This event involves the postulation of a large steam line pipe break outside containment. It is assumed that the largest steam line instantaneously and circumferentially breaks at a location downstream of the outermost isolation valve. The plant is designed to detect immediately such an occurrence, initiate isolation of the broken line, and actuate the necessary protective features. This postulated event represents the
envelope evaluation of steam line failures outside containment.
15.6.4.1 Identification of Causes and Frequency Classification
15.6.4.1.1 Identification of Causes
A main steam line break is postulated without the cause being identified. These lines are designed to high-quality engineering codes and standards, and to restrictive seismic and environmental requirements. However, for the purpose of evaluating the consequences of a postulated large steam line rupture, the
failure of a main steam line is assumed to occur.
15.6.4.1.2 Frequency Classification
This event is categorized as a limiting fault.
RBS USAR Revision 12 15.6-2 December 1999 15.6.4.2 Sequence of Events and Systems Operation 15.6.4.2.1 Sequence of Events Accidents that result in the release of radioactive materials directly outside the containment are the results of postulated breaches in the RCPB or the steam power conversion system
boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault event for
breaks outside the containment is a complete severance of one of
the four main steam lines. The sequence of events and
approximate time required to reach the event is given in Table
15.6-1.10Normally the reactor operator maintains reactor vessel water inventory and, therefore, core cooling with the RCIC system.
Without operator action, the RCIC would initiate automatically on
low water level (L2) following isolation of the main steam supply
system (i.e., MSIV closure) and the ADS would initiate on low water level (L1) and on the bypass timer timed out as shown in
Table 15.6-1. The core would be covered throughout the accident and there would be no fuel damage. Without taking credit for the RCIC water makeup capability and assuming HPCS failure, the
operator should initiate the ADS or manual relief valve system to
ensure termination of the accident without fuel damage.
1015.6.4.2.2 Systems Operation A postulated guillotine break of one of the four main steam lines outside the containment results in mass loss from both ends of the break. The flow from the upstream side is initially limited by the flow restrictor upstream of the inboard isolation valve.
Flow from the downstream side is initially limited by the total area of the flow restrictors in the three unbroken lines.
Subsequent closure of the MSIVs further limits the flow when the valve area becomes less than the limiter area and finally
terminates the mass loss when the full closure is reached.A discussion of plant and reactor protection system action and ESF action is given in Sections 6.3, 7.3, and 7.6.
15.6.4.2.3 The Effect of Single Failures and Operator Errors 12The effect of single failures SEF (Single Equipment Failure) and SOE (Single Operator Error) have been considered in analyzing this event. The ECCS aspects are covered in Section 6.3. The break detection and isolation considerations are defined in
Sections 7.3 and 7.6. Refer to Appendix 15A for further details.
12 RBS USAR Revision 12 15.6-3 December 1999 12 1215.6.4.3 Core and System Performance Quantitative results (including math models, input parameters, and consideration of uncertainties) for this event are given in Section 6.3. The temperature and pressure transients resulting
as a consequence of this accident are insufficient to cause fuel
damage.15.6.4.3.1 Input Parameters and Initial Conditions
Refer to Section 6.3 for initial conditions.
15.6.4.3.2 Results
There is no fuel damage as a consequence of this accident.
Refer to Section 6.3 for ECCS analysis.
15.6.4.3.3 Considerations of Uncertainties Sections 6.3 and 7.3 contain discussions of the uncertainties associated with the ECCS performance and the containment
isolation systems, respectively.
15.6.4.4 Barrier Performance Since this break occurs outside the containment, barrier performance within the containment envelope is not applicable.
Details of the results of this event can be found in Section
6.2.3.The following assumptions and conditions are used in determining the mass loss from the primary system from the inception of the
break to full closure of the MSIVs: 1. The reactor is operating at the power level associated with maximum mass release.2. Nuclear system pressure is 1,060 psia and remains constant during closure.3. An instantaneous circumferential break of the main steam line occurs.4. Isolation valves start to close at 0.5 sec on high flow signal and are fully closed at 5.5 sec. 5. The Moody critical flow model is applicable (1).6. Level rise time is conservatively assumed to be 1 sec. Mixture quality is conservatively taken to be a constant
7 percent (steam weight percentage) during mixture flow.
RBS USAR Revision 17 15.6-4 Initially only steam will issue from the broken end of the steam line. The flow in each line is limited by critical flow at the
limiter as described in Section 5.4.4 "Main Steam Line Flow Restrictors." Rapid depressurization of theRPVcausesthewater level to rise resulting in a steam-water mixture flowing from the break until the valves are closed. The total integrated mass
leaving the RPV through the steam line break is 80,562 lb of
which 68,942 lb is liquid and 11,620 lb is steam.
15.6.4.5 Radiological Consequences The radiological analysis is based on the acceptance criteria of 10CFR50.67. This analysis is referred to as the "design basis analysis."The design basis analysis is based on NRC Standard Review Plan (2)15.0.1 and Regulatory Guide 1.183. Specific values of parameters used in the evaluation are presented in Table 15.6-2.
15.6.4.5.1 Fission Product Release from Fuel
No credit was taken for the Control Room ESF charcoal filter trains. No fuel damage is predicted and thus the postulated release halogen activity is based on the maximum coolant activity allowed by Technical Specifications as required by USNRC Regulatory Guide 1.183, Appendix D. The noble gas activity is based on an offgas release rate of 310,000 uCi/sec. (after 30 minutes decay) which conservatively bounds the 290 mCi/sec. allowed per Technical Specifications. The alkali metals design basis coolant concentrations were also increased by 2% to account for uncertainties in the core thermal power level. The analysis conservatively assumed that 100% of the halogen and alkali metal activity present in the released coolant was transported to the environment.
The postulated accident activity is released as a "ground level release" from the Main Steam Tunnel (MST) blowout panel and dispersed to offsite and control room receptors according to plant specific atmospheric dispersion factors. These plant specific offsite dispersion factors were determined in accordance with Regulatory Guide 1.145, "Atmospheric 'Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," and NUREG/CR-2858, "PAVAN: An Atmospheric Dispersion Program for Evaluating Design Basis Accident Releasesof Radioactive Materials from Power Stations" (PAVAN) guidance.
The plant specific control room dispersion factors were determined in accordance with Draft Regulatory Guide DG-1111, "Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear Power Plants,"
and NUREG/CR-6331, "Atmospheric Relative Concentrations in Building Wakes" (ARCON96) guidance.
RBS USAR Revision 17 15.6-5 Consistent with RG 1.183, Appendix D, Offsite and Control room doses are estimated for two MSLB events: 1. Primary coolant iodine concentration corresponding to art assumed maximum pre-accident spike of 4 Ci/gm dose equivalent I-131 per plant Technical Specifications. 2. Primary coolant iodine concentration corresponding to the Technical Specifications' maximum equilibrium value of 0.2Ci/gm dose equivalent 1-131.
The radiological consequences of the event are evaluated against the acceptance criteria of 10CFR50.67. 3 315.6.4.5.2 Fission Product Transport to the Environment 11The transport pathway is a direct unfiltered release to the environment. The MSIV detection and closure time of 5.5 sec results in a discharge of 11,620 lb of steam and 68,942 lb of liquid from the break. The release of activity to the environment is presented in Table 15.6-3.
1115.6.4.5.3 Results The radiological consequences for the postulated MSLB events are summarized in Table 15.6-4. The MSLB events result in offsite and control room dose within the regulatory limits of 10CFR50.67. 15.6.5 Loss-of-Coolant Accidents, LOCA, (Resulting from Spectrum of Postulated Piping Breaks Within the Reactor Coolant Pressure Boundary) - Inside Containment This event involves the postulation of a spectrum of piping breaks inside containment varying in size, type, and location.
The break type includes steam and/or liquid process system lines.
This event is also assumed to be coincident with a safe shutdown
earthquake (SSE). The event has been analyzed quantitatively in Sections 6.2, 6.3, 7.1, 7.3, and 8.3. Therefore, the following discussion provides
only new information not presented in the subject sections. All
other information is covered by cross-referencing. The postulated event represents the envelope evaluation for liquid or steam line failures inside containment.
RBS USAR 15.6-6 August 1987 15.6.5.1 Identification of Causes and Frequency Classification 15.6.5.1.1 Identification of Causes There are no realistic, identifiable events which would result in a pipe break inside the containment of the magnitude required to cause a accident LOCA coincident with SSE plus SACF criteria
requirements. The subject piping is designed to high quality and strict industry code and standard criteria, and for severe seismic and environmental conditions. However, since such an accident provides an upper limit estimate to the resultant
effects for this category of pipe breaks, it is evaluated without
the causes being identified.
15.6.5.1.2 Frequency Classification
This event is categorized as a limiting fault.
15.6.5.2 Sequence of Events and Systems Operation
15.6.5.2.1 Sequence of Events
The sequence of events associated with this accident is shown in Table 6.3-1 for core system performance and Table 6.2-11 for
barrier (containment) performance.
Following the pipe break and scram, the MSIVs begin closing on the low-low-low level (L1) signal. The low-low water level (L2)
or high drywell pressure signal initiates the HPCS system at time 0 plus approximately 30 sec. The low-low-low water level or high
drywell pressure signal will initiate the LPCS and LPCI systems
at time 0 plus approximately 40 sec.
Since automatic actuation and operation of the ECCS is a system design basis, no operator actions are required for the accident.
However, the operator should perform the following described
actions.The operator should, after assuring that all rods have been inserted at time 0 plus approximately 10 sec, determine plant condition by observing the annunciators. After observing that
the ECCS flows are initiated, the operator should check that the diesel generators have started and are on standby condition.
When possible (less than half an hour later), the operator should initiate operation of the RHR system heat exchangers in the suppression pool cooling mode and give instructions to put the service water systems in service. After the RHR system and other auxiliary systems are in proper operation, the operator should
monitor the hydrogen concentration in the drywell for proper
activation of the recombiner and mixer, if necessary.
RBS USAR 15.6-7 August 1987 15.6.5.2.2 Systems Operations Accidents that could result in the release of radioactive fission products directly into the containment are the results of postulated nuclear system primary coolant pressure boundary pipe breaks. Possibilities for all pipe breaks sizes and locations
are examined in Sections 6.2 and 6.3, including the severance of
small process system lines, the main steam lines upstream of the flow restrictors, and the recirculation loop pipelines. The most severe nuclear system effects and the greatest release of radioactive material to the containment result from a complete circumferential break of one of the two recirculation loop pipelines. The minimum required functions of any reactor and plant protection system are discussed in Sections 6.2, 6.3, 7.3, 7.6, and 8.3, and Appendix 15A.
15.6.5.2.3 The Effect of Single Failures and Operator Errors
Single failures and operator errors have been considered in the analysis of the entire spectrum of primary system breaks. The consequences of a LOCA with considerations for single failures
are shown to be fully accommodated without the loss of any
required safety function. See Appendix 15A for further details.
15.6.5.3 Core and System Performance
15.6.5.3.1 Mathematical Model
The analytical methods and associated assumptions which are used in evaluating the consequences of this accident are considered to provide conservative assessment of the expected consequences of
this very improbable event. The details of these calculations, their justification, and bases for the models are developed in
Sections 6.3, 7.3, 7.6, 8.3, and Appendix 15A.
15.6.5.3.2 Input Parameters and Initial Conditions Input parameters and initial conditions used for the analysis of this event are given in Table 6.3-2.
15.6.5.3.3 Results Results of this event are given in detail in Section 6.3. The temperature and pressure transients resulting as a consequence of
this accident are insufficient to cause perforation of the fuel cladding. Therefore, no fuel damage results from this accident.
Post-accident tracking instrumentation and control is assured.
Continued long term core cooling is demonstrated. Radiological input is minimized and within limits. Continued operator control
and surveillance is examined and guaranteed.
15.6.5.3.4 Consideration of Uncertainties This event was conservatively analyzed; see Sections 6.3, 7.3, 7.6, 8.3, and Appendix 15A for details.
RBS USAR Revision 17 15.6-8 15.6.5.4 Barrier Performance The design basis for the containment is to maintain its integrity, and experience acceptable stresses after the instantaneous rupture of the largest single primary system piping within the structure while also accommodating the dynamic effects of the pipe break at the same time an SSE is also occurring.
Therefore, any postulated LOCA does not result in exceeding the containment design limit. For details and results of the
analyses, see Sections 3.8, 3.9, and 6.2.
15.6.5.5 Radiological Consequences The Loss of Coolant Accident (LOCA) is postulated to occur as a consequence of a double ended guillotine break of a recirculation line. The LOCA is assumed to occur concurrently with a Safe Shutdown Earthquake (SSE), a Loss of Off-site Power (LOP), and a Single Active Failure (SAF) of an Emergency Diesel Generator (EDG). Additionally, a Main Steam Isolation Valve (MSIV) is assumed to fail to close which represents a second SAF.
Traditionally only one SAF is required, however, for some doses the EDG failure would be the bounding assumption and for others the MSIV failure is likely to be bounding. Both SAF were assumed to prevent the necessity of performing detailed sensitivity analyses for each receptor location. The radiological consequences of the LOCA event are determined for the Exclusion Area Boundary (EAB), the Low Population Zone (LPZ), and the Main Control Room (MCR). The calculated results are then evaluated against the acceptance criteria of 10CFR50.67. 10 1015.6.5.5.1 Fission Product Release from Fuel 14 The fission product inventory used was based on the uprate power as depicted Table 15.6-5B. The release fractions assumed for each release phase are consistent with Regulatory Guide 1.183, Table 15.6-5B. The release phases' start time and duration assumed are consistent with Regulatory Guide 1.183, Table 4. The dose conversion factors used are taken from Federal Guidance Report (FGR) 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion and Ingestion," and FGR 12, "External Exposure to Radionuclides in Air, Water and Soil." The activity released from the fuel is assumed to mix instantaneously with the drywell volume. Natural deposition of core halogens is credited in the drywell using the Powers (10%)
model for BWRs from RADTRAD. Deposition for elemental iodine was also credited with a deposition coefficient of 1.01 hr
-1. RBS does not have containment sprays, therefore, none were credited in the analysis. Also, reduction of airborne radioactivity in the containment by suppression pool scrubbing was not credited.
14 RBS USAR Revision 18 15.6-9 10 15.6.5.5.2 Fission Product Transport to the Environment The transport pathways consist of leakage from the containment to the environment by several release points: A. Containment is assumed to leak at the proposed technical specification limit of 0.325 volume percent per day for
the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The containment leakage rate (La) is reduced to 55% of that value at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> based on the
power uprate containment pressure response analysis as allowed per Regulatory Guide 1.183, Appendix A, Section
3.7. Since
this term is in volume % per day, this leakage is assumed for both the drywell and containment.
Manual initiation of the Standby Gas Treatment System (SGTS) is assumed, therefore, secondary containment
releases were not credited for the first 30 minutes of the event. During this time period leakage from the primary containment is released directly to the environment. After 30 minutes containment leakage is directed to the annulus building which is treated by
SGTS.B. The second contributor considered is Secondary Containment Bypass (SCB) leakage. SCB leakage is
independent of La. SCB is assumed to leak at the proposed Technical Specification limit of 580,000 cc/hr (at Pa=7.6 psig) for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of the event.
Since containment pressure is the driving force for this
leakage term, SCB is also reduced to 55% of the original
value after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> based on the containment pressure response. This leakage is assumed to originate from the containment and is released directly to the environment
via the turbine building for the duration of the event. C. The third contributor is 150 scfh through one main steam line which bounds the current TS limit is 150 scfh per division for all four main steam lines. The three
remaining steam lines would not leak due to the fact that the pressure from the steam trapped between the MSIVs is
significantly greater than the maximum containment pressure during an accident. This release is terminated
25 minutes into the event when the Main Steam Positive
Leakage Control System 1413 10 13 14 RBS USAR Revision 17 15.6-10 10 101413(MSPLCS) becomes fully operational. This leakage is assumed to originate from the drywell and is released directly to the environment via the turbine building. Note that the current (i.e., TID) LOCA analysis neglects MSIV leakage in its entirety due to the trapped steam between the MSIVs and the fact that a failed MSIV is not assumed.E. The final contributor is the liquid leakage from Engineered Safety Features (ESF) cooling systems. Specifically, 1 gpm of suppression pool water is assumed to leak for the duration of the event. This leakage is assumed to be released directly to the environment for the first 30 minutes of the event. After 30 minutes the leakage is directed to the auxiliary building where it is treated by SGTS prior to release to the environment.
13 1415.6.5.5.3 Results The radiological consequences for the postulated LOCA event are summarized in Table 15.6-7. The LOCA event results in offsite and control room doses within the regulatory limits of 10CFR50.67.
15.6.6 Feedwater Line Break - Outside Containment In order to evaluate large liquid process line pipe breaks outside containment, the failure of a feedwater line is assumed
to evaluate the response of the plant design to this postulated event. The postulated break of the feedwater line, representing the largest liquid line outside the containment, provides the envelope evaluation relative to this type of occurrence. The break is assumed to be instantaneous, circumferential, and
downstream of the outermost isolation valve.
A more limiting event from a core performance evaluation standpoint (feedwater line break inside containment) has been quantitatively analyzed in Section 6.3. Therefore, the following discussion provides only new information not presented in Section 6.3. All other information is covered by cross-referencing to
appropriate Section 6 sections.
RBS USAR 15.6-11 August 1987 15.6.6.1 Identification of Causes and Frequency Classification 15.6.6.1.1 Identification of Causes
A feedwater line break is assumed without the cause being identified. The subject piping is designed to high quality, to strict engineering codes and standards, and to severe seismic and
environmental requirements.
15.6.6.1.2 Frequency Classification
This event is categorized as a limiting fault.
15.6.6.2 Sequence of Events and Systems Operation
15.6.6.2.1 Sequence of Events
The sequence of events is shown in Table 15.6-8.
Since automatic actuation and operation of the ECCS is a system design basis, no operator actions are required for this accident.
However, the operator should perform the following actions which
are described below for informational purposes:
1.The operator should determine that a line break has occurred and evacuate the area of the turbine building.
2.The operator is not required to take any action toprevent primary reactor system mass loss, but should ensure that the reactor is shut down and that RCIC and/or
HPCS are operating normally.
3.The operator should implement site radiation incident procedures.
4.If possible, the operator should shut down the feedwater system and de-energize any electrical equipment which may be damaged by water from the feedwater system in the turbine building.
5.The operator should continue to monitor reactor water level and the performance of the ECCS systems while the radiation incident procedure is being implemented and begins normal reactor cooldown measures.
RBS USAR 15.6-12 August 1987 6. When the reactor pressure has decreased below 150 psia, the operator should initiate RHR in the shutdown cooling mode to continue cooling down the reactor.
15.6.6.2.2 Systems Operations It is assumed that the normally operating plant instrument and controls are functioning. Credit is taken for the actuation of
the reactor isolation system and ECCS. The RPS and plant protection system are assumed to function properly to assure a
The ESF and RCIC systems are assumed to operate normally.
15.6.6.2.3 The Effect of Single Failures and Operator Errors The feedwater line break outside the containment is a special case of the general LOCA break spectrum considered in detail in Section 6.3. The general single-failure analysis for LOCAs is
discussed in detail in Section 6.3.3.3. For the feedwater line break outside the containment, since the break is isolatable, either the RCIC or the HPCS can provide adequate flow to the vessel to maintain core cooling and prevent fuel rod clad failure. A single failure of either the HPCS or the RCIC would still provide sufficient flow to keep the core covered with water. See Section 6.3 and Appendix 15A for detailed description
of analysis.
15.6.6.3 Core and System Performance
15.6.6.3.1 Qualitative Summary The accident evaluation qualitatively considered in this section is considered to be a conservative and envelope assessment of the consequences of the postulated failure (i.e., severance) of one
of the feedwater piping lines external to the containment. The accident is postulated to occur at the input parameters and
initial conditions as given in Table 6.3-2.
15.6.6.3.2 Qualitative Results The feedwater line break outside the containment is less limiting than either the steam line break outside the containment (analysis presented in Sections 6.3 and/or 15.6.4), or the feedwater line break inside the containment (analysis presented in Sections 6.3.3 and 15.6.5). It certainly is far less limiting than the DBA (the recirculation line break analysis presented in
Sections 6.3.3 and 15.6.5).
RBS USAR Revision 12 15.6-13 December 1999 The RCIC and/or the HPCS initiate on low-low water level and restore the reactor water level to the normal elevation. The fuel
is covered throughout the transient, and there are no pressure or
temperature transients sufficient to cause fuel damage.
15.6.6.3.3 Consideration of Uncertainties
This event was conservatively analyzed and uncertainties were adequately considered (Section 6.3).
15.6.6.4 Barrier Performance Accidents that result in the release of radioactive materials outside the containment are the results of postulated breaches in
the RCPB or the steam power-conversion system boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the limiting fault event for breaks outside the
containment is a complete severance of one of the main steam lines as described in Section 15.6.4. The feedwater system
piping break is less severe than the main steam line break.
Results of analysis of this event can be found in Sections 6.2.3
or 6.2.4.
15.6.6.5 Radiological Consequences
15.6.6.5.1 Design Basis Analysis 12The NRC provides no specific regulatory guidelines for the evaluation of this accident, therefore, no specific design basis analysis is presented. However, the radiological consequences for this event are enveloped by the results of analyses for the main steam line break which are presented in Section 15.6.4.5.
This is considered justified since the feedwater line check
valves isolate the reactor from the downstream side of the break at time 0 seconds after accident initiation. Therefore, there is no reactor coolant backflow via the feed water lines connected to the RPV. The only contribution is from main steam which must
first pass through the turbines, condenser, and other condensate
and feedwater system components which reduces isotopic concentrations due to decay and demineralization. In the main
steam line break analysis, a coincident iodine spike is assumed based on a compound spiking sequence giving 4 ci/gm dose equivalent I-131 as described in Section 15.6.4.5.1.
12 RBS USAR Revision 10 15.6-14 April 1998 References - 15.61. Moody, F. J. Maximum Two-Phase Vessel Blowdown From Pipes.
ASME Paper Number 65-WA/HT-1, March 15, 1965. 32. USNRC Standard Review Plan, NUREG-0800, Washington, DC, July 1981.3. Technical Specification - River Bend Station, NUREG-1172, November 1985.
3104. License Amendment 98 (RBC - 47866 dated August 26, 1997) 10 RBS USAR 15.7-1 August 1987 15.7 RADIOACTIVE RELEASE FROM SUBSYSTEMS AND COMPONENTS 15.7.1 Radioactive Gas Waste System Leak or Failure The main condenser off gas treatment system is examined under severe failure mode conditions for effects on the plant safety
profile.15.7.1.1 Identification of Causes and Frequency Classification 15.7.1.1.1 Identification of Causes Those events which could cause a gross failure in the off gas treatment system are: 1. A seismic occurrence - greater than design basis
- 2. A hydrogen detonation which ruptures the system pressure boundary 3. A fire in the filter assemblies
- 4. Failure of spatially related equipment.
The seismic failure is the only conceivable event which could cause significant system damage.
The equipment and piping are designed to contain any hydrogen-oxygen detonation which has a reasonable probability of
occurring. A detonation is not considered as a possible failure
mode.The decay heat on the filters is handled inherently by the system and by the available air flows. The system is isolated from other systems or components which could cause any serious interaction or failure. The only
credible event which could result in the release of significant
activity to the environment is an earthquake. The off gas system is not designed to Seismic Category I requirements, although the charcoal adsorber tanks are analyzed for an OBE seismic event. A failure of the off gas system is
assumed during a seismic event.
The design basis, description, and performance evaluation of the subject system is given in Section 11.3.
RBS USAR 15.7-2 August 1987 15.7.1.1.2 Frequency Classification This event is categorized as a limiting fault.
15.7.1.2 Sequence of Events and System Operation 15.7.1.2.1 Sequence of Events
The sequence of events following this failure is shown in Table 15.7-1.15.7.1.2.2 Identification of Operator Actions
Gross failure of this system may require manual isolation of this system from the main condenser. This isolation results in high condenser pressure and a reactor scram. The operator should
monitor the turbine-generator auxiliaries and break vacuum as soon as possible. The operator should notify personnel to
evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for
reentry. The time needed for these actions is about 2 min. 15.7.1.2.3 Systems Operation
In analyzing the postulated off gas system failure, no credit is taken for the operation of plant and reactor protection systems, or of ESFs. Credit is taken for functioning of normally operating plant instruments and controls and other systems only
in assuming the following: 1. Capability to detect the failure itself - indicated by an alarmed increase in radioactivity levels seen by area radiation monitoring system, by an alarmed loss of flow
in the off gas system, and by an alarmed increase in
activity at the vent release 2. Capability to isolate the system and shut down the reactor 3. Operational indicator and annunciators in the main control room. 15.7.1.2.4 The Effect of Single Failures and Operator Errors After the initial system gross failure, the inability of the operator to actuate a system isolation could affect the analysis.
RBS USAR 15.7-3 August 1987 However, the seismic event which is assumed to occur beyond the present plant design basis for nonsafety equipment undoubtedly causes the tripping of the turbine or leads to a load rejection.
This initiates a scram and negates a need for the operator to
initiate a reactor shutdown via system isolation. See Appendix 15A for a further detailed discussion of this subject.15.7.1.3 Core and System Performance The postulated failure results in a system isolation necessitating reactor shutdown because of loss of vacuum in the main condenser. This transient has been analyzed in Section
15.2.5.15.7.1.4 Barrier Performance
The postulated failure is the rupture of the off gas system pressure boundary. No credit is taken for performance of secondary barriers, except to the extent inherent in the assumed
equipment release fractions discussed in Section 15.7.1.5. 15.7.1.5 Radiological Consequences
15.7.1.5.1 General The analysis is based on conservative assumptions for the purpose of determining adequacy of the plant design to meet 10CFR100
guidelines. This analysis is referred to as the "design basis
analysis."15.7.1.5.2 Design Basis Analysis
Specific parametric values used in this evaluation are presented in Table 15.7
-2. These data are in accordance with Regulatory Guides 1.98 and 1.109 and result in a conservative estimate of
the radiological consequences. 15.7.1.5.2.1 Fission Product Release 15.7.1.5.2.1.1 Initial Conditions The activity in the off gas system is based on the following conditions:1. 6 scfm air inleakage RBS USAR Revision 9 15.7-4 November 1997
- 2. 100,000 Ci/sec noble gas after 30 min delay for a period of 11 months, followed by 1 month of 304,000 Ci/sec at 30 min. 15.7.1.5.2.1.2 Assumptions Depending upon assumptions as to radionuclide release fractions, various pieces of equipment may be controlling with respect to dose consequences. The assumed release fractions are shown in
Table 15.7
-3.In addition, the steam jet air ejector is assumed to continue
operating for 1 hr until it is manually secured. 15.7.1.5.2.2 Fission Product Transport to the Environment The transport pathway consists of direct release from the failed component to the environment.
15.7.1.5.2.3 Results The calculated exposures for the design basis analysis are presented in Table 15.7-4 and are well within the guidelines of
10CFR100.15.7.2 Radioactive Liquid Waste System Leak or Failure (Release to the Atmosphere) 9The design information used in the dose calculation concerning the atmospheric release due to a liquid radwaste system leak or failure is historical design information. It includes the source term from a two-unit site and two regenerant evaporators which are not installed. Also, the release point used in the analysis was the main plant exhaust duct instead of the radwaste building.
However, the analysis is bounding for an atmospheric release due
to a radioactive liquid waste system leak or failure.
915.7.2.1 Identification of Causes and Frequency Classification Radioactive releases considered include rupture of radwaste tanks, an equipment malfunction, and small leaks in the lines
transporting liquid radwaste to the system for processing. The
most limiting of these failures is defined as an unexpected and
uncontrolled release of the radioactive liquid stored in all of
the liquid radwaste system tanks. The radwaste tanks are nonseismic and are designed in accordance with the requirements of Regulatory Guide 1.143 (Section 11.2). Rupture of these tanks
is considered a limiting fault. 15.7.2.2 Sequence of Events and System Operation 1. Event begins; failure occurs. All liquid radwaste system tanks are assumed to rupture, releasing their entire contents to the radwaste building.
RBS USAR 15.7-5 August 1987 2. Area radiation alarms alert plant personnel. 3. Operator action begins. The rupture of the liquid radwaste system tanks would leave little recourse to the operator. No method of recontaining the gaseous phase discharge is available; isolation of the radwaste area, however, would minimize the results. High radiation alarms, both in the radwaste ventilation exhaust and in the
radwaste area, would alert the operator to the failure. No
credit for any operator action has been taken in evaluating this
event.15.7.2.3 Core and System Performance This failure is not expected to have any applicable effect on the core or NSSS safety performance. 15.7.2.4 Barrier Performance
This release occurs outside the containment and, therefore, does not involve any barrier integrity aspects. 15.7.2.5 Radiological Consequences The assumptions used to evaluate the rupture of the liquid radwaste system tanks are listed in Table 15.7-5, and the
radioactive inventory of each tank is listed in Table 15.7-6.
Offsite doses resulting from the rupture of the liquid radwaste system tanks are presented in Table 15.7-7. These doses are
based on design basis assumptions. As shown, they are small
fractions of the criteria of 10CFR100. 15.7.3 Postulated Radioactive Releases Due to Liquid-Containing Tank Failures 15.7.3.1 Radwaste Equipment Failure The following discussion of failure of the regenerant waste evaporator is clarified as follows. Changes to the liquid radwaste system have resulted in the elimination of the regenerant waste evaporator from radwaste system design. However, the radiological consequences calculated for failure of the regenerant waste evaporator in this section bound the
consequences that would be calculated due to the failure of other
liquid-containing tanks in the current liquid radwaste system
design. Therefore, this analysis is conservative.
RBS USAR 15.7-6 August 198715.7.3.1.1 Identification of Causes and Frequency Classification An unspecified event causes the release of the contents of the tank (or component) containing the largest inventory of radionuclides most easily transported to groundwater in the
liquid radwaste system. This component is the regenerant waste
evaporator in the radwaste building. Postulated events that could cause release of the radioactive inventory of the regenerant waste evaporator are a seismic event, cracks in the vessel, failures of components or process piping and operator error. The regenerant waste evaporator is designed to operate at 35 psig and 297°F, so the possibility of failure is
considered small. A liquid radwaste release caused by operator error is also considered a remote possibility. Operating
techniques and administrative procedures emphasize detailed
system and equipment operating instructions. Much of the exposition concerning the remote likelihood of a leakage or malfunction accident of the regenerant waste evaporator applies equally to a complete release accident. The probability of a complete rupture or complete malfunction
accident is, however, considered lower. The regenerant waste evaporator equipment is designed in accordance with ASME Code Section VIII and TEMA standards, in
conformance with NRC Regulatory Guide 1.143. The failure of the regenerant waste evaporator is considered a limiting fault. 15.7.3.1.2 Sequence of Events and Systems Operation Upon initiation of the event, the regenerant waste evaporator fails, and the contents are released into the radwaste building.
Should a release of liquid radioactive waste occur, floor drain sump pumps in the floor of the radwaste building receive a
high-water-level signal, activate automatically, and remove the
spilled liquid. In the evaluation of the liquid radwaste component or tank failure, no credit is taken for operator action; it is assumed
that liquid leaks from the building into the ground.
RBS USAR 15.7-7 August 1987 15.7.3.1.3 Core and System Performance The failure of these liquid radwaste components does not directly affect the NSSS. 15.7.3.1.4 Barrier Performance
This event does not involve any containment barrier integrity.
15.7.3.1.5 Radiological Consequences The radiological analysis data are presented in Tables 15.7-8 and 15.7-9; results are presented in Table 15.7-10. These are based
on design reactor coolant activities from Section 11.1. 15.7.3.2 Condensate Storage Tank Failure 15.7.3.2.1 Identification of Causes and Frequency ClassificationAn unspecified event causes release of the contents of the condensate storage tank at which time it is assumed to contain maximum design activity of 5.7 x 10
-3 ci/ml. Postulated events that could cause release of condensate storage tank contents are a seismic event, tornado or flood. Failure of the condensate
storage tank is considered a limiting fault. 15.7.3.2.2 Sequence of Events and Systems Operation It is assumed that at the start of the event, the condensate storage tank is full and there are no inputs to the tank. Upon initiation of the event, the contents of the tank are released to
the environment. Two cases are evaluated:1. The entire contents are released to the Mississippi River and from there to the nearest municipal surface water
supply.2. The entire contents are released to groundwater and from there to the nearest usable public well downgradient from
the site. 15.7.3.2.3 Core and System Performance Failure of the condensate storage tank does not affect the NSSS.
RBS USAR 15.7-8 August 1987 15.7.3.2.4 Barrier Performance This event does not involve any containment barrier integrity.
15.7.3.2.5 Radiological Consequences Rupture of the condensate storage tank releases soluble and insoluble radionuclides to the environment. The nearest
municipal surface water supply is the potable water intake on the Mississippi River at Bayou LaFourche, Louisiana, located about 87 mi (140 km) downstream from the site. During the postulated
accident, the minimum dilution factor is estimated to be
4.0 x 10 3. It is conservatively assumed that the entire 620,000 gallons is released to the river and arrives at Bayou LaFourche with no credit taken for decay. Also, the Mississippi River is assumed to be at its lowest flow of
100,000 cfs. Release is also evaluated at well number 56. For this case, the entire 620,000 gallons is assumed to be instantaneously released to the groundwater. Transport pathways are described in more detail in Section 2.4. During the accident, the minimum dilution factor and associated travel time to well 56 are estimated to be
9.7 x 10 2 and 9.8 yrs, respectively.
In both cases, maximum design radionuclide concentrations are assumed to be in the condensate storage tank at the time of rupture. These concentrations are listed in Table 15.7-14.
Maximum design activity was determined to be the worst case transfer of spent fuel pool cooling water to the condensate
storage tank during refueling. The transfer is assumed to occur 75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> after shutdown following a 50-hour refueling cycle.
Credit was taken for demineralization of the upper containment pools by the SFC system for 50 hours5.787037e-4 days <br />0.0139 hours <br />8.267196e-5 weeks <br />1.9025e-5 months <br /> prior to transfer. The SFC
system source term is conservative with respect to design basis
inputs from the radwaste system and condenser drawoff system
which yield lower concentrations for this accident. Effects of a condensate storage tank rupture are listed in Table 15.7-15 for Bayou LaFourche and in Table 15.7-16 for well
number 56.
RBS USAR Revision 17 15.7-9 15.7.4 Fuel Handling Accident 15.7.4.1 Identification of Causes and Frequency Classification 15.7.4.1.1 Identification of Causes 10 The fuel handling accident is assumed to occur as a consequence of a failure of the fuel assembly lifting mechanism, resulting in the dropping of a raised fuel assembly onto stored fuel bundles.
A variety of events which qualify for the class of accidents termed "fuel handling accidents" has been investigated. These include considerations for containment upper pool refueling operations, as well as fuel building pool activities. The
accident which produces the largest number of failed spent fuel rods is the drop of a spent fuel bundle onto the reactor core
when the reactor vessel head is off.15 10 15 RBS USAR Revision 24 15.7-10 15.7.4.1.2 Frequency Classification
This event has been categorized as a limiting fault.
15.7.4.2 Sequence of Events and Systems Operation
15.7.4.2.1 Sequence of Events 10 With no breach of containment the most severe fuel handling accident from a radiological release viewpoint is the drop of a channeled spent fuel bundle onto unchanneled spent fuel in the spent fuel racks in the fuel building. The sequence of events
which is assumed to occur is as follows:
10 Approximate Event Elapsed Time 1. Channeled fuel bundle is being handled by a crane over spent fuel pool.
Crane motion changes from horizontal
to vertical, and the fuel grapple
releases, dropping the bundle. The
channeled bundle strikes unchanneled
bundles in the rack.
0
- 2. Some rods in both the dropped and struck bundles fail, releasing radio-
radioactive gases to the pool water.
0.7 sec
- 3. Gases pass from the water to the fuel building.
< 1.0 min
- 4. The fuel building ventilation system high-radiation alarm alerts plant
personnel.
< 1.0 min
- 5. Operator actions begin.
< 5.0 min 15.7.4.2.2 Identification of Operator Actions
The operator actions are as follows:
- 1. Initiate the evacuation of the fuel building. 13 10 2. The fuel movement supervisor/ spotter should give instructions to go immediately to the radiation protection personnel decontamination area.
10 3. The fuel movement supervisor/ spotter should make the OSS/ CRS aware of the accident.
13 RBS USAR Revision 19 15.7-11 13 4. The OSS/ CRS should initiate action to determine the extent of potential radiation doses by measuring the radiation levels in the vicinity of or close to the fuel
building.7 5. The OSS/ CRS should assure that the charcoal filtration system is performing as designed.
710 6. The OSS/ CRS should initiate action to post the appropriate radiological control signs at the entrance of
the fuel building.
10 13 7. Before entry to the fuel building is made, a careful study of conditions, radiation levels, etc, will be
performed.15.7.4.2.3 System Operation Normally, operating plant instrumentation and controls are assumed to function, although credit is taken only for the operation of the charcoal filtration system. Operation of other plant or reactor protection systems, or ESF systems, is not
expected.15.7.4.2.4 Effects of Single Failures and Operator Errors The ventilation system includes: 1) the radiation monitoring detectors, 2) isolation dampers, and 3) the charcoal filtration system, and is designed to single failure criteria and safety
requirements.Refer to Sections 7.6 and 9.4 and to Appendix 15A for further details.15.7.4.3 Fuel Assembly Drop Accident Evaluation 15.7.4.3.1 Mathematical Model The analytical methods and associated assumptions used to evaluate the consequences of this accident are considered to provide a realistic, yet conservative assessment of the
consequences.
The kinetic energy acquired by a falling fuel assembly may be dissipated in one or more impacts.
To estimate the expected number of failed fuel rods in each impact, an energy approach is used.
This approach is described in Reference 2.
RBS USAR Revision 10 15.7-12 April 1998 10The fuel assembly is expected to impact on the spent fuel racks at a small angle from the vertical, possibly inducing a bending mode of failure on the fuel rods of the dropped assembly. It is assumed that each fuel rod resists the imposed bending load by a couple consisting of two equal, opposite concentrated forces.
Therefore, fuel rods are expected to absorb little energy prior to failure as a result of bending. Actual bending tests with concentrated point-loads show that each fuel rod absorbs
approximately 1 ft-lb prior to cladding failure. Each 9x9 rod that fails as a result of gross compression distortion is expected to absorb approximately 200 ft-lb before cladding failure (based on 1 percent uniform plastic deformation of the rods). The energy of the dropped assembly is conservatively assumed to be absorbed by only the cladding, non-fuel components of the assembly, and other pool structures. Because an unchanneled fuel assembly is approximately 76 percent fuel, 18 percent cladding, and 6 percent other structural material by
weight, the assumption that no energy is absorbed by the fuel material results in considerable conservatism in the mass-energy
calculations.
1015.7.4.3.2 Input Parameters and Initial Conditions The following assumptions are used in the analysis of this accident:1. The fuel assembly is dropped from the maximum height allowed by the fuel handling equipment.102. The entire amount of potential energy, including the energy of the entire assemblage falling to its side from a vertical position is available for application to the
fuel assemblies involved in the accident. 3. The fraction of energy absorbed by the nonfuel-bearing elements of the assembly is assumed to be the same as the fraction of their structural material, i.e., 6/(18+6).
Thus, the cladding absorbs 18/(18+6) of the energy
absorbed during an impact.
104. Dissipation of some of the mechanical energy of the falling fuel assembly due to fluid drag is conservatively
neglected.5. Complete detachment of the assembly from the fuel-hoisting equipment is assumed. This is only possible if the fuel assembly bail, the fuel grapple, or
the grapple cable breaks. 6. None of the energy associated with the dropped assembly is absorbed by the fuel material (uranium dioxide).
RBS USAR Revision 22 15.7-13 7. Energy absorbed by the fuel racks is not considered.
While the fuel drop case is a part of the design requirements for the high-density storage racks, this is intended primarily to protect the geometric and neutron-absorbing reactivity controls in the active fuel
region, not the mechanical integrity of the fuel rods. 10 8. All fuel rods, including tie rods, were assumed to fail by 1% strain in compression, the same mode as for ordinary fuel. There is no propensity for preferential
failure of tie rods. 13 9. The fuel types that are in use or have been used at River Bend are GE 8x8, GE 9x9, GE 10x10 and ATRIUM-10 designs.
An evaluation of these fuel types has concluded that the
drop of a GE 10x10 bundle onto another GE 10x10 bundle resulted in the bounding number of equivalent GE 9x9 fuel rod failures.
10 13 15.7.4.3.3 Results
15.7.4.3.3.1 Energy Available 10 Based upon the design of the fuel handling equipment in the fuel building and containment, it was determined that the drop height is greater for the drop of a fuel bundle over the reactor vessel versus the drop of a fuel bundle over the spent fuel pool. The
larger drop height will be used to determine the number of
damaged fuel rods regardless of whether the drop is postulated to
occur in the fuel building or containment.
The kinetic energy acquired by the falling fuel assembly is
determined by multiplying the weight of the bounding fuel type by
the bounding drop weight. 1 1 10 15.7.4.3.3.2 Energy Loss Per Impact 10 Based on the fuel geometry in the high-density spent fuel rack and containment fuel racks, a maximum of four fuel assemblies are
struck by the impacting assembly. 13 10 13 RBS USAR Revision 19 15.7-14 10 1015.7.4.3.3.3 Fuel Rod Failures 10 10 RBS USAR Revision 22 15.7-15 13 10 8 As described above, the drop of a fuel bundle in containment over the reactor pressure vessel bounds a drop of a fuel bundle in the
fuel building due to the greater drop height. The methodology
used to determine the number of rod failures is described in
Reference 2.
A spectrum of drop scenarios was also performed for containment.
The bounding scenario for that building was the drop of a
channeled 10x10 assembly into the core in which 127 equivalent 9x9 rods were damaged. For conservatism, the source term assumed
was conservatively based on 150 9x9 rods.
8 10 13 15.7.4.4 Barrier Performance
This failure is postulated to occur in either the fuel building or the containment. Regardless of the building, the release
mechanism assumed is consistent with Regulatory Guide 1.183.
15.7.4.5 Radiological Consequences
The postulated accident activity is released as a "ground level release" from the fuel building or containment ventilation vent and dispersed to offsite and control room receptors according to plant specific atmospheric dispersion factors demonstrated as
bounding for both release points. These plant specific offsite dispersion factors were determined in accordance with Regulatory
Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," and
NUREG/CR-2858, "PAVAN: An Atmospheric Diapresion Program for Evaluating Design Basis Accident Releases of Radioactive Materials from Nuclear Power Stations" (PAVAN) guidance. The
RBS USAR Revision 17 15.7-15a plant specific control room dispersion factors were determined in accordance with Draft Regulatory Guide DG-llll, "Atmospheric Relative Concentrations for Control Room Radiological Habitability Assessments at Nuclear Power Plnats," and NUREG/CR-6331, "Atmoshereic Relative Concentrations in Building Wakes" (ARCON96) guidance. Specific values of parameters used in the evaluation are presented in Table 15.7-11. 1210 10 12 RBS USAR Revision 22 15.7-16 10 15.7.4.5.1 Fission Product Release from Fuel In accordance with the guidance in Regulatory Guide 1.183, the following conditions are assumed applicable for this event: 12 1. Power level - 3,100 MWt 12 2. Gap activity release fraction - assumed the RG 1.183 values. 3 Fission product peaking factor - 2.00 for those rods damaged.
- 4. Release fission product species and chemical form -
-assumed the RG 1.183 values.
10 15.7.4.5.2 Fission Product Transport to the Environment Based on conservative and limiting assumptions consistent with USNRC Regulatory Guide 1.183, the RBS bounding FHA event occurs in containment and results in a total of 127 equivalent GE 9x9 fuel rods damaged. This value was conservatively increased to 150 GE 9x9 rods. The failed rods gap activity is immediately
released to the fuel building or containment atmosphere. Over a
period of two hours, this accident activity is released into the atmosphere without crediting building mixing or dilution. The total activity released to the environment is presented in
Table 15.7-12.
15.7.4.5.3 Results The calculated exposures for the design basis analysis are presented in Table 15.7-13 and are well within the regulatory
limits of 10CFR50.67 and GDC 19.
RBS USAR Revision 17 15.7-17 13108 8 1315.7.4.5.4 Fuel Handling Accident Inside Containment During Type C Leak Rate Testing 15 Section Deleted 10 15 RBS USAR Revision 17 15.7-18 141310 13 1410 RBS USAR Revision 17 15.7-19 10131515.7.4.5.5 Fuel Handling Accident Inside Containment with Containment Open Section Deleted 10 13 15 RBS USAR Revision 19 15.7-20 131210 10 12 1315.7.5 Spent Fuel Cask Drop Accident The design of the spent fuel cask trolley ensures that heavy loads cannot be handled above the spent fuel pool. Cask handling procedures ensure that the heights postulated in the spent fuel cask drop accident analyses are not exceeded and impact limiters are in place as required prior to spent fuel cask handling. The drop analyses conclude the following: No radioactive material is released from the cask No significant damage to structures, systems, or components occurs and safe plant shutdown is not jeopardized No significant damage to the spent fuel inside the cask occursBecause no radioactive material is released, a design basis radiological analysis has not been performed for either a shipping cask drop or a transfer cask drop. See Section 9.1.4.3 for additional information pertaining to spent fuel cask drops and the analyses performed.
RBS USAR Revision 15 15.7-21 May 2002 Reference - 15.71. U.S. NRC Standard Review Plan, NUREG-75/087, Washington, DC, November 24, 1975. 82. "GESTAR II, NEDE-24011-P-A (Supplement for US)." 8103. NRC letter to GSU dated March 3, 1989 (RBC-38224), granting Amendment 35 and documenting their evaluation. 4. GSU letters to NRC dated 9/28/88 (RBG-28899), 11/30/88 (RBG-29470), and 2/6/89 (RBG-29959), filing the amendment request, providing information on containment mixing, and reducing the number of open vent and drain line pathways from 20 to 12, respectively.5. NRC letter to GSU dated January 11, 1996 (RBC-46444), granting Amendment 85 and documenting their evaluation. 6. GSU letters to NRC dated 8/17/95 (RBG-41728), 12/18/95 (RBG-42284), 12/20/95 (RBG-42311), and 12/27/95 (RBG-42322),
filing the amendment request, incorporated additional change to the Technical Specifications Bases at the request of NRR project manager, provided clarification on the Technical
Specifications Bases changes, and added additional
clarification to the Technical Specifications Bases, respectively.
- 7. NUREG/CR-5009, Assessment of the Use of Extended Burnup Fuel in Light Water Power Reactors
.10138. NRC letter to EOI dated March 2, 2000 (RBC-49179), granting Amendment 110 and documenting its evaluation. 9. EOI letter to NRC dated December 16, 1999, filing License Amendment Request 99-29.
131510. NRC letter to EOI dated September 14, 2001 (RBC-49633), granting Amendment 119 and documenting its evaluation.
15 RBSUSARRevision10 15.8-1April199815.8ANTICIPATEDTRANSIENTSWITHOUTSCRAM(ATWS)10AnATWSeventisdefinedasAnticipatedOperationalOccurrence(AOO)occurs,butisnotfollowedbyarapidreactorshutdown (scram)whenrequired.Failuretoshutdownthereactormaylead tochallengestothefuelcladding,reactorcoolantpressure boundary,orthecontainmentvessel.15.8.1AcceptanceCriteria Asstatedpreviously,thefailuretoshutdownthereactorinresponsetoanAOOmayleadtochallengestothefuelcladding, reactorcoolantpressureboundary,orthecontainmentvessel.
Thefollowingacceptancecriteriaareusedtoassesstheability oftheplanttosurviveanATWSevent.1.FuelIntegrity:1.1Maximumcladtemperature<2200
°F1.2Maximumlocalcladoxidation<17%2.RPVIntegrity2.1PeakRPVpressure<1500psig(ASMECodeServiceLevelC)3.ContainmentIntegrity3.1Peaksuppressionpoolbulktemperature<185
°FThesearethesameacceptancecriteriausedinthegenericATWS analysisperformedbyGE (1).15.8.2EventMitigationRiverBendStationisrequiredtohavefeaturestomitigateanATWSeventper10CFR50.62.Thesefeaturesare:1.Analternaterodinsertionsystem(ARI).ThissystemisdescribedinSections4.6and7.7.1.9.2.Anautomatictripoftherecirculationpumps(ATWS-RPT).TheATWSpumptriplogicisdescribedinSection
7.7.1.2.3.Astandbyliquidcontrolsystem(SLCS).ThissystemisdescribedinSections7.4.1.3and9.3.5.Inadditiontothesefeatures,RiverBendStationhasEmergencyOperatingProcedures(EOPs).Theseproceduresaredescribedin Section13.5.
10 RBS USAR Revision 25 15.8-2 10 The combination of the design features and the EOPs are the means by which RBS will cope with an ATWS event in the extremely
unlikely event that such an event were to occur.
15.8.3 Event Analysis 14 Several analyses were performed to determine if River Bend Station is able to cope with an ATWS event. The events evaluated
were the closure of all main steam line isolation valves, a failure of the turbine pressure regulator to maximum demand (see note 1), and an inadvertent opening of a main steam safety/relief valve. The analyses demonstrate that the plant can cope with an
ATWS event and that all acceptance criteria specified above are satisfied. The MSIV closure and pressure regulator failure events have been demonstrated to be limiting by generic analyses
for the BWR/6 performed by General Electric (1), and were evaluated specifically for River Bend Station (2). 15 Analyses were performed for the current cycle using approved fuel vendor methodology to confirm acceptance criteria. Results for
the cycle specific analysis are described in Appendix 15B.
15 15.8.3.1 Analysis Method
Analytical methods used to demonstrate that RBS meets the ATWS acceptance criterion discussed above are summarized in this section. Reactor response including reactor power, reactor pressure, reactor water level, and boron injection following an
ATWS is simulated with ODYN. The system response calculated by
ODYN is used as inputs to containment suppression pool and peak
clad temperature (PCT) calculations. Suppression pool heatup is
modeled with STEMP. DCPRF calculates peak clad temperature for
transients analyzed by ODYN using ISCOR and TASC. Using core flow calculated by ODYN as a driving force, ISCOR performs
steady-state thermal-hydraulic core calculations, and TASC
performs single channel transient calculations.
14 15.8.3.2 Initial Conditions
Table 15.8-1 lists the important initial conditions assumed in
the ATWS analyses performed for River Bend Station.
15.8.3.3 Primary Analysis Inputs 14 Table 15.8-2 lists the plant equipment performance characteristics used in the ATWS analyses performed for River Bend Station. In performing the analysis, plant parameters were
taken to be nominal values as opposed to "limiting" values such as analytical limits for setpoints (1). Of particular note, all main steam safety relief valves are assumed to operate in the 10 14 NOTE 1: The pressure regulator failure-open is no longer a postulated single failure scenario; no Ovation TCPS single failure scenarios are postulated that could result in all valves open. This specific USAR section is maintained for historical purposes.
RBSUSARRevision15 15.8-2aMay20021014reliefmodewhichisadeparturefromTechnicalSpecifications.ThisisconsistentwiththegenericanalysesperformedbyGeneral ElectricforBWRfleet (1)andwithguidanceprovidedbythe NRC(3,4).TheRBSspecificsensitivitystudyhasdemonstrated that eleven 1014 RBSUSARRevision15 15.8-2bMay2002THISPAGELEFTBLANKINTENTIONALLY RBS USAR Revision 25 15.8-3 14 10 out of the sixteen total main steam safety relief valves are required to meet the peak vessel pressure acceptance criteria (5). With one valve unavailable, the peak pressure is not expected to be significantly greater than that calculated with all valves
available, and would still meet the peak vessel pressure
acceptance criteria.
For all cases the following assumptions were used:
- 1. The reactor power is 3039 MWt and the core flow is at 68.4 Mlbm/hr (81% of rated core flow). This is the maximum power/minimum flow point associated with the Maximum Extended Load Line Limit Analysis. The core flow assumption is a limiting assumption in that the reduction in core flow associated with the ATWS recirculation pump trip is less than that obtained from
the nominal core flow rate which results in a slightly
higher core power level following the ATWS pump trip.
- 2. Off-site power is assumed to be available.
- 3. All control rods fail to insert (RPS and ARI failure).
This assumption requires boron injection to bring the
reactor to cold shutdown.
For the MSIV closure, pressure regulator failure (see Note 1) to maximum demand and the ATWS events, the following operator
actions were assumed in the analysis.
- 1. The operator lowers reactor water level and inhibits ADS when the suppression pool reached 110 F. Reactor water level is controlled near TAF plus five feet.
- 2. Initiate standby liquid control after the following (whichever occurs last):
2.1 ATWS high pressure signal plus two minutes 2.2 ATWS low reactor water level signal plus two minutes 14 2.3 Suppression pool temperature at 110 F. 3. RHR suppression pool cooling initiated ten minutes following the start of the event.
For the inadvertent opening of a main steam safety/relief valve
ATWS events the following actions were assumed in the analysis.
10
NOTE 1: The pressure regulator failure-open is no longer a postulated single failure scenario; no Ovation TCPS single failure scenarios are postulated that could result in all valves open. This specific USAR section is maintained for historical purposes.
RB S U S AR Revision 20 15.8-4 14 10 1. Initiate standby liquid control after the suppression pool reaches 110F. 2. Manually trip the recirculation pumps off (not transferred) after the suppression pool reaches 110F.
- 3. Initiate reactor water level reduction to five feet above the top of active fuel and inhibit the functions listed below after the suppression pool reaches the 110F: 3.1 AD S 3.2 HPC S 3.3 RCIC 3.4 M S IV closure on low reactor water level.
- 4. RHR suppression pool cooling initiated ten minutes after the suppression pool reaches 110F. 14 15.8.3.4 S equence of Events
A sequence of events is provided in Table 15.8-3 for the case of
the closure of all the main steam line isolation valves.
15.8.4 Analysis Results/Conclusions
The summary of results for the ATW S events, given in Table 15.8-4 shows that the performance of River Bend S tation at 100% power and 81% core flow conditions (corresponding to the MELLL point of the power/flow map) is within the vessel maximum pressure and
suppression pool temperature limits for the most severe ATW S transients. The peak fuel cladding temperature for the most
limiting event, M SIV Closure, is also within its limit.
Therefore, the ATW S acceptance criteria are met by River Bend for the MELLL operating domain.
Cladding oxidation results are not reported as the cladding temperature is at the peak value for a very short period of time thus the amount of cladding oxidation is insignificant (5). 10 RBSUSARRevision14 15.8-5September200110References-15.81.NEDO-24222,"AssessmentofBWRMitigationofATWS,VolumeIII(NUREG0460,AlternateNo.3),"February1981.2.NEDC-32611P,"MaximumExtendedLoadLineLimitAnalysisForRiverBendStation,Reload6Cycle7,"November1996.3.NUREG-0460Volume1,"AnticipatedTransientsWithoutScramForLightWaterReactorsStaffReport,"April1978.4.NUREG-0460Volume2,"AnticipatedTransientsWithoutScramForLightWaterReactorsStaffReportAppendices,"April1978.14 5. GE-NE-A22-00081-32.0,Rev.1,"105%PowerUprateEvaluationreportForEntergyOperations,Inc.,RiverBendStation,GE TaskNo.32.0,AnticipatedTransientWithoutScram analysis,"July1999 10
- 6. LicensingTopicalReport,"QualificationoftheOne-DimensionalCoreTransientModel(ODYN)forBoilingWater Reactors,"NEDC-24254P,Supplement1,December1997, including: (a) MFN-019-98,"RevisiontoODYNATWSQualificationReport,Sections3.1,4.2,and5.1.3."April1998 (b) NRCSafetyEvaluationReport,T.H.EssigtoJ.F.Quirk,"SafetyEvaluationbytheOfficeoftheNuclear ReactorRegulationofNEDC-24154P,Supplement1" (TACNo.MA3478)(c) MFN-0114-99,"ProprietyInformationSupportingMeeting withNRConODYNComputerCodeforATWSAnalysis, April21,1999,"May6,1999.
14 APPENDIX15APLANTNUCLEARSAFETYOPERATIONALANALYSIS(NSOA)-(ASystem-Level/QualitativeTypePlantFMEA)
RBSUSAR 15A-iAugust1987APPENDIX15APLANTNUCLEARSAFETYOPERATIONALANAYLSIS(NSOA)TABLEOFCONTENTS Section Title Page 15A.1 OBJECTIVES 15A-1 15A.1.1EssentialProtectiveSequences 15A-115A.1.2DesignBasisAdequacy 15A-115A.1.3System-Level/QualitativeTypeFMEA 15A-115A.1.4NSOACriteriaRelativetoPlantSafetyAnalysis 15A-215A.1.5TechnicalSpecificationOperational Basis 15A-2 15A.2APPROACHTOOPERATIONALNUCLEAR SAFETY 15A-215A.2.1GeneralPhilosophy 15A-215A.2.2SpecificPhilosophy 15A-215A.2.2.1ConsistencyoftheAnalysis 15A-615A.2.3ComprehensivenessoftheAnalysis 15A-715A.2.4SystematicApproachoftheAnalysis 15A-715A.2.5RelationshipofNuclearSafetyOperationalAnalysistoSafety AnalysisofChapter15 15A-815A.2.6RelationshipBetweenNSOAandOperationalRequirements,Technical Specifications,DesignBasis, andSACFAspects 15A-915A.2.7UnacceptableConsequencesCriteria 15A-915A.2.8GeneralNuclearSafetyOperational Criteria15A-10 15A.3METHODOFANALYSIS 15A-1115A.3.1GeneralApproach 15A-1115A.3.2BWROperatingStates 15A-1115A.3.3SelectionofEventsforAnalysis 15A-1215A.3.3.1NormalOperation 15A-1215A.3.3.2AnticipatedOperationalTransients 15A-1315A.3.3.3AbnormalOperationalTransients 15A-1615A.3.3.4DesignBasisAccidents 15A-1715A.3.3.5SpecialEvents 15A-1815A.3.4ApplicabilityofEventstoOperatingStates 15A-1915A.3.5GuidelinesforEventAnalysis 15A-19 RBSUSAR 15A-iiAugust1987APPENDIX15ATABLEOFCONTENTS(Cont)
Section Title Page15A.3.6StepsinanOperationalAnalysis15A-2115A.4DISPLAYOFOPERATIONALANALYSIS RESULTS 15A-2215A.4.1General 15A-2215A.4.2ProtectionSequenceandSafetySystemAuxiliaryDiagrams 15A-23 15A.5BASESFORSELECTINGSURVEILLANCETESTFREQUENCIES 15A-2515A.5.1NormalSurveillanceTestFrequencies15A-25 15A.5.2AllowableRepairTimes 15A-2515A.5.3RepairTimeRule 15A-25 15A.6OPERATIONALANALYSES 15A-2615A.6.1SafetySystemAuxiliaries 15A-2615A.6.2NormalOperations 15A-2615A.6.2.1General 15A-2615A.6.2.2EventDefinitions 15A-2615A.6.2.3RequiredSafetyActions/RelatedUnacceptableConsequences 15A-2815A.6.2.3.1RadioactiveMaterialReleaseControl15A-28 15A.6.2.3.2CoreCoolantFlowRateControl 15A-2815A.6.2.3.3CorePowerLevelControl 15A-2915A.6.2.3.4CoreNeutronFluxDistribution Control 15A-2915A.6.2.3.5ReactorVesselWaterLevelControl15A-29 15A.6.2.3.6ReactorVesselPressureControl 15A-2915A.6.2.3.7NuclearSystemTemperatureControl15A-30 15A.6.2.3.8NuclearSystemWaterQualityControl15A-30 15A.6.2.3.9NuclearSystemLeakageControl 15A-3015A.6.2.3.10CoreReactivityControl 15A-3015A.6.2.3.11ControlRodWorthControl 15A-3115A.6.2.3.12RefuelingRestriction 15A-3115A.6.2.3.13ContainmentandReactor/AuxiliaryBuildingPressureandTemperature
Control 15A-3115A.6.2.3.14StoredFuelShielding,Cooling,andReactivityControl 15A-3115A.6.2.4OperationalSafetyEvaluations 15A-32 RBSUSAR 15A-iiiAugust1987APPENDIX15ATABLEOFCONTENTS(Cont)
Section Title Page15A.6.3AnticipatedOperationalTransients15A-3415A.6.3.1General15A-34 15A.6.3.2RequiredSafetyActions/RelatedUnacceptableConsequences 15A-3415A.6.3.3EventDefinitionsandOperationalSafetyEvaluations 15A-3515A.6.4AbnormalOperationalTransients 15A-4715A.6.4.1General 15A-4715A.6.4.2RequiredSafetyActions/RelatedUnacceptableConsequences 15A-4715A.6.4.3EventDefinitionandOperationSafetyEvaluation 15A-4815A.6.5DesignBasisAccidents 15A-5015A.6.5.1General 15A-5015A.6.5.2RequiredSafetyActions/Unaccept-ableConsequences 15A-5015A.6.5.3EventDefinitionandOperationalSafetyEvaluations 15A-5115A.6.6SpecialEvents 15A-5615A.6.6.1General 15A-5615A.6.6.2RequiredSafetyAction/Unacceptable Consequences 15A-5615A.6.6.3EventDefinitionsandOperationalSafetyEvaluation 15A-57 15A.7REMAINDEROFNSOA 15A-59 15A.8 CONCLUSIONS 15A-60 RBSUSAR 15A-ivAugust1987APPENDIX15ALISTOFTABLES Table Number Title15A.2-1UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:NORMALOPERATION15A.2-2UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:ANTICIPATEDOPERATIONAL
TRANSIENTS15A.2-3UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:ABNORMALOPERATIONAL
TRANSIENTS15A.2-4UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:DESIGNBASISACCIDENTS15A.2-5UNACCEPTABLECONSEQUENCESCONSIDERATIONSPLANTEVENTCATEGORY:SPECIALEVENTS15A.3-1BWROPERATINGSTATES15A.6-1NORMALOPERATION 15A.6-2ANTICIPATEDOPERATIONALTRANSIENTS 15A.6-3ABNORMALOPERATIONALTRANSIENTS 15A.6-4DESIGNBASISACCIDENTS 15A.6-5SPECIALEVENTS RBSUSAR 15A-vAugust1987APPENDIX15ALISTOFFIGURES Figure Number Title15A.2-1POSSIBLEINCONSISTENCIESINTHESELECTIONOFNUCLEARSAFETYOPERATIONALREQUIREMENTS15A.2-2BLOCKDIAGRAMOFMETHODUSEDTODERIVENUCLEARSAFETYOPERATIONALREQUIREMENTS SYSTEMLEVELQUALITATIVEDESIGNBASIS CONFIRMATIONAUDITSANDTECHNICAL
SPECIFICATIONS15A.2-3SIMPLIFIEDNSOACLASSIFICATION INTERRELATIONSHIPS15A.4-1FORMATFORPROTECTIONSEQUENCEDIAGRAMS15A.4-2FORMATFORSAFETYSYSTEMAUXILIARYDIAGRAMS 15A.4-3FORMATFORCOMMONALITYOFAUXILIARYDIAGRAMS 15A.6-1SAFETYSYSTEMAUXILIARIES 15A.6-2SAFETYSYSTEMAUXILIARIES 15A.6-3SAFETYACTIONSEQUENCESFORNORMALOPERATIONINSTATEA15A.6-4SAFETYACTIONSEQUENCESFORNORMALOPERATIONINSTATEB15A.6-5SAFETYACTIONSEQUENCESFORNORMALOPERATIONINSTATEC15A.6-6SAFETYACTIONSEQUENCESFORNORMALOPERATIONINSTATED15A.6-7PROTECTIONSEQUENCEFORMANUALORINADVERTENTSCRAM15A.6-8PROTECTIONSEQUENCEFORLOSSOFPLANTINSTRUMENTORSERVICEAIRSYSTEM15A.6-9PROTECTIONSEQUENCEFORINADVERTENTSTART-UPOFHPCSPUMPS RBSUSAR 15A-viAugust1987APPENDIX15ALISTOFFIGURES(Cont)
Figure Number Title15A.6-10PROTECTIONSEQUENCESFORINADVERTENTSTART-UPOFIDLERECIRCULATIONLOOPPUMP15A.6-11PROTECTIONSEQUENCEFORRECIRCULATIONLOOPFLOWCONTROLFAILURE-MAXIMUMDEMAND15A.6-12PROTECTIONSEQUENCEFORRECIRCULATIONLOOPFLOWCONTROLFAILURE-DECREASING15A.6-13RECIRCULATIONLOOPPUMPTRIP-ONEORBOTH15A.6-14PROTECTIONSEQUENCESFORISOLATIONOFALLMAINSTEAMLINES15A.6-15PROTECTIONSEQUENCEFORISOLATIONOFONEMAINSTEAMLINE15A.6-16PROTECTIONSEQUENCESFORINADVERTENTOPENINGOFARELIEFORSAFETYVALVE15A.6-17PROTECTIONSEQUENCEFORCONTROLRODWITHDRAWALERRORFORSTART-UPANDREFUELINGOPERATION15A.6-18PROTECTIONSEQUENCEFORCONTROLRODWITHDRAWALERRORFORPOWEROPERATION15A.6-19PROTECTIONSEQUENCESFORRHRS-LOSSOFSHUTDOWNCOOLINGFAILURE15A.6-20RHRS-SHUTDOWNCOOLINGFAILURE-INCREASED COOLING15A.6-21PROTECTIONSEQUENCESFORLOSSOFFEED-WATERFLOW15A.6-22PROTECTIONSEQUENCEFORLOSSOFAFEED-WATERHEATER15A.6-23PROTECTIONSEQUENCESFORFEEDWATERCONTROLLERFAILURE-MAXIMUMDEMAND RBSUSAR 15A-viiAugust1987APPENDIX15ALISTOFFIGURES(Cont)
Figure Number Title15A.6-24PROTECTIONSEQUENCESFORPRESSUREREGULATORFAILURE-OPEN15A.6-25PROTECTIONSEQUENCEFORPRESSUREREGULATORFAILURE-CLOSED15A.6-26PROTECTIONSEQUENCESFORMAINTURBINETRIPWITHBYPASS15A.6-27PROTECTIONSEQUENCESFORLOSSOFMAINCONDENSERVACUUM15A.6-28PROTECTIONSEQUENCESFORMAINGENERATORTRIPWITHBYPASS15A.6-29PROTECTIONSEQUENCEFORLOSSOFNORMALACPOWER15A.6-30PROTECTIONSEQUENCESFORLOSSOFNORMALOFF-SITEACPOWER15A.6-31PROTECTIONSEQUENCESMAINGENERATORTRIP-WITHBYPASSFAILURE15A.6-32PROTECTIONSEQUENCESMAINTURBINETRIP-WITHBYPASSFAILURE15A.6-33PROTECTIONSEQUENCEFORINADVERTENTLOADINGANDOPERATIONOFFUELASSEMBLY INIMPROPERPOSITION15A.6-34PROTECTIONSEQUENCEFORRECIRCULATIONLOOPPUMPSEIZURE15A.6-35PROTECTIONSEQUENCEFORRECIRCULATIONLOOPPUMPSHAFTBREAK15A.6-36PROTECTIONSEQUENCESFORCONTROLRODDROP ACCIDENT15A.6-37PROTECTIONSEQUENCESFORFUELHANDLING ACCIDENT RBSUSAR 15A-viiiAugust1987APPENDIX15ALISTOFFIGURES(Cont)
Figure Number Title15A.6-38PROTECTIONSEQUENCESFORLOSS-OF-COOLANTPIPINGBREAKSINRCPB-INSIDECONTAINMENT15A.6-39PROTECTIONSEQUENCESFORLIQUID,STEAM,LARGE,SMALLPIPINGBREAKSOUTSIDE
CONTAINMENT15A.6-40PROTECTIONSEQUENCEFORGASEOUSRADWASTESYSTEMLEAKORFAILURE15A.6-41PROTECTIONSEQUENCEFORAUGMENTEDOFF-GASTREATMENTSYSTEMFAILURE15A.6-42PROTECTIONSEQUENCEFORLIQUIDRADWASTESYSTEMLEAKORFAILURE15A.6-43PROTECTIONSEQUENCEFORLIQUIDRADWASTESYSTEMSTORAGETANKFAILURE15A.6-44PROTECTIONSEQUENCEFORSHIPPINGCASKDROP15A.6-45PROTECTIONSEQUENCEFORREACTORSHUTDOWN-FROMANTICIPATEDTRANSIENTWITHOUTSCRAM15A.6-46PROTECTIONSEQUENCESFORREACTORSHUT-DOWN-FROMOUTSIDEMAINCONTROLROOM15A.6-47PROTECTIONSEQUENCEFORREACTORSHUT-DOWN-WITHOUTCONTROLRODS15A.6-48COMMONALITYOFAUXILIARYSYSTEMS-DCPOWERSYSTEM(125/250VOLTS)15A.6-49COMMONALITYOFSTANDBYACPOWERSYSTEMS(120/480/4160VOLTS)15A.6-50COMMONALITYOFAUXILIARYSYSTEMS-EQUIP-MENTAREACOOLINGSYSTEM15A.6-51COMMONALITYOFAUXILIARYSYSTEMS-PLANTSERVICEWATERSYSTEM RBSUSAR 15A-ixAugust1987APPENDIX15ALISTOFFIGURES(Cont)
Figure Number Title15A.6-52COMMONALITYOFAUXILIARYSYSTEMS-SUPPRESSIONPOOLSTORAGE RBSUSARRevision3 15A-1August1990APPENDIX15APLANTNUCLEARSAFETYOPERATIONALANALYSIS(NSOA)-(ASYSTEM-LEVEL/QUALITATIVETYPEPLANTFMEA)15A.1OBJECTIVESTheobjectivesoftheNuclearSafetyOperationalAnalysis(NSOA)arecitedbelow.3TheNSOAwasdevelopedinthelate1960'sasabasisforshowingcompliancewiththeNRC'sGeneralDesignCriteria,assuring safetydesignadequacyandconsistency,stipulatingtechnical specificationsanddeterminingapplicabilityofASMEBoilerand PressureVesselCodeSectionIII,ANSIB31.7andIEEE-297.The systematicmethodologywhichwasdevelopedconciselyandclearly identifiedaminimumsetofdesignbasiseventsthatbound potentialadverseparametervariations,thesafetyfunctions reliedupontopreventormitigateeachofthoseevents,andthe safetystructuresreliedupontoprovidethosefunctions.
Safety-relatedfunctions,structuresandsystemsareasubsetof thesafetyfunctions,structuresandsystemsidentifiedinthe NSOA.Itcapturedgenericdevelopmentsencompassingthedesign, calculation,testingandoperatingexperienceoftheearlyBWR productlines.TherepairtimerulegiveninSection15A.5.3was usedasanassumptioninearlyreliabilityanalysisoftheBWR ECCSandwasnotintendedtodirectorreflectindividualplant practices.TheNSOAidentifiesonagenericsystemlevelbasis, thosesystemswhichshouldbethesubjectoftechnical specifications,andthesafetysystemsutilizedduringthe differentmodesofplantoperation.
315A.1.1EssentialProtectiveSequencesIdentifyanddemonstratethatessentialprotectionsequencesneededtoaccommodatetheplantnormaloperations,anticipated andabnormaloperationtransients,anddesignbasisaccidentsare availableandadequate.Inaddition,eacheventconsideredin theplantsafetyanalysis(Chapter15)isfurtherexaminedand analyzed.Specificessentialprotectivesequencesare identified.TheapporpriatesequenceisdiscussedforallBWR operatingmodes.15A.1.2DesignBasisAdequacy RBSUSAR 15A-1aAugust1987Identifyanddemonstratethatthesafetydesignbasisofthevariousstructures,systems,orcomponentsneededtosatisfythe plantessentialprotectionsequencesareappropriate,available, andadequate.Eachprotectivesequenceidentifiesthespecific structures,systems,orcomponentsperformingsafetyorpower generationfunctions.Theinterrelationshipsbetweenprimary systemsandsecondary(orauxiliaryequipment)inprovidingthese funcionsareshown.Theindividualdesignbases(identified throughouttheUSARforeachstructure,system,orcomponent)are broughttogetherbytheanalysisinthissection.Inadditionto theindividualequipmentdesignbasisanalysis,theplantwide designbasesareexaminedandpresentedhere.15A.1.3System-Level/QualitativeTypeFMEA Identifyasystemlevel/qualitative-typeFailureModesandEffectsAnalysis(FMEA)ofessentialprotectivesequencestoshow compliancewiththeSingleActiveComponentFailure(SACF)or SingleOperatorError(SOE)criteria.Eachprotectivesequence entryisevaluatedrelativetoSACForSOEcriteria.Safety classificationaspectsandinterrelationshipsbetweensystemsare alsoconsidered.
RBSUSARRevision3 15A-1bAugust1990THISPAGELEFTINTENTIONALLYBLANK RBSUSAR 15A-2August198715A.1.4NSOACriteriaRelativetoPlantSafetyAnalysisIdentifythesystems,equipment,orcomponents'operationalconditionsandrequirementsessentialtosatisfythenuclear safetyoperationalcriteriautilizedintheChapter15plant
events.15A.1.5TechnicalSpecificationOperationalBasis Establishthelimitingoperatingconditions,testing,andsurveillancebasesrelativetoplanttechnicalspecification.15A.2APPROACHTOOPERATIONALNUCLEARSAFETY 15A.2.1GeneralPhilosophy Thespecifiedmeasuresofsafetyusedinthisanalysisarereferredtoas"unacceptableconsequences."Theyareanalytically determinablelimitsontheconsequencesofdifferent classificationsofplantevents.Thenuclearsafetyoperational analysisisthusan"event-consequence"orientedevaluation.15A.2.2SpecificPhilosophy ThefollowingguidelinesareutilizedtodeveloptheNSOA:1.ScopeandClassificationofPlantEventsa.Normal(Planned)OperationsNormaloperationswhichareunderplannedconditionsintheabsenceofsignificant abnormalities.Operationssubsequenttoan incident(transient,accident,orspecial event)arenotconsideredplanned operationsuntiltheproceduresbeing followedorequipmentbeingusedare identicaltothoseusedduringanyoneof thedefinedplannedoperations.Specific eventsaredescribedfurtherin Table15A.6-1.b.Anticipated (Expected)
Operational TransientsAnticipatedOperationalTransientsaredeviationsfromnormalconditionswhichareexpectedto occuratamoderatefrequency,andassuchthe designshouldincludecapabilitytowithstandthe conditionswithout RBSUSAR 15A-3August1987operationalimpairment.Includedareincidentsthatresultfromasingleoperatorerror,control malfunction,andothersasdescribedin Table15A.6-2.c.Abnormal(Unexpected)OperationalTransientsAbnormalOperationalTransientsaredeviations fromnormalconditionswhichoccuratan infrequentfrequency.Thedesignshouldinclude acapabilitytowithstandtheseconditions withoutoperationalimpairment.Referto Table15A.6-3fordescriptionofeventsincluded withinthisclassification.d.DesignBasis(Postulated)AccidentsDesignBasisAccident(DBA)isahypothesized accident,thecharacteristicsandconsequencesof whichareutilizedinthedesignofthosesystems andcomponentspertinenttothepreservationof radioactivematerialbarriersandtherestriction ofradioactivematerialreleasefromthe barriers.Thepotentialradiationexposures resultingfromadesignbasisaccidentare greaterthanforanysimilaraccidentpostulated fromthesamegeneralaccidentassumptions.
SpecificeventsaredescribedinTable15A.6-4.e.Special(Hypothetical)EventsSpecialEventsarepostulatedtodemonstratesome specialcapabilityoftheplantinaccordance withNRCrequirements.Foranalyzedevents withinthisclassificationseeTable15A.6-5.
2.SafetyandPowerGenerationAspectsMattersidentifiedwith"safety"classificationaregovernedbyregulatoryrequirements.Safetyfunctions
include:a.Theaccommodationofabnormaloperationaltransientsandpostulateddesignbasisaccidentsb.Maintenanceofcontainmentintegrity RBS USAR Revision 17 15A-4 c. Assurance of ECCS operability
- d. Continuance of reactor coolant pressure boundary (RCPB) integrity.
Safety classified aspects are related to 10CFR 50.67 dose limits, infrequent and low probability occurrences, SACF criteria, worst case operating conditions and initial assumptions, automatic (10 min)
corrective action, significant unacceptable dose and
environmental effects, and the involvement of other
coincident (mechanistic or nonmechanistic) plant and
environmental situations.
Power generation classified considerations are related
to continued plant power generation operation, equipment operational matters, component availability
aspects, and long-term offsite public effects. Matters identified with "power generation" classification are also covered by regulatory
guidelines. Power generation functions include: a. Accommodation of planned operations and anticipated operational transients b. Minimization of radiological releases to appropriate levels
- c. Assurance of safe and orderly reactor shutdown, and/or return to power generation operation
- d. Continuance of plant equipment design conditions to ensure long-term reliable operation.
Power generation is related to 10CFR20 and 10CFR50, Appendix I dose limits, moderate and high probability
occurrences, nominal operating conditions and initial
assumptions and allowable immediate operator manual
actions. 3. Frequency of Events Consideration of the frequency of the initial (or initiating) event is reasonably straight-forward.
Added considerations (e.g., such as further failures
or operator errors) certainly influences RBSUSAR 15A-5August1987theclassificationgrouping.Theeventsinthisappendixareinitiallygroupedaccordingtoinitiating frequencyoccurrence.Theimpositionoffurther failuresnecessitatesfurtherclassificationtoa lowerfrequencycategory.TheintroductionofSACForSOEintotheexaminationofplannedoperation,anticipatedoperational transients,orabnormaloperationaltransient evaluationshasnotbeenpreviouslyconsidereda designbasisorevaluationprerequisite.Itis providedandincludedheretodemonstratetheplant's capabilitytoaccommodatethenewrequirement.4.ConservativeAnalysis-MarginsTheunacceptableconsequencesestablishedinthis appendixrelativetothepublichealthandsafety aspectsareinthemselvesinstrictandconservative conformancetoregulatoryrequirements.Restrictiveoperationsonhypotheticallimitsestablishedbyfurtheroperationallimits(e.g.,
setpointmargins)leadstodisrespectfortruesafety
aspects.5.SafetyFunctionDefinitionFirst,theessentialprotectivesequencesshownforan eventinthisappendixlisttheminimumstructuresand systemsrequiredtobeavailabletosatisfytheSACF orSOEevaluationaspectsoftheevent.Other protective"successpaths"existinsomecasesthan areshownwiththeevent.Second,notalltheeventsinvolvethesamenatural,environmental,orplantconditionalassumptions.For exampleLOCAandSSEareassociatedwithEvent44.In Event40,CRDAisnotassumedtobeassociatedwith anySSEorOBEoccurrence.Therefore,seismicsafety functionrequirementsarenotconsideredforEvent40.
Someofthesafetyfunctionequipmentassociatedwith theEvent40protectivesequencearealsocapableof handlingmorelimitingevents,suchasEvent44.Third,containmentmaybeasafetyfunctionforsomeevent(whenuncontainedradiologicalrelease RBS USAR Revision 17 15A-6 would be unacceptable) but for other events it may not be applicable (e.g., during refueling). The
requirement to maintain the containment in
post-accident recovery is only needed to limit doses
to less than 10CFR 50.67. After radiological sources are depleted with time, further containment is
unnecessary. Thus, the "time domain" and "need for" aspects of a function should be and are taken into
account and considered when evaluating the events in
this appendix.
Fourth, the operation of ESF equipment for normal operational events should not be misunderstood to mean that ESF equipment requirements apply to this event
category. Likewise the interpretation of the use of ESF-SACF
capable systems for anticipated operational transient
protective sequences should not imply that these equipment requirements (seismic, redundancy, diversity, testable, IEEE, etc) are appropriately
required for anticipated operational transients. 6. Envelope and Actual Event Analysis The event analyses presented in Chapter 15 do not include event frequency considerations. It does present an "envelope analysis" evaluation based on expected situations. Study of the actual plant occurrences, their frequency, and their actual impact
are reflected in their categorization in this appendix. This places the plant safety evaluations and impressions into a better perspective by focusing attention on the "envelope analysis" with more
appropriate understanding.
15A.2.2.1 Consistency of the Analysis Fig. 15A.2-1 illustrates three inconsistencies. Panel A shows the possible inconsistency resulting from operational requirements being placed on separated levels of protection for one event. If the second and sixth levels of protection are important enough to warrant operational requirements, then so are the third, fourth, and fifth levels. Panel B shows the possible
inconsistency resulting from operational requirements being arbitrarily placed on some action thought to be important to
safety. In the case shown, scram represents different protection
levels for two similar events in one category; if the further
level of protection RBSUSAR 15A-7August1987forEventBisimportantenoughtowarrantanoperationalrequirement,thensoisthefourthlevelforEventA.Thus,to simplyplaceoperationalrequirementsonallequipmentneededfor someaction(scram,isolation,etc)couldbeinconsistentand unreasonableifdifferentprotectionlevelsarerepresented.
PanelCshowsthepossibleinconsistencyresultingfrom operationalrequirementsbeingplacedonsomearbitrarylevelof protectionforanyandallpostulatedevents.Herethe inconsistencyisnotrecognizingandaccountingfordifferent eventcategoriesbasedoncauseorexpectedfrequencyof
occurrence.InconsistenciesofthetypesillustratedinFig.15A.2-1areavoidedintheNSOAbydirectingtheanalysisto "event-consequences"orientedaspects.
Analyticalinconsistenciesareavoidedbytreatingalltheeventsofa categoryunderthesamesetoffunctionalrulesapplyinganother setoffunctionalrulestoanothercategory,andbyhavinga consistentsetofrulesbetweencategories.Thus,itisvalidto comparetheresultsoftheanalysesoftheeventsinanyone categoryandinvalidtocompareeventsofdifferentcategory,and thusdifferentrules,totheothercategory.Anexampleofthis isthedifferentrules(limits,assumptions,etc)ofaccidents comparedtoanticipatedtransients.15A.2.3ComprehensivenessoftheAnalysis Theanalysismustbesufficientlycomprehensiveinmethodthat1)allplanthardwareisconsidered;and,2)thatthefullrange ofplantoperatingconditionsareconsidered.Thetendencytobe preoccupiedwith"worstcases"(thosethatappeartogivethe mostsevereconsequences)isrecognized;however,theprotection sequencesessentialtolessercasesmaybedifferent(moreor lessrestrictive)fromtheworstcasesequence.Toassurethat operationalanddesignbasesrequirementsaredefinedand appropriateforallequipmentessentialtoattainingacceptable consequences,allessentialprotectionsequencesmustbe identifiedforeachoftheplantsafetyeventsexaminations.
Onlyinthiswayisacomprehensivelevelofsafetyattained.
Thus,theNSOAisalso"protectionsequence"orientedtoachieve
comprehensiveness.15A.2.4SystematicApproachoftheAnalysis Insummary,thesystematicmethodutilizedinthisanalysiscontributestoboththeconsistencyandcomprehensivenessofthe analysismentionedabove.Thedesiredcharacteristics RBSUSAR 15A-8August1987representativeofasystematicapproachtoselectingBWRoperationalrequirementsarelistedasfollows:1.Specifymeasuresofsafety-unacceptableconsequences2.Considerallnormaloperations 3.Systematiceventselection 4.Commontreatmentanalysisofalleventsofanyone type5.Systematicidentificationofplantactionsandsystemsessentialtoavoidingunacceptableconsequences6.Emergenceofoperationalrequirementsandlimitsfromsystemanalysis.Fig.15A.2-2illustratesthesystematicprocessbywhichtheoperationalanddesignbasisnuclearsafetyrequirementsand technicalspecificationsarederived.Theprocessinvolvesthe evaluationofcarefullyselectedplanteventsrelativetothe unacceptableconsequences(specifiedmeasuresofsafety).Those limits,actions,systems,andcomponentlevelsfoundtobe essentialtoachievingacceptableconsequencesarethesubjects ofoperationalrequirements.Fig.15A.2-3summarizesthesystematictreatmentoftheappendix analysis.15A.2.5RelationshipofNuclearSafetyOperationalAnalysistoSafetyAnalysesofChapter15Oneofthemainobjectivesoftheoperationalanalysisistoidentifyallessentialprotectionsequencesandtoestablishthe detailedequipmentconditionsessentialtosatisfyingthenuclear safetyoperationalcriteria.Thespectrumofeventsexaminedin Chapter15representacompletesetofplantsafety considerations.Themainobjectiveoftheearlieranalysesof Chapter15,is,ofcourse,toprovidedetailed"worstcase" (limitingorenvelope)analysesoftheplantevents.The"worst cases"arecorrespondinglyanalyzedandtreatedlikewiseinthis appendixbutinlightoffrequencyofoccurrence,unacceptable consequences,assumptioncategories,etc.
RBSUSAR 15A-9August1987Tables15A.6-1through15A.6-5providecross-correlationbetweentheNSOAevent,itsprotectionsequencediagram,anditssafety evaluationinChapter15.15A.2.6RelationshipBetweenNSOAandOperationalRequirements,TechnicalSpecifications,DesignBasis,andSACFAspectsBydefinition,"anoperationalrequirement"isarequirementor restriction(limit)oneitherthevalueofaplantvariableor theoperabilityconditionassociatedwithaplantsystem.Such requirementsmustbeobservedduringallmodesofplantoperation (notjustatfullpower)toassurethattheplantisoperated safely(toavoidtheunacceptableresults).Therearetwokinds ofoperationalrequirementsforplanthardware:1.Limitingconditionforoperation:therequiredconditionforasystemwhilethereactorisoperating inaspecifiedstate2.Surveillancerequirements:thenatureandfrequencyoftestsrequiredtoassurethatthesystemiscapable ofperformingitsessentialfunctions.Operationalrequirementsaresystematicallyselectedforoneof twobasicreasons:1.Toassurethatunacceptableconsequencesaremitigatedfollowingspecifiedplanteventsbyexaminingand challengingthesystemdesign2.ToassuretheconsequencesofatransientoraccidentisacceptablewiththeexistenceofaSACForSOE
criteria.Theindividualstructuresandsystemswhichperformasafety functionarerequiredtodosounderdesignbasisconditions includingenvironmentalconsiderationandundersingleactive componentfailureassumptions.TheNSOAconfirmstheprevious examinationoftheindividualequipment(seeEventEvaluation, Section15.0.3)requirementconformanceanalyses.15A.2.7UnacceptableConsequencesCriteria Tables15A.2-1through15A.2-5identifytheunacceptableconsequencesassociatedwithdifferenteventcategories.In ordertopreventormitigatethem,theyarerecognizedas RBSUSAR 15A-10August1987themajorbasesforidentifyingsystemoperationalrequirementsaswellasthebasesforallothersafetyanalysesversus criteriathroughouttheFSAR.15A.2.8GeneralNuclearSafetyOperationalCriteria Thefollowinggeneralnuclearsafetyoperationalcriteriaareusedtoselectoperationalrequirements:
ApplicabilityNuclearSafetyOperationalCriteriaPlannedoperationTheplantshallbeoperatedsoasanticipated,abnormaltoavoidunacceptableconsequences.operationaltransients, designbasisaccidents, andadditionalspecial plantcapabilityeventsAnticipatedandTheplantshallbeoperatedinsuchabnormaloperationalawaythatnoSingleActiveCompo-transientsanddesignnentFailure(SACF)canpreventthe basisaccidentssafetyactionsessentialtoavoid-ingtheunacceptableconsequences associatedwithanticipatedor abnormaloperationaltransientsor designbasisaccidents.However, thisrequirementisnotapplicable duringstructure,system,orcompo-nentrepairiftheavailabilityof thesafetyactionismaintained eitherbyrestrictingtheallowable repairtimeorbymorefrequently testingaredundantstructure, system,orcomponent.Theunacceptableconsequencesassociatedwiththedifferent categoriesofplantoperationandeventsaredictatedby:1.Probabilityofoccurrence2.Allowablelimits(pertheprobability)-relatedtoradiological,structural,environmental,etc,aspects3.Coincidenceofotherrelatedorunrelateddisturbances 4.Timedomainofeventandconsequencesconsideration.
RBSUSAR 15A-11August198715A.3METHODOFANALYSIS15A.3.1GeneralApproach TheNSOAisperformedontheplantasdesigned.Theendproductsoftheanalysisarethenuclearsafetyoperationalrequirements andtherestrictionsonplanthardwareanditsoperationthat mustbeobserved1)tosatisfythenuclearsafetyoperational criteria,and2)toshowcomplianceoftheplantsafetyandpower generationsystemswithplantwiderequirements.Fig.15A.2-2 showstheprocessusedintheanalysis.Thefollowinginputsare requiredfortheanalysisofspecificplantevents:1.UnacceptableConsequencesCriterion(Section15A.2.7)2.GeneralNuclearSafetyOperationalCriteria(Section15A.2.8)3.DefinitionofBWROperatingStates(Section15A.3.2) 4.SelectionofEventsforAnalysis(Section15A.3.3) 5.RulesforEventAnalysis(Section15A.3.5).Withthisinformation,eachselectedeventcanbeevaluatedtodeterminesystematically,theactions,thesystems,andthe limitsessentialtoavoidingthedefinedunacceptable consequences.Theessentialplantcomponentsandlimitsso identifiedarethenconsideredtobeinagreementwithand subjecttonuclearoperational,designbasisrequirementsand technicalspecificationrestrictions.15A.3.2BWROperatingStates FourBWRoperatingstatesinwhichthereactorcanexistaredefinedin15A.6.2.4andsummarizedinTable15A.3-1.Themain objectiveinselectingoperatingstatesistodividetheBWR operatingspectrumintosetsofinitialconditionstofacilitate considerationofvariouseventsineachstate.Eachoperatingstateincludesawidespectrumofvaluesforimportantplantparameters.Withineachstate,theseparameters areconsideredovertheirentirerangetodeterminethelimitson theirvaluesnecessarytosatisfythenuclearsafetyoperational criteria.Suchlimitationsarepresentedinthesubsectionsof theUSARthatdescribethesystemsassociatedwiththeparameter limit.Theplant RBSUSAR 15A-12August1987parameterstobeconsideredinthismannerincludethefollowing:ReactorcoolanttemperatureReactorvesselwaterlevel Reactorvesselpressure Reactorvesselwaterquality Reactorcoolantforcedcirculationflowrate Reactorpowerlevel(thermalandneutronflux)
Coreneutronfluxdistribution Feedwatertemperature Containmenttemperatureandpressure Suppressionpoolwatertemperatureandlevel Spentfuelpoolwatertemperatureandlevel15A.3.3SelectionofEventsforAnalysis15A.3.3.1NormalOperation Operationssubsequenttoanincident(transient,accident,oradditionalplantcapabilityevent)arenotconsideredplanned operationsuntiltheactionstakenorequipmentusedintheplant areidenticaltothosethatwouldbeusedhadtheincidentnot occurred.Asdefined,theplannedoperationscanbeconsidered asachronologicalsequence:refuelingoutage->achieving criticality->heatup->poweroperation->achievingshutdown->
cooldown->refuelingoutage.Thenormaloperationseventsaredefinedbelow.1.Refuelingoutage:Includesalltheplannedoperationsassociatedwithanormalrefuelingoutageexceptthosetestsinwhichthereactoristakencriticaland returnedtotheshutdowncondition.Thefollowing plannedoperationsareincludedinrefuelingoutage:a.Planned,physicalmovementofcorecomponents(fuel,controlrods,etc)b.Refuelingtestoperations(exceptcriticalityandshutdownmargintests)c.Plannedmaintenance d.Requiredinspection2.Achievingcriticality:Includesalltheplantactionsnormallyaccomplishedinbringingtheplant RBSUSAR 15A-13August1987fromaconditioninwhichallcontrolrodsarefullyinsertedtoaconditioninwhichnuclearcriticality isachievedandmaintained3.Heatup:Beginswhenachievingcriticalityendsandincludesallplantactionsnormallyaccomplishedin approachingnuclearsystemratedtemperatureand pressurebyusingnuclearpower(reactorcritical).
Heatupextendsthroughwarmupandsynchronizationof themainturbine-generator4.Poweroperation:Beginswhenheatupendsandincludescontinuedplantoperationatpowerlevelsinexcessof heatuppower5.Achievingshutdown:Beginswhenthemaingeneratorisunloadedandincludesallplantactionsnormally accomplishedinachievingnuclearshutdown(morethan onerodsubcritical)followingpoweroperation6.Cooldown:Beginswhenachievingnuclearshutdownendsandincludesallplantactionsnormaltothecontinued removalofdecayheatandthereductionofRPV temperatureandpressure.Theexactpointatwhichsomeoftheplannedoperationsendand othersbegincannotbepreciselydetermined.Itisshownlater thatsuchprecisionisnotrequired,fortheprotection requirementsareadequatelydefinedinpassingfromonestateto thenext.Dependenceofseveralplannedoperationsontheone rodsubcriticalconditionprovidesanexactpointoneitherside ofwhichprotection(especiallyscram)requirementsdiffer.
Thus,whereapreciseboundarybetweenplannedoperationsis needed,thedefinitionsprovidetheneededprecision.Together,theBWRoperatingstatesandtheplannedoperationsdefinethefullspectrumofconditionsfromwhichtransients, accidents,andspecialeventsareinitiated.TheBWRoperating statesdefineonlythephysicalcondition(pressure,temperature, etc)ofthereactor;theplannedoperationsdefinewhattheplant isdoing.Theseparationofphysicalconditionsfromthe operationbeingperformedisdeliberateandfacilitatescareful considerationofallpossibleinitialconditionsfromwhich incidentsmayoccur.15A.3.3.2AnticipatedOperationalTransients Toselectanticipatedoperationaltransients,eightnuclearsystemparametervariationsareconsideredaspotential RBSUSAR 15A-14August1987initiatingcausesofthreatstothefuelandthereactorcoolantpressureboundary.Theparametervariationsareasfollows:1.Reactorpressurevesselpressureincrease2.Reactorpressurevesselwater(moderator)temperature decrease3.Controlrodwithdrawal 4.Reactorpressurevesselcoolantinventorydecrease 5.Reactorcorecoolantflowdecrease 6.Reactorcorecoolantflowincrease 7.Reactorpressurevesselwater(moderator)temperature increase8.Reactorpressurevesselcoolantinventoryincrease.Theseparametervariations,ifuncontrolled,couldresultindamagetothereactorfuelorreactorcoolantpressureboundary, orboth.Anuclearsystempressureincreasethreatenstorupture thereactorcoolantpressureboundaryfrominternalpressure.A pressureincreasealsocollapsesvoidsinthemoderator,causing aninsertionofpositivereactivitythatthreatensfueldamageas aresultofoverheating.Areactorvesselwater(moderator) temperaturedecreaseresultsinaninsertionofpositive reactivityasdensityincreases.Thiscouldleadtofuel overheating.Positivereactivityinsertionsarepossiblefrom causesotherthannuclearsystemspressureormoderator temperaturechanges.Suchreactivityinsertionsthreatenfuel damagecausedbyoverheating.Bothareactorvesselcoolant inventorydecreaseandareductionincoolantflowthroughthe corethreatenstheintegrityofthefuelasthecoolantbecomes unabletoadequatelyremovetheheatgeneratedinthecore.An increaseincoolantflowthroughthecorereducesthevoid contentofthemoderator,andresultsinaninsertionofpositive reactivity.Corecoolanttemperatureincreasethreatensthe integrityofthefuel;suchavariationcouldbetheresultofa heatexchangermalfunctionduringoperationintheshutdown coolingmode.Anexcessofcoolantinventorycouldbetheresult ofmalfunctioningwaterlevelcontrolequipment;sucha malfunctioncanresultinaturbinetrip,whichcausesan expectedincreaseinnuclearsystempressureandpower.
RBSUSAR 15A-15August1987Anticipatedoperationaltransientsaredefinedastransientsresultingfromasingleactivecomponentfailure,SACF,orsingle operatorerror,SOE,thatcanbereasonablyexpected(moderate frequencyofoccurrenceofonceperyeartooncein20yr)during anymodeofplantoperation.Examplesofsingleoperational failuresoroperatorerrorsinthisfrequencyrangeare:1.Openingorclosinganysinglevalve(acheckvalveisnotassumedtocloseagainstnormalflow)2.Startingorstoppinganysinglecomponent3.Malfunctionormaloperationofanysinglecontrol device4.Anysingleelectricalfailure 5.Anysingleoperatorerror.Anoperatorerrorisdefinedasanactivedeviationfromnuclearplantstandardoperatingpractices.Asingleoperatorerroris thesetofactionsthatisadirectconsequenceofasingle reasonablyexpectederroneousdecision.Thesetofactionsis limitedasfollows:1.Thoseactionsthatcouldbeperformedbyonlyone person2.Thoseactionsthatwouldhaveconstitutedacorrectprocedurehadtheinitialdecisionbeencorrect3.Thoseactionsthataresubsequenttotheinitialoperatorerrorandthataffectthedesignedoperation oftheplant,butarenotnecessarilydirectlyrelated totheoperatorerror.Examplesofsingleoperatorerrorsareasfollows:1.Anincreaseinpowerabovetheestablishedflowcontrolpowerlimitsbycontrolrodwithdrawalinthe specifiedsequences2.Theselectionandcompletewithdrawalofasinglecontrolrodoutofsequence3.Anincorrectcalibrationofanaveragepowerrange monitor RBSUSAR 15A-16August19874.Manualisolationofthemainsteamlinescausedby operatorThevarioustypesofasingleoperatorerrororasingleactivecomponentfailureareappliedtovariousplantsystemswitha considerationforavarietyofplantconditionstodiscover eventsdirectlyresultinginanundesiredparametervariation.
Oncediscovered,eacheventisevaluatedforthethreatitposes totheintegrityoftheradioactivematerialbarriers.15A.3.3.3AbnormalOperationalTransients Toselectabnormaloperationaltransients,eightnuclearsystemparametervariationsareconsideredaspotentialinitiating causesofgrosscore-widefuelfailuresandthreatsofthe reactorcoolantpressureboundary.Theparametervariationsare asfollows:1.Reactorpressurevesselpressureincrease2.Reactorpressurevesselwater(moderator)temperature decrease3.Controlrodwithdrawal 4.Reactorvesselcoolantinventorydecrease.
5.Reactorcorecoolantflowdecrease 6.Reactorcorecoolantflowincrease 7.Reactorpressurevesselwater(moderator)temperature increase8.Reactorvesselcoolantinventoryincrease.Theeightparametervariationslistedaboveincludealleffectswithinthenuclearsystemcausedbyabnormaloperational transientsthatthreatengrosscore-widereactorfuelintegrity orseriouslyaffectreactorcoolantpressureboundary.Variation ofanyoneparametermaycauseachangeinanotherlisted parameter;however,foranalysispurposes,threatstobarrier integrityareevaluatedbygroupsaccordingtotheparameter variationoriginatingthethreat.Abnormaloperationaltransientsaredefinedasinfrequentincidentsresultingfromsingleormultipleequipmentfailures and/orsingleormultipleoperatorerrorsthatare RBSUSAR 15A-17August1987notreasonablyexpected(spanningoneeventin20yrtoonein100yr)duringanymodeofplantoperation.Examplesofsingle ormultipleoperationalfailuresand/orsingleormultiple operatorerrorsare:1.Failureofmajorpowergenerationequipmentcomponents2.Multipleelectricalfailures 3.Multipleoperatorerrors 4.Combinationsofequipmentfailureandanoperator error.Operatorerrorisdefinedasanactivedeviationfromnuclearplantstandardoperatingpractices.Amultipleoperatorerroris thesetofactionsthatisadirectconsequenceofseveral unexpectederroneousdecisions.Examplesofmultipleoperatorerrorsareasfollows:1.Inadvertentloadingandoperatingafuelassemblyinanimproperposition2.Themovementofacontrolrodduringrefueling operations.Thevarioustypesofsingleerrorsand/orsinglemalfunctionsareappliedtovariousplantsystemswithaconsiderationfora varietyofplantconditionstodiscovereventsdirectlyresulting inanundesiredparametervariation.Oncediscovered,eachevent isevaluatedforthethreatitposestotheintegrityofthe variousradioactivematerialbarriers.15A.3.3.4DesignBasisAccidents Accidentsaredefinedashypothesizedeventsthataffecttheradioactivematerialbarriersandarenotexpectedduringplant operations.Theseareplantevents,equipmentfailures, combinationsofinitialconditionswhichareofextremelylow frequency(i.e.,notexpectedtooccur).Thepostulatedaccident typesconsideredareasfollows:1.Mechanicalfailureofasinglecomponentleadingtothereleaseofradioactivematerialfromoneormore barriers.Thecomponentsreferredtoherearenot thosethatactasradioactivematerialbarriers.
Examplesofmechanicalfailureare RBSUSAR 15A-18August1987breakageofthecouplingbetweenacontrolroddriveandthecontrolrod.2.Arbitraryruptureofanysinglepipeuptoandincludingcompleteseveranceofthelargestpipein thereactorcoolantpressureboundary.Thiskindof accidentisconsideredonlyunderconditionsinwhich thenuclearsystemispressurized.Forpurposesofanalysis,accidentsarecategorizedasthose eventsthatresultinreleasingradioactivematerial:1.Fromthefuelwiththereactorcoolantpressureboundary,reactorbuilding,auxiliarybuilding,and fuelbuildinginitiallyintact(Event40)2.Directlytothecontainment(Event42)3.Directlytothereactor,auxiliary,fuel,orturbinebuildingswiththecontainmentinitiallyintact(Events40,43,44,45,50)4.Directlytothereactororfuelbuildingswiththecontainmentnotintact(Events41,50)5.Directlytothefuelbuilding(Events41,50)6.Directlytotheturbinebuilding(Events46,47) 7.Directlytotheenvirons(Events48,49).Theeffectsofvariousaccidenttypesareinvestigated,withconsiderationforthefullspectrumofplantconditions,to examineeventsthatresultinthereleaseofradioactive
material.15A.3.3.5SpecialEvents Anumberofadditionaleventsareevaluatedtodemonstrateplantcapabilitiesrelativetospecialnuclearsafetycriteria.These specialeventsinvolveextremelylowprobabilityoccurrence situations.Asanexample,theadequacyoftheredundant reactivitycontrolsystemisdemonstratedbyevaluatingthe specialevent,"reactorshutdownwithoutcontrolrods."Another similarexample,thecapabilitytoperformasafeshutdownfrom outsidethemaincontrolroom,isdemonstratedbyevaluatingthe specialevent,"reactorshutdownfromoutsidethemaincontrol
room."
RBSUSAR 15A-19August198715A.3.4ApplicabilityofEventstoOperatingStatesThefirststepinperforminganoperationalanalysisforagiven"incident"(transient,accident,orspecialevent)isto determineinwhichoperatingstatestheincidentcanoccur.An incidentisconsideredapplicablewithinanoperatingstateif theincidentcanbeinitiatedfromthephysicalconditionsthat characterizetheoperatingstate.Applicabilityofthe"normal operations"totheoperatingstatesfollowsfromthedefinitions ofplannedoperations.Aplannedoperationisconsidered applicablewithinanoperatingstateiftheplannedoperationcan beconductedwhenthereactorexistsunderthephysical conditionsdefiningtheoperatingstate.15A.3.5GuidelinesforEventAnalysis ThefollowingfunctionalguidelinesarefollowedinperformingSACF,operational,anddesignbasisanalysesforthevarious plantevents:1.Anaction,system,orlimitshallbeconsideredessentialonlyifitisessentialtoavoidingan unacceptableresultorsatisfyingthenuclearsafety operationalcriteria.2.Thefullrangeofinitialconditions(asdefinedinSection15A.3.5.(3))shallbeconsideredforeach eventanalyzedsothatallessentialprotection sequencesareidentified.Considerationisnotlimited to"worstcases"becauselessercasessometimesmay requiremorerestrictiveactionsorsystemsdifferent fromthe"worstcases."3.Theinitialconditionsfortransients,accidents,andadditionalplantcapabilityeventsshallbelimitedto conditionsthatwouldexistduringplannedoperations intheapplicableoperatingstate.4.Fornormaloperations,considerationshallbemadeonlyforactions,limits,andsystemsessentialto avoidingtheunacceptableconsequencesduring operationinthatstate(asopposedtotransients, accidents,andadditionalplantcapabilityevents, whicharefollowedthroughtocompletion).Normal operationsaretreateddifferentlyfromotherevents becausethetransferfromonestatetoanotherduring plannedoperationsisdeliberate.Foreventsother thannormaloperations,the RBSUSAR 15A-20August1987transferfromonestatetoanothermaybeunavoidable.5.Limitsshallbederivedonlyforthoseessentialparametersthatarecontinuouslymonitoredbytheoperator.Parameterlimitsassociatedwiththe requiredperformanceofanessentialsystemare consideredtobeincludedintherequirementforthe operabilityofthesystem.Limitsonfrequently monitoredprocessparametersarecalled"envelope limits,"andlimitsonparametersassociatedwiththe operabilityofasafetysystemarecalled"operability limits."Systemsassociatedwiththecontrolofthe envelopeparametersareconsiderednonessentialifit ispossibletoplacetheplantinasafecondition withoutusingthesysteminquestion.6.Fortransients,accidents,andspecialevents,considerationshallbemadefortheentiredurationof theeventandaftereffectsuntilsomeplanned operationisresumed.Normaloperationisconsidered resumedwhentheproceduresbeingfollowedor equipmentbeingusedareidenticaltothoseused duringanyoneofthedefinedplannedoperations.
Where"ExtendedCoreCooling"isanimmediateintegral partoftheevent,itisincludedintheprotection sequence.Whereitmaybeaneventualpartofthe eventitisnotdirectlyaddedbutofcoursecanbe impliedtobeavailable.7.Creditforoperatoractionshallbetakenonacase-by-casebasisdependingontheconditionsthat wouldexistatthetimeoperatoractionwouldbe required.Becausetransients,accidents,andspecial eventsareconsideredthroughtheentiredurationof theeventuntilnormaloperationisresumed,manual operationofcertainsystemsissometimesrequired followingthemorerapidorautomaticportionsofthe event.Creditforoperatoractionistakenonlywhen theoperatorcanreasonablybeexpectedtoaccomplish therequiredactionundertheexistingconditions.8.Fortransients,accidents,andspecialevents,onlythoseactions,limits,andsystemsshallbeconsidered essentialforwhichtherearisesauniquerequirement asaresultoftheevent.Forinstance,ifasystem thatwasoperatingpriortotheevent(duringplanned operation)istobe RBSUSAR 15A-21August1987employedinthesamemannerfollowingtheevent,andiftheeventdidnotaffecttheoperationofthe system,thenthesystemwouldnotappearonthe protectionsequencediagram.9.Theoperationalanalysesshallidentifyallthesupportorauxiliarysystemsessentialtothe functioningofthefront-linesafetysystems.Safety systemauxiliarieswhosefailureresultsinsafe failureofthefront-linesafetysystemsshallbe considerednonessential.10.Asystemoractionthatplaysauniqueroleintheresponsetoatransient,accident,orspecialevent shallbeconsideredessentialunlesstheeffectsof thesystemoractionarenotincludedinthedetailed analysisoftheevent.15A.3.6StepsinanOperationalAnalysisAllinformationneededtoperformanoperationalanalysisforeachplanteventhasbeenpresented(Fig.15A.2-2).Theprocedure followedinperforminganoperationalanalysisforagivenevent (selectedaccordingtotheeventselectioncriteria)isas
follows:1.DeterminetheBWRoperatingstatesinwhichtheeventisapplicable2.Identifyalltheessentialprotectionsequences(safetyactionsandfront-linesafetysystems)forthe eventineachapplicableoperatingstate3.Identifyallthesafetysystemauxiliariesessentialtothefunctioningofthefront-linesafetysystems.TheprecedingthreestepsareperformedinSection15A.6.Toderivetheoperationalrequirementsandtechnicalspecificationsfortheindividualcomponentsofasystemincluded inanyessentialprotectionsequence,thefollowingstepsare
taken:1.Identifyalltheessentialactionswithinthesystem(intrasystemactions)necessaryforthesystemto functiontothedegreenecessarytoavoidthe unacceptableconsequences RBSUSAR 15A-22August19872.Identifytheminimumhardwareconditionsnecessaryforthesystemtoaccomplishtheminimumintrasystem actions3.Ifthesingle-failurecriterionapplies,identifytheadditionalhardwareconditionsnecessarytoachieve theplantsafetyactions(scram,pressurerelief, isolation,cooling,etc)inspiteofsinglefailures.
Thisstepgivesthenuclearsafetyoperational requirementsfortheplantcomponentssoidentified.4.Identifysurveillancerequirementsandallowablerepairtimesfortheessentialplanthardware (Section15A.5.2)5.Simplifytheoperationalrequirementsdeterminedinsteps3and4sothattechnicalspecificationsmaybe obtainedthatencompassthetrueoperational requirementsandareeasilyusedbyplantoperations andmanagementpersonnel.15A.4DISPLAYOFOPERATIONALANALYSISRESULTS15A.4.1General Tofullyidentifyandestablishtherequirements,restrictions,andlimitationsthatmustbeobservedduringplantoperation, plantsystemsandcomponentsmustberelatedtotheneedsfor theiractionsinsatisfyingthenuclearsafetyoperational criteria.Thisappendixdisplaystheserelationshipsinaseries ofblockdiagrams.Tables15A.3-1and15A.6-1through15A.6-5indicatetheoperatingstatesapplicabletoeachevent.Foreachevent,ablockdiagram ispresentshowingtheconditionsandsystemsrequiredtoachieve eachessentialsafetyaction.Theblockdiagramsshowonlythose systemsnecessarytoprovidethesafetyactionssuchthatthe nuclearsafetyoperationalanddesignbasiscriteriaare satisfied.Thetotalplantcapabilitytoprovideasafetyaction isgenerallynotshown,onlytheminimumcapabilityessentialto satisfyingtheoperationalcriteria.Itisveryimportantto understandthatonlyenoughprotectiveequipmentiscitedinthe diagramtoprovidethenecessaryaction.Manyeventscanutilize manymorepathstosuccessthanareshown.Theseoperational analysesinvolvetheminimumequipmentneededtopreventoravert anunacceptableconsequence.Thus,thediagramsdepictall essentialprotectionsequencesforeacheventwiththeleast amountof RBSUSAR 15A-23August1987protectiveequipmentneeded.Oncealloftheseprotectionsequencesareidentifiedinblockdiagramform,system requirementsarederivedbyconsideringalleventsinwhichthe particularsystemisemployed.Theanalysisconsidersthe followingconceptualaspects:1.BWRoperatingstate2.Typesofoperationsoreventsthatarepossiblewithintheoperatingstate3.Relationshipsofcertainsafetyactionstotheunacceptableconsequencesandtospecifictypesofoperationsandevents4.Relationshipsofcertainsystemstosafetyactionsandtospecifictypesofoperationsandevents5.Supportingorauxiliarysystemsessentialtotheoperationofthefront-linesafetysystems6.Functionalredundancy(Thesingle-failurecriterionappliedatthesafetyactionlevel.Thisis,in effect,aqualitative,systemlevel,FMEA-type
analysis.)Eachblockinthesequencediagramsrepresentsafindingof essentialityforthesafetyaction,system,orlimitunder consideration.Essentialityinthiscontextmeansthatthe safetyaction,system,orlimitisneededtosatisfythenuclear safetyoperationalcriteria.Essentialityisdeterminedthrough ananalysisinwhichthesafetyaction,system,orlimitbeing considerediscompletelydisregardedintheanalysesofthe applicableoperationsorevents.Ifthenuclearsafety operationalcriteriaaresatisfiedwithoutthesafetyaction, system,orlimit,thenthesafetyaction,system,orlimitisnot essential,andnooperationalnuclearsafetyrequirementwouldbe indicated.Whendisregardingasafetyaction,system,orlimit resultsinviolatingoneormorenuclearsafetyoperational criteria,thesafetyaction,system,orlimitisconsidered essential,andtheresultingoperationalnuclearsafety requirementscanberelatedtospecificcriteriaandunacceptable
consequences.15A.4.2ProtectionSequenceandSafetySystemAuxiliaryDiagrams Blockdiagramsillustrateessentialprotectionsequencesforeacheventrequiringuniquesafetyactions.These RBSUSAR 15A-24August1987protectionsequencediagramsshowonlytherequiredfront-linesafetysystems.Theformatandconventionsusedforthese diagramsareshowninFig.15A.4-1.Theauxiliarysystemsessentialtothecorrectfunctioningoffront-linesafetysystemsareshownonsafetysystemauxiliary diagrams.Theformatusedforthesediagramsisshownin Fig.15A.4-2.ThediagramindicatesthatauxiliarysystemsA,B, andCarerequiredforproperoperationoffront-linesafety systemX.Totalplantrequirementsforanauxiliarysystemortherelationshipsofaparticularauxiliarysystemtoallother safetysystems(front-lineandauxiliary)withinanoperating stateareshownonthecommonalityofauxiliarydiagrams.The formatusedforthesediagramsisshowninFig.15A.4-3.The conventionemployedinFig.15A.4-3indicatesthatauxiliary systemAisrequired:1.Tobesingle-failureproofrelativetosysteminStateA-eventsX,Y;StateB-eventsX,Y;State C-eventsX,Y,Z;StateD-eventsX,Y,Z2.Tobesingle-failureproofrelativetotheparallelcombinationofsystemsandinStateA-eventsU,V,W;StateB-eventsV,W;StateC-eventsU,V,W,X; StateD-eventsU,V,W,X3.Tobesingle-failureproofrelativetotheparallelcombinationofsystemand[systeminserieswiththeparallelcombinationofsystemsand]inStateC-eventsY,W;StateD-eventsY,W,Z.Asnoted, systemispartofthecombinationbutdoesnotrequireauxiliarysystemAforitsproperoperation.4.ForsysteminStateB-eventsQ,R;StateD-eventsQ,R,S.Withthesethreetypesofdiagrams,itispossibletodetermineforeachsystemthedetailedfunctionalrequirementsand conditionstobeobservedregardingsystemhardwareineach operatingstate.Thedetailedconditionstobeobserved regardingsystemhardwareincludesuchnuclearsafetyoperational requirementsastestfrequenciesandthenumberofcomponents thatmustbeoperable.
RBSUSAR 15A-25August198715A.5BASESFORSELECTINGSURVEILLANCETESTFREQUENCIES15A.5.1NormalSurveillanceTestFrequencies Aftertheessentialnuclearsafetysystemsandengineeredsafeguardshavebeenidentifiedbyapplyingthenuclearsafety operationalcriteria,surveillancerequirementsareselectedfor thesesystems.Inthisselectionprocess,thevarioussystems areconsideredintermsofrelativeavailability,test capability,plantconditionsnecessaryfortesting,and engineeringexperiencewiththesystemtype.15A.5.2AllowableRepairTimes Allowablerepairtimesareselectedbycomputationusingappropriateavailabilityanalysismethodsforredundantstandby systems.Theresultingmaximumaverageallowablerepairtimes assurethatasystem'slong-termavailability,including allowanceforrepair,isnotreducedbelowthetheoretical availabilitythatwouldbeachievedifrepairscouldbemadein zerotime.15A.5.3RepairTimeRule Asafetysystemcanberepairedwhilethereactorisinoperationiftherepairtimeisequaltoorlessthanthemaximumallowable averagerepairtime.Ifrepairisnotcompletewhenthe allowablerepairtimeexpires,theplantmustbeplacedinits safestmode(withrespecttotheprotectionlost).Tomaintainthevalidityoftheassumptionsusedtoestablishtheaboverepairtimerule,thefollowingrestrictionsmustbe
observed:1.Theallowablerepairtimeshouldonlybeusedasneededtorestorefailedequipmenttooperation,not forroutinemaintenance.Usingthistimeshouldbean eventasrareasfailureoftheequipmentitself.
Routinemaintenanceshouldbescheduledwhenthe equipmentisnotneeded.2.Attheconclusionoftherepair,therepairedcomponentmustberetestedandplacedinservice.3.Oncetheneedforrepairofafailedcomponentisdiscovered,repairsshouldproceedasquicklyas possibleconsistentwithgoodcraftmanship.
RBSUSAR 15A-26August1987Alternatively,ifasystemisexpectedtobeoutofrepairforanextendedtime,theavailabilityoftheremainingsystemscanbe maintainedattheprefailurelevelbytestingthemmoreoften.
ThistechniqueisfullydevelopedinReference1.15A.6OPERATIONALANALYSES ResultsoftheoperationalanalysesarediscussedinthefollowingparagraphsanddisplayedonFig.15A.6-1through 15A.6-52andinTables15A.6-1through15A.6-5.15A.6.1SafetySystemAuxiliaries Fig.15A.6-1and15A.6-2showthesafetysystemauxiliariesessentialtothefunctioningofeachfront-linesafetysystem.
CommonalityofauxiliarydiagramsareshowninFig.15A.6-48 through15A.6-52.15A.6.2NormalOperations 15A.6.2.1General Requirementsofthenormalorplannedoperationsnormallyinvolvelimits(L)oncertainkeyprocessvariablesandrestrictions(R) oncertainplantequipment.Thecontrolblockdiagramsforeach operatingstate(Fig.15A.6-3through15A.6-6)showonlythose controlsnecessarytoavoidunacceptablesafetyconsequences,1-1 through1-4ofTable15A.2-1.Table15A.6-1summarizes additionalinformationfornormaloperation.Followingisadescriptionoftheplannedoperations(Events1through6)astheypertaintoeachofthefouroperatingstates.
Thedescriptionofeachoperatingstatecontainsadefinitionof thatstate,alistoftheplannedoperationsthatapplytothat state,andalistofthesafetyactionsthatarerequiredto avoidtheunacceptablesafetyconsequences.15A.6.2.2EventDefinitions Event1-RefuelingOutageRefuelingoutageincludesalltheplannedoperationsassociatedwithanormalrefuelingoutageexceptthosetestsinwhichthe reactorismadecriticalandreturnedtotheshutdownconditions.
Thefollowingplannedoperationsareincludedinrefueling
outage:
RBSUSAR 15A-27August19871.Planned,physicalmovementofcorecomponents(fuel,controlrods,etc)2.Refuelingtestoperations(exceptcriticalityandshutdownmargintests)3.Plannedmaintenance4.Requiredinspection.Event2-AchievingCriticalityAchievingcriticalityincludesalltheplantactionsnormallyaccomplishedinbringingtheplantfromaconditioninwhichall controlrodsarefullyinsertedtoaconditioninwhichnuclear criticalityisachievedandmaintained.Event3-ReactorHeatupHeatupbeginswhereachievingcriticalityendsandincludesallplantactionsnormallyaccomplishedinapproachingnuclearsystem ratedtemperatureandpressurebyusingnuclearpower(reactor critical).Heatupextendsthroughwarmupandsynchronizationof themainturbinegenerator.Event4-PowerOperationPoweroperationbeginswhereheatupendsandcontinuedplantoperationatpowerlevelsinexcessofheatuppowerorsteady stateoperation.Italsoincludesplantmanueverssuchas:1.Dailyelectricalloadreductionandrecoveries2.Electricalgridfrequencycontroladjustment 3.Controlrodmovements 4.Powergenerationsurveillancetestinginvolving:a.Turbinestopvalveclosing b.Turbinecontrolvalveadjustments c.MSIVexercising.Event5-AchievingReactorShutdownAchievingshutdownbeginswherethemaingeneratorisunloadedandincludesallplantactionsnormally RBSUSAR 15A-28August1987accomplishedinachievingnuclearshutdown(morethanonerodsubcritical)afterpoweroperation.Event6-ReactorCooldownCooldownbeginswhereachievingshutdownendsandincludesallplantactionsnormaltothecontinuedremovalofdecayheatand thereductionofnuclearsystemtemperatureandpressure.15A.6.2.3RequiredSafetyActions/RelatedUnacceptable ConsequencesThefollowingparagraphsdescribethesafetyactionsforplannedoperations.Eachdescriptionincludesaselectionofthe operatingstatesthatapplytothesafetyaction,theplant systemaffectedbylimitsorrestrictions,andtheunacceptable consequencethatisavoided.Thefouroperatingstatesare definedinSection15A.6.2.4andsummarizedinTable15A.3-1.
Theunacceptableconsequencescriteriaaretabulatedin Table15A.2-1.15A.6.2.3.1RadioactiveMaterialReleaseControl Radioactivematerialsmaybereleasedtotheenvironsinanyoperatingstate;therefore,radioactivematerialreleasecontrol isrequiredinalloperatingstates.Becauseofthesignificance ofpreventingexcessivereleaseofradioactivematerialstothe environs,thisistheonlysafetyactionforwhichmonitoring systemsareexplicitlyshown.Theoffgasventradiation monitoringsystemprovidesindicationforgaseousreleasethrough themainvent.Gaseousreleasesthroughotherventsare monitoredbytheventilationmonitoringsystem.Theprocess liquidradiationmonitorsarenotrequired,becauseallliquid wastesaremonitoredbybatchsamplingbeforeacontrolled release.Limitsareexpressedontheoffgasventsystem,liquid radwastesystem,andsolidradwastesystemsothattheplanned releasesofradioactivematerialscomplywiththelimitsgivenin 10CFR20,10CFR50,and10CFR71(relatedunacceptablesafetyresult 1-1showninTable15A.2.1).15A.6.2.3.2CoreCoolantFlowRateControl InStateD,whenaboveapproximately10percentNBRpower,thecorecoolantflowratemustbemaintainedabovecertainminimums (i.e.,limited)tomaintaintheintegrityofthefuelcladding (1-2)andassurethevalidityoftheplantsafetyanalysis(1-4).
RBSUSAR 15A-29August198715A.6.2.3.3CorePowerLevelControlTheplantsafetyanalysesofaccidentalpositivereactivityadditionshaveassumedasaninitialconditionthattheneutron sourcelevelisaboveaspecifiedminimum.Becauseasignificant positivereactivityadditioncanonlyoccurwhenthereactoris lessthanonerodsubcritical,theassumedminimumsourcelevel needbeobservedonlyinStatesBandD.Theminimumsource levelassumedintheanalyseshasbeenrelatedtothecounts/sec readingsonthesourcerangemonitors(SRM);thus,thisminimum powerlevellimitonthefuelisexpressedasarequiredSRM countlevel.Observingthelimitassuresvalidityoftheplant safetyanalysis(1-4).Maximumcorepowerlimitsarealso expressedforoperatingStatesBandDtomaintainfuelintegrity (1-2)andremainbelowthemaximumpowerlevelsassumedinthe plantsafetyanalysis(1-4).15A.6.2.3.4CoreNeutronFluxDistributionControl CoreneutronfluxdistributionmustbelimitedinStateD,otherwisecorepowerpeakingcouldresultinfuelfailure(1-2).
Additionallimitsareexpressedinthisstate,becausethecore neutronfluxdistributionmustbemaintainedwithintheenvelope ofconditionsconsideredbyplantsafetyanalysis(1-4).15A.6.2.3.5ReactorVesselWaterLevelControl Inanyoperatingstate,thereactorvesselwaterlevelcould,unlesscontrolled,droptoalevelthatdoesnotprovideadequate corecooling;therefore,reactorvesselwaterlevelcontrol appliestoalloperatingstates.Observationofthereactor vesselwaterlevellimitsprotectsagainstfuelfailure(1-2)and assuresthevalidityoftheplantsafetyanalysis(1-4).15A.6.2.3.6ReactorVesselPressureControl ReactorvesselpressurecontrolisnotneededinStatesAandBbecausevesselpressurecannotbeincreasedaboveatmospheric pressure.InStateC,alimitisexpressedonthereactorvessel toassurethatitisnothydrostaticallytesteduntilthe temperatureisabovetheNDTtemperatureplus60°F;thisprevents excessivestress(1-3).Also,inStatesCandDalimitis expressedontheresidualheatremovalsystemtoassurethatit isnotoperatedintheshutdowncoolingmodewhenthereactor vesselpressureisgreaterthanapproximately100psig;this preventsexcessivestress(1-3).InstatesCandD,alimiton thereactor RBSUSAR 15A-30August1987vesselpressureisnecessitatedbytheplantsafetyanalysis (1-4).15A.6.2.3.7NuclearSystemTemperatureControl InoperatingStatesCandD,alimitisexpressedonthereactorvesseltopreventthereactorvesselheadboltingstudsfrom beingintensionwhenthetemperatureislessthan70°Ftoavoid excessivestress(1-3)onthereactorvesselflange.Thislimit doesnotapplyinStatesAandBbecausetheheadisnotbolted inplaceduringcriticalitytestsorduringrefueling.Inall operatingstates,alimitisexpressedonthereactorvesselto preventanexcessiverateofchangeofthereactorvessel temperaturetoavoidexcessivestress(1-3).InStatesCandD, whereitisplannedoperationtousethefeedwatersystem,a limitisplacedonthereactorfuelsothatthefeedwater temperatureismaintainedwithintheenvelopeofconditions consideredbytheplantsafetyanalysis(1-4).ForStateD,a limitisobservedonthetemperaturedifferencebetweenthe recirculationsystemandthereactorvesseltopreventthe startingoftherecirculationpumps.Thisoperatingrestriction andlimitpreventsexcessivestressinthereactorvessel(1-3).15A.6.2.3.8NuclearSystemWaterQualityControl Inalloperatingstates,waterofimproperchemicalqualitycouldproduceexcessivestressasaresultofchemicalcorrosion(1-3).
Therefore,alimitisplacedonreactorcoolantchemicalquality inalloperatingstates.Foralloperatingstateswherethe nuclearsystemcanbepressurized(StatesCandD),anadditional limitonreactorcoolantactivityassuresthevalidityofthe analysisofthemainsteamlinebreakaccident(1-4).15A.6.2.3.9NuclearSystemLeakageControl Becauseexcessivenuclearsystemleakagecouldoccuronlywhilethereactorvesselispressurized,limitsareappliedonlytothe reactorvesselinStatesCandD.Observingtheselimitsprevents vesseldamageduetoexcessivestress(1-3)andassuresthe validityoftheplantsafetyanalysis(1-4).15A.5.2.3.10CoreReactivityControl InStateAduringrefuelingoutage,alimitoncorefuelloadingtoassurethatcorereactivityismaintainedwithintheenvelope ofconditionsconsideredbytheplantsafety RBSUSAR 15A-31August1987analysis(1-4).Inallstates,limitsareimposedonthecontrolroddrivesystemtoassureadequatecontrolofcorereactivityso thatcorereactivityremainswithintheenvelopeofconditions consideredbytheplantsafetyanalysis(1-4).15A.6.2.3.11ControlRodWorthControl Anytimethereactorisnotshutdownandisgeneratinglessthan20percentpower(StateD),alimitisimposedonthecontrolrod patterntoassurethatcontrolrodworthismaintainedwithinthe envelopeofconditionsconsideredbytheanalysisofthecontrol roddropaccident(1-4).15A.6.2.3.12RefuelingRestriction Bydefinition,plannedoperationevent1(refuelingoutage)appliesonlytoStateA.Observingtherestrictionsonthe reactorfuelandontheoperationofthecontrolroddrivesystem withinthespecifiedlimitmaintainsplantconditionswithinthe envelopeconsideredbytheplantsafetyanalysis(1-4).15A.6.2.3.13ContainmentandReactor/AuxiliaryBuildingPressureandTemperatureControlInStatesCandD,limitsareimposedonthesuppressionpooltemperaturetomaintaincontainmentpressurewithintheenvelope consideredbyplantsafetyanalysis(1-4).Theselimitsassure anenvironmentinwhichinstrumentsandequipmentcanoperate correctlywithinthecontainment.Limitsonthepressure suppressionpoolapplytothewatertemperatureandwaterlevel toassurethatithasthecapabilityofabsorbingtheenergy dischargedduringasafety/reliefvalveblowdown.
15A.6.2.3.14StoredFuelShielding,Cooling,andReactivity ControlBecausebothnewandspentfuelarestoredduringalloperating states,storedfuelshielding,cooling,andreactivitycontrol applytoalloperatingstates.Limitsareimposedonthespent fuelpoolstoragepositions,waterlevel,fuelhandling procedures,andwatertemperature.Observingthelimitsonfuel storagepositionsassuresthatspentfuelreactivityremains withintheenvelopeofconditionsconsideredbytheplantsafety analysis(1-4).Observingthelimitsonwaterlevelassures shieldinginordertomaintainconditionswithintheenvelopeof conditionsconsideredbytheplantsafetyanalysis(1-4)and RBSUSAR 15A-32August1987providesthefuelcoolingnecessarytoavoidfueldamage(1-2).Observingthelimitonwatertemperatureavoidsexcessivefuel poolstress(1-3).15A.6.2.4OperationalSafetyEvaluations StateAInStateAthereactorisinashutdowncondition,thevesselheadisoff,andthevesselisatatmosphericpressure.The applicableeventsforplannedoperationsarerefuelingoutage, achievingcriticality,andcooldown(Events1,2,and6, respectively).Fig.15A.6-3showsthenecessarysafetyactionsforplannedoperations,thecorrespondingplantsystems,andtheeventfor whichtheseactionsarenecessary.Asindicatedinthediagram, therequiredsafetyactionsareasfollows:SafetyActionsRadioactivematerialreleasecontrolReactorvesselwaterlevelcontrol Nuclearsystemtemperaturecontrol Nuclearsystemwaterqualitycontrol Corereactivitycontrol Refuelingrestrictions Storedfuelshielding,cooling,andreactivitycontrolStateBInStateBthereactorvesselheadisoff,thereactorisnot shutdown,andthevesselisatatmosphericpressure.Applicable plannedoperationsareachievingcriticalityandachieving shutdown(Events2and5,respectively).Fig.15A.6-4relatesthenecessarysafetyactionsforplannedoperations,theplantsystems,andtheeventforwhichthesafety actionsarenecessary.Therequiredsafetyactionsforplanned operationinStateBareasfollows:SafetyActionsRadioactivematerialreleasecontrolCorepowerlevelcontrol Reactorvesselwaterlevelcontrol Nuclearsystemtemperaturecontrol Nuclearsystemwaterqualitycontrol Corereactivitycontrol Rodworthcontrol RBSUSAR 15A-33August1987Storedfuelshielding,cooling,andreactivitycontrolStateCInStateCthereactorvesselheadisonandthereactorisshutdown.Applicableplannedoperationsareachieving criticalityandcooldown(Events2and6,respectively).Sequencediagramsrelatingsafetyactionsforplannedoperations,plantsystems,andapplicableeventsareshowninFig.15A.6-5.
TherequiredsafetyactionsforplannedoperationinStateCare asfollows:SafetyActionsRadioactivematerialreleasecontrolReactorvesselwaterlevelcontrol Reactorvesselpressurecontrol Nuclearsystemtemperaturecontrol Nuclearsystemwaterqualitycontrol Nuclearsystemleakagecontrol Corereactivitycontrol Containmentbuildingpressureandtemperaturecontrol Spentfuelstorageshielding,cooling,andreactivity controlStateDInStateDthereactorvesselheadisonandthereactorisnot shutdown.Applicableplannedoperationsareachieving criticality,heatup,poweroperation,andachievingshutdown (Events2,3,4,and5,respectively).Fig.15A.6-6relatessafetyactionsforplannedoperations,correspondingplantsystems,andeventsforwhichthesafety actionsarenecessary.Therequiredsafetyactionsforplanned operationinStateDareasfollows:SafetyActionsRadioactivematerialreleasecontrolCorecoolantflowratecontrol Corepowerlevelcontrol Coreneutronfluxdistributioncontrol Reactorvesselwaterlevelcontrol Reactorvesselpressurecontrol Nuclearsystemtemperaturecontrol Nuclearsystemwaterqualitycontrol Nuclearsystemleakagecontrol Corereactivitycontrol RBSUSAR 15A-34August1987RodworthcontrolContainmentbuildingpressureandtemperaturecontrol Spentfuelstorageshielding,cooling,andreactivity control15A.6.3AnticipatedOperationalTransients15A.6.3.1General Thesafetyrequirementsandprotectionsequencesforanticipatedoperationaltransientsaredescribedinthefollowingparagraphs forEvents7through29.Theprotectionsequenceblockdiagrams showthesequenceoffront-linesafetysystems.(Referto Fig.15A.6-7through15A.6-30.)Theauxiliariesforthe front-linesafetysystemsareindicatedintheauxiliarydiagrams (Fig.15A.6-1and15A.6-2)andthecommonalityofauxiliary diagrams(Fig.15A.6-48through15A.6-52).15A.6.3.2RequiredSafetyActions/RelatedUnacceptable ConsequencesThefollowinglistrelatesthesafetyactionsforanticipatedoperationaltransientstomitigateorpreventtheunacceptable safetyconsequences.RefertoTable15A.6-2fortheunacceptable consequencescriteria.
Related Unacceptable
ConsequencesSafetyAction CriteriaReasonActionRequiredScramand/or 2-2Topreventfueldamageand RPT 2-3tolimitRPVsystempres-surerise.Pressurerelief2-3TopreventexcessiveRPV systempressurerise.CoreandCon-2-1,2-2,Topreventfuelandcon-tainment 2-4tainmentdamageinthe coolingeventthatnormalcooling isinterrupted.
RBSUSAR 15A-35August1987 Related Unacceptable ConsequencesSafetyAction CriteriaReasonActionRequiredReactorvessel2-2Topreventfueldamageby isolationreducingtheoutflowof steamandwaterfromthe reactorvessel,thereby limitingthedecreasein reactorvesselwater
level.Restoreac 2-2Topreventfueldamageby powerrestoringacpowerto systemsessentialto othersafetyactions.Prohibitrod 2-2Topreventexceedingfuel motionlimitsduringtransients.
Containment2-1,2-4Tominimizeradiological isolation effects.15A.6.3.3EventDefinitionsandOperationalSafety EvaluationsEvent7-ManualandInadvertentSCRAMThedeliberatemanualorinadvertentautomaticSCRAMdueto singleoperatorerrorisaneventwhichcanoccurunderany operatingcondition.Althoughassumedtooccurherefor examinationpurpose,multioperatorerrororactionisnecessary toinitiatesuchanevent.Whileallthesafetycriteriaapply,nouniquesafetyactionsarerequiredtocontroltheplannedoperation-likeeventafter effectsofthesubjectinitiationactions.Inalloperating states,thesafetycriteriaarethereforemetthroughthebasic designoftheplantsystems.Fig.15A.6-7identifiesthe protectionsequencesforthisevent.Event8-Loss-of-PlantInstrumentorServiceAirSystemLossofallplantinstrumentorserviceairsystemcausesreactorshutdownandtheclosureofisolationvalves.Althoughthese actionsoccur,theyarenotarequirementtopreventunacceptable consequencesinthemselves.Multiequipmentfailureswouldbe necessaryinordertocausethedeteriorationofthesubject systemtothepointthat RBSUSAR 15A-36August1987thecomponentssuppliedwithinstrumentorserviceairwouldceasetooperate"normally"and/or"fail-safe."Theresulting actionsareidenticaltotheEvent14describedlater.Isolationofthemainsteamlinescanresultinatransientforwhichsomedegreeofprotectionisrequiredonlyinoperating StatesCandD.InoperatingStatesAandB,themainsteam linesarecontinuouslyisolated.IsolationofallmainsteamlinesismostsevereandrapidinoperatingStateDduringpoweroperation.Fig.15A.6-8,15A.6-14,and15A.6-15showhowscramisaccomplishedbymainsteamisolationthroughtheactionsofthe reactorprotectionsystemandthecontrolroddrivesystem.The nuclearsystempressurereliefsystemprovidespressurerelief.
Pressurerelief,combinedwithlossoffeedwaterflow,causes reactorvesselwaterleveltofall.Thehigh-pressurecore coolingsystemsupplieswatertomaintainwaterlevelandto protectthecoreuntilnormalsteamflow(orotherplanned operation)isestablished.AdequatereserveserviceairsuppliesaremaintainedexclusivelyforthecontinualoperationoftheADSsafety/reliefvalvesuntil reactorshutdownisaccomplished.
Event9-InadvertentHPCSPumpStart(ModeratorTemperatureDecrease)Aninadvertentpumpstart(temperaturedecrease)isdefinedasan unintentionalstartofanynuclearsystempumpthatadds sufficientcoldwatertothereactorcoolantinventorytocausea measurabledecreaseinmoderatortemperature.Thiseventis consideredinalloperatingstatesbecauseitcanpotentially occurunderanyoperatingcondition.SincetheHPCSpump operatesovernearlytheentirerangeoftheoperatingstatesand deliversthegreatestamountofcoldwatertothevessel,the followinganalysisdescribesitsinadvertentoperationrather thanotherNSSSpumps(e.g.,RCICS,RHRS,LPCS).Whileallthesafetycriteriaapply,nouniquesafetyactionsarerequiredtocontroltheadverseeffectsofsuchapumpstart (i.e.,pressureincreaseandtemperaturedecreaseinStatesAand C).Intheseoperatingstates,thesafetycriteriaaremet throughthebasicdesignoftheplantsystems,andnosafety actionisspecified.InStatesBandD,wherethereactorisnot shutdown,the RBSUSAR 15A-37August1987operatorortheplantnormalcontrolsystemcancontrolanypowerchangesinthenormalmannerofpowercontrol.Fig.15A.6-9illustratestheprotectionsequenceforthesubjectevent.Singlefailurestothenormalplantcontrolsystem pressureregulatororthefeedwatercontrollersystemsresultin furtherprotectionsequences.TheseareshowninEvents22and
23.Event10-StartupofIdleRecirculationPumpThecold-loopstartupofanidlerecirculationpumpcanoccurinanystateandismostsevereandrapidforthoseoperatingstates inwhichthereactormaybecritical(StatesBandD).Whenthe transientoccursintherangeof10to60percentpower operation,nosafetyactionresponseisrequired.Reactorpower isnormallylimitedtoapproximately60percentdesignpower becauseofcoreflowlimitationswhileoperatingwithone recirculationloopworking.Aboveabout60percentpower,ahigh neutronfluxscramisinitiated.Fig.15A.6-10showsthe protectivesequenceforthisevent.Event11-RecirculationFlowControlFailure(IncreasingFlow)ArecirculationflowcontrolfailurecausingincreasedflowisapplicableinStatesCandD.InStateD,theresultingincrease inpowerlevelislimitedbyareactorscram.Asshownin Fig.15A.6-11,thescramsafetyactionisaccomplishedthrough thecombinedactionsoftheneutronmonitoring,reactor protection,andcontrolroddrivesystems.Event12-RecirculationFlowControlFailure(DecreasingFlow)Thisrecirculationflowcontrolmalfunctioncausesadecreaseincorecoolantflow.ThiseventisnotapplicabletoStatesAand Bbecausethereactorvesselheadisoffandtherecirculation pumpsnormallywouldnotbeinuse.Thenumberandtypeofflowcontrollerfailuremodesdeterminetheprotectionsequencefortheevent.Forflowcontrolvalve controlsystems,thefastclosureofoneortwocontrolvalves resultsintheprotectivesequenceofFig.15A.6-12.
RBSUSAR 15A-38August1987Event13-TripofOneorBothRecirculationPumpsThetripofonerecirculationpumpproducesamildertransientthandoesthesimultaneoustripoftworecirculationpumps.Thetransientresultingfromthistwo-looptripisnotsevereenoughtorequireanyuniquesafetyaction.Thetransientis compensatedforbytheinherentnuclearstabilityofthereactor.
ThiseventisnotapplicableinStatesAandBbecausethe reactorvesselheadisoffandtherecirculationpumpsnormally wouldnotbeinuse.ThetripcouldoccurinStatesCandD; however,thereactorcanaccommodatethetransientwithnounique safetyactionrequirement.Fig.15A.6-13providestheprotection sequencefortheeventforoneorbothpumptripactuations.Infact,thiseventconstitutesanacceptableoperationaltechniquetoreduceorminimizetheeffectsofotherevent conditions.Tothisend,anengineeredrecirculationpumptrip capabilityisincludedintheplantoperationaldesigntoreduce pressureandthermohydraulictransienteffects.Operating StatesCandDareinvolvedinthisevent.Trippingasinglerecirculationpumprequiresnoprotectionsystemoperation.Atwopumptripresultsinahighwaterleveltripofthemainturbinewhichfurthercausesastopvalveclosureandits subsequentSCRAMactuation.Mainsteamisolationsoonoccursand isfollowedbyRCIC/HPCSsystemsinitiationonlowwaterlevel.
Reliefvalveacuationfollows.Event14-IsolationofOneorAllMainSteamLinesIsolationofthemainsteamlinescanresultinatransientforwhichsomedegreeofprotectionisrequiredonlyinoperating StatesCandD.InoperatingStatesAandB,themainsteam linesarecontinuouslyisolated.IsolationofallmainsteamlinesismostsevereandrapidinoperatingStateDduringpoweroperation.Fig.15A.6-14showshowscramisaccomplishedbymainsteamisolationthroughtheactionsofthereactorprotectionsystem andthecontrolroddrivesystem.Thenuclearsystempressure reliefsystemprovidespressurerelief.Pressurerelief,combined withlossoffeedwaterflow,causesreactorvesselwaterlevelto fallandhigh-pressurecoreandRCICcoolingsystemssupplywater tomaintainwaterlevelandto RBSUSAR 15A-39August1987protectthecoreuntilnormalsteamflow(orotherplannedoperation)isestablished.IsolationofonemainsteamlinecausesasignificanttransientonlyinStateDduringhighpoweroperation.Scramistheonly uniqueactionrequiredtoavoidfueldamageandnuclearsystem overpressure.Becausethefeedwatersystemandmaincondenser remaininoperationfollowingtheevent,nouniquerequirement arisesforcorecooling.AsshowninFig.15A.6-15,thescramsafetyactionisaccomplishedthroughthecombinedactionsoftheneutron monitoring,reactorprotection,andcontrolroddrivesystems.Event15-InadvertentOpeningoftheSafety/ReliefValveTheinadvertentopeningofasafety/reliefvalveispossibleinanyoperatingstate.Theprotectionsequencesareshownin Fig.15A.6-16.InStatesA,B,andC,thewaterlevelcannotbe loweredfarenoughtothreatenfueldamage;therefore,nosafety actionsarerequired.InStateD,thereisaslightdecreaseinreactorpressurefollowingtheevent.Thepressureregulatorclosesthemain turbinecontrolvalvesenoughtostabilizepressureatalevel slightlybelowtheinitialvalue.Therearenouniquesafety systemrequirementsforthisevent.IftheeventoccurswhenthefeedwatersystemisnotactiveinStateD,alossinthecoolantinventoryresultsinareactor vesselisolation.Thelowwaterlevelsignalinitiatesreactor vesselisolation.Thenuclearsystempressurereliefsystem providespressurerelief.CorecoolingisaccomplishedbytheRCICandHPCSsystemswhichareautomaticallyinitiatedbytheincidentdetectioncircuitry (IDC).Theautomaticdepressurizationsystem(ADS)orthemanual reliefvalvesystemremainasthebackupdepressurizationsystem ifneeded.Afterthevesselhasdepressurized,longtermcore coolingisaccomplishedbytheLPCI,LPCS,andHPCS,whichare initiatedonalowwaterlevelbytheIDCsystemoraremanually operated.Containment-suppressionpoolcoolingismanually
initiated.
RBSUSARRevision13 15A-40September2000 Event16-ControlRodWithdrawalErrorDuringRefueling StartupOperationsBecauseacontrolrodwithdrawalerrorresultinginanincreaseofpositivereactivitycanoccurunderanyoperatingcondition, itmustbeconsideredinalloperatingstates.Forthisspecific eventsituation,onlyStateAandBapply.
RefuelingNouniquesafetyactionisrequiredinoperatingStateAforthewithdrawalofonecontrolrodbecausethecoreismorethanone controlrodsubcritical.Withdrawalofmorethanonecontrolrod isprecludedbytheprotectionsequenceshowninFig.15A.6-17.
Duringcorealterations,themodeswitchisnormallyinthe REFUELposition,whichallowstherefuelingequipmenttobe positionedoverthecoreandalsoinhibitscontrolrod withdrawal.Thistransient,therefore,appliesonlytooperating StateA.Nosafetyactionisrequiredbecausethetotalworth(positivereactivity)ofonefuelassemblyorcontrolrodisnotadequate tocausecriticality.Moreover,mechanicaldesignofthecontrol rodassemblypreventsphysicalremovalwithoutremovingthe adjacentfuelassemblies.
StartupDuringlowpoweroperation(StateB),theneutronmonitoringsystemviatheRPSinitiatesaSCRAMifnecessary.Referto Fig.15A.6-17.
Event17-ControlRodWithdrawalError(DuringPowerOperation)Becauseacontrolrodwithdrawalerrorresultinginanincrease ofpositivereactivitycanoccurunderanyoperatingcondition, itmustbeconsideredinalloperatingstates.Forthisspecific eventsituation,onlyStatesCandDapply.Duringpoweroperation(PowerRangeStateD),anumberofplantprotectivedevicesofvariousdesignsprohibitthecontrolrod motionbeforecriticallevelsarereached.Referto Fig.15A.6-18.WhileinStateCnoprotectiveactionisneeded.13Systemsinthepowerrange(0to100percentNBR)preventtheselectionofanout-of-sequencerodmovementbyuseof 13 RBSUSARRevision13 15A-41September200013theRodControlandInformationSystem(RC&IS).TheRodPatternControlSystem(RPCS)isasub-systemoftheRC&ISandisusedto enforcebankedpositionwithdrawalsequences.Inaddition,the movementofcontrolrodsismonitoredandlimitedwithin acceptableintervalsbyactualrodmotion.TheRodWithdrawal Limiter(RWL)ofRPCSprovidesthismovementsurveillance.
13Event18-LossofShutdownCoolingThelossofRHRS-shutdowncoolingcanoccuronlyduringthelowpressureportionofanormalreactorshutdownandcooldown.
AsshowninFig.15A.6-19,formostsinglefailuresthatcould resultinprimarylossofshutdowncoolingcapabilities,no uniquesafetyactionsarerequired;inthesecases,shutdown coolingissimplyreestablishedusingredundantshutdowncooling equipment.InthecaseswheretheRHR-shutdowncoolingsuction linebecomesinoperative,auniquearrangementforcooling arises.InStatesAandB,inwhichthereactorvesselheadis off,theLPCI,LPCS,orHPCScanbeusedtomaintainreactor vesselwaterlevel.InStatesCandD,inwhichthereactor vesselheadisonandthesystemcanbepressurized,the automaticdepressurizationsystem(ADS)ormanualoperationof reliefvalvesinconjunctionwithanyoftheECCSandtheRHRS suppressionpoolcoolingmode(bothmanuallyoperated)canbe usedtomaintainwaterlevelandremovedecayheat.Suppression poolcoolingisactuatedtoremoveheatenergyfromthe suppressionpoolsystem.Event19-RHRShutdownCooling-IncreasedCoolingAnRHRshutdowncoolingmalfunctioncausingamoderatortemperaturedecreasemustbeconsideredinalloperatingstates.
However,thiseventisnotconsideredinStatesCandDifRPV systempressureistoohightopermitoperationoftheshutdown coolingmodeofRHR.RefertoFig.15A.6-20.Nouniquesafety actionsarerequiredtoavoidtheunacceptablesafety consequencesfortransientsasaresultofareactorcoolant temperaturedecreaseinducedbymisoperationoftheshutdown coolingheatexchangers.InStatesBandD,wherethereactorisatornearcritical,theslowpowerincreaseresultingfromthecoolermoderator temperaturewouldbecontrolledbytheoperatorinthesame mannernormallyusedtocontrolpowerinthesourceor intermediatepowerranges.
RBSUSAR 15A-42August1987Event20-LossofAllFeedwaterFlowAlossoffeedwaterflowresultsinanetdecreaseinthecoolantinventoryavailableforcorecooling.Alossoffeedwaterflow canoccurinStatesCandD.Appropriateresponsestothis transientincludeareactorscramonlowwaterleveland restorationofRPVwaterlevelbyRCICandHPCS.AsshowninFig.15A.6-21,thereactorprotectionandcontrolroddrivesystemseffectascramonlowwaterlevel.Thecontainment andreactorvesselisolationcontrolsystem(CRVICS)andthemain steamisolationvalves(MSIV)acttoisolatethereactorvessel.
AftertheMSIVsclose,decayheatslowlyraisessystempressure tothelowestreliefvalvesetting.Pressureisrelievedbythe RPVpressurereliefsystem.EithertheRCICorHPCSsystemcan maintainadequatewaterlevelforinitialcorecoolingandto restoreandmaintainwaterlevel.Forlongtermshutdownand extendedcorecooling,containment/suppressionpoolcooling systemsaremanuallyinitiated.TherequirementsforoperatingStateCarethesameasforStateDexceptthatthescramactionisnotrequiredinStateC.Event21-LossofaFeedwaterHeaterLossofafeedwaterheatermustbeconsideredwithregardtothenuclearsafetyoperationalcriteriaonlyinoperatingStateD becausesignificantfeedwaterheatingdoesnotoccurinanyother operatingstate.Alossoffeedwaterheatingcausesatransientthatrequiresnoprotectiveactionswhenthereactorisinitiallyonautomatic recirculationflowcontrol.Ifthereactorisonmanualflow control,however,theneutronfluxincreaseassociatedwiththis eventreachesthescramsetpoint.AsshowninFig.15A.6-22, thescramsafetyactionisaccomplishedthroughactionsofthe neutronmonitoring,reactorprotection,andcontrolroddrive
systems.Rvent22-FeedwaterControllerFailure-MaximumDemandAfeedwatercontrollerfailure,causinganexcessofcoolantinventoryinthereactorvessel,ispossibleinalloperating states.Feedwatercontrollerfailuresconsideredarethosethat wouldgivefailuresofautomaticflowcontrol,manualflow control,orfeedwaterbypassvalvecontrol.Inoperating StatesAandB,nosafetyactionsare RBS USAR Revision 25 15A-43 required since the vessel head is removed and the moderator temperature is low. In operating State D, any positive reactivity effects by the reactor caused by cooling of the
moderator can be mitigated by a scram. As shown in Fig. 15A.6-23, the accomplishment of the scram safety action is satisfied through the combined actions of the neutron monitoring, reactor protection, and control rod drive systems. Pressure relief is required in States C and D and is achieved through the operation of the RPV pressure relief system. Initial restoration of the core water level is by the RCIC and HPCS systems.
Prolonged isolation may require extended core cooling and
containment/suppression pool cooling.
Event 23 - Pressure Regulator Failure (Open Direction) (Note 1)
A pressure regulator failure in the open direction, causing the
opening of a turbine control or bypass valve, applies only in operating States C and D, because in other states the pressure
regulator is not in operation. A pressure regulator failure is
most severe and rapid in operating State D.
The various protection sequences giving the safety actions are shown in Fig. 15A.6-24. Depending on plant conditions existing
prior to the event, scram is initiated either on main steam isolation, main turbine trip, reactor vessel high pressure, or reactor vessel low water level. The sequence resulting in reactor vessel isolation also depends on initial conditions.
With the mode switch in "RUN," isolation is initiated when main steam line pressure decreases to approximately 825 psig. Under other conditions, isolation is initiated by reactor vessel low water level. After isolation is completed, decay heat causes
reactor vessel pressure to increase until limited by the operation of the relief valves. Core cooling following isolation can be provided by RCIC or HPCS. Shortly after reactor vessel isolation, normal core cooling can be reestablished via the main condenser and feedwater systems, or if prolonged isolation is
necessary, extended core and containment cooling are manually
actuated.
Event 24 - Pressure Regulator Failure - Closed
A pressure regulator failure in the closed direction (or downscale), causing the closing of turbine control valves, applies only in operating States C and D, because in other states
the pressure regulator is not in operation.
NOTE 1: The pressure regulator failure-open is no longer a postulated single failure scenario; no Ovation TCPS single failure scenarios are postulated that could result in all valves open. This specific USAR section is maintained for historical purposes.
RBS USAR Revision 25 15A-44 A single pressure regulator failure downscale would result in no effect on the plant ope ration. The pr essure regulator w o uld provide tur bine-react or control. If the ba ckup regulator failed this would result in a worse situation, yet it is much less severe than Events 25, 27, 30, and 31. The dual pr essure regulator failures a re most severe and rap id in operati n g State D a t high powe
- r. The various protection sequences giving the safety actions are shown in Fig. 15A.6-25. Upon failure of one pressure regulator downscale, normally a backup regulator maintains the plant in the present status upon the initial regulator downscale failure. An additional single active component failure of the backup regulator results in a high flux or pressure SCRAM, system isolation, and subsequent extended isolation core cooling system
actuations.
Event 25 - Main Turbine Trip (With By-Pass System Operation) 14 A main turbine trip can occur only in operating State D (during heatup or power operation). For a turbine trip above 40 percent power, a scram occurs via turbine stop valve closure as does a recirculation pump trip (RPT). Subsequent relief valve actuation
does occur. Eventual main steam isolation and RCIC and HPCS system initiation result from low water level. At below 40
percent power and above approximately 10 percent power, this
event is terminated either by a high flux scram or pressure scram, to achieve shutdown. At below approximately 10 percent power, the plant may or may not be shut down due to a main turbine trip. Fig. 15A.6-26 depicts the protection sequences required for a main turbine trip. Main turbine trip and main generator trip are similar anticipated operational transients
and, although main turbine trip is a more severe transient than main generator trip due to the rapid closure of the turbine stop
valves, the required safety actions are the same.
14 Event 26 - Loss of Main Condenser Vacuum (Turbine Trip)
A loss of vacuum in the main turbine condenser can occur any time steam pressure is available and the condenser is in use; it is applicable to operating States C and D. This nuclear system pressure increase transient is the most severe of the pressure increase transients. However, scram protection in State C is not
needed since the reactor is not coupled to the turbine system. For State D above 40 percent power, loss of condenser vacuum initiates a turbine trip, with its attendant stop valve closures, (which leads to SCRAM) and a recirculation pump RBSUSARRevision14 15A-45September2001trip(RPT).Italsoinitiatesisolation,pressurerelievevalveactuation,andRCICandHPCSinitialcorecooling.Ascramis initiatedbyMSIVclosuretopreventfueldamageandis accomplishedwiththeactionsofthereactorprotectionsystem andcontrolroddrivesystem.Below40percentpower(StateD) scramisinitiatedbyahighneutronfluxsignal.Fig.15A.6-27 showstheprotectionsequences.Decayheatnecessitatesextended coreandsuppressionpoolcooling.WhentheRPVdepressurizes sufficiently,thelowpressurecorecoolingsystemsprovidecore coolinguntilaplannedoperationviaanRHRshutdowncooling modeisachieved.Event27-MainGeneratorTrip(WithBypassSystemOperation)14AmaingeneratortripwithbypasssystemoperationcanoccuronlyinoperatingStateD(duringheatuporpoweroperation).Fast closureofthemainturbinecontrolvalvesisinitiatedwhenever anelectricalgriddisturbanceoccurswhichresultsin significantlossofelectricalloadonthegenerator.The turbinecontrolvalvesarerequiredtocloseasrapidlyas possibletopreventexcessiveoverspeedofthemain turbine-generatorrotor.Closureoftheturbinecontrolvalves causesasuddenreductioninsteamflowwhichresultsinan increaseinsystempressure.Above40percentpower,scramoccurs asaresultoffastcontrolvalveclosure.Turbinetripping actuatestherecirculationpumptrip(RPT).Subsequently,main steamisolationresults,andpressurereliefandinitialcore coolingbyRCICandHPCStakeplace.Prolongedshutdownofthe turbine-generatorunitnecessitatesextendedcoreandcontainment cooling.Atbelow40percentpowerandaboveapproximately10 percentpower,thiseventisterminatedeitherbyahighflux scramorpressurescram,toachieveshutdown.Atbelow approximately10percentpower,theplantmayormaynotbe shutdownduetoamaingeneratortrip.Fig.15A.6-28depictsthe protectionsequencesrequiredforamaingeneratortrip.Main generatortripandmainturbinetriparesimilaranticipated operationaltransients.Althoughthemaingeneratortripisa lessseveretransientthanaturbinetripduetotherapid closureoftheturbinestopvalves,therequiredsafetyactions forbotharethesamesequence.
14Event28-LossofNormalOnsitePowerThereisavarietyofpossibleplantelectricalcomponent failureswhichcouldaffectthereactorsystem.Thetotalloss ofonsiteacpoweristhemostsevere.Thelossofauxiliary powertransformerresultsinasequenceofevents RBSUSAR 15A-46August1987similartothatresultingfromalossoffeedwaterflow.ThemostseveresituationoccursinStateDduringpoweroperation.
Fig.15A.6-29showsthesafetyactionsrequiredtoaccommodatea lossofnormalonsitepowerintheStatesA,B,C,andD.Thereactorprotectionandcontrolroddrivesystemseffectascramonmainturbinetriporlossofreactorprotectionsystem powersources.Theturbinetripactuatesarecirculationpump trip(RPT).Thecontainmentandreactorvesselisolationcontrol system(CRVICS)andthemainsteamisolationvalvesactto isolatethereactorvessel.AftertheMSIVSclose,decayheat slowlyraisessystempressuretothelowestreliefvalvesetting.
PressureisrelievedbytheRPVpressurereliefsystem.With continuedisolation,decayheatmaycauseincreasedRPVpressure, andperiodicallyliftreliefvalveswhichcausesreactorvessel waterleveltodecrease.Thecoreandcontainmentcooling sequencesshowninFig.15A.6-29denotetheshortandlongterm actionsforachievingadequatecooling.Event29-LossofOffsitePowerThereisavarietyofplant-gridelectricalcomponentfailureswhichcanaffectreactoroperation.Thetotallossofoffsiteac poweristhemostsevere.Thelossofbothonsiteandoffsite auxiliarypowersourcesresultsinasequenceofeventssimilar tothatresultingfromalossoffeedwaterflow(seeEvent20).
ThemostseverecaseoccursinStateDduringpoweroperation.
Fig.15A.6-30showsthesafetyactionsrequiredforatotalloss ofoffsitepowerinallStatesA,B,C,andD.Thereactorprotectionandcontrolroddrivesystemsaffectascramfrommainturbinetriporlossofreactorprotectionsystem powersources.Theturbinetripinitiatesrecirculationpump trip(RPT).Thecontainmentandreactorvesselisolationcontrol system(CRVICS)andtheMSIVsacttoisolatethereactorvessel.
AftertheMSIVsclose,decayheatslowlyraisessystempressure tothelowestreliefvalvesetting.Pressureisrelievedbythe nuclearsystempressurereliefsystem.Afterthereactoris isolatedandfeedwaterflowhasbeenlost,decayheatcontinues toincreaseRPVpressure,periodicallyliftingreliefvalvesand causingreactorvesselwaterleveltodecrease.Thecoreand containmentcoolingsequenceshowninFig.15A.6-30showsthe shortandlongtermsequencesforachievingadequatecooling.
RBSUSAR 15A-47August198715A.6.4AbnormalOperationalTransients15A.6.4.1General Thesafetyrequirementsandprotectionsequencesforabnormaloperationaltransientsaredescribedinthefollowingparagraphs forEvents30through39.Theprotectionsequenceblockdiagrams showthesequenceoffront-linesafetysystems(referto Fig.15A.6-31through15A.6-35).Theauxiliariesforthe front-linesafetysystemsareindicatedintheauxiliarydiagrams (Fig.15A.6-1and15A.6-2)andthecommonalityofauxiliary diagrams(Fig.15A.6-48through15A.6-52).15A.6.4.2RequiredSafetyActions/RelatedUnacceptable ConsequencesThefollowinglistrelatesthesafetyactionsforabnormaloperationaltransientstomitigateorpreventtheunacceptable safetyconsequencescitedinTable15A.2-3.
Related UnacceptableSafetyAction ConsequenceReasonActionRequiredScramand/orRPT3-2Tolimitgrosscore-wide 3-3fueldamageandtolimitnuclearsystempressure
rise.PressureRelief3-3Topreventexcessivenuclearsystempressure
rise.Core,suppression3-2,Tolimitfurtherfuelandpoolandcontain-3-4containmentdamageinthementcoolingeventthatnormalcooling isinterrupted.Reactorvessel3-2Tolimitfurtherfuel isolationdamagebyreducingthe outflowofsteamand waterfromthereactor vessel,therebylimiting thedecreaseinreactor vesselwaterlevel.
RBSUSAR 15A-48August1987 Related UnacceptableSafetyAction ConsequenceReasonActionRequiredRestoreacpower 3-2Tolimitinitialfueldamagebyrestoringac powertosystemsessen-tialtoothersafety
actions.Containment 3-1Tolimitradiological isolation effects.15A.6.4.3EventDefinitionandOperationSafety Evaluation Event30-MainGeneratorTrip(WithoutBypassSystemOperation)Amaingeneratortripwithoutbypasssystemoperationcanoccur onlyinoperatingStateD(duringheatuporpoweroperation).A generatortripduringheatupwithoutbypassoperationresultsin thesamesituationasthepoweroperationcase.Fig.15A.6-31 depictstheprotectionsequencesrequiredforamaingenerator trip.Theeventisbasicallythesameasthatdescribedin Event27atpowerlevelsabove40percent.Ascram,RPT, isolation,reliefvalve,andRCICandHPCSoperationimmediately resultinprolongedshutdown,whichfollowsthesamepatternas Event27.Thethermal-hydraulicandthermodynamiceffectsonthecore,ofcourse,aremoreseverethanwiththebypassoperating.Since theeventisoflowerprobabilitythanEvent27,theunacceptable consequencesarelesslimiting.Theloadrejectionandturbinetriparesimilarabnormaloperationaltransientsand,althoughmaingeneratortripisa lessseveretransientthanaturbinetripduetotherapid closureoftheturbinestopvalves,therequiredsafetyactions arethesame.
Event31-MainTurbineTrip(WithoutBypassSystemOperation)Amainturbinetripwithoutbypasscanoccuronlyinoperating StateD(duringheatuporpoweroperation).Fig.15A.6-32depicts theprotectionsequencesrequiredformainturbinetrips.Plant operationwithbypasssystemoperationaboveorbelow40percent power,duetobypass RBSUSAR 15A-49August1987systemfailure,resultsinthesametransienteffects:ascram,anRPT,anisolation,subsequentreliefvalveactuation,and immediateRCICandHPCSacuation.Afterinitialshutdown, extendedcoreandcontainmentcoolingisrequiredasnoted previouslyinEvent25.Turbinetripswithoutbypasssystemoperationsresultinveryseverethermohydraulicimpactsonthereactorcore.Theallowable limitoracceptablecalculationaltechniquesforthiseventis lessrestrictivesincetheeventisoflowerprobabilityof occurrencethantheturbinetripwithabypassoperationevent.
Event32-InadvertentLoadingandOperationwithFuelAssemblyin ImproperPositionOperationwithafuelassemblyintheimproperpositionisshown inFig.15A.6-33andcanoccurinalloperatingstates.No protectionsequencesarenecessaryrelativetothisevent.
Calculatedresultsofworstfuelhandlingloadingerrorwillnot causefuelcladdingintegritydamage.Itrequiresthree independentequipment/operatorerrorstoallowthissituationto
develop.Events33through37-NotUsedEvent38-RecirculationLoopPumpSeizureArecirculationlooppumpseizureeventconsiderstheinstantaneousstoppageofthepumpmotorshaftofone recirculationlooppump.Thecaseinvolvesoperationatdesign powerinStateD.Amainturbinetripoccursasvesselwater levelswellexceedstheturbinetripsetpoint.Thisresultsina tripscramandanRPTwhentheturbinestopvalvesclose.Relief valveopeningoccurstocontrolpressurelevelandtemperatures.
TheRCICorHPCSsystemmaintainsvesselwaterlevel.Prolonged isolationrequirescoreandcontainmentcoolingandpossiblysome radiologicaleffluentcontrol.TheprotectionsequenceforthiseventisgiveninFig.15A.6-34.
Event39-RecirculationLoopPumpShaftBreakArecirculationlooppumpshaftbreakeventconsidersthedegraded,delayedstoppageofthepumpmotorshaftofone recirculationlooppump.Thecaseinvolvesoperationatdesign powerinStateD.Amainturbinetripoccursasvesselwater levelswellexceedstheturbinetripsetpoint.
RBSUSAR 15A-50August1987ThisresultsinatripscramandanRPTwhentheturbinestopvalvesclose.Reliefvalveopeningoccurstocontrolpressure levelandtemperatures.TheRCICorHPCSsystemmaintainsvessel waterlevel.Prolongedisolationrequirescoreandcontainment coolingandpossiblysomeradiologicaleffluentcontrol.TheprotectionsequenceforthiseventisgiveninFig.15A.6-35.
15A.6.5DesignBasisAccidents 15A.6.5.1General ThesafetyrequirementsandprotectionsequencesforaccidentsaredescribedinthefollowingparagraphsforEvents40through 49.Theprotectionsequenceblockdiagramsshowthesafety actionsandthesequenceoffront-linesafetysystemsusedfor theaccidents(refertoFig.15A.6-36through15A.6-43).The auxiliariesforthefront-linesafetysystemsareindicatedin theauxiliarydiagrams(Fig.15A.6-1and15A.6-2)andthe commonalityofauxiliarydiagrams(Fig.15A.6-48through
15A.6-52).15A.6.5.2RequiredSafetyActions/UnacceptableConsequences Thefollowinglistrelatesthesafetyactionsfordesignbasisaccidenttomitigateorpreventtheunacceptableconsequences citedinTable15A.2-4.
Related UnacceptableSafetyAction ConsequnceReasonActionRequired Scram 4-2Topreventfuelcladding 4-3failure*andtoprevent excessivenuclearsystem
pressures.Pressurerelief 4-3Topreventexcessive nuclearsystempressure.Corecooling 4-2Topreventfuelcladding
failure.*Failureofthefuelbarrierincludesfuelcladdingfrag-mentation(loss-of-coolantaccident)andexcessivefuel enthalpy(controlroddropaccident).
RBS USAR Revision 17 15A-51 Related Unacceptable
Safety Action Consequence Reason Action RequiredReactor Vessel 4-1 To limit radiological isolation effect to not exceed the guideline values of
10CFR 50.67.Establish reactor 4-1 To limit radiological containment effects to not exceed the guideline values of
10CFR 50.67.Containment 4-4 To prevent excessive cooling pressure in the contain-ment when containment is
required. Stop rod ejection 4-2 To prevent fuel cladding failure. Restrict loss of 4-2 To prevent fuel cladding reactor coolant failure.
(passive)Main control room 4-5 To prevent overexposure environmental to radiation of plant control personnel in the control
room. Limit reactivity 4-2 To prevent fuel cladding insertion rate 4-3 failure and to prevent (passive) excessive nuclear system
pressure.
15A.6.5.3 Event Definition and Operational Safety Evaluations
Event 40 - Control Rod Drop Accident (CRDA)The control rod drop accident (CRDA) results from an assumed failure of the control rod-to-drive mechanism coupling after the control rod (very reactive rod) becomes stuck in its fully inserted position. It is assumed that the control rod drive is then fully withdrawn before the stuck rod falls out of the core.
The control rod velocity limiter, an engineered safeguard, limits the control rod drop velocity. The resultant radioactive material release is maintained far below the guideline values of
RBSUSARRevision8 15A-52August1996ThecontrolroddropaccidentisapplicableonlyinoperatingStateD.ThecontrolroddropaccidentcannotoccurinStateB becauserodcouplingintegrityischeckedoneachrodtobe withdrawnifmorethanonerodistobewithdrawn.Nosafety actionsarerequiredinStatesAorCwheretheplantisina shutdownstatebymorethanthereactivityworthofonerodprior totheaccident.8Fig.15A.6-36presentsthedifferentprotectionsequencesforthecontrolroddropaccident.AsshowninFig.15A.6-36,the reactorisautomaticallyscrammed.Foralldesignbasiscases, theneutronmonitoring,reactorprotection,andcontrolroddrive systemswillprovideascramfromhighneutronflux.Themain steamlineradiationmonitoringsysteminitiatestheisolationof thereactorwatersamplevalvesandtripsthemechanicalvacuum
pump.Afterthereactorhasbeenscrammed,thepressurereliefsystemallowsthesteam(producedbydecayheat)tobedirectedtothe suppressionpool.Initialcorecoolingisaccomplishedbyeither theRCICortheHPCSorthenormalfeedwatersystem.With prolongedisolationasindicatedinFig.15A.6-36,thereactor operatorinitiatestheRHRsuppressionpoolcoolingmodeand depressurizesthevesselwiththemanualmodeoftheADSorvia normalmanualreliefvalveoperation.TheLPCI,LPCS,andHPCS maintainthevesselwaterlevelandaccomplishextendedcore cooling.Isolationofturbine-condenserfissionproductreleases isalsomaintained.8Event41-FuelHandlingAccidentBecauseafuel-handlingaccidentcanpotentiallyoccuranytimewhenfuelassembliesarebeingmanipulated,eitheroverthe reactorcoreorinaspentfuelpool,thisaccidentisconsidered inalloperatingstates.Considerationsincludemechanicalfuel damagecausedbydropimpactandasubsequentreleaseoffission products.Theprotectionsequencespertinenttothisaccidentare showninFig.15A.6-37.Containmentand/orreactor/auxiliary/spentfuelbuildingisolationandstandbygas treatmentoperationareautomaticallyinitiatedbytherespective building,pool,and/orventilationradiationmonitoringsystems.Fig.15A.6-37describestheprotectionsequencesfortheevent.
RBSUSAR 15A-53August1987Event42-Loss-of-CoolantAccidentsResultingfromPostulatedPipingBreaksWithinRCPBInsideContainment (DBA-LOCA)Pipebreaksinsidethecontainmentareconsideredonlywhenthenuclearsystemissignificantlypressurized(StatesCandD).
Theresultisareleaseofsteamandwaterintothecontainment.
ConsistentwithNSOAcriteria,theprotectionrequirements considerallsizelinebreaksincludinglargerliquid recirculationlooppipingdowntosmallsteaminstrumentline breaks.Themostseverecasesarethecircumferentialbreakof thelargestrecirculationsystempipeandthecircumferential breakofthelargestmainsteamline.AsshowninFig.15A.5-38,inoperatingStateC(reactorshutdown,butpressurized),apipebreakaccidentuptotheDBAcan beaccommodatedwithinthenuclearsafetyoperationalcriteria throughthevariousoperationsoftheMSIVs,emergencycore coolingsystems(HPCS,ADS,LPCI,andLPCS),containmentand reactorvesselisolationcontrolsystem,reactorplant ventilationsystem,standbygastreatmentsystem,maincontrol roomheating,coolingandventilationsystem,MS-PLCS,standby servicewatersystem,combustiblegascontrolsystem,equipment coolingsystems,andtheincidentdetectioncircuitry.Forsmall pipebreaksinsidethecontainment,pressurereliefiseffected bythenuclearsystempressurereliefsystem,whichtransfers decayheattothesuppressionpool.Forlargebreaks, depressurizationtakesplacethroughthebreakitself.In StateD(reactornotshutdown,butpressurized),thesame equipmentisrequiredasinStateCbut,inaddition,thereactor protectionsystemandthecontrolroddrivesystemmustoperate toscramthereactor.Thelimitingitems,onwhichtheoperation oftheaboveequipmentisbased,aretheallowablefuelcladding temperatureandthecontainmentpressurecapability.Thecontrol roddrivehousingsupportsareconsiderednecessarywheneverthe systemispressurizedtopreventexcessivecontrolrodmovement throughthebottomofthereactorpressurevesselfollowingthe postulatedruptureofonecontrolroddrivehousing(alesser caseofthedesignbasisloss-of-coolantaccidentandarelated preventiveofapostulatedrodejectionaccident).Aftercompletionoftheautomaticactionoftheaboveequipment,manualoperationoftheRHR(suppressionpoolcoolingmode)and ADSorreliefvalves(controlleddepressurization)isrequiredto maintaincontainmentpressureandfuelcladdingtemperature withinlimitsduringextendedcorecooling.
RBSUSAR 15A-54August1987Events43,44,45-LossofCoolantAccidents(LOCA)ResultingfromPostulatedPipeBreaks-OutsideContainmentPipebreakaccidentsoutsidethecontainmentareassumedtooccuranytimethenuclearsystemispressurized(StatesCandD).
Thisaccidentismostsevereduringoperationathighpower (StateD).InStateC,thisaccidentbecomesasubsetofthe StateDsequence.TheprotectionsequencesforthevariouspossiblepipebreaksoutsidethecontainmentareshowninFig.15A.6-39.Thesequences alsoshowthatforsmallbreaks(breaksnotrequiringimmediate action)thereactoroperatorcanusealargenumberofprocess indicationstoidentifythebreakandisolateit.InoperatingStateD(reactornotshutdown,butpressurized),scramisaccomplishedthroughoperationofthereactorprotection systemandthecontrolroddrivesystem.Reactorvessel isolationisaccomplishedthroughoperationoftheMSIVsandthe containmentandreactorvesselisolationcontrolsystem.Foramainsteamlinebreak,initialcorecoolingisaccomplishedbyeithertheHPCSortheautomaticdepressurizationsystem(ADS) ormanualreliefvalveoperationinconjunctionwiththeLPCSor LPCI.Thesesystemsprovideparallelpathstoeffectinitial corecooling,therebysatisfyingthesingle-failurecriterion.
Extendedcorecoolingisaccomplishedbythesingle-failure proof,parallelcombinationoftheLPCImodeofRHR,theLPCS, andHPCSsystems.TheADSorreliefvalvesystemoperationand theRHRsuppressionpoolcoolingmode(bothmanuallyoperated) arerequiredtomaintaincontainmentpressureandfuelcladding temperaturewithinlimitsduringextendedcorecooling.Event46-GaseousRadwasteSystemLeakorFailureItisassumedthatthelineleadingtothesteamjetairejectorfailsnearthemaincondenser.Thisresultsinactivitynormally processedbytheoffgastreatmentsystembeingdischarged directlytotheturbinebuildingandsubsequentlythroughthe ventilationsystemtotheenvironment.Thisfailureresultsina loss-of-flowsignaltotheoffgassystem.Thiseventcanbe consideredonlyunderStatesCandD,andisshownin Fig.15A.6-40.Thereactoroperatorinitiatesanormalshutdownofthereactortoreducethegaseousactivitybeingdischarged.A RBSUSAR 15A-55August1987lossofmaincondenservacuumresults(timingdependingonleakrate)inamainturbinetripandultimatelyareactorshutdown.
RefertoEvent26forreactorprotectionsequence (Fig.15A.6-27).
Event47-AugmentedOffGasTreatmentSystemFailure Anevaluationofthoseeventswhichcouldcauseagrossfailureintheoffgassystemhasresultedintheidentificationofapostulatedseismicevent,moreseverethantheoneforwhichthesystemisdesigned,astheonlyconceivableeventwhichcouldcausesignificantdamage.Thedetectedgrossfailureofthissystemresultsinmanual isolationofthissystemfromthemaincondenser.Theisolation resultsinhighmaincondenserpressureandultimatelyareactor scram.Protectivesequencesfortheeventareshownin Fig.15A.6-41.Theundetectedpostulatedfailuresoonresultsinasystemisolationnecessitatingreactorshutdownbecauseoflossof vacuuminthemaincondenser.Thistransienthasbeenanalyzed inEvent26(Fig.15A.6-27).Event48-LiquidRadwasteSystemLeakorFailureReleaseswhichcouldoccurinsideandoutsideofthecontainment,notcoveredbyEvents40,41,42,43,44,45,47,and48include smallspillsandequipmentleaksofradioactivematerialsinside structureshousingthesubjectprocessequipment.Conservative valuesofleakagehavebeenassumedandevaluatedintheplant underroutinereleases.Theoffsitedosethatresultsfromany smallspillwhichcouldoccuroutsidecontainmentisnegligible incomparisontothedoseresultingfromtheaccountable (expected)plantleakages.TheprotectivesequencesforthiseventareprovidedinFig.15A.6-42.Event49-LiquidRadwasteSystem-StorageTankFailureAnunspecifiedeventcausesthecompletereleaseoftheaverageradioactivityinventoryfromthestoragetankcontainingthe largestquantitiesofsignificantradionuclidesfromtheliquid radwastesystem.Thisisassumedtobeoneoftheconcentrator wastetanksintheradwastebuilding.Theairborneradioactivity releasedduringtheaccidentpassesdirectlytotheenvironment viatheradwastebuildingvent.
RBSUSAR 15A-56August1987Thepostulatedeventsthatcouldcausereleaseoftheradioactiveinventoryoftheconcentratorwastetankincludecracksinthe vesselsandanoperatorerror.Thepossibilityofsmallcracks andconsequentlow-levelreleaseratesreceivesprimary considerationinsystemandcomponentdesign.Theconcentrator wastetankisdesignedtooperateatatmosphericpressureand 200°Fmaximumtemperaturesothepossibilityoffailureis consideredsmall.Aliquidradwastereleasecausedbyoperator errorisalsoconsideredaremotepossibility.Operating techniquesandadministrativeproceduresemphasizedetailed systemandequipmentoperatinginstruction.Apositiveaction interlocksystemisprovidedtopreventinadvertentopeningofa drainvalve.Shouldareleaseofliquidradioactivewastes occur,floordrainsumppumpsintheflooroftheradwaste buildingreceiveahighwaterlevelalarm,activate automatically,andremovethespilledliquidtoacontained storagetank.TheprotectivesequencesforthiseventareprovidedinFig.15A.6-43.15A.6.6SpecialEvents 15A.6.6.1General Additionalspecialeventsarepostulatedtodemonstratethattheplantiscapableofaccommodatingoff-designoccurrences(refer toEvents50through53).Assuch,theseeventsarebeyondthe safetyrequirementsoftheothereventcategories.Thesafety actionsshownonthesequencediagrams(refertoFig.15A.6-44 through15A.6-47)fortheadditionalspecialeventsfollow directlyfromtherequirementscitedinthedemonstrationofthe plantcapability.AuxiliarysystemsupportanalysesareshowninFig.15A.6-1,2,and15A.6-48through15A.6-52.15A.6.6.2RequiredSafetyAction/UnacceptableConsequences Thefollowinglistrelatesthesafetyactionsforspecialeventstoprovidethecapabilitydemonstrationindicatedin Table15A.2-1:
RBS USAR Revision 19 15A-57 Related Unacceptable Reason for
Safety Action Consequences Action AvailableA. Main Control Room Considerations Manually initiate 5-1 Local panel control has all shutdown 5-2 been provided and is controls from available outside main local panels control room. Manually initiate 5-3 Standby liquid control SLCS system to control reac-tivity to cold shutdown is available.
B.Spent Fuel Cask Considerations See Section 9.1.4.
15A.6.6.3 Event Definitions and Operational Safety Evaluation
Event 50 - Shipping Cask Drop Spent Fuel Cask Drop The spent fuel cask drop accident is hypothetically assumed to occur as a consequence of an unspecified failure of the cask lifting mechanism, thereby allowing the cask to fall.It is assumed that a spent fuel shipping or HI-TRAC transfer cask containing irradiated fuel assmblies is in the process of being moved with the cask suspended from the crane directly above atransport carrier or HI-STORM mating device, respectively, in the outside cask crane structure. The fuel assemblies have been out of the reactor for at least 90 days.
Through some unspecified failure, the cask is released from the crane and falls from a height less than postulated in the cask drop accident analyses onto either a transport carrier or HI-STORM mating device, as applicable. No damage is assumed to occur to the cask.
While loading on the transport carrier , the shipping cask is considered inside the fuel building and any releases are not treated.The protective sequences for this event are provided in Fig. 15A.6-44.
RBSUSAR 15A-58August1987NewFuelCaskDropSeeSection9.1.4.Event51-ReactorShutdown-ATWSReactorshutdownfromaplanttransientoccurrence(e.g.,turbinetrip)withouttheuseofmechanicalcontrolrodsisanevent currentlybeingevaluatedtodeterminethecapabilityofthe planttobesafelyshutdown.Theeventisapplicableinany operatingstate.Fig.15A.6-45showstheprotectionsequencefor thisextremelyimprobableanddemandingeventineachoperating state.InStateA,nosequenceisshownbecausethereactoris alreadyintheconditionfinallyrequiredbydefinition.StateDisthemostlimitingcase.Uponinitiationoftheplanttransientsituation(turbinetrip),ascramisinitiatedbutno controlrodsareassumedtomove.Therecirculationpumpsare trippedbytheinitialturbinetripsignal.Ifthenuclear systembecomesisolatedfromthemaincondenser,lowpower neutronheatcanbetransferredfromthereactortothe suppressionpoolviathereliefvalves.Theincidentdetection circuitryinitiatesoperationoftheHPCSonlowwaterlevel whichmaintainsreactorvesselwaterlevel.Thestandbyliquid controlsystemismanuallyinitiatedandthetransitionfromlow powerneutronheattodecayheatoccurs.TheRHRsuppression poolcoolingmodeisusedtoremovethelowpowerneutronand decayheatfromthesuppressionpoolasrequired.WhenRPV pressurefallsto100to200psiglevel,theRHRshutdowncooling modeisstartedandcontinuedtocoldshutdown.Varioussingle failureanalyticalexercisescanbeexaminedtoshowadditional capabilitiestoaccommodatefurtherplantsystemdegradations.Event52-ReactorShutdownFromOutsideMainControlRoomReactorshutdownfromoutsidethemaincontrolroomisaneventinvestigatedtoevaluatethecapabilityoftheplanttobesafely shutdownandcooledtothecoldshutdownstatefromoutsidethe maincontrolroom.Theeventisapplicableinoperating StatesA,B,C,andD.Fig.15A.6-46showstheprotectionsequencesforthiseventineachoperatingstate.InStateA,nosequenceisshownbecause thereactorisalreadyintheconditionfinallyrequiredforthe event.InStateC,onlycooldownisrequiredsincethereactor isalreadyshutdown.
RBSUSAR 15A-59August1987Ascramfromoutsidethemaincontrolroomcanbeachievedbyopeningtheacsupplybreakersforthereactorprotectionsystem.
Ifthenuclearsystembecomesisolatedfromthemaincondenser, decayheatistransferredfromthereactortothesuppression poolviathereliefvalves.Theincidentdetectioncircuitry initiatesoperationoftheRCICandHPCSsystemsonlowwater levelwhichmaintainsreactorvesselwaterlevel,andtheRHR suppressionpoolcoolingmodeisusedtoremovethedecayheat fromthesuppressionpoolifrequired.Whenreactorpressure fallsbelow100psiglevel,theRHRshutdowncoolingmodeis
started.Event53-ReactorShutdownWithoutControlRodsReactorshutdownwithoutcontrolrodsisaneventrequiringanalternatedmethodofreactivitycontrol,thestandbyliquid controlsystem.Bydefinition,thiseventcanoccuronlywhen thereactorisnotalreadyshutdown.Therefore,thiseventis consideredonlyinoperatingStatesBandD.Thestandbyliquidcontrolsystemmustoperatetoavoidunacceptableconsequencecriteria5-3.Thedesignbasesforthe standbyliquidcontrolsystemresultfromtheseoperating criteriawhenappliedunderthemostsevereconditions(StateD atratedpower).AsindicatedinFig.15A.6-47,thestandby liquidcontrolsysteminmanuallyinitiatedandcontrolledin StatesBandD.15A.7REMAINDEROFNSOA Withtheinformationpresentedintheprotectionsequenceblockdiagrams,theauxiliarydiagrams,andthecommonalityof auxiliarydiagrams,itispossibletodeterminethefunctional andhardwarerequirementsforeachsystem.Thisisdoneby consideringeacheventinwhichthesystemisemployedand derivingalimitingsetofoperationalrequirements.This limitingsetofoperationalrequirementsestablishesthelowest acceptablelevelofperformanceforasystemorcomponent,orthe minimumnumberofcomponentsorportionsofasystemthatmustbe operableinorderthatplantoperationmaycontinue.Theoperationalrequirementsderivedusingtheaboveprocessmaybecomplicatedfunctionsofoperatingstates,parameterranges, andhardwareconditions.Thefinalstepistosimplifythese complexrequirementsintotechnicalspecificationsthatencompass theoperationalrequirementsthatcanbeusedbyplantoperations andmanagementpersonnel.
RBSUSAR 15A-60August198715A.8CONCLUSIONSItisconcludedthatthenuclearsafetyoperationalandplantdesignbasiscriteriaaresatisfiedwhentheplantisoperatedin accordancewiththenuclearsafetyoperationalrequirements determinedbythemethodpresentedinthisappendix.
RBSUSAR 15A-61August1987Reference-15A1.Hirsch,M.M.MethodsforCalculatingSafeTestIntervalsandAllowableRepairTimesforEngineeredSafeguardSystems,January1973(NEDO-10739).
RBS USAR1 of1August1987TABLE15A.2-1UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:NORMALOPERATIONUnacceptableConsequences1-1.Releaseofradioactivematerialtotheenvironsthatexceedsthelimitsofeither10CFR20or10CFR50.1-2.Fuelfailuretosuchanextentthatwerethefreedfissionproductsreleasedtotheenvironsviathenormaldischargepathsforradioactive material,thelimitsof10CFR20wouldbeexceeded.1-3.Nuclearsystemstressinexcessofthatallowedforplannedoperationbyapplicableindustrycodes.1-4.Existenceofaplantconditionnotconsideredbysafetyanalyses.
RBS USAR1 of1August1987TABLE15A.2-2UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:ANTICIPATEDOPERATIONALTRANSIENTSUnacceptableConsequences2-1.Releaseofradioactivematerialtotheenvironsthatexceedsthelimitsof10CFR20.2-2.ReactoroperationinducedfuelcladdingfailureasadirectresultofthetransientanalysisabovetheMCPRuncertaintylevel(0.1%).2-3.Nuclearsystemstressexceedingthatallowedfortransientsbyapplicableindustrycodes.2-4.Containmentstressesexceedingthatallowedfortransientsbyapplicableindustrycodes whencontainmentisrequired.
RBS USAR1 of1August1987TABLE15A.2-3UNACCEPTABLECONSEQUENCESCRITERIAPLANTEVENTCATEGORY:ABNORMALOPERATIONALTRANSIENTSUnacceptableConsequences3-1.Radioactivematerialreleaseexceedingtheguidelinevaluesofasmallfractionof10CFR100.3-2.ReactoroperationinducedfuelcladdingfailureasadirectresultofthetransientanalysisabovetheMCPRuncertaintylevel(0.1%).3-3.Nuclearsystemstressesexceedingthatallowedfortransientsbyapplicableindustrycodes.3-4.Containmentstressesexceedingthatallowedforaccidentsbyapplicableindustrycodeswhen containmentisrequired.
RBS USAR Revision 17 1 of 1 TABLE 15A.2-4 UNACCEPTABLE CONSEQUENCES CRITERIA PLANT EVENT CATEGORY: DESIGN BASIS ACCIDENTS Unacceptable Consequences4-1. Radioactive material release exceeding the guideline values of 10CFR50.67.4-2.* Failure of the fuel barrier as a result of exceeding mechanical or thermal limits. 4-3. Nuclear system stresses exceeding that allowed for accidents by applicable industry codes. 4-4. Containment stresses exceeding that allowed for accidents by applicable industry codes when containment is required. 4-5. Overexposure to radiation of plant main control room personnel.
- Failure of the fuel barrier includes fuel cladding fragmentation (loss-of-coolant accident) and excessive fuel enthalpy (control rod drop accident).
RBS USAR1 of1August1987TABLE15A.2-5UNACCEPTABLECONSEQUENCESCONSIDERATIONSPLANTEVENTCATEGORY:SPECIALEVENTSSpecialEventsConsidered A.Reactorshutdownfromoutsidethemaincontrolroom B.Reactorshutdownwithoutcontrolrods C.Reactorshutdownwithanticipatedtransientwithoutscram(ATWS)
D.ShippingCaskDropCapabilityDemonstration5-1.Abilitytoshutdownreactorbymanipulatingcontrolsandequipmentoutsidethemaincontrolroom.5-2.Abilitytobringthereactortothecoldshutdownconditionfromoutsidethemaincontrolroom.5-3.Abilitytoshutdownthereactorindependentofcontrolrods.5-4.Abilitytocontainradiologicalcontamination.5-5.Abilitytolimitradiologicalexposure.
RBS USAR1 of 1August 1987TABLE15A.3-1BWROPERATINGSTATES*
States Condition A B C DReactorvesselheadoffXXReactorvesselheadonXX Shutdown X XNotshutdown X X DefinitionShutdown:K effsufficientlylessthan1.0thatthefullwithdrawalofanyonecontrolrodcouldnotproducecriticalityunderthemostrestrictivepotentialconditionsoftemperature,pressure,coreage,andfissionproductconcentrations.*FurtherdiscussionisprovidedinSection15A.6.2.4.
1 of 1 August 1987 RBS USAR TABLE 15A.6-1 NORMAL OPERATION NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 1 Refueling 15A.6-3,4,5,6 X 2 Achieving Criticality 15A.6-3,4,5,6 X X X X 3 Heat-Up 15A.6-6 X 4 Power Operation 15A.6-6 X 5 Achieving Shutdown 15A.6-4,6 X X 6 Cooldown 15A.6-3,5 X X 1 of 2 August 1987 RBS USAR TABLE 15A.6-2 ANTICIPATED OPERATIONAL TRANSIENTS NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 7 Manual or Inadvertent SCRAM 15A.6-7 7.2 X X X X 8 Loss of Plant Instrument Service Air Systems 15A.6-8 9.3.1 X X X X 9 Inadvertent Startup of HPCS Pump 15A.6-9 15.5.1 X X X X 10 Inadvertent Startup of Idle Recirculation Loop Pump 15A.6-10 15.4.4 X X X X 11 Recirculation Loop Flow Control Failure with Increasing Flow 15A.6-11 15.4.5 X X 12 Recirculation Loop Flow Control Failure with Decreasing Flow 15A.6-12 15.3.2 X X 13 Recirculation Loop Pump Trip 15A.6-13 15.3.1 X X 14 Inadvertent MSIV Closure
-With One Valve
-With Four Valves 15A.6-14 15A.6-15 15.2.4 X
X X X 15 Inadvertent Operation of One Safety/Relief Valve 15A.6-16 15.6.1 X X X X 16 Continuous Control Rod Withdrawal Error
-During Startup
-During Refueling 15A.6-17 15.4.1
X X 17 Continuous Control Rod Withdrawal Rod Error at Power 15A.6-18 15.4.2 X X 18 RHR - Shutdown Cooling Failure Loss of Cooling 15A.6-19 15.2.9 X X X X 19 RHR - Shutdown Cooling Failure Increased Cooling 15A.6-20 15.1.6 X X X X 20 Loss of All Feedwater Flow 15A.6-21 15.2.7 X X 21 Loss of Feedwater Heater 15A.6-22 15.1.1 X Revision 25 2 of 2 RBS USAR TABLE 15A.6-2 (CONT)
NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 22 Feedwater Controller Failure Maximum Demand - Low Power 15A.6-23 15.1.2 X X X X 23 Pressure Regulator Failure - Open (Note 1) 15A.6-24 15.1.3 X X 24 Pressure Regulator Failure - Closed 15A.6-25 15.2.1 X X 25 Main Turbine Trip with Bypass System Operational 15A.6-26 15.2.3 X 26 Loss of Main Condenser Vacuum 15A.6-27 15.2.5 X X 27 Main Generator Trip (Load Rejection)
With Bypass System Operational 15A.6-28 15.2.2 X 28 Loss of Plant Normal On-Site ac Power 15A.6-29 15.2.6 X X X X 29 Loss of Plant Normal Offsite ac Power 15A.6-30 15.2.6 X X X X NOTE 1: The pressure regulator failure-open is no longer a postulated single failure scenario; no Ovation TCPS single failure scenarios are postulated that could result in all valves open. This specific USAR section is maintained for historical purposes.
1 of 1 August 1987 RBS USAR TABLE 15A.6-3 ABNORMAL OPERATIONAL TRANSIENTS NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 30 Main Generator Trip (Load Rejection)
With Bypass System Failure 15A.6-31 15.2.2 X 31 Main Turbine Trip with Bypass System Failure 15A.6-32 15.2.3 X 32 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position 15A.6-33 15.4.7 X X X X 33-37 Not Used
---- 38 Recirculation Loop Pump Seizure for One Loop 15A.6-34 15.3.3 X 39 Recirculation Loop Pump Shaft Break 15A.6-35 15.3.4 X 1 of 1 August 1987 RBS USAR TABLE 15A.6-4 DESIGN BASIS ACCIDENTS NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 40 Control Rod Drop Accident 15A.6-36 15.4.9 X 41 Fuel Handling Accident 15A.6-37 15.7.4 X X X X 42 Loss-of-Coolant Accident*
Resulting from Spectrum of Postulated Piping Breaks Within
the RPCB Inside Containment 15A.6-38 15.6.5 X X 43 Small, Large, Steam and Liquid Piping Breaks Outside Containment 15A.6-39 15.6.4 X X 44 Instrument Line Break Outside Drywell 15A.6-39 15.6.2 X X 45 Feedwater Line Break Outside Containment 15A.6-39 15.6.6 X X 46 Gaseous Radwaste System Leak or Failure 15A.6-40 15.7.1 X X X X 47 Augmented Off Gas Treatment System Failure 15A.6-41 15.7.1 X X X X 48 Liquid Radwaste System Leak or Failure 15A.6-42 15.7.2 X X X X 49 Liquid Radwaste System Storage Tank Failure 15A.6-43 15.7.3 X X X X
- Small, Intermediate, and Large 1 of 1 August 1987 RBS USAR TABLE 15A.6-5 SPECIAL EVENTS NSOA Event No. Event Description NSOA Event Fig. No. USAR Section No.
BWR Operating State A B C D 50 Shipping Cask Drop 15A.6-44 15.7.5 X X X X 51 Reactor Shutdown from Anticipated Transient Without Scram (ATWS) 15A.6-45 15.8 X X X X 52 Reactor Shutdown From Outside Main Control Room 15A.6-46 7.5 X X X X 53 Reactor Shutdown Without Control Rods 15A.6-47 9.3.5 X X PROTECTION LEVEL 1 I EVENT A I 1ST PROTECTION LEVEL OPERATIONAL 2ND PROTECTION REQUIREMENT LEVEL I EVENT 1 CATEGORY'1 I EVENT A:I---....
EVENT B I PROTECTION LEVEL 1 SINGLE EQUIPMENT MALFUNCTION SINGLE OPERATOR ERROR I SINGLE QPERATOR I'ERROR 1 3RD PROTECTION LEVEL OPERATIONAL PROTECTION LEVEL 2*------t------
REQUIREMENT SCRAM 4TH PROTECTION LEVEL PROTECTION LEVEL 3 ADDITIONAL EQUIPMENT MALFUNCTION SINGLE OPERATOR ERROR I EVENT A I I EVENT B I 1STPROTECTION PROTECTION
____
LEVEL OPERATIONAL LEVEL REQUIREMENT LEVEL-----+----
PRO PROTECTION PROTECTION LEVEL EVEL____-L_IT IS INCONSISTENT TO PLACE OPERATIONALREQUIREMENTS ON EVEN THE"SAME LEVELS OF PROTECTION.
IF THE EVENTS ARE NOT OF THE SAME CATEGORY, PROTECTION LEVEL 3 PROTECTION LEVEL 2 PANEL B PROTECTION OPERATIONAL PROTECTION LEVEL 4 REQUIREMENT LEVEL 4*
SCRAM IT IS INCONSISTENT TO PLACE OPERATIONAL REQUIREMENTS ARBITRARILY ON SOME ACTION ISCRAMIIN ALL CASES OF ONE EVENT CATEGORY.BECAUSE THAT ACTION (SCRAM)MAY REPRESENT DIFFERENT LEVELS OF PROTECTION FOR THE VARIOUS CASES.5TH PROTECTION LEVEL PANEL/>.OPERATIONAL 6TH PROTECTION REQUIREMENT LEVEL IT IS INCONSISTENT TO PLACE OPERATIONAL REQUIREMENTS ON SEPARATED LEVELS OF PROTECTION FOR ANY ONE EVENT PANEL C FIGURE 15A.2-1 POSSIBLE INCONSISTENCIES IN THE SELECTION OF NUCLEAR SAFETY OPERATIONAL REQUIREMENTS RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT REDUNDANCY REQUIREMENT ISACFI IDENTIFICATION OF HARDWARE CONDITIONS TO SATISFY REDUNDANCY AEQUIREMENTS EACH SYSTEM (QPERATIONAL NUCLEAR SAFETY REOUIREMENTS.
LIMITING CONDITIONS FOR OPERATIONI IACTlO-;;O 8E TAK;;I;-1 1 OPERATIONAL REOUIRE I
,------I I I I I TOTAL SAFElY REQUIREMENT I LFIGURE 15A2-2 BLOCK DIAGRAM OF METHOD USED TO DERIVE NUCLEAR SAFETY OPERATIONAL REQUIREMENTS SYSTEM LEVEL QUALITATIVE DESIGN BASIS CONFIRMATION AUDITS AND TECHNICAL SPECIFICATIONS RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT E o CLASSI FreAT/ON NORMAL OPERATION to CFR SO.I DOSE LIMIT FIGURE 15A.2-3 SIMPLIFIED NSOA CLASSIFICATION INTERRELATIONSHIPS RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT DIFFERENT PLANT CONDITION 01 FFERENT PLANT CONDITION r......EVENTXY)-EVENT TITLE NUMBER OF EVENT STATES IN WHICH THIS PROTECTION SEQUENCE IS APPLICABLE SAFETY SYSTEM o SAFETY SYSTEM R SAFETY SYSTEM USF INDICATES THAT SYSTEMS Q AND R SHARE AS A FAIR THE REQUIREMENT TO MEET THE SINGLE FAILURE CRITERION SAFETY..-, SYSTEM(P)W'-/PERSONNEL (MANUALIACTION REQUIRED FOR SYSTEM W SAFETY SYSTEM SSF L SYSTEMS MUST ITSELF MEET THE SINGLE FAI LURE CRITERION INDICATES THAT ONE OR MORE OF THE KEY PROCESS PARAMETERS MUST BE LIMITED TO SATISFY NUCLEAR..-SAFETY OPERATIOII;AL CRITERIASF SAF ETY SYSTEM T EACH CONNECTED PROTECTION SEQUENCE IS F:::>R JUST ONE SAFETY ACTION FIGURE 15A.4-1 FORMAT FOR PROTECTION SEQUENCE DIAGRAM RIVER BEND 5l A liON UPDATED SAFETY ANALYSIS REPORT FRONT LINE SAFETY SYSTEM XSAFETY SYSTEM AUXILIARY A DIAGRAM INDICATES THAT AUXILIARIES A, e, AND CARE ESSENTIAL TO THE OPERATION OF SAFETY SYSTEM THE FRONT LINE AUXILIARye SAFETY SYSTEM X.NO CHRONOLOGY OR ORDER OF ACTION IS IMPLIED SAFETY SYSTEM AUXILIARY C FIGURE 15A.4-2 FORMAT FOR SAFETY SYSTEM AUXILIARY DIAGRAMS RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT SAFETY SYSTEM'Y STATE EVENTS STATE EVENTS STATE STATES AND EVENTS EVENTS A U,V,W A-FOR WHICH THE AUX-A-B V,W-ILlARY/SAFETY SYSTEM-B-C U,V,W,X B Q,R RELATIONSHIP APPLIES C Y,W C-D U,V,W,X D Y,W,Z D Q,R,SSFSF STATE A B C D S EVENTS X,Y X,Y X, Y,Z X,Y,Z F r SAFETY SYSTEM Q 1 SAFETY SYSTEM{3 AUXILIARY SYSTEM A I SAFETY SYSTEM 7r SAFETY SYSTEM 8 INDICATES THAT SYSTEM IS INCLUDED IN COMBINATION BUT DOES NOT REQUIRE THE AUXILIARY.
SAFETY SYSTEMSAFETY SYSTEM IjJ FIGURE 15A.4-3 FORMAT FOR COMMONALITY OF AUXILIARY DIAGRAMS RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT I MANUALADS RELIEF VALVE LPCS OPERATION HPCS*I LPLI SUPPRESSION POOL STEAM AUXILIARY AC VALVE AND I I STORAGE (PASSIVE)CONDENSATION POWER SYSTEM PUMP POWER AUXILIARY I I AUXILIARY to--VALVE.BLOWER t--VALVE AND AC POWER AC POWER PUMP POWER RELIEF VALVE SYSTEM AND PUMP POWER SYSTEM DC POWER to--CONTROLS;SENSORS.DC POWERBREAKER CONTROL STANDBY LIQUID I SYSTEM LOGIC.AND SYSTEM CONTROL LOG IC CONTROL SYSTEM I SOLENOIDS I I I:)C POWER DC POWER I--BREAKER CONTROL SYSTEMCONTROL LOGIC PNEUMATIC PUMP POWER SYSTEM CONTROL LOGIC AIR EQUIPMENT AREA OF CORE AUXILIARY HEATERS SYSTEM AREA COOLING SPRAY EQUIPMENT AC POWER SYSTEM VALVE FIRING CIRCUITS I I SYSTEM EQUIPMENT COOL AREA OF I PLANT SERVICE-RliRS PUMP COOLER AREA COOLING r--HPCS EQUIPMENT WATER SYSTEM SYSTEM SUPPRESSION POOL STORAGE_WATER SUPPL Y I I (PASSIVE)TO PUMPS SUPPRESSIONWATER SUPPLY EQUIPMENT AREA_COOL AREA OF POOL STORAGE COOLING SYSTEM RHRS EQUIPMENT (PASSIVE)FOR HPCS RHRS*RHRS*SUPPRESSION SHUTDOWN COOLING I POOL COOLING MODE I I SUPPR ESSION POOL STORAGE to--WATER SUPPL Y TO (PASSIVE I LPCI PUMPS AUXILIARY AC AUXILIARY VALVE AND AC POWER POWER SYSTEMPUMP POWER PUMP POWER SYSTEM I I DC POWER DC POWER VALVE POWER RCICS SYSTEM AND CONTROL lOGIC SYSTEMBREAKER CONTROL I I I DC POWER CONTROL CIRCUIT PLANT SERVICE PLANT SERVICE PRESSURE REL IEF SYSTEM-VALVE PCMlER.WATER SYSTEM__RHRSPUMPCOOlER WATER SYSTEM SYSTEM LUBE OIL PUMP I I I I EQUIPMENT COOL AREA AROUND RHRS SERVICE EQUIPMENT AREA AROUND SUPPRESSION POOL AREA COOLING-RCICS TURBINE PUMP WATER SYSTEM i--RHRS HEAT EXCHANGERS AREA COOLING STORAGE (PASSIVE I to--STEAM SYSTEM SYSTEM RHRS EQUIPMENT CONDENSA TlON I I I SUPPRESSION EQUIPMENT COOL AREA OF RHR WATER SUPPL Y FOR RHRS SERVICE RHRS POOL STORAGE AREA COOLINGEQUIPMENT.HEAT EXCHANGER5 (PASSIVE)140°MAXIMUM WATER SYSTEM SYSTEM FIGURE 15';.6-1 SAFETY SYSTEM AUXILIARIES RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EOUIPMENT AREA COOL ING SYST FCONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM I DC POWER SYSTEM I I VALVE POWER I CONTAINMENT IPASSIVEJ I SUPPR ESSION POOL STORAG E IPASSIVEJ I CONTROL ROOM HEATING VENTILATING AND AIR CONDITIONING SYSTEM AUXILIARY AC POWER SYSTEM*ESSENTIAL EQUIPMENT SERVICE WATER SYSTEM POWER TO EQUIPMENT STANDBY GAS TREATMENT qYSTEM I DC POWER SYSTEM I AUXILIARY AC POWER SYSTEM CONTROL POWER DELIVER POWER TO BLOWERS A AND HEATERS I PLANT SERViCE WATER SYSTEM I COUL AREACOOLeRS AUXILIARYVALVE_AC POWER SYSTEM POWER DC POWER SYSTEM CONTAINMENT VACUUM RELIEF SYSTEM SHIELD BUILDINGiCONTAINMENTDIFFERENTIAL PRESSURE CONTROL I WATER I SYSTEM I AUXILIARYPOWER TO AC POWER SYSTEM BLOWERS INCIDENT DETECTION CIRCUITRY INITIATES HPCS, ADS.lPCI AND LPCS, AND RCIC I DC POWER SYSTEM CONTROL POWER RHRS SERViCE WATER SYSTEM I I AUXILIARY AC POWER SYSTEM VALVE AND PUMP POWER I OFF-SITE HYDROGEN STANDBY AC CONTROL MS-PLCS AC POWER POWER SYSTEM SYSTEM SYSTEM I I I I DC POWERBREAKER DC POWERBREAKER DC POWER DC POWER SYSTEM CONTROL SYSTEM CONTROL SYSTEM SYSTEM I I I AUXILIAFlY VALVE ON AUXILIARY PLANT SERVICE l-COOL AC POWER
-WATfR SYSTEM AC POWER SYSTEM DIESELS SYSTEM FAN POWER AUXILIARY VALVE AND AC POWER SYSTEM-PUMP POWER PLANT INSTRUMENTATION SERVICE AIR SYSTEM DC POWER SYSTEM_POWER TO CONTROL CIRCUITRY AUXILIARY AC POWER SYSTEM I I 1 STANDBY AC OFF-SITE AC POWER SYSTEM POWER SYSTEM I I I DC POWER_BREAKER SYSTEM CONTROl I DC POWER I AUX ILIARY AC POWER SYSTEM_CONTROL POWERCOMPRESSOR POWER FIGURE 15A..6-2 SAFETY SYSTEM AUXILIARIES RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT STATE A NORMAL OPERATION EVENTS 1, 2, AND 6 EVENTS 1,2 AND 6 EVENTS 1,2, AND6 EVENTS 1.2, AND 6 EVENTS 1,2,AND6 EVENTS 1,2, AND 6 EVENT 1 EVENTS 1,2, AND 6 WATER TEMPERATURE, WATER LEVEL, FUEL SPACING, FUEL HANDLING FUEL SPACING NEW FUEL STORAGE FACILITIES SPENT FUEL STORAGE FACILITIES L L PROCEDURAL RESTR ICTIONS (FUEL ASSEMBLY ORIENTATION)
PROCEDURAL RESTR ICT10NS (CONTROL ROD POSITION)CONTROL ROD DRIVE SYSTEM REACTOR FUEL R L EVENTS 1,2, AND 6 EVENT 1 WATER CHEMISTRY LIMIT MINIMUM TEMPERATURE TO BOLT DOWN VESSEL HEAD REACTOR COOLANT REACTOR VESSEL L MINIMUM WATER LEVEL TO AVOID EXCESS TEMPEF(ATURE REACTOR FUEL L 10 CFR 71 LIMIT APPLIED TO SHIPPING CASKS 1OCFR20, 1OCFR50 LIMIT 1OCFR20, 1OCFR50 LIMIT VENT RELEASE LIQUID RADWASTE SYSTEM OFF GAS VENT SYSTEM SOLID RADWASTE SYSTEM OFFGASVENT RADIATION MONITORING SYSTEM L L L CONTAINMENT VENTILATION RADIATION MONITORING SYSTEM MONITOR ACTIVITY RELEASE THROUGH VENTILATING SYSTEM CORE LOADING PATTERN L REACTOR FUEL L CONTROL ROD DRIVE SYSTEM LIMIT ON NUMBER OF DRIVES VALVED OUT OF SERVICE FIGURE 15A.6-3 SAFETY ACTION SEQUENCES FOR NORMAL OPERATION IN STATE A RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT STATE B NORMAL OPERATION EVENTS 2 AND 5 EVENTS 2AND5 EVENTS 2AND 5 EVENTS 2AND5 EVENTS 2AND 5 EVENTS 2AND 5 EVENTS 2AND5 EVENT 2 EVENT 2AND5 OFF-GAS VENT RADIATION MONITORING SYSTEM LIQUID RADWASTE SYSTEM L VENT RelEASE 10 CFR 20 10 CFR 50 LIMIT REACTOR FUEL L MINIMUM POWER (SAM)MAXIMUM POWER L REACTOR VESSEL NUCLEAR SYSTEM TEMPERATURE CONTROL RATE OF CHANGE TEMPERATURE LIMIT CONTROL ROD DR IVE SYSTEM POSITIONING OF CONTROL RODS DURING CORE ALTERATION NEW FUEL STORAGE FACILITIES L SPENT FUEL STORAGE FACILITIES FUEL SPACING WATER TEMPERATURE, WATER LEVEL, FUEL SPACING, AND FUEL HANDLING STORED FUEL SHIELDING COOLING AND REACTIVITY CONTROL ROD PATTERN RSC, RWM, RBM CONTROL ROD DRIVE SYSTEM L WATER CHEMISTRY LIMIT REACTOR COOLANT l MINIMUM WATER LEVEL TO AVOID EXCESS TEMPERATURE CONTROL REACTOR FUEL 10 CFR 71 LIMIT APPLIED TO SHIPPING CASK 10 CFR 20 10 CFR 50 LIMIT OFF-GAS VENT SYSTEM SOLID RADWASTE SYSTEM L L CONT AI NMENT VENTILATION RADIATION MONITORING SYSTEM RADIOACTIVE MATERIAL RELEASE CONTROL MONITOR ACTIVITY RELEASE THROUGH VENTILATION SYSTEM ROD WORTH CONTROL FIGURE 15A.6-4 SAFETY ACTION SEQUENCES FOR NORMAL OPERATION IN STATE B RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT NORMAL OPERATION EVENTS 2 AND 6 WATER TEMPERATURE WATER LEVEL, FUEL SPACING, FUEL HANDLING FUEL SPACING NEW FUEL STORAGE FACILITIES SPENT FUEL STORAGE FACILITIES L WATER TEMPERATURE AND VOLUME LIMIT TEMPERATURE LIMIT PRESSURE LIMIT SUPPRESSION POOL (PASSIVE)CONTAINMENT (PASSIVE I L OVERSTRESS PROTECTION AND MAKEUP CAPABILITY REACTOR VESSEL MAXIMUM FEEDWATER TEMPERATURE TEMPERATURE RATE OF CHANGE, MINIMUM TEMPERATURE REACTOR VESSEL REACTOR FUEL L MINIMUM WATER LEVEL REACTOR FUEL VENT RELEASE 10 CFR 20 10 CFR 50 LIMIT 10 CFR 20 10 CFR 50 LIMIT LIQUID RAONASTE SYSTEM OFF-GAS VENT SYSTEM OFFGASVENT RADIATION MONITORING SYSTEM L L SOLID RADWASTE SYSTEM L CONTAINMENT VENTILATION RADIATION MONITORING SYSTEM 10 CFR 71 LIMIT APPLIED TO SHIPPING CASK MONITOR ACTIVITY RELEASE THROUGH VENTILATING SYSTEM REACTOR VESSEL L RHRS SHUTDOWN COOLING MODE MAXIMUM PRESSURE, MINIMUM PRESSURIZATION TEMPERATURE MAXIMUM PRESSURE LIMIT REACTOR COOLANT WATER CHEMISTRY LIMITS ACTIVITY LIMIT CONTROL ROD DRIVE SYSTEM NUMBER OF DRIVES VALVED OUT OF SERVICE FIGURE 15A.6-5 SAFETY ACTION SEQUENCES FOR NORMAL OPERA nON IN ST ATE CRIVERBEND STATION UPDATED SAFETY ANALYSIS REPORT STATE 0 i NORMAL OPERATION EVENTS 2, 3, 4, AND 5 EVENTS 2,3.4.AND 5EVENTSEVENTS 3,4, AND 5 2,3.4, AND 5EVENTSEVENTS 2, 3,4 AND 5 2,3,4.AND 5 EVENTS 2, 3,4,AND 5EVENTSEVENTS EVENTS 2,3.4 AND 5 2.3.4.AND 5 2.3.4, AND 5EVENTSEVENTS 2.3.4.AND52.3.4,AND5 EVENTS EVENTS 2.3,4.AND5 2.3.4.AND5 OVERSTRESS MINIMUM MINIMUM PROTECTION REACTORPOWER (SRMI REACTOR*WATER REACTORFUEL MAXIMUM FUEL VESSEL MAKEUP LEVEL L POWER L L CAPABILITY t t , REACTOR 1<NUCLEAR VESSEL SYSTEM LEVEL WATER LEAKAGE CONTROL LEVEL CONTROL CONTROL t 10 CFR 71 LIMIT TO SHIPPING CASK MONITOR ACTIVITY THROUGH VENTILATION SYSTEMFUEL SPACING WATER TEMPERATURE I-WATER LEVEL FUEL SPACING FUEL HANDLING TEMPERATURE
_AND PRESSURE LIMITS WATER_TEMPERATURE AND VOLUME LIMIT t l NEW FUEL STORAGE FACILITIES L SPENT FUEL STORAGE FACILITIES L I<STORAGE FUEL: SHIELDING COOLING AND REACTIVITY CONTROL t SUPPRESSION POOL (PASSIVEI CONT AINMENT (PASSIVE)L L L ROD WORTH CONTROL CONTROL ROD ROD DRIVE SYSTEM.PATTERN CONTROL.RSC, RWM, RBM CORE REACTIVITY CONTROL+Ll(NUCLEAR REACTOR MAXIMUM SYSTEM VESSEL PRESSURE WATER QUALITY L LIMIT CONTROL L::----1---l RA TE OF TEMPERATURE REACTORCHANGE.VESSEL MINIMUM TEMPERATUR E WITH HEAD ON.EVENTS 2 AND 5'VWATER NUMBER RHRS-CHEMISTRY SHUTDOWN MAXIMUM REACTORLIMIT CONTROL RODDRIVES COOLING PRESSURE COOLANT ACTIVITY OR IVE SYSTEM OUT OF L MODE LIMIT L LIMIT L SERVICE t t t REACTOR VESSEL L PEAKING EVENTS 3 AND 4 MAXIMUM PRESSURE_LIMIT REACTOR FUEL L MINIMUMFLOW RATE REACTOR FUEL L 10 CFR 20 50 LIMIT 10 CFR 20 1-10 CFR 50 LIMIT OFF-GAS VENT RADIATIONVENT MONITORING RELEASE SYSTEM LIQUID RADWASTE SYSTEM L t OFF-GAS VENT SYSTEM L J SOLID RADWASTE SYSTEM L t AUXILIARYI SPENT FUEL REACTOR BUILDING VENTILATION RADIATION MONITORING SYSTEM EVENTr09" 3.4.AND 5 MAXIMUM REACTOR TEMPERATURE RECiRCULATION
....DIFFERENCE SYSTEM IN RECIRCU-L LA T ION LOOPS RADIOACTIVE MATERIAL RELEASE CONTROL CORE COOLANT FLOW RATE CONTROL CORE NEUTRON FLUXBUTION CONTROL REACTOR VESSEL PRESSURE CONTROL L REACTOR FUEL MAXIMUMFEEDWATER TEMPERATURE CONTAINMENT TEMPERATURE
&PRESSURE CONTROL NUCLEAR SYSTEM TEMPERATURE CONTROL FIGURE 15A.6-6 SAFETY ACTION SEQUENCES FOR NORMAL OPERATION IN STATE D RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 7 MANUAL OR)INADVERTENT SCRAM STATES A, B, C, 0 REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEMSF SCRAM FIGURE 15A.6-7 PROTECTION SEQUENCE FOR MANUAL OR INADVERTENT SCRAM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT STATES A, B PLANNED OPERATION SCRAM SIGNAL WHEN 3MAIN_STEAM LINES CLOSED>10%STATES C, D REACTOR PROTECTION SYSTEMSFLOSS OF PLANT INSTRUMENT OR SERVICE AIR SYSTEM STATES A,B,C.D I HIGH PRESSURE LIFTS VALVE TRANSFERRINGHEAT TO SUP*PRESSION POOL PRESSURE RELIEF SYSTEMSF INSERT CONTROL_CONTROL ROD RODS DRIVE SYSTEMSF SCRAM INCIDENT DETECTION CIRCUITRYSF RCICS I"" START HPCS.RCIC, ON LOW WATER LEVELMAINTAIN WATER LEVEL-CORE COOLING FIGURE 15A.6-8 PRESSURE RELIEF HPCS I PROTECTION SEQUENCE FOR LOSS OF PLANT INSTRUMENT OR SERVICE AIR SYSTEM RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT STATES S, D PRESSURE REGULATOR EVENT 9 I NADV ERTENT START*UP HPCS PUMP STATES A, S, C AND D STATES A,C}STATES S, D FEEDWATER CONTROLLER OPERATE PLANNED OPERATION FAILURE TO OPEN SEE EVENT NO.23 PLANNED OPERATION OPERATE PLANNED OPERATION FAILURE MAXIMUM DEMAND SEE EVENT NO.22 FIGURE 15A.6-9 PROTECTION SEQUENCE FOR INADVERTENT START-UP OF HPCS PUMPS RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT NEUTRON MONITORING SYSTEM NEUTRON MONITORING SYSTEMo V a: w;: o Q.V*-It'>STATES BAND D*-IRM:il_HIGHFLUX w SIGNALQ.EVENT10 STARTUP OF IDLE RECIRCULATION PUMPS STATES A, B, C.D I APRM_HIGH FLUX SIGNAL STATES A AND B POWER 10*60%PLANNED OPERATION STATE D POWER 5*10%PLANNED OPERATION REACTOR PROTECTION SYSTEMSFSF SCRAM SIGNAL ON-NEUTRON MONITORING SYSTEM TRIP CONTROL ROD DRIVE SYSTEMSF SCRAMINSERT CONTROL RODS FIGURE 15A.6-10 PROTECTION SEQUENCES FOR INADV ERTENT STARTUP 0 F IDLE RECIRCULATION LOOP PUMP RIVER BEND 8T A TION UPDATED SAFETY ANALYSIS REPORT STATE 0, MODE SWITCH IN RUN, POWER OPERATION EVENT tt RECIRCULATION LOOP FLOW CONTROL FAILURE MAXIMUM DEMAND STATES C AND 0 STATE C STATE 0 (MODE SWITCH NOT IN RUN)PLANNED OPERATION NEUTRON MONITORING SYSTEMSF REACTOR PROTECTION SYSTEMSF HIGH NEUTRON FLUX_(APRMI SIGNAL TO RPS SCRAM SIGNAL ON NEUTRON-MONITORING SYSTEM TRIP CONTROL ROD DRIVE""-'NSERT CONTROL RODS SYSTEMSF SCRAM FIGURE 15A.6-11 PROTECTION SEQUENCE FOR RECIRCULATION LOOP FLOW CONTROL FAILURE-MAXIMUM DEMAND RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT PROTECTION SEQUENCE FOR RECIRCULATION LOOp*FLOW CONTROL FAILURE-DECREASING FIGURE 15A.6-12 S MAIN STEAM LINE ISOLA TION VALVES INITIATE ISOLATION ON CONTAINMENT 1.LOW WATER LEVEL AND REACTOR VESSEL ISOLATION CONTROL SYSTEM 1 RHRSHEATEXCHANGER 1 RHRS PUMP 2 RHRS SERVICE WATER PUMPS MAXIMUM VALVES REQUIRED FOR CONTROLLED DEPRESSURIZATION LPCI PSUPPRESSION POOL TEMPERATURE LIMIT START DEPRESSURIZATION RCICS AFTER ISOLATION START HPCI/RCIC SYSTEM ON LOW WATER LEVEL ONE/TWO VALVE FAST CLOSURE OR ONE/MASTER CONTROLLER FAILURE HPCS INCIDENT DETECTION CIRCUITRY EVENT 12 RECIRCULATION LOOP FLOW CONTROL FAILURE DECREASING STATES C AND 0 MANUAL RELIEF VALVES****............
,********w*a:::>..J U<iUJ>..Jw z.o************, PLANNED OPERATION MAINTAIN WATER LEVEL IN REACTOR VESSEL ONE/TWO VALVE FAST CLOSURE OR ONE/MASTER CONTROLLER FAILURE INSERT CONTROL RODS SCRAM SIGNAL FROM 1.TURBINE STOP VALVE CLOSURE 2.HIGH WATER LEVEL REACTOR PROTECTION SYSTEM CONTROL ROD DRIVE SYSTEM STATE DONLYSF PRESSURE RELIEF PRESSURE RELIEF SYSTEM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT 13 RECIRCULATION lOOP PUMP TAIP ONE OR BOTH STATES C AND D I PLANNED OPERATION ONE PUMP TR IP SACF I STATE C STATE D ONE PUMP TRIP TWO PUMP TRIP I TWO PUMP TRIP PRESSURE RELIEF SYSTEMSF HEAT TO t---'SUPPRESSION POOL CONTAIN*,1ENT ANO REACTOR VESSE l ISOLATION CONTROL SVSTEf\1 s;: REACTOR PROJECTION f-SYSTEMSF PRESSURE I I MAIN STEAM LINE ISOLATION VALVES REACTOR VE SSE L ISOL A TlON CONTROL ROD DRIVE SYSTEMSF SCRAM INSERT I--CONTROL RODS I I RCICS INCIDENT DETECTION CIRCUITRYSF MAINT AIN WATER LEVEL START HPCS.RCIC, ON LOW WATER LEvEL ISF INITIAL CORE COOLING FIGURE 15A.6-13 RECIRCULATION LOOP PUMP TRIP-ONE-OR BOTH RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT PLANNED OPERATION STATE D REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEM EVENT 14 ISOLATION OF ALL MAIN STEAM LINES STATES C.D SCRAM SIGNAL WHEN 3 MAIN STEAM LINES CLOSED>10%INSERT CONTROL RODS PRESSURE RELIEF SYSTEMSF PRESSURE RELI EF HIGH PRESSURE LIFTS VALVE TRANSFERRING HEAT TOPRESSION POOLSF SCRAM RCICS INCIDENT DETECTION CIRCUITRYSF MAINTAIN WATER LEVEL START HPCS.RCIC.ON LOW WATER LEVEL HPCS FIGURE 15A.6-14 PROTECTION SEQUENCE FOR ISOLATION OF ALL MAIN STEAM LINES RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 14 ISOLATION OF ONE MAIN STEAM LINE STATES C.AND 0)CONTINUE PLANNED OPERATION LESS THAN 90%POWER GREATER THAN 90'" POWER NEUTRON HIGH NEUTRON_MONITORING FLUX SIGNAL SYSTEMSF SCRAM SIGNAL ON NEUTRON MONITORING SYSTEM TRIP-REACTOR PROTECTION SYSTEMSF INSERT CONTROL ROD CONTROL RODS-DRIVE SYSTEMSF SCRAM FIGURE 15A.6-15 PROTECTION SEQUENCE FOR ISOLATION OF ONE MAIN STEAM LINE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT15 OPENING OF A SAFE TY RELIEF VALVE STATESA,B,C ANDD NO FEEDWATER REACTOR PROTE:;T10N SYSTEM INITIATE SCRAM ON LOW WATER LEVEL NUCLEAR SYSTEM PRESSURE RELIEF SYSTEM TRANSFER DECAY HEAT TO SUPPRESSION POOL INCIDENT DETECTION CIRCUITRYSF START HPCS, LPCI UNRESPECTIVE TRIP SETTINGS I-START ADS (AUTOMATIC FEEDWATER FLOW CONTROL STATE D)MAIN STEAM LINE RADIATION MONITORING SYSTEMSF CONTAINMENT AND REACTORVESSEL ISOLATION CONTROL SYSTEM CONTROL ROD DRIVE SYSTEMSF SCRAM INSERT CONTROL RODS PRESSURE RELIEF HPCS LPC)MAINTAIN WATER LEVELSF INITIAL CORE COOLING-RCICS MAINTAIN...--_......._--., WATER LEVELSF MAIN STEAM LINE ISOLATION VALVESSF REACTOR VESSEL ISOLATION CONTAINMENT AND REACTOR VESSEL ISOLA TION CONTROL SYSTEM SF CONTAINMENT (PASSIVEISF ESTABLISH CONTAINMENTINITIATE CLOSURE OF ALL CONTAINMENT ISDLATION VALVES EXCEPT MAIN STEAM LINE ON HIGH DRYWELL PRESSURE RHRS.SUPPRESSION', POOL COOLING MODE i st r-A.D.S.A.C.T.U.A.T.E.D_</
..O SUPPRESSION POOL TEMPERATURE LIMIT, START DEPRESSURIZATION MANUAL RELIEF VALVE OPERATION I P ADS I I REQUIRED VALVES TO MAINTAIN DEPRESSURIZATION LPCI HPCS LPCS P p PSF I MANUAL RE*REQUIRED VALVES TO LIEF VALVE ADS OPERATION MAINTAIN DEPRESSURIZATION P I S F EXTENDED CORE COOLING FIGURE 15A.6-16 PROTECTION SEQUENCES FOR INADVERTENT OPENING OF A RELIEF OR SAFETY VALVE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 16 CONTROL ROD WITHDRAWAL ERROR START*UP AND REFUELING OPERATION STATES A AND B STATE A STATE B-J<<3:<<0 Ct 0 0 Ct STATE B INTERMEDIATE RANGE:I: I--J0 Ct 0 I-0 Z 0 Ct U UJ 0 Z Z 0 0 PLANNED U HIGH UJ NEUTRON OPERATION en NEUTRON Ll.MONITORING 0 FLUX..J SYSTEM SIGNAL<<>0 SF UJ Ct SCRAM SIGNAL REACTOR REACTOR ON PROTECTION"REFUEL" PROTECTION NEUTRON SYSTEM SYSTEM MONITORING SYSTEM TRIP S FSF CONTROL ROD DRIVE SYSTEM CONTROL ROD DRIVE SYSTEM INSERT CONTROL RODSSFSF ROD BLOCK SCRAM FIGURE 15A.6-17 PROTECTION SEQUENCE FOR CONTROL ROD WITHDRAWL ERROR FOR START-UP AND REFUELING OPERATIONS RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT PLANNED OPERATION NEUTRON MONITORING SYSTEMSF REACTOR PROTECTION SYSTEMSF STATE 0 INTERMEDIATE RANGE HIGH NEUTRON FLUX SIGNAL SCRAM SIGNAL ON NEUTRON MONITORING SYSTEM TRIP STATE D POWE,R RANGE ROD PATTERN CONTROL PORTION OF RC&IS UNAUTHORIZED ROD WITHDRAWAL INSERT CONTROL RODS FIGURE 15A.6-18 PROTECTION SEQUENCE FOR CONTROL ROD WITHDRAWL ERROR FOR POWER OPERATION RIVER BENDST A TION UPDATED SAFETY ANALYSIS REPORT EVENT 18 RHRS-LOSS OF SHUTDOWN COOLING STATES A,B,C, AND D ISOLATION OF SHUTDOWN COOLING SUCTION LINE ALL OTHER SINGLE FAILURES STATES A, B STATES C.D p;>135 psig P LPGI I P HPCSSF LPCS P I t STATES A.B.C.D P LPCI I HPCS PSF+LPCS P I MAIN STEAMLINE ISOLATION VALVESF REACTOR VESSEL ISOLATION tMANUAL ADSREQUIRED RELIEF VALVE VALVES OPERATION P I S F PLANNED OPERATION REESTABLISH RHRS SHUTDOWN COOLING MODE WITH ALTERNATE EQUIPMENT EXTENDED CORE COOLING RHRS SUPPRESSION POOL COOLING MODE PSF RHRSHEATEXCHANGERRHRS PUMP RHRS SERVICE WATER PUMP FIGURE 15A.6-19 PROTECTION SEQUENCES FOR RHRS-LOSS OF SHUTDOWN COOLING FAILURE RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT PLANNED OPERATION A.AND B EVENT 19 RHRS-5HUTDOWN COOLING)INCREASED COOLING STATES A, 8,C,AND 0CANDO PLANNED OPERATION FIGURE 15A.6-20 RHRS-SHUTDOWN COOLING FAILURE-INCREASED COOLING RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 20 LOSS OF ALL FEEDWATER FLOW STATES C AND 0 RCICS START HPCS/RCIC ON LOW WATER LEVEL INCIDENT DETECTION CIRCUITRY MAINTAIN WATER LEVEL HPCS TRANSFER DECAY HEAT TO PLANNED OPERATION:
SUPPRESSION SHUTDOWN COOLING POOL PRESSURE RELIEF SYSTEM INITIATE MAIN STEAM LINE ISOLATION ON LOW WATER LEVEL MAIN STEAM LINE ISOLATION VALVESSF CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM INSERT CONTROL RODS INITIATE SCRAM ON LOW WATER LEVEL SF REACTOR PROTECTION SYSTEM CONTROL ROD DRIVE SYSTEM STATE 0 ONLYSUPPRESSION POOLING MODE 1 RHR HEAT EXCHANGE.1 RHRS PUMP 2 RHRS SERVICE WATER PUMPS SUPPRESSION POOL TEMPERATURE LIMIT START DEPRESSURIZATION MANUAL RELIEF VALVE OPERATION ADS REQUIRED VALVES FOR CONTROLLED DEPRESSURIZATIONSF MAINTAIN WATER LEVEL IN REACTOR VESSEL LPCI LPCS HPCS P P FIGURE 15A.6-21 S F PROTECTION SEQUENCES FOR LOSS OF FEEDWA TER FLOW RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT 21 LOSS OF A FEEDWATER HEATER STATE D RECIRCULATION FLOW IN MANUAL RECIRCULATION FLOW IN AUTO PLANNED OPERATION NEUTRON MONITORING SYSTEMSF REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEMSF SCRAM HIGH FLUX"'"-SCRAM SIGNAL (THERMAL POWER MONITORI SCRAM SIGNAL ON NEUTRON SYSTEM TRIP-INSERT CONTROL RODS FIGURE 15A.6-22 PROTECTION SEQUENCE FOR LOSS OF A FEEDW A TER HEATER RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT 22 FEEDWATER CONTROLLER FAILURE*MAXIMUM DEMAND STATES A, B, C, AND D STATES A AND B STATE D STATES C AND D PRIMARY CON*TAINMENT AND REACTOR VESSEL ISOLATION CON*TROL SYSTEM OTHER OPERATING MODES_---00(NEUTRON MONITORING SYSTEMSF STATE D"RUN" MODE HIGH FLUX SCRAM SIGI\IAL IIRMI HPCS INCIDENT DETECTION CIRCUITRY RCICS PRESSURE RELIEF SYSTEMSFSF MAIN STREAM LINE ISOLATION VALVESF MAIN TURBINE TRIPSF RECIRCULATION PUMP TRIP IRPTI REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEM SCRAM SIGNAL FROM TURBINE TRIP IRUI, MODEl OR NEUTRON MONITORING SYSTEM INSERT CONTROL RODS PLANNED OPERATIONSF FIGURE 15A.6-23 PROTECTION SEQUENCES FOR FEEDWATER CONTROLLERMAXIMUM DEMAND RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT SF CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM INITIATE ISOLATION ON'.--------------1.
ZATION TO 850 ps'g (RUN MODE POWER 0-100%)2.LOW WATER LEVEL IOTHER THAN RUN MODE POWER 0-10%1 START HPCS, RCIC ON LOW WATER LEVEL INCIDENT DETECTION CIRCUITRY EVENT 23 PRESSURE REGULATOR FAILURE-OPEN STATES C, AND 0SF REACTOR PROTECTION SYSTEM STATE DONLY SCRAM SIGNAL FROM.-.L-*MAIN STEAM LINE ISOLATION*TURBINE TRIP IRUN MODE: POWER 30-50%1*HIGH PRESSURE IRUN MODE: POWER 15-30%1*LOW WATER LEVEL (OTHER THAN ,........RUN MODE: POWER 0-10%1SF PRESSURE RELIEF SYSTEM CONTROL ROD DRIVE SYSTEMSF INSERT CONTROL RODS HPCS MAINTAIN CORE COOLINGSF RCICS MAIN STEAM LINE ISOLATION VALVESSF PLANNED OPERATION RE-ESTABLISH COOLING VIA MAIN CONDENSER FIGURE 15A.6-24 PROTECTION SEQUENCES FOR PRESSURE REGULATOR FAILURE-OPEN RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT
(/.------E v un 24 FIRST PRESSLJRE FAILURE ClOSFO STA.TES C ANU D PLANNED OPERATION i_-INCIDENT DETECTION CIRCUITRY MAINTAIN CORE COOLING START HPCS.RCte ON LOW WA Tf: R LEVEL , RHRS HEAT EXCHANGER 1 RHAS PUMP 2 RKA$SERVICE WATER PRESC;URE RELlEI=SYSTEM ReQlilREU VALVES FOR CONTROLLED DEP SUPPR ESS;QN POOL TEMPf:RATURE LIMIT START DEPRESSUR I ZATIOfll L)--FIGURE 15A.6-25 PROTECTION SEQUENCE FOR PRESSURE REGULATOR FAILURE-CLOSED RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT VfNT]'J MAIN TURBINE TRIP WITH ByPASS STAT(0 I
.,r-r-I-r---------
..I 8YPASS SYSTEM OPEAA1[S I HPCS T INCIDfl\JT OfT£t.:TIQN CIRCUITRySFSF I ACICS 1 MAIN STEAI\, L1Nf ISOLATION VALvf SCHA'Y1 SICNAlS MAIN TURBINE TRIP S f REACTOR PRQUeTION SYSTEM-'TURBINf STOP VALVE (LOSURE PLANNED OPE RA TION RESUME POW(H OPE RA T ION OR A.CHIEVE SHUTDOWN tlECIRCULATION PUMP TRIP IAPT I S If CONTROL ROD DRIVE svs Tf MSI I-fl ALIIVITy CONTROl I--tNSf I-IT CONTRllt RUUS INITIAL CQHl UIf)lINt, PRESSURE RELIH SYSTEM S f PRESSUH(HE LIEF CAVICS S f CONTAINMfNf I$()l AIHJN FIGURE 15A.6-26 PROTECTION SEQUENCES FOR MAIN TURBINE TRIP WITH BYPASS RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT STATE D ONLY MAIN TURBINE TRIPSF EVENT 26 LOSS OF MAIN CONDENSER VACUUM STATES C AND 0 INCIDENT DETECTION CIRCUITRY START HPCS, RCIC-ON LOW WATER LEVEL PRESSURE RELIEF SYSTEM TRANSFER_DECAY HEi\T TOSION POOL MAIN STEAM LINE ISOLATION VALVESSF RECIRCULATION PUMP TRIPSF rO ABOVE 400f0POWER BELOW 40"1.POWER I I MAINTAIN RCICSCORE-HPCS COOliNG I ISF PRESSURE RELIEF CRVICSSF Q_F SUPPRESSION POOL TEMPERATURE LIMIT START DEPRESSURIZATION
II NEUTRON MONITORING SYSTEMSF REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEMSFSF HIGHNEUTRON FLUX SCRAM SIGNAL ON NEUTRON MONITOR_SYSTEM TRIP OR TURBINE STOP VALVE CLOSURE INSERT-CONTROL RODS INITIAL CORE COOliNG RHRS-SUPP POOL COOLING MODE p ADS's F 1 RHRS HEAT EXCHANGER 1 RHRS PUMP 2 RHRS SERVICE WATER PUMPS REQUIRED VALVES FOR CONTROLLED DEPRESSURIZATION CONTAINMENT ISOLATION REACTIVITY CONTROL+LPCS I MAINTAIN HPCS WATER LEVEL P P I S F EXTENDED CORE COOLING FIGURE 15A.6-27 PROTECTION SEQUENCES FOR LOSS OF MAIN CONDENSER VACUUM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT
.BYPASS SYSTEM OPERATES INCIDENT DETECTION CIRCUITRY MAIN STEAM LINE ISOLATION VALVE CRVles5F PRESSURE RELIEF SYSTEM5F SCRAM SIGNALS 1.TURBINE CONTROL VALVE j:AST CLOSURE INSERT CONTROL RODS5F5F MAIN TURBINE TRIP (GENERATORI RECIRCULATION PUMP TRIP IRPTJ PLANNED OPERATION RESUME POWER OPERATION OR ACHIEVE SHUTDOWN FIGURE 15A.6-28 PROTECTION SEQUENCES FOR MAIN GENERATOR TRIP WITH BYPASS RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 28 LOSS OF NORMAL ACPOWER STATES A,B,C AND D STATE 0 ,...--------...,r--------------------------------..., START HPCS, RCIS ON LOW WATER LEVEL INCIDENT DETECTION CIRCUITRY STATES C, 0 p>135 psig PLANNED OPERATION:
SHUTDOWN COOLING TRANSFER DECAY HEAT TO SUPPRESSION POOL PRESSURE RELIEF SYSTEM MAIN STEAM LINE ISOLATION VALVES INITIATE CONTAINMENT MAIN STEAM AND REACTOR LINE ISOLATION VESSEL ISOLATION ON LOSS..C_O_N_T_R_O
......Lr-S_Y_S_T_EM---'
CONDENSER VACUUM L..._--,r--_....J INSERT CONTROL RODS INITIATE MAIN STEAM LINE ISOLATION ON LOW WATER LEVELSF REACTOR PROTECTION SYSTEM CONTROL ROD DRIVE SYSTEM MAIN TURBINE TRIP RCICS RHRS*SUPPRESSION POOL COOLING MODE HPCS 1 RHRS HEAT EXCHANGER I RHRS PUMP 2 RHRS SERVICE WATER PUMP RECIRCULATION PUMP TRIP (RPT)SUPPRESSION POOL TEMPERATURE LIMIT START DEPRESSURIZATION REQUIRED VALVES FOR CONTROLLED DEPRESSURIZATION MAINTAIN WATER LEVEL IN REACTOR VESSEL FIGURE 15A.6-29 PROTECTION SEQUENCES FOR LOSS OF NORMAL AC POWER RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT
""Ll.STATES STATES BAND D (EVENT 29 LOSS OF NORMAL AC POWER OFF-SITE STATES A,B,C, AND D*+STATESCANDD STATES C AND D STANDBY AC POWER SYSTEM MAIN TURBINE TRIPSF RECIRCULATION PUMP TRIP tRPTI REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEM INITIATE SCRAMON LOSS OF RPS M-G SETS OR TURBINE TRIP_INSERT CONTROL RODS RELIEF SYSTEM PRESSURE RELIEF TRANSFER DECAYHEAT TO SUP*PRESSION POOL I INCIDENT DETECTION CIRCUITRYSFSTART HPCS, RCtC ON LOW WATER LEVEL ISF RESTORE AC POWERSFSF REACTIVITY CONTROL RCICS I
_CORE COOLINGSF INITIAL CORE COOLING HPCIS I MAIN STEAM LINE ISOLATION VALVE RHRS SUPPRESSION POOL COOLING MODE 1 RHRSHEATEXCHANGER-, RHRS PUMP 2 RHRS SERVICE WATER PUMPSSF CRVICSSF REACTOR VESSE L ISOLATION CONTAINMENT ISOLATIONSUPPRESSION POOL TEMPERATURE Y START DEPRESSURIZATION r--------I ADS_REQUIRED VALVES FOR CONTROLLED DEPRESSURIZATION HPCSSF EXTENDED CORE COOLING LPCS P I....MAINTAIN CORE COOLING FIGURE 15A.6-30 PROTECTION SEQUENCES FOR LOSS OF NORMAL OFF-SITE AC POWER RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT POWl H<40%l'(lWI H>40%INCIDfNT DETECTION CIRCUITRY MAIN STEAM LINE ISOLATION VALVE SCHA!\1 SICNALS I HI(;H pnr SSLJHt 2 HI(,HFlUX REACTOR t\1AIN REACTOR PR6TECTION TURBINE PROTECTION SCRAM SIGNALS SYSTEM TRIP SYSTEl\1 1 TURBINE CONTROL VALVE FAST CLOSURE PRESSURE RELIEF CRVICS SYSTEM CONTROL RECIRCULATION CONTROL INSERT ROD DRIVE PUMP ROD DRIVE CONTROL RODS SYSTEl\1 TRtP IRPTl SySTEM FIGURE 15A.6-31 PROTECTION SEQUENCES MAIN GENERATORWITH BYPASS FAILURE RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT.-21 r\1Al,"\J TURBINE TRIP WITH BYPASS FAILURE STATE D I I POWfR r--POWFR<40%A:>40%
>r.,.----T""""'--------r-------,-----
INCIDENl DE TECTlDN CIRCUiTRY MAIN STEAM LINE ISOLATION VALVE I HPCS RCICS I MAIN TURBINE TRIP REACTOR PROTECTION SySTEM SCRAM SIG AL B1 TURBINE STOP V.Al VE CLOSURESFSF PRESSURE RELIEF SYSTEM CRVICS RE=CIRCULAT10I\J PUMP (flPTI CONTROL ROD Ol1lvf SYSTF M CONTROL RODSSFSFSI F S I F HfACTIVITY CONTFlOL INITIAL CORE COnLiNG PRESSURE RELIEF CONTAINMENT ISOLATION FIGURE 15A.6-32 PROTECTION SEQUENCES MAIN TURBINE TRIP-WITH BYPASS FAILURE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EVENT 32 INADVERTENT LOADING AND OPERATION-FUEL ASSEMBLY I IN IMPROPER POSITION STATES A, B, C, D PLANNED OPERATION FIGURE 15A.6-33 PROTECTION SEQUENCE FORINADVERTENTLOADING AND OPERA TION OF FUEL ASSEMBLY IN IMPROPER POSITION RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT I CIDENT DETECTION CIRCUITRYSF REACTOH PROTECTION SYSTEM SENSES HIGH REACTOR VESSEL WATEH LEVEL SCRAM SIGNAL FROM TURBINE TRIP EVENT]!!RECIRCULATION LOOP PUMP SEIZURE STATF OONLY INCIDENT DETECTION CIRCUITRYSF SENSES LOW WATER LEVEL PRESSURE RELIEF SYSTEM MAIN STEAM LINE ISOLATION VALVESF INSERT CONTROL RODS AHRS SUPPRESSION POOL COOLING MODE MAINTAIN WATER LEVELSF CRVICS FIGURE 15A.6-34 PROTECTION SEQUENCE FOR RECIRCULATION LOOP PUMP SEIZURE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT RECIRCULATION LOOP PUMP SHAFT BREAK STATE OONLY INCIOENT OETECTION CIRCUITRY SENSES HIGH REACTOR VESSEL WATER LEVEL INCIDENT DETECTION CIRCUITRY SENSES LOW WATER LEVEL PRESSURE RELIEF SYSTEMSFSF REACTOR PROTECTION SYSTEM SCRAM SIGNAL FROM TURBINE TRIP MAIN STEAM LINE ISOLATfON VALVESF CRVICS FIGURE 15A.6-35 MAINTAIN CORE COOLING SUPPR ESSI ON POOL COOLING MODE INSERT CONTROL RODSSF CONTROL ROO ORIVE SYSTEM PROTECTION SEQUENCE FOR RECIRCULATION LOOP PUMP SHAFT BREAK RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT
_
..--.EVENT 40 CONTROL ROD DROP ACCIDENT STATE 0 CONTROL ROOMMENTAL CONTROL MAIN CONTROL ROOMMENTAL CONTROL SYSTEM"---TRANSFER DECAY HEAT-TO SUPPRESSION POOL PRESSURE RELIEF PRESSURE RELIEF SYSTEM t LIMIT REACTIVITY INSERTION RATE CONTROL ROD VELOCITY LIMITED (PASSIVE)STARTHPCS, RCIC ON LOW WATER LEVEL-HPCS INCIDENT DETECTION CIRCUITRY MAINTAIN CORE COOLING f RCICS CONTAINMENT AND REACTOR VESSEL ISOLATION CONTROL SYSTEM S t F MAIN STEAM LINE RADIATION MONITORING SYSTEM HIGH NEUTRONFLUX SIGNAL SCRAM SIGNAL ON CONTAINMENT
!-NEUTRON AND REACTOR MONITORING VESSEL ISOLATION SYSTEM CONTROL SYSTEM TRIP Ir S t F NEUTRON MONITORING SYSTEM REACTOR PROTECTION SYSTEM CONTROL ROD INSERT DRIVE SYSTEM RODS REACTOR WATER SAMPLE VALVES AND MECHANICAL VACUUM PUMPS CONTAINMENT (PASSIVE)TSF I SCRAM ESTABLISH CONTAINMENT INITlALCORE COOLING RHRS SUPPRESSION 1 RHRS HEAT EXCHANGER POOL COOLING I--1 RHRS PuMP MODE 2 RHRS SERVICE WATER PUMPS P S 0)ooF__SUPPRESSION POOL TEMPERATURE LIMIT"1-'START DEPRESSURIZATION
- MANUAL RELIEF VALVE OPERATION P ADS REQUIRED VALVES FORCONTROLLED DEPRESSURIZATION t t I I MAINTAIN WATER lEVEL IN REACTOR VESSEL P HPCS LPCS lPCI FIGURE 15A.6-36 5 F PROTECTION SEQUENCES FOR CONTROL ROD DROP ACCIDENT EXTENDED CORE COOLING RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT REVISION 8 AUGUST 1996 AUXILIARY/SPENT FUEL REACTORING, POOL, AND/OR VENTILATIONATION MONITORING YSTEMS AUXILIARY/SPENT FUEL/REACTOR BUILDINGTION CONTROL SYSTEMSSF STANDBY GAS TREATMENT SYSTEMSF AUXILIARY/SPENT FUEL/REACTOR BUILDING (PASSIVEI OFF GAS VENT SYSTEM (PASSIVE)RADIATION MONITOR TRIP INITIATE BUILDING VENT ISOLATION EVENT 41 FUEL HANDLING ACCIDENT STATES A, B, C, AND D MAIN CONTROL ROOM HEATING VENTILATING AND AIR CONDITIONING SYSTEM FIGURE 15A.6-37 RADIATION LEVEL INDICATION PROTECTION SEQUENCES FOR FUEL HANDLING ACCiDENT RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT IIQUIRED VALVES ON CONTROLlED DEPIESSURIZATION SUPPRESSION TEMPERATURE LIMITED START DEPRUSUR.ZA TlON AD'DETECT LOW WATER LEvn HIGH CONTAINMIFN' PIfSSURl tHIS SUPPRESSION POOL COOLING MODE MANUAL IV OPERATION S f ADS ACTUATED HPCS ACTUATED MAINTAIN CORE COOLING IHCIDINT DEtECTION CIRCUUIY S f HPCS P llEAKS INCAPACITATtNO H'CS SUPPRESSION POOL TEMPERATURE LIMITED STAI:T DEPRESSURIZATION REQUIIED VALVES FOR CONTROLLED DEPRESSURIZATION I RHRS HEAT EXCHANGE 1 tHIS PUM!'2 RHRS SERVICE WAlll.UM'S LETECT WATEI LEVU HIGH DIYWELL PUSSURE SMALL alEAKS OTHU'UAKS INCIDINT DETECTION CIICUITlY INTERMEDIATE alEAkS unORE COOLING IV FLOODING AND/OI SPRAYING,f aREAK SIZE SUFFICIENT FOR DECAY HEAT REMOVAL INCIDENT DETECTION CIRCUITIY ADS TRANSfER DECAY HEAT TO.....__.L__-, SUP'USSION POOL SMALL BREAkS ONLY REQUIRED VALVES FOR CONTROLLED DE!'USSURIZATION IADIATION MONITORING INTAKE AIR MANUAL IV OPERATION OFF GAS VENT SYSTEM{PASSIVE I SCRAM SIGNAL ON LOW WAUR LEVU 01 HIGH CONTAINMENf PlESSURE FIGURE 15A.6-38 PROTECTION SEQUENCES FOROF-COOLANT PIPING BREAKS IN RCPBINSIDE CONTAINMENT RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT 1 RHRS HEAT EXCHANGER 1 RHRS PUMP 2 RHRS SERVICE WATER PUMPS INCIDENT DETECTION CIRCUITRY RHRS*SUPPR ES*SION POOL COOL*ING MODE STATES C.D RHRS SHUTDOWN COOLING BREAK{RESTORE AND MAINTAIN COOLING BY FLOODING.._-,==:....:==I=:;:::.
...:-:-:-:J,........
AND/OR SPRAYING START LPCI, LPCS AND HPCS ON RESPECTIVE TRIP SETTINGS RESTOREING BY FLOOD*ING AND/OR SPRAYING INCIDENT DETECTION CIRCUITRY OTHER PROCESS LINE BREAKS EVENT 43,44,45 LOCA III OUTSIDE CONTAINMENT STATES C AND D MAIN STEAM LINE ISOLATION VALVES ISOLATE ON LOW WATER LEVEL HIGH FLOW OR HIGH AREA TEMPERATURE RADIATION MON1TOfIING INTAKE AIR STATE DONLY CONTROL ROOM HEATING SYSTEM VARIOUS INDICATIONS 1.FEED SIGNALS TO PUMPS 2.FEED TEMPERATURE J.SPACE TEMPERATURE 4.FLOW INDICATIONS 5.REACTOR VESSEL WATER FLOW 6.FEEDWATER FLOW-5TEAM FLOW 7.HOT WELL LEVEL B.VISUAL INSPECTION 9.LEAKAGE INDICATIONS FLOW RESTRICTORS IPASSIVE)TRANSFER DECAY HEAT TO SUPPRES*SION POOL PRESSURE RELIEF SYSTEM I'I LOCA PIPE BREAKS CONSIDERED 1 REACTOR CLEANUP SYSTEM 2 RHR/sHUTDOWN COOLING 3 MAINSTEAM LINE 4 FEEDWATER LINE 5 RCICS STEAM LINE REQUIRED VALVES FOR CONTROLLED DEPRESSURIZATION SUPPRESSION POOL TEMPERATURE LIMIT START DEPRESSURIZATION F L SSF RHRS-SUPPRESSION POOL COOLING MODE ADS ACTUATED SUPPRESSION POOL TEMPERATURE LIMIT START==:-:':!'-_...,.._......_--,
nON REQUIRED VALVES TO MAINTAIN DE*PRESSURIZATION MAINTAIN CORE COOLING SCRAM SIGNAL ON LOW WATER LEVEL OR MAIN STEAM LINE ISOLATION REACTOR PROTECTION SYSTEM CONTROL ROO DRIVE SYSTEM FIGURE 15A.6-39 PROTECTION SEQUENCES FOR LIQUID, STEAM, LARGE , SMALL PIPING BREAKS OUTSIDE CONTAINMENT RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT PLANNED OPERATION STATES A, B EVENT46 GASEOUS RADWASTE SYSTEM LEAK OR FAILURE STATES A, B, C, D)STATES C.D MANUAL OPERATOR ACTION OFF*GAS SYSTEM ISOLATION MAIN CONDENSER LOW VACUUM SEE LOSS OF CONDENSER VACUUM EVENT 26 FIGURE 15A.6-40 PROTECTION SEQUENCE FOR GASEOUS RADWASTE SYSTEM LEAK OR FAILURE RIVER BEND 8T A TION UPDATED SAFETY ANALYSIS REPORT STATES A.B EVENT 47 AUGMENTED OFF-GAS TREATMENT SYSTEM FAILURE STATES A.B.C, AND 0 STATES C.0 PLANNED OPERATION MANUAL OPERATION ACTION OFF-GAS SYSTEM ISOLATION MAIN CONDI:NSER HIGH PRESSURE MAIN TURBINE TRIPSF REACTOR PROTECTION SYSTEMSF CONTROL ROD DRIVE SYSTEM FIGURE 15A.6-41 SEE OTHER LOSS OF CONDENSER VACUUM EVENT 26 ACTIONS PROTECTION SEQUENCE FOR AUGMENTED OFF-GAS TREATMENT SYSTEM FAILURE RIVER BEND 8T A TION UPDATED SAFETY ANALYSIS REPORT GAS LEAK HIGH RADIATION PROCESSLATION RADIATION MONITORING SUBSYSTEM VENTILATION SYSTEM CONTROL ISOLATE BUILDING EVENT 48 LIQUID RADWASTE SYSTEM LEAK OR FAI LURE STATES A, B, C, D)WATER LEAK HIGH WATER FLOOR DRAIN MONITORING SYSTEM SUMP PUMP SYSTEM CONTAINMENT LIQUID EFFLUENT FIGURE 15A.6-42 PROTECTION SEQUENCE FOR LIQUID RADWASTE SYSTEM LEAK OR FAILURE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT GAS LEAK HIGH RADIATION PROCESSLATION RADIATION MONITORING SUBSYSTEM VENTILATION SYSTEM CONTROL ISOLATE BUILDING EVENT49 LIQUID RADWASTE SYSTEM)STORAGE TANK FAILURE STATES A, B, C, DWATER LEAK HIGH WATER FLOOR DRAIN MONITORING SYSTEM SUMP PUMP SYSTEM CONTAINMENT LIQUID EFFLUENT FIGURE 15A.6-43 PROTECTION SEQUENCE FOR LIQUID RADWASTE SYSTEM STORAGE TANK FAILURE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT OPErlATOR MANUAL INITIATION AUXILIARY/SPENT FUEL REACTOR BUILDING, POOL, AND/OR VENTILATION RADIATION MONI*TORING SYSTEMS RADIATION MONITOR TRIP SERVICE WATER SYSTEM AUXILIARY/SPENT FUEL/REACTOR BUILDING ISOLA*TION CONTROL SYSTEMSSF STANDBY GAS TREATMENT SYSTEMSF AUXILIARY/
SPENT/FUEL!
REACTORING (PASSIVE)OFFGAS VENT SYSTEM IPASSIVE)INITIATE BUILDING VENT ISOLATION EXTERNAL COOLING SPRAY RESTORE CASK COOLING INTER AL COOLI G CONNECTION TEMPORARY CONTAINMENT FIGURE 15A.6-44 PROTECTION SEQUENCE FOR SHIPPING CASK DROP RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT ISTATESB.D EVENT 51 REACTOR SHUTDOWN FROM ANTICIPATED TRANSI ENT WITHOUT SCRAM STATES B.C.D I STATESC.DI REACTOR PROTECTION SYSHM REACTOR ISOLATED FROM MAIN CONDENSER TRANSFER DECAY HEAT_TO SUPPRESSION POOL PRESSURE RELIEF SYSTEM P I STANDBY LIQUID CONTROL SYSTE rvl I I INCIDENT DETECTION CIRCUITRY I START HPCS._RCIC SYSTEM ON LOW WATER LEVEL I PRESSURE RELIEF LIQUID SCRAM RCICS MAINTAIN-WATERLEVEL HPCS I PLANNED OPERATIONS CONTINUE COOLING RHRSSUPPRESSION POOL COOLING MODE P I I H EMOV E DECA Y_HEAT FROM SUPPRESSION POOL RHRSSHUTDOWN COOLING MODE CORE COOLING FIGURE 15A.6-45 PROTECTION SEQUENCE FOR REACTOR SHUTDOWN-FROM ANTICIPATATED TRANSIENTWITHOUTSCRAM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT 52 REACTOR SHUTDOWN FROM ANTICIPATED TRANS!ENT WITHOUT SCRAM STATES B, C, D STATESU.D T PRESSURE RELIEF SYSTEM STATESC,D TRANSFER DECAY HEAT TO SUP_PRESSION POOL START HPCS""-SYSTEM ON LOW WATER LEVEL I INCIOENT DETECTION CIRCUITRY REACTOR NOT ISOLATEDT REACTOR ISOLATED FROM FROM MAIN CONDENSER A MAIN CONDENSER I STATES C, D I STATES B, C, D PLANNED OPERATION CONTROL COOL DOWN USING NORMAL EQUIPMENT SCRAM BY i--DE ENERGIZING SYSTEM MANUALL Y REACTOR PROTECTION SYSTEM I PLANNED OPERATIONS CONTINUE SHUTDOWN COOLING I I 1SF CONTROL ROD DRIVE SYSTEM RCICS MAINTAIN VESSEL WATER LEVEL-HPCS PRESSURE RELIEF I I I SHUTUOWN RE ACTOR FROM DUTSI DE CON TROL ROGM RHRSSUPPRESSION REMOVE DECAY POOL_HEAT FROM COOLING MODE SUPPRESSION P POOL I L I RHRSSHUTDOWN COOLING MODE P T COOL DOWN REACTOR FROM OUTSIDE MAIN CONTfl0L FIGURE 15A.6-46 PROTECTION SEQUENCES FOR REACTOR SHUTDOWN-FROM OUTSIDE MAIN CONTROL ROOM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT EVENT:,]REACTOR SHUTDOWN WITHOl" T CONTROL RODS STATES 8.AND 0 T 1 PRESSURE RE LIE F SYSTEM PRESSURE RELIEF STATES8.o TRANSF ER DECAY HEAT TO SUP*PRESSION POOL-(135 pstg START HPCS.Rcrc I-SYSTEM ON LOW WATER LEVEL I I REACTOR ISOLATED FROM MAIN CONDENSER INCIDENT DETECTION CIRCUITRY PLANNED OPERATION CONTROL COOl.DOWN USING NORMAL EQUIPMENT I REACTOR NOT ISOLATED A FROM MAIN CONDENSER ,---......()------.I I I>135 P>l9 STATES B.0 I I STATES B.D STANDBY LIQUID CONTROL SYSTEM REACTOR PROTECTION SYSTEM P I PLANNED OPEHATIONS CONTINUE SHUTDOWN COOl.ING I RCICS MAINTAIN I-WATER-LEVEL HPCS LIQUID SCRAM I I I R HRS*SUPPR ESSION POOL COOl.INGMODE P REMOVE DECAY HEAT FROM SUPPRESSION POOL I 1 RHRS*SHUTDOWN COOLING MODE P I EXTENDED CORE COOLING FIGURE 15A.6-47 PROTECTION SEQUENCE FOR REACTOR SHUTDOWN-WITHOUT CONTROL RODS RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT STATE EVE\ITS STATE EvENTS STATE EVEf\lT$A A A STATE.fVE'\ITS 8 A*8*B C C*B*0 C C 0 0 0*fVff\lTS STATE EVfNTS STA£\:f:\lTS E-Vff\lTS A A SIA rr fVENTS$TA T{r V(\ITS*"*B*B A C C*B*" ,)C C*0 D 0 C 0 STAT[A B C o 1
';>'(1")"-TRQLl f D T 101'1I").sr
....O APPLICABLE I'" EvEI'IIT'.>1.,:'*LATER FIGURE 15A.6-48 COMMONALITY OF AUXILIARY SYSTEMS-DC POWER SYSTEMS (125/250 VOLTS)RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT 511\11 A b (I f V{"015*STATf A B (" I f\:1 NTS*STAff A o C U I!VENTS*I PLANT 1 STANOS"'" AC PQWfR SYSHMS S I, STAff A*C D I f:VfNTS*STAT(A*C D I
- STATI I VI-,,15 STAH f vt I\,jTS A A""*L*"" s ,""I-!ns LPCI t-lPlS l pes MQOfL..--L--S F S F!RHRS RHRS SERVICE SHUTDOWN WATER COOLING SYSTEM MODE 1"*:"1\1 I UVU.f1\TI Ii SVSTi\'s, I.ONflHH'HI(}f.'Itl:'11"'1, VI'"Iq...IINC, A!'vl)A1H (.fIN!)IIIC)"".....C.5vSTf...1 MP<"S STAf\D8Y (,AS THfAT\'F!'IlT SYST[Il.1 UCl1.5 STAff A" C o rVfNTS*SF STANDBY liQuID CQNHIOL SVSTEM STATE EVENTS A*C*0 S'STATE'EVENTS A" C*u'" CONTAINt..*1ENT A"'D R[ACTOR l-l-VESSEL ISOLATION CON rAOl SY5TE MRHAS lPCI lPCS HPCS MOOEL--EQUIPMENT AAfA COOLING SYSTEM STATE A B C o RHRS SUPPRESSION POOL COOLING MODE EVENTS*STATE A 8 C D EVENTS*!IIBcOWDO.....N (;II rjl,IlH'.lp*n
....il!AI'I'I H.AHll l\i I VI"'-1V'....[lILATI S THAT SYSTfIS.!\ILI':lJl I)I'\, (,C)MH1....A1IO"" Itl" nOIS'Of II!nljllli"Ii fl.llll'Il,AflY j'{lWII"*LATER FIGURE 15A.6-49 COMMONALITY OF STANDBY AC POWER SYSTEMS (120/480/4160 VOLTS)RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT EOUIPMENT AREA COOLING SYSTEM I I I I I I STATE EVENTS STATE EVENTS I rATE EVENTS STATE EVENTS STATE EVENTS A A A A B*B**B*B*C C I g C C D D D D S I F S IF I sr S FIIIII I I RCICS I 1 I I RHRS I I I I LPCS I\"1 I I HPCS LPCI HPCS RHRS*HPCS RHRS MODE SHUTDOWN SUPPRESSION COOLING MODE POOL COOLING MODE I I I RHRS*I LPCS I I HPCS I STATE EVENTS LPCI A MODE B*C D INCIDENT DETECTION CIRCUITRY*lATER NOTE SF REOUIREMENT NOT APPLICABLE IN EVENTS 51 52.53 HPCS FIGURE 15A.6-50 COMMONALITY OF AUXILIARY SYSTEM-EQUIPMENT AREA COOLING SYSTEM RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT PLANT SERVICE WATER SYSTEM I I I I STATE EVENTSEVENTSEVENTS A A A B*B*B*C C C 0 0 0 Sr Sr Sr EQUIPMENT STANDBY AC AREA LPCI POWER COOLING SYSTEM SYSTEMA B C o*SF RHRS SUPPRESSION POOL COOLING MODE STATE A B C o RHRS*SHUTOOWI'II COOLING MODE*NOTE: SF REQUIREMENT NOT APPLICABLE IN EVENTS51,52, 53*LATER FIGURE 15A.6-51 COMMONALITY OF AUXILIARY SYSTEMS-PLANT SERVICE WATER SYSTEM RIVER BEND 5T A TION UPDATED SAFETY ANALYSIS REPORT INCIDENT DETECTION CIRCUITRY CONTAINMENT (PASSIVE)STATE A B C D EVENTS*SUPPRESSIO POOL STORAGE (PASSIVE)I STATE EVENTS STATE EVENTS STATE EVENTS STATE EVENTS A A A A B B*B*B*C*C C C D D D D I r 1 I I I I HPCS I RCICS I I LPCI I I HPCS I LPCS I STATE A B C D EVENTS*!HPCS 1 PRESSURE RELIEF SYSTEM I ADS(lI I r STATE A B C D EVENTS**LATER 111 BLOWDOWN 12)CONTROLLED DEPRESSURIZATION 131 SF REOUIREMENT NOT APPLICABLE IN EVENTS 51, 52,53 I I RHR I LPCI MODE I LPCS I 1 I HPCS I I I ADS(21 I I MANUAL RESETI21 VALVE SYSTEM OPERATION FIGURE 15A.6-52 COMMONALITY OF AUXILIARY SYSTEMS-SUPPRESSION POOL STORAGE RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT Revision 21 15 1 4 13 12 1 0 8 7 6 4 1 USAR APPENDIX 15B CYCLE SPECIFIC ACCIDENT ANALYSIS 1 4 6 7 8 10 12 13 14 15 RBS USAR Revision 21 15B-1 6 4 1 15B.0 GENERAL 15 14 13 12 10 This appendix discusses the analyses performed in support of the current operating cycle. These analyses differ by fuel vendor, but are performed using NRC approved methods as discussed in RBS Technical Specification 5.6.5, "CORE OPERATING LIMITS REPORT (COLR)".
This includes the results of the Reference Core Loading Pattern for the latest reload of fuel. The Reference Core Loading Pattern is designed to meet the Safety Design Bases in accordance
with Reference 2
- 4. 12 14 15 This Appendix also reports the results of the Reactivity Control Data, the Maximum Average Planar Linear Heat Generation Rate for
new fuel type(s), and Stability Analysis that are calculated based
upon the Reference Loading Pattern. 15 8 7 In this Appendix the effects of a subset of anticipated process disturbances examined in 15.1 through 15.6 and 15.8 are re-examined to verify that following this reload, the plant is still within the
limits established in the original accident analyses.
7 8 The events analyzed include generator load rejection without bypass (LRNB P), turbine trip without bypass (TTNB P), 100°F loss of feedwater heating (LFWH), feedwater controller failure to maximum
demand (FWCF), pressure regulator failure downscale (PRFDS),
control rod drop accident (CRDA), rod withdrawal error (RWE),
mislocated bundle accident and misoriented bundle accident, recirculation pump seizure for single loop operation and slow
recirculation flow excursion.
13 15B.1 SAFETY LIMIT MINIMUM CRITICAL POWER RATIO (SLMCPR)
The specific analysis was performed to determine SLMCPR for the current cycle. The calculated results of SLMCPR values (two recirculation loop operation and single loop operation) for the
current cycle using the approved GEH methods are documented in the SRLR (Reference 27). 15 15B.2 RELOAD ANALYSIS INITIAL CONDITIONS
15B.2.1 INITIAL PLANT PARAMETERS 15 8 7 Exposure dependent analyses assume several different power and flow conditions that cover the entire expected operating domain, including the MELLL and ICF regions. The initial conditions and input conditions of plant parameters and the operating domain for
transient analyses are listed in the SRLR (Reference 27). 1 4 6 7 8 10 15 RBS USAR Revision 21 15B-2 15 10 8 7 15 15B.2.2 RELOAD-UNIQUE TRANSIENT ANALYSIS INITIAL CONDITION PARAMETERS Assumptions for current cycle are listed in the SRLR (Reference 27).
15B.2.3 SELECTED MARGIN IMPROVEMENT OPTIONS
Selected margin improvement options for current cycle are listed in
the SRLR (Reference 27).
15B.3 ANALYSIS METHODS
T he NRC approved GEH methodology is used to perform the reload analysis and established core thermal limits for plant operation.
7 8 6 4 1 15B.3.1 PRESSURIZATION EVENTS 13 Pressurization events that could establish the operating Limit MCPR (Load Rejection Without Bypass, Turbine Trip without Bypass and Feedwater Controller Failure) are analyzed at the 100%.
Pressurization events that could challenge the ASME peak pressure
criteria (MSIV closure with failure of the scram function on MSIV position) are analyzed a t limiting power and flow conditions (100.3% of licensed thermal power at ICF and MELL flow conditions
.) 13 15B.3.2 LOSS OF FEEDWATER HEATING
The Loss of Feedwater Heater event was analyzed with the 3D BWR
Simulator code described in Reference
Therefore, these items are not included.
1 4 6 10 15 RBS USAR Revision 21 15B-3 15B.3.3 CONTROL ROD DROP ACCIDENT 15 10 7 The NRC approved Control Rod Drop Accident analysis for Banked Position Withdrawal Sequence plants (such as RBS) described in
Reference 24 is applied to this reload. 8 Results of the CRDA for the current cycle are presented in the SRLR (Reference 27). 8 15B.3.4 ROD WITHDRAWAL ERROR
The generic Rod Withdrawal Error analysis described in Reference 24 is applied to this reload. Cycle specific analyses are performed to confirm the applicability of the generic results. The
results are presented in the SRLR (Reference 27). 15 8 15B.3.5 MISORIENTED BUNDLE AND MISLOCATED BUNDLE ANALYSIS 15 12 The Misplaced Bundle Accident or Fuel Loading Error is discussed in Section 15.4.7 of the USAR and is evaluated for the current cycle in the SRLR (Reference 27). 12 15B.3.6 Recirculation Pump Seizure - Single Loop Operation
The single-loop operation pump seizure analysis is performed to demonstrate that the event is non-limiting. Analysis results confirm that the power and flow dependent MCPR limits provide adequate margin and the 10CFR50.67 dose limits are not exceeded.
The analysis results are reported in Reference 26.
7 8 10 15 RBS USAR Revision 21 15B-4 15 10 8 7 15B.3.7 Slow Recirculation Excursion The slow flow excursion analysis is performed to develop the flow dependent MCPR and LHGR limits. The MCPR analysis in performed
with the steady state thermal-hydraulics method and the LHGR analysis is performed with the core simulator method (Reference 25). 16 Flow dependent thermal limits for this event are determined for two modes of recirculation flow control (loop manual mode and loop automatic mode) as the two modes result in significantly different responses. The results are reported in Reference 26.
16 15B.3.8 Pressure Regulator Failure Downscale
General Electric SIL-614 requires plant transient licensing analyses be reviewed to evaluate if operation with a pressure regulator out of service (without backup) is an analyzed condition.
Therefore, GEH has performed analysis to support operation for one pressure regulator out of service. The results are presented in
SRLR (Reference 27).
15B.3.9 ATWS Peak Pressure Analysis
Analyses are performed to determine the peak pressure that occurs during an ATWS event. The results of the MSIV closure and pressure regulator failure-open evaluations confirm that the peak pressure
remain below 1500 psig.
The results are reported in Reference 26.
15B.3.10 POWER/FLOW OPERATING REGION
Analyses have been performed in addition to the standard reload analyses to support operation in the extended operating region.
The operating domain covers the standard region and the regions
that are bounded by 113% rod line (MELLL) and 107% rated core flow (ICF). The final feedwater temperature reduction analysis is also
performed for cycle extension. The results are presented in SRLR (Reference 27). 7 8 10 15 RBS USAR Revision 24 15B-5 10 15B.4 ANALYSIS RESULTS AND SUPPLEMENTAL RELOAD LICENSING REPORT (SRLR) 15 13 12 The results of the reload transient analyses performed by GEH are reported in the SRLR (Reference 27) which together with the new fuel introduction report (Reference 26) provides the technical
bases for the Core Operating Limits Report (COLR). The COLR, created in accordance with Technical Specifications 5.6.5, reports
the core operating limits as reported in the SRLR and the new fuel introduction report. These operating limits protect the SLMCPR for
transient or accident events discussed in the previous sections.
12 14 10 13 14 15 15B.5 Lead Test & Lead Use Assemblies Four GNF3 Lead Use Assemblies (LUAs) were inserted into the reactor core during refueling outage 18. The thermal limits to be used for these assemblies is discussed in Appendix F of Reference 27.
RBS USAR Revision 21 15B-6 May 2002 1 REFERENCES 15B 15 8 6 4 1) Deleted 2)Deleted 3)Deleted 4)Deleted 5)Deleted 6)Deleted 7)Deleted 8)Deleted 9)Deleted 10)Deleted 11)Deleted 1 4 6 8 15 RBS USAR Revision 25 15B-7 15 8 6 4 1 12)Deleted
13)Deleted
14)Deleted
15)Deleted
16)Deleted
17)Deleted
18)Deleted
19)Deleted
20)Deleted
21)Deleted
22)Deleted
23)Deleted
24)"General Electric Standard Application for Reactor Fuel," NEDE-24011-P-A, latest approved revision. 13 10 7 1 4 6 7 8 10 13 15
- 25) NEDE-30130-P-A, "Steady-State Nuclear Methods," April 1985
- 26) GEH-0000-0118-2907-R0, "GNF2 Fuel Design Cycle-Independent Analysis for Entergy River Bend," Revision 0, November 2010
with errata. (Entergy Report # ECH-NE-10-00066, Revision 1).
- 27) 003N9291, Revision 0, "Supplemental Reload Licensing Report for River Bend Station - Unit 1 Reload 19 Cycle 20,"
November 2016. (Entergy Report # ECH-NE-16-00037, Revision 0).
RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT INPUT PARAMETERS AND INITIAL CONDITIONS FOR RELOAD 9 TRANSIENTS TABLE 15B.1-1
THIS TABLE HAS BEEN DELETED RIVER BEND STATION CONTROL ROD DRIVE POSTION VERSUS TIME
THIS TABLE HAS BEEN DELETED RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT TRANSIENT PROTECTION PARAMETERS VERIFICATION FOR RELOAD LICENSING ANALYSESRIVER BEND STATION - UNIT 1 TABLE 15.B1.1-3REVISION 15MAY 2002 THIS TABLE HAS BEEN DELETED
RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT GENERATOR LOAD REJECTION WITHOUT BYPASS FIGURE 15B.3-1 THIS FIGURE HAS BEEN DELETED RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT FEEDWATER CONTROLLED FAILURE
- MAXIMUM DEMAND FIGURE 15B.3-2 THIS FIGURE HAS BEEN DELETED RIVER BEND STATION UPDATED SAFETY ANALYSIS REPORT PRESSURE REGULATOR FAILURE DOWNSCALE FIGURE 15B.3-3 THIS FIGURE HAS BEEN DELETED RBSUSARRevision9November1997APPENDIX15CSTATIONBLACKOUT(SBO)
RBSUSARRevision9 15C-1November199715CSTATIONBLACKOUT(SBO)15C.1INTRODUCTION TheStationBlackoutRule,promulgatedas10CFR50.63,"LossofAllAlternatingCurrentPower,"requiresthateachlightwater-cooled nuclearpowerplantlicensedtooperatemustbeabletowithstand foraspecifieddurationandrecoverfromastationblackout.A stationblackoutasdefinedin10CFR50.2meansthecompleteloss ofalternatingcurrent(ac)electricpowertotheessentialand nonessentialswitchgearbuses(i.e.,lossofoff-siteelectric powersystemconcurrentwithturbinetripandunavailabilityof theon-siteemergencyacpowersystem).Stationblackoutdoesnot includethelossofavailableacpowertobusesfedbythestation batteriesthroughinvertersorbyalternateacsources.In addition,stationblackoutdoesnotassumeaconcurrentsingle failureordesignbasisaccident.Thespecifiedstationblackout durationisbasedonthefollowingfactors:(1)Theredundancyoftheon-siteemergencyacpower sources;(2)Thereliabilityoftheon-siteemergencyacpower sources;(3)Theexpectedfrequencyoflossofoff-sitepower;and(4)Theprobabletimeneededtorestoreoff-sitepower.EvaluationoftheRiverBendStationforcompliancewiththestationblackoutruleconcludedthattheRiverBendStationis classifiedasafour-hourcopingplantwith0.95EmergencyDiesel Generator(EDG)reliability.AnoverallEDGreliabilityof0.95, ascalculatedinaccordancewiththeguidanceprovidedinNSAC-108,mustbemaintainedtoremainincompliancewith10CFR50.63.15C.2NUMARC87-00REQUIREMENTS Tomeettherequirementsof10CFR50.63,thenuclearindustrydevelopedfiveinitiativesprovidedinNUMARC87-00:1)RISKREDUCTION2)PROCEDURES 3)COLDFASTSTARTS 4)ACPOWERAVAILABILITY 5)COPINGASSESSMENT/EDGRELIABILITY RBS USAR Revision 23 15C-2 River Bend Station is in compliance with the initiatives in NUMARC 87-00. Guidance on an acceptable method of analysis was provided by the NRC in Regulatory Guide 1.155 which finds NUMARC 87-00 as an
acceptable alternative to demonstrate compliance with the Station Blackout Rule except where Regulatory Guide 1.155 takes precedence. In summary, the following was determined for these initiatives:
15C.2.1 RISK REDUCTION River Bend Station falls into the category of a four-hour site.
This is based on:
- 1. River Bend is categorized as a "P1" AC Power Design Characteristic Group based on: an expected frequency of
grid-related loss of offsite power (LOOP) of less than once per 20 years; a "Group 2" estimated frequency of
loss of off-site power due to extremely severe weather (ESW); a "Group 1" estimated frequency of loss of
offsite power due to severe weather (SW); and an independent offsite power (I Group) rating for River
Bend of "I 1/2".
- 2. The EAC Group for River Bend is "C".
- 3. Average EDG reliability was calculated as 99% for the last 20, 50, and 100 demands, respectively.
- 4. River Bend's EDG target reliability of 0.95 was selected for the station.
With an off-site power group of P1, an EAC Group of "C", and 0.95
EDG reliability, River Bend has a four-hour coping duration for
SBO. 15C.2.2 PROCEDURES Procedures brought into compliance with NUMARC 87-00 which would
be utilized during a SBO include Abnormal Operating Procedures (AOP), Emergency Operating Procedures (EOP), and corporate
procedures for grid operation.
15C.2.3 COLD FAST STARTS
The EDG cold-start initiative is not applicable to River Bend.
15C.2.4 AC POWER AVAILABILITY
EAC power availability at River Bend is addressed via
participation in INPO's Plant Performance Indicator Program.
RBSUSARRevision14 15C-3September200115C.2.5COPINGASSESSMENT/EDGRELIABILITYTheabilityofRiverBendtocopewithafour-hourSBOhasbeenevaluated.Thecopingassessmentindicatedthatprovidedoperator actionistimely,nosupplementalcoolingisrequiredforthe controlroomduringastationblackoutevent.Thecoping evaluationalsoindicatedthatequipmentoperabilityduringa four-hourstationblackoutwasnotaconcernwiththeexceptionof RCICisolationonhighmainsteamtunneltemperature.This potentialconcernhasbeenresolvedbyrevisingthestation blackoutproceduretoincludebypassoftheleakagedetection systemtrips.Themaintopicsaddressedbythecopingassessment
are:1)Condensateinventoryfordecayheatremoval2)Class1Ebatterycapacity 3)Compressedair 4)Effectsoflossofventilation 5)Containmentisolation15C.2.5.1CONDENSATEINVENTORYFORDECAYHEATREMOVALCondensateinventoryfordecayheatremovalwasfoundtoexceedtheinventoryrequiredforcopingwithafour-hourSBO.14AnanalysiswasperformedwhichconcludedthattheminimumavailableCSTinventoryof125,000gal.wasadequatefor5.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />,orwellinexcessofSBOcopingdurationof4hours.The analysisindicatedthatforthis"classicSBO"case,HCTLwould notbeexceeded.Theanalysisassumedthefollowing:
141)RCICistheonlyinjectionsourcetothereactorpressurevessel(RPV),2)RCICisalignedtotakesuctionfromtheCST,3)RPVcooldownisinitiated5°Fbelowtheheatcapacitytemperaturelimit(HCTL)curvebyopeningoneSRV,144)(notused) 145)onesafetyreliefvalve(SRV)remainsopen, 6)suppressionpooltemperatureis100°FandvolumeisTechnicalSpecificationlimit, RBSUSARRevision14 15C-4September20017)RCSpumpsealleakageis18gpmperpump,and8)cooldownisterminatedwhenRPVpressurereaches100 psia.GenericLetter(GL)91-07,"ReactorCoolantPumpSealFailuresandItsPossibleEffectonStationBlackout"wasissuedas informationaltoaddressthepotentialfor100gpmperpump leakage.TheNRChasagreedtoacceptthe18gpmsealleakage rateperpumpforBWRspendingresolutionofGenericIssue23.NocreditwastakenfortheHPCSdieselasanalternateAC(AAC)powersupply.Therefore,HPCScannotberelieduponasan injectionsourcetotheRPVduringaSBO.15C.2.5.2CLASS1EBATTERYCAPACITY TheClass1Ebatterycapacitywasfoundtobesufficientforcopingwithafour-hourSBO.Batterycapacitywasbasedonan electrolytetemperatureof60 oFwhichislowerthanthelowestcalculatedSBObatteryroomtemperature.Loadstrippingtoextend thebatterycapacityisnotrequired.TheRCICloadprofileused inthesecalculationsisconsistentwithSBOoperation.15C.2.5.3COMPRESSEDAIRItwasdeterminedthattheonlyair-operatedvalveswhicharerequiredtobecycledduringaSBOaretheSRVs.Thesehaveback-upairaccumulatorsadequateforcopingwithafour-hourSBO.SRV operationisrequiredtoavoidexceedingtheheatcapacity temperaturelimitandtheSRVtailpipelevellimit.14TheADSSRVairaccumulatorsaresizedtoprovide4to5actuationspervalveatatmosphericpressureinthedrywell.Asa resultatotalof28to35ADSSRVactuationsareavailableto controlRPVpressure.Whennon-ADSSRVsareconsidered,aminimum of37-valvecyclesareavailable,or15moreSRVoperationsthan areneededfora4hourSBO.
14AOP-0050directstheoperatortocontrolRPVpressurewith continuousSRVopeningifairsupplytotheSRVsislost.Inthe eventthatadditionalairisrequired,AOP-0050alsodirectsthe operatortoprovidebottledcompressedairornitrogentorecharge theSRVaccumulators.
RBSUSARRevision9 15C-5November199715C.2.5.4EFFECTSOFLOSSOFVENTILATIONRiverBendStationhasanalyzedenclosedcompartmentstodeterminewhichcontainsystemsandequipmentthatwouldbeheatsources duringtheSBOevent.Thedominantareasofconcernare:RCICpumpandturbineroom(Aux.Bldg.)
HPCSpumproom(Aux.Bldg.)
MainControlRoom(ControlBldg.)
Batteryroom1A(ControlBldg.)
Batteryroom1B(ControlBldg.)
Standbyswitchgearroom1A(ControlBldg.)
Standbyswitchgearroom1B(ControlBldg.)
StandbyDCequipmentroom1A(ControlBldg.)
StandbyDCequipmentroom1B(ControlBldg.)EachoftheseareaswasanalyzedforheatupfollowingSBOandloss ofventilation.Additionally,BatteryRooms1Aand1Bwere analyzedforpotentialcooldownduringcoldweathertoensure batterycapacityassumptionsforminimumelectrolytetemperature remainvalid.SomecompartmentswerenotanalyzedfortheSBOevent.Temperatureeffectsinthemainsteamtunnelwerenotevaluated, sinceAOPsrequiretheoperatorstobypasstheRCICleakdetection systemisolationsintheeventofanSBO.Becausenocreditis takenforoperationoftheHPCSdieselgenerator,controlbuilding compartmentscontainingonlyHPCSrelatedelectricalequipment werenotanalyzed.ThesecompartmentsareBatteryRoom1C, StandbySwitchgearRoom1C,andStandbyDCEquipmentRoom1C.15C.2.5.4.1RCICEQUIPMENTROOMSBOOPERATINGTEMPERATURE ExisitingenvironmentalqualificationreportsforthelimitingRCICcomponent'squalificationtemperaturefortheRCICroom indicatethattheequipmentcanbesubjectedtotemperaturesupto 207°Ffor4hoursandremainoperable.RCICequipmentroom temperaturewillbebelowthislimitafterthe4-hourSBOcoping duration;therefore,RCICcanbeutilizedforSBOcoping.15C.2.5.4.2CONTROLROOMSBOAIRTEMPERATURE Controlroomambientairtemperatureisbasedontheallowabletemperaturesforcomponentsinsidecontrolroominstrumentpanels, sincethepanelinteriorsareatahighertemperaturethancontrol roomambient.
RBSUSARRevision9 15C-6November1997Byopeningthedoorstoselectedcontrolroompanelsandremovingceilingtilestoimproveaircirculation,itwillbepossibleto maintainactivecomponentsatlessthan120°F.15C.2.5.4.3CONTROLBUILDINGROOMTEMPERATURES RiverBendStationperformedcalculationstodeterminethetemperatureofothercontrolbuildingcompartmentsfollowinga stationblackout.Thesecompartmentsincluded:batteryroomsA andB,standbyswitchgearroomsAandB,andstandbyDCequipment roomsAandB.Ineachcasetemperatureswerefoundnottoexceed acceptedequipmentoperabilitylevelsforthe4-hourSBOduration.15C.2.5.4.4EQCONSIDERATIONS Asurvivabilityreviewofcriticalcomponentsbasedonenvironmentalqualification(EQ)criteriafoundthatcritical componentshadeitherbeenpreviouslyqualifiedasharsh environmentitemsorwereidenticaltoequipmentthatwas qualifiedforharshenvironments.15C.2.5.5CONTAINMENTISOLATION ContainmentintegritycanbeprovidedasrequiredbythescreeningandselectionrequirementsofNUMARC87-00duringastationblackoutevent.Valvesmusthaveclosurecapabilityunderblackout conditionseitherthroughmanualoperatoractionsorbyac independentpowersupplies.Somevalvesareexcludedfromthe requirementsofSBOclosurecapabilityperfiveNUMARC87-00 exclusioncategories.Excludedvalvesarethosevalvesthatwould normallybeconfiguredtoprovidecontainmentintegritydueto theirconfigurationordesigncharacteristicssuchasnormally lockedclosedvalvesorvalvesthatfailclosed.Inaddition, basedoninformationprovidedbytheSBOClearinghouse,RiverBendappliedfourotherexclusionscreeningcriteriatothecontainment isolationvalves.Containmentisolationvalveswerereviewedtoidentifyanyvalvesetswhereboththeinboardandoutboardisolationvalvesdidnot meetanyoftheninecriteria.Singlefailureneednotbeassumed, theproperoperationofeithertheoutboardorinboardvalvewould besufficienttoensureisolation.
RBSUSARRevision9 15C-7November1997ThefollowingvalvesetsdidnotmeetanyoftheNUMARCexclusioncriteriaforeitherinboardoroutboardvalvesandarelistedas "normallyopen":
INBOARD OUTBOARDRWCUReturntoFWG33*MOVF040G33*MOVF039RWCUPumpSuctionG33*MOVF001G33*MOVF004RWCUPumpDischargeG33*MOVF053G33*MOVF054FuelPoolPurificationSuctionSFC-MOV139 SFC-MOV121Thesevalvesaremotoroperatedvalvesthatfail"asis"uponlossofACpower.RCICisolationvalveswereomittedsincetheyareDC poweredandareexpectedtoremainopenforRCICoperationduring anSBOevent.15C.3COMMUNICATIONSANDPORTABLELIGHTING Duringthecopingperiodnormallightingandcommunicationssystemsmaynotbeavailable.RiverBendconfirmedthat alternativelightingandcommunicationswillbeavailableina SBO.TheEmergencyResponseCabinethaswithinitbothdedicated portablelightsandtwo-wayradios.Dominantareasofconcernand theotherplantareasrequiringaccessduringthecopingperiod, andtheingressandegressroutestotheseareasareequipped withEmergencyLights.Eachoperatorcarriesaportablelight whenperforminglocalmanualoperations.Communicationsystems availableinaSBOarethePageParty/PublicAddressSystem,the PortableIntercomSystem,andthePrivateBranchExchange(PBX)
System.15C.4FIRESUPPRESSIONSYSTEMACTUATION ARiverBendreviewoffiresuppressionsystemsfoundthatwithintheDominantAreasofConcerntheMainControlRoom,RCICPump andTurbineRoom,theTurbineBuildingatthe67'Elevation,and theingress-egressroutestotheFuelBuildinghavefire suppressionsystemssubjectedtoSBOconsideration.Theseareas willremainattemperaturesbelowthefiresuppressionlimits.15C.5REACTORCOREISOLATIONCOOLING(RCIC)SYSTEMOPERATION TheReactorCoreIsolationCooling(RCIC)SystemisdesignedtoassurethatsufficientwaterinventoryismaintainedinRPVto permitadequatecorecoolingtotakeplace.TheRCICSystemwill maintaintheunitinthehotstandbycondition.FortheSBO copingperiodtheRCICSystemandtheSafety/ReliefValves RBSUSARRevision14 15C-8September2001(S/RVs)aretheonlyremoteoperatingsystemsavailableformaintainingRPVlevelandremovalofdecayheat.ReactorvesseldepressurizationisaccomplishedbyopeningasingleSRVatone hourandmaintainingitopen.Thereactorpressureispredictedto fluctuatefrom70(wheretheSRVcloses)to110psigdueto operationoftheRCICsystem.TheRCICSystemisDCpoweredexceptforthefive(5)containmentisolationvalves(1E51-F063,1E51-F064,1E51-F076,1E51-F077,and 1E51-F078).ThesystemiscompletelyoperablefromtheMain ControlRoomduringthecopingperiod,andtheACPowered ContainmentIsolationValvesareallinthepositionnecessaryto supportRCICSystemwithnolocalmanualalignmentsnecessaryto allowsystemoperation.TheDCpowerfortheRCICSystemis providedfromtheEssentialPowerDistributionSystem.AtthestartoftheSBOcopingperiodtheRPVisisolatedbecausetheMSIVscloseandFeedwaterisnolongeravailable.The pressureintheRPVincreasesuntiltheS/RVsopenontheir safetysettings.TheRPVleveldecreasesandRCICis automaticallyinitiatedwhenLevel2isreachedintheRPV.If RCICdidnotautomaticallyinitiate,remotemanualinitiation fromtheMainControlRoomisalsopossible.Thismanual initiationwillcausetheRCICSystemtoaligninthesame configurationaswiththeautomaticinitiation.Onceinitiated anduponreachingsteady-stateconditions,theRCICSystemis throttledtomaintaintheRPVlevelabovetheactivefuelregion withoutoverfillingtheRPV.TheRCICSystemisinitiallyalignedtotheCSTasthesourceofmakeupwaterfortheRPV.IftheCSTlevelshouldfallbelowa presetlevel,theRCICPumpsuctionautomaticallytransfersto theSuppressionPool.Thisisaccomplishedbyhavingvalve1E51-F031automaticallyopen.Oncevalve1E51-F031isfullyopen,the CSTsupplyvalve1E51-F010isautomaticallyclosed.Becauseof thedesiretoremainontheCSTasthewatersourcefortheRCIC SystemtheinterlocksthatswitchRCICPumpsuctiontothe SuppressionPoolonhighSuppressionPoolLevelandtheRCIC isolationonhighsteamtunneltemperaturearebypassedaspart ofthecopingperiodactivities.14TheRCICswapduetohighsuppressionpoollevelmightautomaticallyswitchfromtheCSTtothesuppressionpoolbefore theoperatorscanbypasstheinterlocks.Highsuppressionpool levelwouldoccurduetotheopeningoftheSRVstocontrol reactorpressure.Additionally,alowsuctionpressureatthe RCICpumpsuctioncouldoccurduetoincreasingsuppressionpool temperatureassociatedwiththeSRVactuationtocontrolreactor pressure.Thislowsuctionpressureconditioncouldresultina RCICtripduringtheSBOcopingperiod.Therefore,operator actionsarerequiredtoswaptheRCICsuctionbacktotheCSTif thehighsuppressionpoolswapoccurs.
14 RBSUSARRevision9 15C-9November199715C.6REFERENCES1.February16,1989/RBG-30090,GSUInitialResponsetoGenericLetter88-14,InstrumentAirSupplySystemProblemsAffectingSafety-relatedEquipment2.April17,1989/RBG-30553,EvaluationofRBSCompliancewithStationBlackoutRule10CFR50.633.March30,1990/RBG-32597,SupplementalResponsetoApril17,1989SubmittalonCompliancewith10CFR50.634.September12,1991/RBC-41149,NRCRequestforAdditionalInformationonSBOSubmittalsdatedApril17,1989andMarch30,19905.October18,1991/RBG-35809,GSUResponsetoNRCRequestforAdditionalInformationdatedSeptember12,19916.January16,1992/RBC-41689,RiverBendStationUnit1-StationBlackoutSafetyEvaluation(TACNo.M68593)7.March20,1992/RBG-36633,ResponsetotheNRCStationBlackoutSafetyEvaluationReport(SER)fortheRiverBendStationdatedJanuary16,19928.June11,1992/RBC-42208,StationBlackoutAnalysisSupplementalSafetyEvaluation-RiverBendStation,Unit1 (TACNo.M68593)9.July8,1992/RBG-37132,ResponsetoNRCStationBlackoutAnalysisSupplementalSafetyEvaluationReportforRiver BendStationdatedJune11,199210.October17,1995/RBG-42060,GSUResponsetoNRCRequestsduringRiverBendStationEngineeringandTechnicalSupport Inspection95-1011.April17,1996/RBC-46647,RiverBendStation,Unit1-ReactorCoreIsolationCooling(RCIC)GlandSealFailure; StationBlackout(TACNo.M94133)