Text

Forwards Revised Evaluation of Design-Basis Events: Accidents & Transients. Revised Rept Incorporates Comments from Util .Sep Topics XV-1 - XV-10,XV-12,XV-14, XV-15,XV-16,XV-17,XV-19 & XV-20 Considered Complete
	ML18046A822
Person / Time
Site:	Palisades
Issue date:	07/17/1981
From:	Crutchfield D; Office of Nuclear Reactor Regulation
To:	Hoffman D; CONSUMERS ENERGY CO. (FORMERLY CONSUMERS POWER CO.)
References
	TASK-***, TASK-RR LSO5-81-07-064, NUDOCS 8107300030
	Download: ML18046A822 (81)
	v • d • e

>--

OotketNo. 50-255 tS_OS07-064 Mr. David P. Hoffman Nu~lear Licensing Administrator

',Consumers Power Company J 945 W Parnal 1 Road Jack~ori, Michigan 49201

Dear Mr. Hoffman:

SUBJECT:

SEP TOPICS XV-1, XV-2, XV-3, XV-4, XV*S, XV-6, XV-7, XV-8, XV-9, XV-10, XV-12, XV-14, xv~ls, XV-16, XV-17, XV.-19, ANO XV-20, DESIGN BASIS EVENTS - ACCIDENTS AND TRANSIENTS (PALISADES) s~ ~~-

Enclosed is the revised evaluation of accidents and transients for Palisades *.

Cotmnents from your letter of May 19, 1981 have been incorporated into the re-v1sed 'r~port.

With respect to your letter of June* 12, 1981 regardif1g*.the design basis event radiological.* tqp.ics, we have not changed the previously transmitted. res.ults for the following reasons:* 1) our_ original transmittal of Topic XV*l6 con-sidered the information supplied in your May 6, 1980 letter; 2) the dose consequences of Topic X-V-19 were calculated using the assumptions anct pro-cedures of SRP is.6.5 and provide a conservative estimate by which* to judge

. the adequacy of the plant design; 3) Topic XV-20 was done using a sitnplisUc approach assumfog no isolation or filtration and since the ~ose consequences were within the acceptance cri~eria no further calcul,ati<:mswere nec_essary.

These toptc evaJu~tions will be a basic input to the integra~ed, safety assess-ment for yoy_r facility unless you identify changes needed: to reflect the as-b~t--eon-ctftions at your facility. Thi_s ~ssessment may be,revised in the

... ------future if your facility design is changed or if NRC criteria rela~1ng to this subject is tnodified before.the integrat~d asse~s01~nt is COIJIPleted.

<.~' :,.

_ The staff now considers the above topic evaluations to ~e complete.

Any unresolved dev1ati<m~ identifi.ed in the repQrt will be. c_onsidered in the

.,,~

1 ntegrated ~sses-sment.

~ ~

\\

Sjncerely,

~~

~~~",J,_g~0~3CF'lll'0'717~-~-,benn1s M. Crutchfield, Chief

~~~~~L

~D!l ADOCK' 05GOO~fi~ [,\\ -11

. Operating Reactors Br_ancQ.!Jo.

7/t/~1 t1. -

~1)(. o o cens g~

1;u:::::: *........ :E~~*1~~:-.~~;*~*A~*~t~t~ lfc~~*;ci~****: 2~~~d~ * *, *Q~*~~P.~..... ;.... : ~~ici~f>~~{=*-**~ :.. g~.ru*f~~*~~*~;*a

. ~.,.~................... :........... :........,..... iii.......,. *7/ *ia*i...... 'ii~....., ii.',iiii..... ii/I/iii........ _

........ cc.. w./e c.losur.e *.... S.e.~((pa.ge........... 1...............,....................... '/.L.............. 1.............. *~***.

~RC.FORM 318 110180! NRCM 0240,

CfflClAL. RECCR.C CCPY

, US.GRO: 1980-329*!!:14.

UNITED ST ATES NUCLEAR REGULATORY COMMISSION WASHINGTON, 0. C. 20555 Docket No. 50-255 LS05 07-064 Mr. David P. Hoffman Nuclear Licensing Administrator Consumers Power Company 1945 W Parnall Road Jackson, Michigan 49201

Dear Mr. Hoffman:

July 17, 1981 *

SUBJECT:

SEP TOPICS XV-1, XV-2, XV-3, XV-4; XV-5, XV-6, XV-7, XV-8;

. XV-9, XV-10, XV-12, XV-14, XV-15, XV-16, XV-17, XV-19, AND XV-20, DESIGN BASIS EVENTS - ACCIDENTS AND TRANSIENTS (PALISADES)

Enclosed is the revised evaluation of accidents and transients.for Palisades.

Comments from your letter of May 19, 1981 have been incorporated into the re-.

vised report.

With respect to your letter of June 12, 1981 regarding. the design basis.event radiological topics, we have not changed the previously transmitted results for the following reasons:

l) our original transmittal of Topic XV-16 con-sidered the information supplied in your May 6, 1980 letter; 2) the dose consequences of Topic XV-19 were calculated using the assumptions and pro-cedures of SRP 15.6.5 and provide a conservative estimate by which to judge the adequacy of the plant design; 3) Topic XV-20 was done using a simplistic approach assuming no isolation or filtration and since the dose consequences were*within the acceptance criteria no further calculations were necessary *.

These topic evaluations will be a basic input to the integrated safety asses*s-ment for your faci 1 ity unless you identify changes needed to reflect the as-buil t conditions at your facility. This assessment may be revised in the future if your facility design is changed or if NRC criteria relating to this subject is modified before the integrated assessment is completed.

The staff now considers the above topic evaluations to be complete *. *Any unresolved deviations identified in the. report will.be considered in the integrated assessment.

Enclosure:

As stated

~c w/enclosure:

See next page Sincerely,

~y~

f Dennis M. Crutchfield, Chief Opera.ting Reactors Branch No. 5 Division of Licensing *

\\

SAFETY ASSES.SMENT PALISADES NUCLEAR POWER PLANT DOCKET NO. 50-255 EVALUATION*OF*DESIGN-BASIS*EVENTS~ ACCIDENTS-ANO-TRANSIENTS REGUlATO.RY DOCKET FILE COPY

CONTENTS Page EVALUATION OF DESIGN-BASIS EVENTS--ACCIDENTS AND TRANSIENTS..........

1 1

2 3

4 INTRODUCTION....................................................

DOCUMENTATION HISTORY OF DESIGN-BASIS EVENTS....................

CODES AND MODELS................... -.............................

PERFO~MANCE -OF DESIGN-BASIS EVENTS..............................

1

. 12 14 16 4.1.0 Group I Events...........................................

16 4.1.1 Decrease in Feedwater Temperature (Topic XV-1)...........

4.1.2 Increase in Feedwater Flow (Topic XV-1)..................

4.1.3 Increase in Steam Flow (Topic XV-1).......................

4.1.4 Inadvertent Opening of Steam Generator Reli*ef/Safety Valve (Topic XV-1)......................

4.1.5 Startup of Inactive Loop (Topic XV-9)....................

4.1.6 *System. Malfunction Causing Boron Dilution (Topic XV-10)...........................................

16 18 19 21 21 22 4.2.0.Group II Events..........................................

23 4.2.1 Loss of External Load (Topic XV-3).................... ~..

23 4.2.2 Turbine Trip (Topic XV-3)................................

26 4.2.3 Loss of Condenser Vacuum (Topic XV-3).............. ~.....

26 4~2.4 Steam Pressure Regulator Failure (Closed)

(Topic XV-3)...........................................

26

4. 2. 5 Loss of Feedwater Fl ow (Topic XV-5)........ ~.............

26 4.2.6 Feedwater System Pipe Break (Topic XV-6).................

28

4. 3. 0 Group III Events... ;.....................................

31 4.3.1 Steamline Break Inside Containment (Topic XV-2)..........

31 4.3.2 Steamline Break Outside Containment (Topic XV-2).........

39 4.3.3 Radiological Consequences of Breaks Outside Containment (Topic XV-2)...............................

40 4.3:4 Containment Response (Topics VI-2, VI-3).................

41

~- -- -- ~--- ------

- -A-.-4-. o-*-Grcrnp-IV Events~-:.--:-:~ ;-:--. -;~ -;-. -:- ;-:- ;-. --; ;-.-;.-. ;-.-.--;-. ;-;-. -;;.-. ;-.. -'-;-.-;.- - -- - -

4.4.1 Loss of AC Power to Station Auxiliaries (Topic XV-4)............................... _..... ;.......

43 4.4.2-Loss of all AC Power (Station Blackout) (Topic XV-24)....

44

4. 5. 0 Group V Events..... -........... ;..........................

45 4.5.1 Loss of Forced Coolant Flow (Topic XV-7)..... ~...*.......

4.5.2 Pump Rotor Seizure ~nd Shaft Break in Reactor Coolant Pumps (Topic XV-7).....................

ii 45 45

CONTENTS (Continued) 4.6.0 Group VI Events.........................................

47 4.6.1 Uncontrolled Rod Assembly Withdrawal at Power (Topic XV-8)...........................................

47

4. 6. 2 Uncontrolled Rod Assembly Withdrawal--Low Power Startup (Topic XV-8)...................................

47 4.6.3 Control Rod Misoperation (Topic XV-8)....................

47 4.6.4 Spectrum.of Rod Ejection Accidents (Topic XV-12).........

48 4.6.5 Radiological Consequences of a Rod Ejectiori (Topic XV-12)..........................................

49 4.6.E Spectrum of Rod Drop Accidents (Topic XV-13).............

50 4.7.0 Group VII Events.........................................

51 4.7.1 4.7.2 4.7.3 4.7.4 Spectrum of Loss-of-Coolant Accidents (Topic XV-19)......

Radiological Consequences of Loss-of-Coolant Accident (Topic XV-19)........ ~........................

Containment Pressure/Temperature Response (Topics VI-2, VI-3)....................................

Radiological Consetjuences of Failure of Small Lines Carrying Primary Coolant Outside Containment.

(Topic XV-16)..........................................

51.

55.

56 56 4.8.0 Group VIII Events............... :........................

58

4. 8.1 Drop of Cask or Heavy Equipment (Topic IX-2).............

58 4.8.2 Radiological Co~sequences of Fuel-Damaging Accidents (Inside and Outside Containment)

(Topic XV-.20)........................... *................

58

4.9.0 Group IX Events..........................................

60 4.9.1 Inadvertent Opening of PWR Pressurizer Relief Valve or BWR Safety/Relief Valve (Topic *xv-15).... ~....

60

4. 10. 0 Group X Events.................................. *.........

62 4.10.1 Inadvertent Operation of ECCS or CVCS Malfunction That Causes an Increase in Coolant Inventory

-- --.---- -----* - --- --- ---(-Topi-E---XV.... 14).-..* -.--.-..--. -.-.--. -.-.--. -.-.-. -.. -.. -.. -.. -.. --.-.-... -.. -.*.-.. -.-.--.-.-- ----- - - --- ---

4. 11. 0 Group XI Events..........................................

63 4.11.1. Fuel Loading Error (Topic XV-11).........................

63 4.12~ 0 Group XII Events.........................................

64 4.12.1 Steam Generator Tube Failure (Topics IV-17, XV-23).......

4.12.2 Radiological Consequences of Steam Generator Tube Failure (Topic XV-17).............................

iii 64 65

5 6

7 1

2 3

4 1

2 4.13.0 Group XIII Events..........*.............................

4.13.1 *Anticipated Transients Without Scram (Topic XV-22).......

OCCURRENCES OF DESIGN-BASIS EVENTS..............................

SUMMARY

REFERENCES........ ~.............................................

FIGURES Plant Systems Needed To Mitigate Design-Basis Events........*..*

Safety Topic.Interface With Mitigating Systems..... ~... ;........

Emergency Core Cooling System (Injection Mode).........*....*...

Main Steam/Main Feedwater System................................

TABLES Plant Conditions That Initiate Reactor Scram....................

Engineered Safety Features Initiation Setpoints.................

3 Design-Basis-Event Analysis Assumptions:

Initial Conditions....

3A. Design-Basis-Event Analysis Assumptions:

Technical 4

5 6

7 8

Specification Limits............................................

Assumptions Made in Analysis of Radiological Consequences of Postulated Tube Failure, Main Steamline Failure~ and Control-Rod Ejection Accidents...................................

Accident Doses at Nearest Site Boundary.........................

Estimated Offsite Doses for Postulated Loss-of-Coolant Accidents......................................................

Calculated Doses for Fuel-Handling Accident............*........

Assumptions Used in Analysis of Fuel-Handling Accident...........

67 67 68' 69

. 71 10 11 36 38 5

6 7

9 41 42 56 58 59.

~------- ---- ---- -- ------

~ ------- ------ _____,___ -- ----- -

iv

AFWS ASME BOC BWR ccw CE CHF CPR eves DNB ECCS ESF FSAR HPSI LOCA LPSI MSIV

-MTC NRC PCS PCT PORV PWR RCP RCPB SEP SG SI SIAS SIRW SIS SRP TMI ABBREVIATIONS auxiliary feedwater system American Society of Mechani.cal Engineers beginning of cycle boiling-water reactor

. component cooling water*

Combustion Engineering critical heat flux critical power ratio chemical and volume control system departure from nucleate boiling emergency-core-cooling system engineered safety feature final safety analysis report high-pressure safety injection loss-of-coolant accident low-pressure safety injection main steam isolation valve

_moderator temperature coefficient U.S. Nuclear Regulatory Commission primary coolant system peak clad temperature power-operated relief valve pressurized-water reactor reactor coolant pump reac,tor cool ant pressure boundary Systematic Evaluation Program steam generator.

safety injection safety injection actuation signal safety injection and refueling water (tank) safety injection system Standard Review Plan Three Mile Island v

SAFETY ASSESSMENT PALISADES NUCLEAR POWER PLANT DOCKET NO. 50-255 EVALUATION OF DESIGN-BASIS EVENTS:

ACCIDENTS AND TRANSIENTS vi

III.

EVALUATION OF DESIGN-BASIS EVENTS--ACCIDENTS AND TRANSIENTS 1

INTRODUCTION The safety philosophy used in the design of reactor plants has traditionally been based on the concept of 11defense-in-depth. 11 The approach begins with a

conservative design, using components of high quality.

Redundant and diverse systems are used to ensure that a single failure will not prevent system functions.

The reactor systems are designed to prevent ~nforeseen occurrenc~s, and to mitigate the consequences of s.uch events should they happen.

One important means of protecting the public from exposure to the radioactive products produced by nuclear fission in the fuel is by providing multiple barriers between the fuel and the public.

The three main layers of defense are the physical barriers of the reactor fuel clad, the reactor coolant system pressure boundary (RCPB), and the. reactor containment building.

System di.sturbances and malfunctions or equipment fai 1 ures can occur during plant operation and challenge the integrity of the three barriers. These are analyzed to determine the capability of the plant design and installed p.lant systems to prevent breaching these barriers.

The American Nuclear Society has classified plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological *consequences to the public.

In general, *this classification is also followed in the NRC Standard Review Plan Chapter 15 review procedure for plant accidents and transients.

The four categories are:

Condition I:

Normal operation and operational transients Condition II:

Faults of moderate frequency Condition III: Infrequent faults Condition IV:

Limiting faults The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radio-logical risk to the public and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur.

The impact of various single failures on the course of an accident or transient is also considered.

For a new plant under review for an operating license, the approach outlined in Regulatory Guide 1. 70~

11Standard Format and Content of Safety Analysis Reports for Nuclear Power Plant, 11 Chapter 15 is used to:

(1)

Ensure that a sufficiently broad. spectrum of initiating events has been considered, 1

(2) Categorize the initiating events by type and expected frequency of

.occurrences so that only the limiting cases in each group need to be quantitativ~ly analyzed, and (3)

Permit the consistent application of specific acceptance criteria for

.each postulated initiating event.

To accomplish these goals, a number of disturbances of process variables and malfunctions or failures of equipment should be postulated.

Each postulated initiating event should be assigned to one of the following categories:

(1)

Increase in heat removal by the secondary system (turbine plant)

(2). Decrease in heat removal by the secondary system (turbine plant)

(3) Decrease in reactor coolant system flow rate (4)

Reactivity and power distribution anomalies (5)

Increase in reactor coolant inventory (6) Decrease in reader coolant inventory (7)

Radioactive release from a subsystem or component (8) Anticipated transients without scram One of the items of information that should be*discussed for each initiating event relates to its expected frequency of occurrence.

Each initiating event within the eight major categories (see previous list) should be assigned to one of the following frequency groups:

(1} Incidents of moderate frequency (2)

Infrequent incidents (3)

Limiting faults The initiating events for each combination of category and frequency group should be evaluated to identify the events that would be limiting.

The intent is to reduce the number of initiating events that need to be quantitatively analyzed.

That is, not every postulated initiating event needs to be completely analyzed by the applicant.

In some cases a qualitative comparison of similar initiating events may be sufficient to identify the specific initiating event that leads to the most limiting consequences. Only that initiating event should then be analyzed in detail.

It should be noted, however, that different initiating events in the same category/frequency group may be limiting when the multiplicity of consequences is considered.

For example, within a given category/frequency group combina-tion, one initiating event might result in the hi~hest reactor coolant pressure boundary (RCPB) pressure, and another initiating event might lead to minimum core thermal-hydraulic margins or maximum.offsite doses.*

This approach was used in the reevaluation of accidents and transients for the Systematic Evaluation Program (SEP) facilities.

The accident and transient analyses for the Palisades plant are discussed and evaluated in the following The review approach is consistent with Regulatory Guide 1. 70.

2

subsections.

The DBEs are organized ino groups on the basis of commonality of plant response to the initiating events.

The group structure is shown in*

Reference 47.

In accordance with the SEP review method, the evaluation includes an assessment of the expected system response and the ability of the plant to adequately mitigate the event.

The frequency of occurrence of events based upon a review of plant operating experience is discussed in Section 5 of this report.

The current regulatory criteria used in the accident and transient evaluations are those found in Chapter 15 of the Standard Review Plan.

In general, the acceptance criteria for moderate frequency events are:

(1)

Pressures.must not exceed 110% of design pressure for the reactor coolant and steam generator systems.

(2)

Fuel clad integrity must be maintained for essentially all fuel rods in the core.*

(3)

An incident assigned a "moderate frequency" likelihood of occurrence should not generate a more serious plant condition without other faults occurring independently.

(4) A moderate frequency event in combi.nation with an assumed single active failure, o~ single operator error, should not cause the loss of function of any barrier other than the fuel cladding.

A limited number of fuel rod clad perforations is acceptable.

Palisades design pressure is 2500 psia, so the American Society of Mechanical Engineers* (ASME) 110% limit is 2750 psia.

An additional criterion is that the pressure differential between the primary and secondary systems be less.

than *1530 psid.

For the Palisades plant, the fuel clad integrity limit for moderate frequency events is a minimum departure from nucleate boiling (DNB) ratio of 1.3. This ratio corresponds to at least a 95% probability with 95%

confidence that no fuel rod in the core will experience DNB.

Prevention of DNB is sufficient to demonstrate the avoidance of rod overheating

and of consequent rod failure.

Thus if DNB is not reached, clad integrity is preserved and fission products are not released from the fuel into the cool~nt.

For infrequent events, limited fuel damage is acceptable provided control-rod insertion is not prevented, no loss-of-core cooling capability will result, and offsite doses fall within the limits cf 10 CFR Part 100.* This regulation states that an exclusion area must be established so that an individual. at the boundary for 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months immediately following onset of the postulated fission-product release would not receive a total radiation dose to the whole body in excess of 25 rem or a total radiation dose to the thyroid from iodine exposure of 300 rem.

In addition, a low population zone is established so that an individual at its boundary who is exposed to the radioactive cloud from the postulated release (during the entire period of its passage) would not receive

Two approaches are used to meet this criterion.

One is based on departure from nucleate boiling {DNB) ratio or* critical heat flux (CHF) ratio.

The other is based on critical power ratio (CPR).

In general~ pressurized water reactors (PWRs) used DNB or CHF ratios and boiling water reactors*(BWRs) define thermal margin in terms of CPR.

3

doses in excess of those given above.

For some events, the Standard -Review Plan requires that the doses be less than a specified fraction of the limits set in 10 CFR 100.

The acceptance criteria for the rod-ejection event for Palisades are those given in SRP 15.4.8.

For LOCAs, the acceptance criteria as given in 10 CFR 50.46 are applicable.

That is, the peak clad temperature shall not exceed 2200°F, the total clad oxidation shall not exceed 17%, the hydrogen generated shall not exceed 1% of the hypothetical amount if all metal reacted, a coolable geometry shall be maintained, and decay heat shall be removed for long-term cooling.

The above criteria must be met using an acceptable evaluation model which meets the requirements of Appendix K to 10 CFR 50.

One of the issues raised as part of the TMI Action Plan, NUREG-0660 (Ref. 38),

is consideration of core degradation and melting beyond the design basis.

The NRC_will conduct rulemaking on this subject, and this will be done outside of the SEP.

This item may become an unr~solved safety issue.

Other concerns rai.sed following TMI, such as changes to 10 CFR 50.44 on hydrogen generation, are being addressed outside of the SEP.

Tables 1 and 2 present the setpoints for the reactor protection system and the engineered safety features initiation.

Table 3 summarizes the key input-assumptions for each DBE.

Table 3A lists operating parameters assumed and the corresponding technical specification limits.

Figure 1 shows which plant systems are required to mitigate the consequences of the DBEs.

Some of the systems identified may only be necessary if loss of offsite power or other single failures are postulated.

Alternate methods of fulfilling the same safety function have been identified in some cases.

Figure 2 shows the applicability of SEP topics to these-plant systems.

The topic evaluations are presented in Section II of the integrated assessment report.

4

Table 1 Plant*conditions that initiate reactor scram Parameter Nominal setpoint Setpoint used in analysis Delay time, sec High neutron flux 4-pump operation 3-pump operation 2-pump.operation High neutron.flux*

(1 ow range).-* --

Low flow 4-pump operation 3-pump operation 2-pump operation High pressurizer pressure Low steam generator pressur&

Low steam generator level Thermal margin/low pressure High containment pressure High power rate of change Loss of load (low autostop oil pressure)

Manual trip

Startup mode only.

106.5%

39%-

21%

10.65%

95%

.71%

46%

2255 psia 500 psia.

112%.

0.4 15%

0.4 93%

0.6 2277 psia 0.6 478 psia 0.6 6 ft below operating level 6 ft 10 in. below 0.6

operating level p = f(Th' Tc)**

1750 psia 5 psig p - 165 psia_

0.6 1728psia 5.75 psig 2.6 decades/min Not used (anticipatory trip}

Not used, trip (Anticipatory trip) bypassed while

below 15% power The thermal margin trip setpoint is a functional pressurizer pressure

_ varying as a function of the average hot leg temperature (Th) and the cold-leg temperature (T ), with a minimum value as indicatetl.

c 5

setpoint, average

Table 2 Engineered safety features inititation setpoints Parameter High containment pressure Low pressurizer pressure High containment radiation Setpoint 5 psig (- 25)

(+ 75) 1615 psia (+/-22) 20 R/hr Low steam generator pressure

500 psia (+/-22)

Low suction flow on main feedwater pump Closure ~f main feed pump turbine stop valves 6

Functions actuated Safety injection Containment spray Continament isolation Containment air cooler OBA mode MSIV closure Safety injection Containment isolation Main steamline isolation valve ~losure Main feedwater isolation Auxiliary feedwater Auxiliary feedwater

Table 3 DBE analysis assumptions:

initial conditions Section DBE (1.1)

Decrease in FW temperature (1.2)

Increase in FW flow (1. 3) &

Iner.ease in (1.4) steam flow (1. 5)

(1. 6)

(2.1)

(2.2)

(2.3)

(2.5)

Startup of inactive loop Boron dilution Loss of external load Turbine trip Loss of condenser vacuum Loss of FW (3.1) & Steamline break (3.2)

Assumptions 102% power

Low pressurizer pressure

BOC. kinetics (positive MTC)

Pressurizer heaters inoperable 52% power

Low pressurizer pressure EOC kinetics (most negative MTC)

Manual mode'

High pressurizer pressure

Minimum SI fl ow.

Case *l:*

102% power*-EOC kinetics, 40%-steam flow increase

Case 2:

hot standby--EOC kinetics, 40% steam flow increase

Reduced flux and low-flow setpoints

EOC kinetics At power:

see Rod Withdrawal (6.1) & (6.2)

102% power

BOC kinetics

Case 1:

high pressure--high pressurizer pressure, pressurizer relief and spray, steam dump and bypass inoperable

Case 2:

high ~p--high pressurizer pressure,

. pressurizer relief and spray inoperable

Case 3:

low DNB ratio~-low pressurizer pressure, steam dump and bypass inoperable

102% power

BOC kinetics

Low pressurizer pressure

102% power and hot standby.

EOC kinetics Offsite power available

Two loop and one*loop operation

2 of 3 pumps available for boron injection

See Table 4 7

Table 3 (Continued)

Section DBE (5.1)

Loss of forced coolant flow (5.2)

Rotor seizure (6.1) & Rod withdrawal (6.2)

(6.3)

Control-rod misoperation (rod drop)

(6.4)

Rod ejection (7.1)

LOCA (8.1)

Fuel-handling accident (9.1)

Opening of pressurizer relief/safety valves (10.1)

Actuation of eves or ECCS (12.1)

Steam generator tube failure (rupture)

Assumptions

102% power BOC kinetics No turbine generator assist

Pressurizer heaters and steam dump inoperable 102% power

BOC kinetics

102% and 52% power

Range of worths

Manual control

Minimum and maximum feedback

102% power Maximum and minimum worths

No turbine runback

Manual control 102% power and zero power

Maximum worth

See Table 4

102% power

BOC conditions

Appendix K evaluation model

Minimum safety injection capability--single failure See Table 8 See LOCA and generic analyses

. eves:

steam dump inoperable, no operator action

Eecs (HPSI):

solid plant conditions; one PORV fails

2650 MWt

One tube ruptured (double ended)

~ Loss of offsite power

See Table 4 8

Table 3A DBE analysis assumptions:

Technical Specification limits Parameter Moderator temperature coefficient (~/°F)

Doppler coefficient Shutdown margin 4 pumps Less than 4 pumps Reactor power System pressure Total flow rate (Mlbs/hr)

Core inlet temperature Average core coolant temperature Total peaking factor Radial peaking factor Maximum individual rod worth Rod speed PLHGR (kW/ft)

Scram rod insertion time Assumed in analysis

-4

, +. 50 to -3. 50 x 10

-1. 09 to* -1. 38 llp/°F (x.8, x 1.2) 2%

3.75%

2580.6 MWt 2060 psia +/- 50 psi 121.7 (at hot full power) 537.5 + 5°F 532.0-565.0°F (nominal) zero power to full power

2. 55.

1.45 [1.0 + 0.5 [l-P 1 ))

1.2%

46 in./min Up to 15.28 100% in 3.0 sec W:

Reactor flow in M1bs/hr P:

pressure in psia P

1 fractional power 9

Technical Specification

,limit

-4

+.50 to -3.5 x 10

> 2%

> 3. 75%

< 2530 MWt

~ 2100 psia

> 126.9 (at hot zero power)

T.

< 538.0 +.0398 CPD2060) +.00004843 (P-2060) 2 + 1.0342 (W-120.2) 525°F for criticality

< 2.55

< 1.45 [1.0 + 0:5 (1-p*)

< 0.6% at rated power

< 1.2% at zero power 15.28 90% in 2.5 sec

P~ANT.FEATURES Scram lr1111a1ion I

lni~i~~ion I Alarms & Signals I Heal Removal Systems I Engineered Safely features I

~~~;.:::: I Power Supplv II ACCIDENT AND TRANSIENT*GRDUPS Decrease in FW 1empcia1url! 1 Increase 1n FW llow 1 Increase 1n summ tlowl

~-----------~---*~-----

lnadve11en1 op1mmg al S~ reliet/_sahnv valve7 S1a11up oi macuve loop2 Sy51em mallunclJOn causing bo1on dllu11on2 Los~ of e1t1emal load1 Turbine 1r1pl Loss ol condemer vacuuml Stearn pressure reguta1or fa1h.m:3 _____ ----. *.

e e e

+-t-t-+--+-t- - -

.. -* - f-* --*

-*+--+--+-+__,,_..~ - -

~- -- f--

Loss of FW llow 1 FW sysum1 1upe hrea11:3 Ill*

S1ea-nliru: break ms1dt! con1a1nmcn11 Sr*amhno bo*ak ourMo con1a --m-m-.,-,.-2------

IV*

Loss of ac power 10 s1a11on aux1hanes3 loss ol all ac puwe13 V*

Loss of lorctid coolan1 flaw1

~r1mary pump 1010r )f!11Ure 1 Pumarv pump shah break3 VI:

Uncon1rolll:!d rod assemhly v.t11hdrawal ill powe11 Unco111rolled rod assembly w11htlra.wal, low powe1 ua11up2 Control*rod m1sopera11on2 Spec1rum ol 1od-e1ec11011 ac"'idems 1 VI I. Specuum ol LOCAs 1*

VIII Fuel*haudhng accidena IX*

lnadVf!flenl openmQ ol PAW 1.m:si.ur~ rt:lie( valw3

-* --*--t>--1--+---+--t---t>--l--+---+--+--t>--l-+---+--+-t~

~ *

le

tt * * * *

Figure 1

'(""""!_,'°mm,...._--:

I

.I

.1

,-.. xx H H l-U*-1 <. <<<<<

<<HHH HHHHH -I VI <

XXXXl-I 1-1 1-1 1-1 1-1 H HI-IHI-II-I Hl-IHH I I

I <

1-1 1-1 1-1 H 1-1 1-1 1-1 0

(I)

I I

I H 1-1 H 1-1 1-1 H 1-1 H I

I I

I IH t-'WIHH 1-1 1-1 1-1 H H l'D H C1'l01.~WH H 1-1 H I

I I

I 1-'-..JO"l 01.j::a W N W

........ NI I

I I

B I

I I

I.P. W NHO Ht-'

I-' m 01.P. t-1 n

..,, c+

.p.

WNH NH 0

...... 0 I

IQ I-'

c: N 0

IQ

""1 0 c:

(I)

""1 (I) f-1 N

VI x

x x

x x x x ><

x >< >< x Reactor protection system Ill

-ti (I)

~

x x

x x x x ><

x x x x Engineered safeguard actuation

~

0 x

x x

x x.

x x x x x xx Containment isolation

-0 n

x xx x x x x

x x

xx x x x x x Emergency core cooling system H

i c+

(I) x x

x x xx

x ><

>< x x x ><

Containment heat removal systems

""1

-ti Ill n

x x x x

x xx x x x x Combustible gas control (I) f-.1

!£:

Component cooling water system x

x x

x x x

xx xx x x x c+

i-.

3:

x x

x x x x

xx x x x x x Service water system c+

Auxiliary f eedwater system IQ x

x x

x x x

x xx x x x x Ill c+

Emergency power (ac and de)

i x

X x

x x x x

xx x x x x IQ VI

~

x x

x x x x x x Compressed air/ventilation Ill c+

(I) 3 x

x x

xx x x x x Main steam system Ill x

x x

xx x x x x Primary coolant system (including pressurizer) x x

x xx x

x x xx x x x x x Shutdown cooling* system x

x x x x

x x xx x x x x x Chemical and Volume Control System

2 DOCUMENTATION HISTORY OF DESIGN-BASIS EVENTS The original final safety analysis report (FSAR) for Palisades was submitted in November 1968 (Ref. 1). This document was prepared by the licensee and Combustion Engineering (CE).

The Palisades plant was first operated in 1971 at 20% of 2200 MWt.

Later amendments increased the allowable power level to 60%, then 100% of 2200 MWt. -

O~ December 15, 1973, a major rev1s1on of the FSAR (Ref. 2) was made and was for a power uprating from 2200 to 2650 MWt.

Extensive rearialyses were per-formed in support of the power increase.

Most transients were either reanalyzed, or a determination was made that they were bounded by other events.

The power increase was not approved by the NRC, but the analyses were bounding for the licensed power level (2200 MWt), and were used as the reference analysis.

In 1976, the Palisades plant was reloaded.with Exxon fuel.

The limiting

transients were reanalyzed using Exxon codes (Refs. 3 and 4).

The remainfng events were not reanalyzed since the FSAR reference cycle 'analysis was still applicable and enveloped the Exxon analysis.

In July 1977, Exxon submitted a topical report on plant transient analysis of

the Palisades reactor at a power uprating of 2530 MWt (Ref. 5).

The NRC approved the power increase to 2530 MWt by license amendment No. 31 dated November 1, 1977 (Ref. 6).

The core was comprised of both Exxon and CE fuel elements.

Most of the DBE transients were reassessed for this power increase (Ref. 5).

However, 1973 FSAR analyses (Ref~ 2) were often used as the basis.for selecting initial conditions assumed to produce the worst transient--for instance, high or low initial pressure and least or most negative moderator temperature coefficient.

Subsequent to the 1977 submittals, Palisades has been reloaded under the provisions of 10 CFR 50.59, which_ permits the licensee to make changes to his facility without prior Commission approval unless the proposed change i nvo.l ves a change in the technical specifications incorporated in the license or an unreviewed safety question.

The licensees made the finding that the reload cycles satisfied this requir~ment so they did not submit new analyses for these cycles.

The original loss-of-coolant accident (LOCA) analysis was submitted in the FSAR of November 1968.

When 10 CFR 50.46 and Appendix K to Part 50 were issued, the licensee made additional submittals of analyses, performed with an

~evaluation model that satisfied the requirements of Appendix K, to meet the acceptance: criteria of 10 CFR 50.46.

The analyses performed.at that time by CE showed that l~rge breaks were most limfting, and that for small breaks there was considerable margin to the limits of 10 CFR 50.46.

The Exxon LOCA analysis for-large breaks was submitted in References 10 and

11.

This analysis has been revi~wed and approved by NRC (Ref. 6).

The

12.

generic CE small-break analysis (Ref. 45) has been reviewed and approved for the Palisades core with a composite of CE and Exxon fuel.

For cycle 4, with Exxon Type H fuel, a topical report on LOCA analysis was submitted in Reference 22.

This report formed the basis for technical specification changes on peaking factors.

Generic analyses for CE operating plants have also been provided in response to post-Three Mile Island (TM!) requirements.

Loss of feedwater or feedwater line breaks were reassessed to demonstrate the ability of the plant to remove heat, and of the operator to detect the onset of inadequate core cooling.

In addition, small-break LOCAs with loss of feedwater or with inadvertent opening of power-operated relief valves (PORVs) have been reevaluated.

Inadequate core cooling and natural circulation following a loss of feedwater and loss of offsite power-~~re also addressed. *A general discussion of the implications o~ the pdst-TMI analyses for the Palisades plant is presented in the report sections*applicable to each event.

Further*information can be obtained from References 20, 29, and 30.

Containment response to accidents was supplied in References 2 and 15.

Additional analyses for main steamline break were performed in 1980 to assess the effects of automatic initiation of auxiliary feedwater.

These analyses are cbntained in References 33 and 34.

13

3 CODES AND MODELS The CE analysis was performed with digital computer codes which modeled the.

reactor kinetics and plant thermal/hydraulic response.

The loss-of-flow

. analysis was performed with the CHIC-KIN code.

The rod-ejection analysis was performed with the WIGL2 program, which has two-dimensional space-time kinetics modeling.

The Exxon analysis utilized the PTSPWR2 code (Ref. 12) for most events and the XTRAN code (Ref. 13) for the rod-ejection transient.

These methods have been reviewed and approved by the* staff for use in plant-transient analysis.

The PTSPWR2 code is a plant-transient-simulation code.

The model is based on the solution of the basic transient conservation equations for the primary and secondary coolant system, on the transient conduction equation for fuel rods, and on the point kinetics equation for the core neutronics.

The program c~lculates fluid conditions such as flow, pressure, mass inventory and quality, heat flux in the core, reactor power, and reactivity during the transient.

Various control and safety system components are included as necessary to analyze desired transients.

A hot channel model is used to evaluate the DNB ratio during transients.

Evaluation Of the DNB ratio is based on the hot rod heat flux for the subchannel with the highest enthalpy rise.

The W-3 DNB correlation or the modified Barnett CHF correlation are used to predict DNB or CHF depending on the system conditions.

The W-3 correlation, with a minimum DNB ratio of 1.3 has been found acceptable for PWRs as discussed in Section 4.4 of the Standard Review Plan. (Ref.* 7)..

XTRAN is a two-dimensional code used in the calculation of rapid transients, considering moderator and fuel temperature feedback.

It solves the space-and time-dependent neutron-diffusion equation.

Both the CE and E~xon codes used for the LOCA analyses have been reviewed and accepted by the staff.

The CE code, CEFLASH-4, was used for the December 1973 stretch power analysis.

The Exxon code, ENC-WREM-II (Ref. 14), was used to calculate performance with the requirements of Appendix K of 10 CFR Part 50, and was found to be acceptable for use in ECCS performance calculations (Ref. 6).

The post-TM! generic small-break analyses were performed with CE evaluation models and codes such as CEFLASH-4AS.

Staff review of these analyses has, raised questions concerning the adequacy of some individual models included in the CE methods for analyzing very small breaks to demonstrate compliance with 10 CFR 50.46.

One of the requirements of the TMI Action Plan is that the CE analysis methods for a small-break LOCA be revised, documented, and resubmitted for NRC approval.

Plant-specific calculations, using the NRC-approved model should then be. submitted to show compliance with 10 CFR 50.46.

This issue will be resolved outside the SEP.

Further information is provided in Reference 30.

14

The codes used to determine containment response are discussed in the topic assessment for Topic VI-2.D.

15

4 PERFORMANCE OF DESIGN-BASIS EVENTS 4.1.0 Group I Events (PWR)

These events occur with moderate frequency and involve either a decrease in the reactor coolant temperature (which results in core reactivity and power changes) or a decrease in core shutdown margin.

4.1.1 Decrease in Feedwater Temperature (Topic XV-1)

A reduction in feedwater temperature or enthalpy can result from loss of a feedwater heater or accidental starting of the auxiliary feedwater system (AFWS).

The cooler feedwater temperature causes increased heat transfer across the steam generator and excessive heat removal from the primary system.

The worst transients are intitiated from high power (102% assumed) and low pressurizer pressure, since these result in the smallest margin to DNB.

The loss-of feedwater heater event is more limiting than the accidental auxiliary feedwater startup event because the former causes a 50°F decrease, whereas the latter causes a temperature decrease of approximately 7°F.

R,eference 5 states analysis assumptions are made* so as to allow a more rapid depressurization of the primary system, ensuring a conservativeprediction of margin to DNB~

The beginning of cycle, positive moderator temperature coeffi-cient (MTC), was therefore assumed.

Minimum initial pressure was ass*umed.

The minimum DNB ratio for the transient did not change from the steady-state value.

There is an initial calculated increase in primary pressure; when the pressure begin~ to drop there is also a reduction in core power from the positive MTC, so the net effect is no change in the minimum DNB ratio.

If a negative MTC was assumed, reactor power would increase as the colder water reached the core.

The pressure*would not drop as rapidly as predicted for the above case.

It takes less time for the reactor trip on high flux to terminate the transient than it does for the low pressure trip to terminate the case with a positive coefficient.

Palisades technical specifications permit a maximum moderator temperature coefficient of +O.SE-4 Llp/°F.and this value was used in the analys.is.

Other key input assumptions a*re provided in Table 3.

The sequence of events is as follows:

16

Time (sec.)

Event 0

One high~pressure feedwater heater is lost.

8 Minimum DNB ratio (1. 75) occurs and peak primary coolant system (PCS) pressure (2019 psia) occurs.

8+

Positive MTC causes core power decrease; CS pressure and temperature follow.

125 Reactor trip occurs on low PCS pressure (pressurizer pressura signal).* Turbine trip occurs with react6r trip.

If the operator can reduce steam demand to approximately 90% in accordance with the plant emergency procedures, no reactor trip will occur, and the transient will be terminated.

After the reactor and turbine trip, PCS.and steam generator temperatures and pressures will increase to be limited by the bypass, atmospheric dump, or steam generator safety valves.

The feedwater control system will control steam generator level or the feedwater pumps w111 be manually tripped.

The plant is then in a condition from which a safe shutdown may be achieved.

See Topic VII-3 for a discussion of safe shutdown systems and Topic X for a discussion of the auxiliary feedwater system, including the automatic actuation feature.. Pressure does not decrease to the safety injection trip.

Potential single active failures of the systems which function during this event are failure of the turbine bypass valve to open or to shut once opened, and failure of the feedwater flow control to maintain steam generator level.

The turbine bypass function is backed up by two atmospheric dump valves which in turn are backed up* by self-actuating steam generator safety valves.

Failure of the dump valves to close is evaluated in subsection 4.1.3 Increase in Steam Flow.

11 Operator action to control steam generator level is described in plant emergency operating procedures and can be used to overcome a failure in the feedwater flow control system.

The staff evaluated the potential for single operator errors in the course of thi*s event.

Operator errors were considered possible only when the operator could be expected to perform system operations from the control room.

During the event, functions are performed automatically.

In accordance with proce-dures, the operator must (1) attempt to reduce plant *1oad to. prevent a reactor trip, and (2) after the reactor trip, trip the feedwater pumps if they do not ramp down automatically to 5% flow.

If an error is made in trying to reduce plant load, the result would be a shorter time to reactor trip. If the operator fails to trip the feedwater pumps (if required), a high steam generator level alarm would alert him to this error.

This event is analyzed in Section 3.4.1 of Reference 5.

The minimum DNB ratio remains well above the safety limit of 1.3, and no high PCS or steam generator pressure conditions occur.

17

4. 1.2 Increase in Feedwater Flow (Topic XV-1)

An increase in feedwater flow can result from excessive opening of the feedwater control valve, overspeed of a feedwater pump, or starting a second feedwater pump.

The start of a second pump is assumed to cause an increase in feedwater flow from 50% to 100% with power initially at a maximum of 52%

. power.

This transient produces the largest possible increase in feedwater flow, and thus increase in heat removal.

The sharp increase in feedwater flow causes more heat to be extracted by the generator, which causes power increase through negative reactivity feedback when the colder water reaches the core.

No credit is taken for the high steam generator water level alarm which would automatically close the feedwater regulator valves and alert the operator to this abnormal situation.

No trips are predicted to occur and the temperatures approach asymptotic values within one minute.

For the Exxon power uprating in 1977 (Ref. 5), this transient was analyzed in Section 3.4.2. This transient is less severe than the decrease in feedwater enthalpy event discussed in Section 4. 1. l of this report, since the primary pressure decrease is much less severe.

The sequence of events for the analyzed case is summarized below:

Time*

0 8

8+

60 (sec.)

Event Second feedwater pump is started.

100% feedwater flow attained.

Steam-generator level 1ncreases*, power increases to 59%.

Asymptotic values reached for temperature, flow, power.

No credit taken for automatic closure of feedwater regulating valves.

The plant is then in a condition from which it can be brought to a safe shutdown condition, if de~ired.

Since the analysis takes no credit for automatic system or o*perator actions, single failures defeating system operation will not increase the severity of this event.

Single failures during the recovery stage have.s*imilar consequences to those discussed in Section 4.1.1 of this report.

The licensee did not analyzes an increase in feedwater flow event from an initial power of 102%.

The amount of flow increase is less for this case, but the consequences could be more severe than for the low-power case since there is less margin to DNB at high-power levels.

As discussed in the FSAR, an increase of only 10% above. nominal full feedwater flow could result from full opening of a feedwater control valve or from feedwater pump overspeed.

Therefore, the effects should not be limiting on system performance.

18

4.1.3 Increase in Steam Flow (Topic XV-1)*

An increase in steam flow may be initiated by opening of the turbine control.

valves, atmospheric steam dump valves, and/or the steam bypass to condenser valve.

The increased steam flow produces a cooldown of the primary system.

Power increases as a result of the negative moderator temperature coefficient, and primary temperatures and both primary and secondary pressures decrease.

Protection against core damage is provided by reactor trips from high neutron flux, low steam-generator pressure, or thermal margin/low pressure.

Turbine control valve opening is limited by the turbine load control system (goNernor control) and the turbine load limit control, which is set slightly above the 1 oad contra 1 ( "'5%) by the admini strati ve contra 1. Thus, the maxi mum opening of the turbine admission valves is "-115% of rated flow.

The combined capacity of the dump and turbi.ne bypass valves is 40% of rated ful l_-power steam fl ow.

At hot standby, unp 1 anned opening could occur because of malfunction of a steam dump controller or because of a low reference temper-ature setting in the controller.

This latter fail~re would result in a partial opening of the valves, which would close again when the temperature dropped to the reference setpoint.

At full load, the valves could be opened if the circuit between the controller and the atmospheric dump valves is closed, so that the temperature program causes the atmospheric dump valves to open fully.

For an event initiated from 102% of reactor power, the turbine control, turbine bypass, and atmospheric dump valves are all assumed to open.

Reactor power increases to the high flux scram setpoint.

After the reactor trip, the turbine trips, so the.turbine control valves are closed.

The atmospheric steam-dump and turbine bypass valves tontinue to blowdown at ~ lower rate until the core average temperature drops to the controller setpoint which closes the atmospheric dump valves.

There is no return to power for this event.

The sudden opening of only the turbine.bypass and atmospheric dump valves is assumed for hot standby, when the turbine is not being used.

The reactor trips on overpower (reduced flux setpoint).

The pressure may decrease suffi-ciently to actuate safety injection.

Two out of three* of the high-pressure safety injection (HPSI) and charging pumps are assumed to be operable.

A penalty is taken for the time required to sweep the injectio*n lines of the low boron concentration flow before the concentrated boric acid is delivered; that is, no boration i& assumed until concentrated boric acid is flowing into the system.

The flow from the HPSI.pumps reaches the core 80 seconds after the dump or bypass valves open.

The concentrated boric acid from the charging pumps arrives 80 seconds after the safety injection actuation signal (SIAS),

which is 128 seconds after initiation of the event.

There can be a return to power fo 11 owing the reduced setpoi nt flux scram before the boron reaches the core.

Excess load increase/inadvertent opening of steam generator relief or safety valve.

19

The Exxon analysis of this event is presented in Section 3.5 of Reference 5.

This transient is similar to but less severe than a steamline break.

Minimum DNB ratio limits are not approached for this event.

In Reference 19 the license~ also considered this event from hot standby if the reduced flux trip was inoperable.

The high rate of change in flux trip would initiate a trip sooner than the flux level trip.

Eventually the low

steam generator level trip would be reached~ Minimum DNB ratio is not approached.

The ~equence -0f events for the full-power cas* is as follows:

Time (sec.)

0 10.6 Event Turbine control valves~ atmospheric steam dump and turbine bypass valves opened.

High neutron* flux reactor trip.

Turbine trip ensues; closing the control valves.

Steam dump controller closes atmospheric dump and turbine bypass valves when T

reaches the controller setpoint.

The feedwater control system controls*

og steam generator level.

The plant is then in a conditibn from which a safe shutdown can be achieved.

From hot standby, the following events occcur:

Time (sec.)

0 17 40 48 75 80 128 Event Atmospheric steam dump and turbine bypass valves open.

Overpower reactor trip.

Pressurizer empties.

Safety injection signal on low pressurizer pressure.

Operator trips RCPs.

Return to power as a result of the cool down.

HPSI flow (borated) reaches the core, terminating the power excursion.

Charging pump flow (high boron concentration) reaches the core..

Because of the high frequency of loss of offsite power for this facility,

challenges to the atmospheric dump or safety valves are not uncommon.

Should the valve fail to reclose, operator response similar to that required for a 20

steamline. leak would be required.

The operator should verify such automatic actions as reactor trip, turbine trip, and safety injection.

Following this initial response, the operator should take control of the HPSI system to prevent PCS overfill and proceed with a controlled plant cooldown.

Emergency boration may be required if depressurization caused by the atmospheric relief or safety valve blowdown is excessive.

The dump valves can be remotely operated from the control room.

Compressed air is used to actuate these valves; however, they fail closed on loss of air.

The operator can override the control to close these valves by s.hutting off their air supply.

Previous analyses reported in Section 14.10 of the FSAR (Ref. 2) showed that even if the dump valves do not close in response to the controller, the operator has ample time (at least 15 minutes) to close them from the control room before exhausting steam generator inventory.

The air supply to the valve operator can be turned off causing the valve to close.

The capacity of one steam generator safety valve is much less than the steam dump capacity, so the short-term consequences of this event are bounded by the above.

However, the safety valves* cannot be manually closed.

If they do not reseat when pressure is reduced, the operator must shut down the reactor and cool down to cold shutdown in*order to effect repairs.

4. 1.4 Inadvertent Opening of Steam Generator Relief/Safety Valve (Topic XV-1)

Each of the 2 steam generators is equipped with 2 air-operated atmospheric dump valves and 12 spring-loaded code safety valves.

The dump valves are operated by the steam*dump controller.

The controller automatically controls the valves on the basis of average reactor ~oolant temperature and-steam pressure.

The dump valves exhaust directly to the atmosphere, as do the safety valves.

The turbine bypass valve discharges to the main condenser.

When the condenser is unavailable, the atmospheric dump valves must be used.

Unplanned opening of the dump valves is discussed in Section 4.1.3.

Each of the 24 steam generator code safety valves passes only ~5% of rated steam flow~ This increase in steam flow has only minor effects compared to the event postulated in the excess load increase section.

The consequences of this event, therefore, are bounded by the analysis discussed in the preceding section, Section 4.1.3.

4. 1.5 Startup of Inactive Loop (Topic XV-9)

Actuation of a reactor coolant pump in an inactive loop could result in the insertion of cold water into the core.

Reactor power increases because of effects of the negative moderator temperature coefficient.

Continuous operation at* power is limited to four-pump operation.

Operation with two or three pumps is only permitted to provide a limited time for repair/

pump restart, to provide for an orderly shutdown or to conduct* noise-monitoring tests. It is limited by the technical specifications to less than 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months before the plant must be put into a hot standby condition.

The high flux and 21

low reactor flow trips must be manually reset for two-or three-pump operation.

The setpoints are given in Table 1.

These trips restrict allowable power so that a reactivity insertion when the pumps start up will not violate any safety limits.

When operating at power, with four pumps running, the low-flow trip is set at 95% flow.

Loss of a pump would cause a reactor scram since the flow from three pumps would be less than 95%.

In order to remove a pump from service and remain at power, the setpoints.must be adjusted to 71% flow and 39% power for three-pump operation.

Reactor power would first have to be reduced below the 39% setpoint before resetting the trips.

Thus, to avoid a scram, power must be reduced, then the trips reset, before flow can be reduced.

This ensures that an acceptable power/flow rate is maintained.

While operating with one pump not running and when bringing the pump back.on line, the reduced setpoints would be in effect. Thus, when the pump is started, any power increase would be terminated by the flux tri.p at 39% power.

Startup above hot standby with less than four pumps operating is not permitted by the technical specifications.

A pump-start transient was assessed in the FSAR in Section 14.8 (Ref. 2) to demonstrate that should a pump be started, the power increase does not result in unacceptable consequences.

Reanalysis is not required for subsequent reloads, since this transient is not limiting because of the reduced setpoints.

4. 1. 6 System Mal function Causi.ng Boron Di 1 ution (Topic XV-10)

A boron dilutio~ incident could occur as a result of operator error in adjusting tank lineups so as to charge with flow of too low a boron concentra-tion or by improperly starting charging pumps while in a shutdown or refueling mode.

Administrative controls regulate the boron concentration allowed in the storage tanks,* as well as the boron concentration in the charging flow and in the reactor coolant system.

The Standard Review Plan Section 15.4.6 requires minimum time intervals between detection of the event and a loss-of-shutdown margin of 30 minutes during refueling and 15 minutes during startup, cold shutdown, and power operation.

Boron dilution in the refueling mode would be detected through the audible count rate instrumentation.

There are two source range channels of count rate indicators and two wide-ranqe units which cover the range from. startup to full power.

High count rate is alarmed in the control ~nd in the containment..

There is ample time for operator response to alleviate the low-concen~ration condition.

Under conservative conditions of initial boron concentration of 1720ppm and the minimum PCS volume for head removal (3300 ft3), it would take 70 minutes to reach criticality.

In the startup mode, nuclear instrumentation and boronometer readings are available for detection of the decreasing boron concentration.

The reactor protection system would be available to respond to this increasing r7activity event.

Assuming a dilution rate of 133gpm, initial ~oron concentration.of.

1720ppm and a full PCS volume (9220 ft3), it would taken 3.4 hours4.62963e-5 days 0.00111 hours 6.613757e-6 weeks 1.522e-6 months of dilution to reach criticality.

failure to increase boron concentration during a plant cooldown or for the reactivity changes from xenon could also cause a decrease in shutdown margin.

Based on a 75°F/hr cooldown, it takes 45 minutes to reach criticality.

Boron dilution during power operation would behave like a slow rod withdrawal, and is thus bounded by the rod-withdrawal analysis discussed in Sections 6.1 and 6.2.

If the reactor is in automatic control mode, rods will be automati-cally inserted in response to the increasing power and pressure.

When the regulating rod position is such that further insertion would reduce the available shutdown margin below 2%, an alarm sounds in the control room.

The SRP requires alarms to alert the operator of unplanned dilution. Although such alarms do not exist in all cases, the reactor protection automatic response, other plant indications, administrative controls and the time available for operator response provide an adequate level of protection.

These events have been considered in Section 14.3 of the FSAR, Reference 2.

For the reasons given above, they are not considered to be limiting events, and thus are not reanalyzed for reload cycles.

Another potential for boron dilution was identified after an occurrence at an operating plant, caused by the transfer of the contents of the iodine removal system tank to the primary. coolant system.

For Palisades this could occur during cold shutdown or refueling modes, by* opening an isolation valve.

In Reference 35 the licensee provided an assessment of the effects of such a dilution.

The cases considered included 1) refueling modes with 5% shutdown margin and minimum PCS volume (3300ft3), 2) cold shutdown with 2% shutdown margin and a full PCS volume (9220 ft3) and 3) cold shutdown 2% shutdown margin and a drained PCS volume (3300 ft3). Assuming the entire tank contents (6,000 gallons) were uniformly mixed in the PCS, the first two ~ases would not reach criticality, for the third case, the dilution would result in a boron concen-tration below the expected critical *concentration.

To eliminate the possibility of this event, administrative controls have been instituted (Reference 36) to ensure that no single failure would result in the inadvertent trans fer of the tank contents to the Shutdovm Coo 1 ing Sys tern.

In June 1980 the staff identified another potential boron dilution scenario, again as the' result of an incident at an operating plant.

Certa~n plant operations which can be performed while at cold shutdown result in a reduced PCS volume.

A boron dilution event under these circumstances may be* more severe than those previously analyzed due to the smaller volume.

The s~aff is considering such events on a generic basis to ensure that adequate time exists for operator action to terminate the dilution.

(2% shutdown; reduced volume, 133 gpm dilution~}

2.3

4.2.0 Group II Events The group II events occur with moderate frequency (except for feedwater-line ruptures) and involve a decrease in heat removal by the secondary system.

4.2.1 Loss of External Load (Topic XV-3)

A loss of load can result from many causes, one of the most common causes is a turbine/generator trip.

The turbine can trip in respon~e to mechanical or electrical problems.

A loss of load produces a significant reduction in the heat-removal rate of the primary system.

The atmospheric steam dump and bypass to the condenser open to remove energy from the primary system.

If credit is not taken for these systems, the pressurizer and steam-generator safety valves will act to keep primary and secondary pressures below design.

1 imits.

A reactor trip can occur on high pressurizer pressure or high neutron flux.

The*analysis does not take credit for direct scram on loss of*load (low tur-bine autostop oil pressure), which is an anticipatory trip. This trip is 23a

bypassed while operating at less than 15% reactor power, since the relief capacity prevents adverse effects on the plant when load is lost.

Following the scram, the pressure relief systems will continue to function for removal of decay heat.

Auxiliary feedwater will be supplied to maintain steam generator level.

The loss-of-load event is conservatively. analyzed assuming the least negative moderator temperature coefficient and 102% initial power.

For considerations of DNB ratio, minimum initial pressure is assumed.

The analysis also demonstrated that for maximum. initial pressure, the pressurizer safety valves are adequate to limit pressure below 2750 psia, assuming the relief valves fail.

This analysis is shown in Section 3.6 of Reference 5.

The* sequence of events for the three cases considered is given below:

Case 1:

No primary pressurizer spray

No pressurizer relief valves Peak primary pressure

No steam dump or bypass Time (sec.)

0 6

11 ll+

Event Turbine-generator trip on loss of load.

First steam generator safety valve lifts to reduce pressure.*

High pressurizer pressure reactor trip.

Steam generator safety valves relieve decay heat.

On a turbine trip signal the feedwater regulating valves 11fail as is 11 and the feedwater pump drive t~rbines ramp down.

Although this ramp down was designed to go to a speed which would produce 5% full power feedwater flow, in actual practice the flow is much greater.

Following a reactor trip, to prevent a high steam generator level from causing the feedwater regulating valves to close at the high level override setpoint and to prevent unnecessary PCS cooldown, plant operating procedures require that one feedwater pump be manually tripped immediately and the second pump be tripped if PCS temperature approaches 525°F.

Even if the pumps are not tripped, however, the excess flow does not affect.core thermal margins, and the overcooling transient can be no more severe than analyzed for the reduction in feedwater enthalpy and excessive feedwater flow events.

24

Case 2:

pressurizer spray No pressurizer relief valves Steam dump and bypass operable Time (sec.)

0 1

12 14 Highest primary-secondary ~p Event Turbine generator trip.

Turbine bypass valve opens.

Atmospheric valve opens.

High pressure reactor trip.

Steam relief systems remove decay heat.

System is in a condition from which a safet shutdown can be conducted (as for Case 1).

Case 3:

Pressurizer spray operable Pressurizer relief valves operable (analytical assumption only, in practice PORVs are blocked at power)

No bypass or steam dump*

minimum DNB ratio, i.e., low reactor pressure high primary temperature Time (sec.)

Event 0

6 13 Turbine-genErator trip.

First steam generator safety valve lifts.

High neutron flux reactor trip.

System is in a condition to permit proceeding to safe shutdown (see Case 1).

In each of these cases potential single active failures have been considered.

25

The results show that the minimum DNB ratio is 1.39, the maximum pressure is 2394 psia, and the maximum primary-secondary ti.P is 1388 psid.

Therefore, the acceptance criteria of minimum DNB ratio of greater than 1.3, maximum pressure of less than 2750 psia, and maxim~m ti.P of 1530 psid are satisfied.

4.2.2 Turbine Trip (Topic XV-3)

The turbine trip event is assessed in Section 4.2.1 as part of the loss-of-external-load transient.

4.2.3 Loss of Condenser.Vacuum (Topic XV-3)

The consequences of a loss of condenser vacuum become identical to thdse of a

.turbine tri~ since loss of vacuum results in loss of the condenser and thus of the heat sink for the turbine.

No separate analysis was performed for this transient.

The analysis discussed in Section 4.2.1 above is applicable.

4.2.4 Stea~ Pressure Regulator Failure (Closed) (Topic XV-3)

Steam flow to the turbine is controlled by the turbine generator control system.

A malfunction in the control system resulting.in-zero demand for the turbine would lead to closure of the turbine control valves (load rejection).

Excess steam flow is automatically transferred to the condenser via the bypass valve on high steam pressure.

The atmospheric steamdump valves would also be available to relieve pressure. *The safety valves are the ultimate means of removing the heat out of the generators.

Consequences of this event are

.considered to be covered by analysis of the loss of load/turbine trip event, Section 4.2.1, which analyzes a rapid reduction in steam flow from full power, assuming no credit for bypass and relief valves.

Control failures resulting in an increase in steam flow are considered in*

Se.ct ion 4.1. 3.

4.2.5 Loss of Feedwater Flow (Topic XV-5}

A complete loss of feedwater flow could be caused by low suct'ion pressure for the feedwater pumps.

The most likely cause of a loss of feedwater flow for this plant is from the loss of a condensate pump.

The result of this_ loss of feedwater flow would be increasing core inlet temperature due *to a decrease in heat removal and decreasing water 1eve1 in the steam generator.

Reactor protection is provided by trips on low steam generator water level, high pressurizer pressure, or thermal margin.

The reactor trip precipitates a turbine trip which activates the steam dump valves and bypass to the condenser.

With loss of offsite power, steam is dumped to the atmosphere.

The water inventory in the steam generator is adequate for decay heat removal for

"'15 miriutes.

The auxiliary feedwater system automatically starts and restores steam ge*nerator 1eve1.

The Exxon analysis is in Section 3.7 of the Palisades plant transient analysis topical report (Ref. 5).

Conservative initial conditions (102% power, low pressurizer pressure, positive MTC, and minimum Doppler coefficient) were

.26

assumed.

These conditions result in least margin to DNB, and longest time to reach a reactor trip.

Following the turbine trip, both the atmospheric and condenser steam dump systems are assumed to function.

Operation of the steam dump valves decreases the steam generator inventory and decreases the primary system temperature and pressure.

The sequence of events is:

Time (sec) 0 2

26.7 27.0 65 Event Low suction pressure to feedwater pump Feedwater flow reduced to zero Reactor trip on low steam generator water level; turbine trip; steam dump systems operate Minimum DNB ratio reached (1.65)

Atmospheric dump valves close, turbine bypass to condenser removes decay heat (if offsite power were not available atmospheric dump valves would be used instead)

The original analysis assumed that auxiliary feedwater was manually initiated.

With system upgrading for automatic actuation of auxiliary feedwater flow, the consequences of this event are less severe, since feedwater*f-s restored earlier.

Auxiliary feedwater is automatically actuated on closure of the main feedwater turbine stop valves or low suction flow to the pump.

After a 2-minute delay, the motor-driven pump starts. Thirty seconds later, the turbine-driven pump will start, unless flow sensors indicate that adequate auxiliary feedwater is already being delivered.

The time delay is included so that auxiliary feedwater will not start to flow until after the containment peak pressure caused by a steamline break.

The proposed 2-minute delay will ensure that auxiliary feedwater is delivered soon enough to maintain feedwater inventory.

In response to Three Mile Island Lessons Learned concerns, the actuation logic is being altered to provide autostart of the auxiliary feedwater system on low steam generator level.

Because of potential water-hammer problems, the auxiliary feedwater controller is set at 150 gpm.

Also, by procedure, the steam generator refill rate is limited to 150 gpm if steam generator low-level trip point has been experi-enced for 1 minute and all feedwater has been lost. If only one steam 27

generator is available, the operator may feed at 300 gpm until the sparger nozzles are approached (""16% indicator level).

The nozzles must be recovered at 100 gpm or less.

Following the reactor trip, 300 gpm is adequate to remove decay heat at 15 minutes.

The initial water inventory in the generator is adequate to accommodate decay heat for the first 15 minutes after the reactor trip and the minimum DNB ratio remains above the limit of 1.3.

However, the licensee has p.roposed modifi cations to the auxi 1 i ary f eedwater piping to reduce the potential for water hammer and to assure that sufficient auxiliary feedwater flow is provided to the steam generators under normal and emergency coriditions.

The proposed changes, as described in Reference 43, are scheduled to be installed during the 1981 refueling outage.

With the modified system, the auxiliary feedwater flow controller will be reset to permit rated auxiliary feedwater flow.

. More-recent generic analyses of a total loss-of-feedwater-flo~ event in Combustion Engineering (CE) plants were submitted in Reference 29~ Compl.ete loss of feedwater ~nd loss of offsite power (thus loss of reactor coolant pumps) were assumed.

Loss of main and auxiliary feedwater results in steam generator dryout and the loss of the steam generator heat sink.

Decay heat must be removed via the PORVs in this event.

Three cases were considered:

normal PORV operation, one PORV stuck open, and two PORVs stuck open.

The transient was continued for an extended time to determine the effects on long-term ability to cool the core.

Following steam generator dryout, the primary system heats up and expands, filling the pressurizer and increasing primary pressure.

The rise in pressure is terminated when the PORVs, or the primary safety valves open.

This pressure

'is maintained until the hot side of the primary coolant system (PCS) reaches saturation.

High pressure safety injection (HPSI) is not effective since system pressure remains above the pump shutoff head.

The two-phase vessel level then begins to drop and without operator action may lead to eventual core uncovery.

In the generic CE evaluation it was concluded that restoration of feedwater within 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months would maintain core temperatures within acceptable limits.

For a total loss-of-feedwater event, operator action to open the PORVs must have occurred within 10 minutes to ensure that peak cladding temperature remains below 2200°F.

The Palisades plant normally operates with the PORVs isolated, however the PORVs can be opened from the control room.

Based on Lessons Learned Recommendations (Ref.39), redundant emergency power has been provided to PORVs and block valves.

Heat is being removed during this initial 10-minute period by blowdown of steam through the steam generator safety valves.

Sufficient water inventory exists in the steam generator for 15 minutes of decay-heat removal.

. 4. 2. 6 Feedwater System Pipe Breaks (Topic XV-6)

A feedwater-line break can result in either a cooldown (such as that from a steamline break) or a heatup (from loss of feedwater inventory in the generator).

Feedwater-break cooldowns are bounded by the analysis of steam-28

line breaks, since the rate of cooldown is slower.

For a heatup, the worst case would occur if the break prevented feedwater flow to the generator.* If main feedwater is lost because of the feedwater-line break, the auxiliary feedwater system (AFWS), which connects to the main feedwater lines downstream of the feedwater control and check valves, can be used.

Two diversely powered auxiliary feedwater pumps are available with automatic initiation.

The signs of a high..;energy-line (steam or. feedwater) break outside containment include:

1.

Rapid loss of pressure and level in one generator

2.

Release of water within the auxiliary building

3.

Loss of feedwater-flow indication to a generator

4.

Un us ua 1 1 oud noise

5.

Low pressurizer pressure For a~ inside-containment break, additional iigns would include an increase in containment pressure, temperature, and humidity.

In response to the blowdown, the reactor and turbine trip, the MSIVs close, main feedwater is isolated, and safety injection is actuated.

Auxiliary feedwater will automatically start after a tiine delay.

Immediate operator actions must be taken to verffy the automatic responses as well as to terminate auxiliary feedwater flow to the affected generator.

A feedwater-line break in the component cooling pump room could result in loss of this system because of the feedline-rupture forces.

In this event, the operator would switch cooling of the safety injection pumps to the service-water system, maintain primary system water level with intermittent charging, and establish an emergency tie-in to provide service water to the shutdown heat exchanger (for reactor cooldown).

The licensee has an emergency procedure for a high-energy-line break which disables the component cooling water system, con~urrent with a loss of offsite power.

Special Report No. 6, 11Analysis of Postulated High Energy Line Breaks Outside Containment 11 (Ref. 18), addressed breaks in main feedwater piping to ensure that such a break would not endanger structures and components needed to shut down and remove decay heat.

Potential interactions due to pipe whip or other adverse effects of the break were identified in this review.

Most of these issues were resolved by reloca-tion, installation of redundant lines, or pipe restraints.

Howeve~, iri a few areas such measures were not feasible.

In part*icular, the main steam and feedwater lines could not be equipped with restraint or encapsulation sleeves sufficient to protect against damage resulting from a break.

However, the main steam and feedwater piping near the containment penetration had been thickened to 25% beyond that required by piping codes when constructed and special tests were performed on them during construction.

Based on these considerations, the licensee postulated that feedwater piping failures would occur upstream of the check valve, rather than in the* penetration area.

The licensee 1 s evaluation and the technical ~pecifications for inservice inspection of the main steam and feedwater piping in the auxiliary building were accepted by the staff in Reference 37.

29

SEP evaluation of the effects of high-energy-line breaks outside containment is presented in Topic III-5.B.

The effects of a feedwater-line break on reactor response have not been analyzed by the licensee.

Cooldown effects are bounded by the steam-line-break spectrum.

A feedwater-line break can also lead to a heatup by preventing feedwater addition to the generator.

Analysis of loss of feedwater is considered in Section 4.2.5.

These calculations show that there is ample inventory to remove decay heat for 15 minutes without any feedwater flow.

Further, in the special report on analysis of postulated high'."'energy-line breaks outside of containment (Ref. 18), the licensee states, 11 None of the feedwater failures postulated herein result in conditions as severely adverse as those previously considered in the Palisades FSAR for a complete loss of feedwater.

11 (Note that the licensee only postulated breaks upstream of the check valve).

Breaks upstream qf the check valve would not lead to steam generator blowdown, nor would they interfere with auxiliary feedwater flow delivery for decay-heat removal.

These breaks thus do not result in conditions more adverse than the complete loss of feedwater already addressed in Section 4.2.5.

A break downstream of the check valve would prevent feedwater addition, either from auxiliary or main feedwater to one steam generator with the present configuration.

Th~ other steam generato~ would be available for heat removal, provided auxiliary feedwater flow can be maintained.

The operator should isolate auxiliary feedwater to the broken line generator.

Because water hammer must be considered, the auxiliary feedwater flow rate is limited to 150 gpm.

The auxiliary feedwater flow controller is designed to throttle feedwater flow so that this limit is met.

Should this controller fail, thus allowing runout flow, the water-hammer situation could be affected (Topic V-13).

A failure so. that no auxiliary feedwater would be delivered*, would be equi-

Valent to the complete loss-of-feedwater events discussed in the previous section, Section 4.2.5.

As discussed in the previous section, the licensee has proposed modifications to the existing auxiliary feedwater piping.

Instead of connecting to the main feedwater lines, the auxiliary feedwater lines will be routed through spare containment penetrations to existing auxiliary feedwater nozzles on the steam generators to a separate auxiliary feedwater sparger inside each steam generator.

These mo~ifications are designed to alleviate water-hammer concerns.

This modification will also separate the auxiliary feedwater system from the main feedwater system.

A break in the main feedwater line downstream of the check valve, therefore, will not prevent auxiliary feedwater flow delivery to either generators.

Automatic initiation of auxiliary feedwater will provide for expeditious decay heat removal.

Operator action would be required to isolate auxiliary feedwater flow to the generator with the broken line.

30

As already stated, if auxiliary (or main) feedwater to the intact steam generator cannot be establi.shed, the operator should proceed to remove heat with the PORVs in a timely manner.

4.3.0 Group III Events Group III events are infrequent or limiting events with a low probability of occurrence.

These events involve ruptures of secondary system piping, up to and including a double-ended rupture of a main steamline.

These events cause a loss of energy and mass from the secondary system.

4.3.1 Steamline Break Inside Containment (Topic XV-2)

Plant Response--A steamline break results in a decrease in steam pressure and increased heat removal from the primary coolant system.

Primary coolant temperature and pressure decrease.

Reactor power increases because of the reactivity feedback from the negative MTC during the cooldown.

For a large rupture, the positive reactivity from the cooldown can exceed the shutdown margin of the rods and permit a return to power after the scram.

Signs of a steamline break inside containment include:

(1)

Rapid drop in steam generator pressure, reactor trip (2)

High containment pressure (3)

Safety injection actuation (4) Containment isolation actuation (5) Closure of main steam isolation vaTve (MSIV)

(6} Changes in steam flow indication (7)

Steam generator level fluctuations (8) Steam/feed mismatch (9)

Primary system cooldown (10) Primary system depressurization The steamline break allows steam to escape into the containment; indicated steam flow will increase if the break is downstream of the flow restrictors, but indicated steam flow may decrease if the break is upstream of the flow restrictors as steam flow is diverted from the steamline and out the break.

The rupture drops the steam pressure as well as the temperature and pressure A reactor trip occurs on low steam generator pressure.

As ~ressure continues to decrease, the main steam isolation valves and feedwater-regulating and bypass valves close.

This limits the blowdown to one steam generator and prevents continued feeding of the steam generator with the ruptured steamline by the condensate pumps.

Safety injection is initiated by low pressurizer pressure or high containment pressure.

The followin~ systems are actuated:

(1) Diesel generator start

. (2)

High pressure safety injection (HPSI) pumps start (3)

Low pressure safety injection (LPSI) pumps start (4)

Isolation valves in safety injection systems open (5) Charging pump suction is realigned to concentrated boric acid (6)

Normal-speed fan motors of containment cooling stop; fast speed motor start.

31

(7) Service water and component cooling water are directed to engineered safety feature (ESF) equipment.

Containment isolation is initiated on high containment pressure or high containment radiation.

Containment spray will autostart on high containment pressure.

Emergency procedures for a steamline break (inside) require that the operator verify that automatic actions,. such as MSIV closure, reac:tor trip, and SIS have occurred.

The procedure following safety injection actuation directs the operator to trip the reactor coolant pumps.

Containment cooling should be in operation, but the containment spray can be secured if the_fan coolers are working properly (that is, with high power fans and adequate service water supply) and high pressure in containment has been reduced.

The operator should terminate auxiliary feedwater flow to the steam generator with the rupture~ line. The condensate storage tank is the water supply for the auxiliary feedwater system.

Its inventory is maintained by using the makeup demineralizer or pure water storage.

Main feedwater is automatically isolated on low steam generator pressure.

Decay heat is removed via the atmospheric dump valves (or steam generator safety valves) with the auxiliary feedwater.system maintaining steam generator inventory.

Pressurizer heaters are used to maintain RCS pressure.

Once the steam generator blowdown is controlled, the operator can take the plant to a cold shutdown condition.

When temperature and pressure are reduced sufficiently, the shutdown cooling system is normally used.

As discussed in the safe shutdown report, alternate methods exist for plant cooldown.

Analysis--The licensees* analysis of steamline breaks inside containment at 2530 MWt is presented in Section 3.8 of Reference 5.

Two cases are considered:

full power (102%) and hot, zero power.* Both cases were analyzed assuming offsite power remains available.

For the full-power case, feedwater flow is assumed to ramp down to 5% fl ow in 60 seconds.

For the zero-power-case, a constant feed flow of 5% is assumed.

The reactor coolant pumps are assumed to continue to run, even though the procedures require the operator to trip them, since this continued main coolant flow causes a more severe cooldown.

The break location that gives the fastest blowdown, and thus the worst cooldown, is at the steam generator nozzle.

The event is most severe at end of cycle owing to the large negative moderator temperature coefficient, which intro-duces positive reactivity during the coolc:!own.

This reactiv-ity addition causes a return to criticality after the scram and before the boron injection flow reaches the core.

The most reactive rod is assumed to stick out of the core upon reactor scram.

An uncertainty factor is applied to the reactivity coefficient.

The reactivity resulting from the MTC and the cooldown is applied as a function of temperature.

Two HPSI pumps are assumed to deliver flow 20 seconds after a safety injection actuation signal (SIAS).

Two of the three charging pumps are assumed to deliver concentrated boric acid 80 seconds after safety injection.

This delay includes the time sweep the lines of the low-concentration boron.

(No credit is taken for the reactivity that results from the low-concentration boron in the analysis.)

32

The sequence of events for the two cases analyzed is shown below.

Full-power case time (sec.)

o*

1 7.6*

18+

35 60 74 96 115 126 Zero-power case time (sec.)

0 1

7.6 14 20 35 95 96 225+

Event Nozzle break.

Reactor trip on low steam-generator pressure.

MSIVs close (on low steam pressure).

~ressurizer is drained.

HPSI system boric acid reaches core.

Feedwater flow has ramped down to 5%.

Return to criticality.

Charging system boric acid reaches core.

Maxtmum core average heat flux, minimum DNB ratio = 1. 30.

Ruptured steam generator empties.

Event Steamline break.

Reactor trip on low steam pressure.

MS IVs close.

Pressurizer is drained.

Core returns to criticality HPSI system boric acid reaches core.

Maximum core average heat flux, minimum DNB ratio = 1.41.

Charging system boric acid reaches core.

Steam generator empties.

33

The full-power analysis assumed that main feedwater was reduced to 5% within 60 seconds with the feedwater control system acting on the main feedwater pump turbine.

The regulating valve position was unaffected.

It was subsequently determined that following a steamline break, the above assumption may not be applicable.

The resultant feedwater flow has been more

. than 5% when t.he-feed pump turbine control responds.

Furthermore, with offsite power available the condensate pumps would sti11 be running and would deliver more than 5% of main feed flow when generator pressure drops below the condensate pump shutoff head (500 psia). The turbine-driven main feedwater pumps would trip when the MSIV closure stopped the steam flow to the turbine drive.

To alleviate this problem, the licensee has provided automatic isolation of main feedwater, by closing the regulating and bypass valves, on low steam generator pressure~ This parameter is also the one that closes the MSIVs.

Low pressure in one generator initiates isolation of feedwater only to that generator.

Both MSIVs are closed.

Main feedwater isolation is not single-failure-proof, however~ the automatic isolation is backed up by plant emergency procedures for steamline break which direct the operator to assure closure of the feedwater valves.

Also, the operator is directed to immediately trip a f eedwater pump upon reactor trip.

As discussed in Section 4.2.5, auxiliary feedwater is automatically actuated.

The flow rate, as throttled by the flow controller, is 150 gpm.

Full flow is 415 gpm per pump, which is much less *than the.5% of main feedwater flow assumed in the analysis.

Therefore; the cooldown calculations are applicable.

The effects of runout-auxiliary feedwater flow on a steamline-break accident have been considered by the licensee in Reference 44.

The core response would not be significantly affected since the 2-minute time delay prevents auxiliary feedwater addition until after steam generator dryout, and after the minimum DNB ratio is reached.

Since the analysis considers the effect of auxiliary feedwater addition to the broken-loop steam generator, operator action (after 10 minutes) to terminate auxiliary feedwater flow is acceptable.

The operator uses steam pressures and/or steam flows in the respective steam generators to determine which generator is blowing down.

With the wide-range steam generator level instru-mentation to be installed during the 1981 Palisades refueling outage in response to post-TM! concerns, steam generator level differences can also be used to determine which generator is affected.

With loss of offsite power and postulated worst-case single failure of diesel generator 1-2, one HPSI pump and one charging pump would be available.

The reactor coolant pumps (RCPs) are tripped, main feedwater pumps are tripped, and auxiliary feed would be automatically initiated after the delay.

The cooldown is less severe than for the case with offsite power available since the RCPs are lost, reducing the heat transferred through the steam generator.

However, the rate of boron and mass addition from the one rema-i ni ng HPSI pump and charging pump is less than for two pumps.

Also, the diesel generator start time results in a longer time until boron reaches the core.

34

The previous analyses showed that for two-loop operation, the full-power case resulted in the minimum DNB ratio.

There are several differences between the full-load arid no-load cases.

Because of less stored energy, the no-load case results in a greater decrease in RCS temperature.

In addition, the initial generator inventory is greater at no-load.

On the other hand, more feedwater was added to the generator while the feedwater control system responds for the full-load case, which*tends to compensate for the lower initial inventory in its effects on the blowdown.

Also, the Doppler coefficient of reactivity produces a positive reactivity insertion during the cooldown for.the full-power case.

The net effect, therefore, was that the full-power case was slightly more severe.

With automatic feedwater isolation, however, the above situation may change and.a zero-power.case may become limiting.

With the present safety injection system configuration (see Figure 3)* a failure of the check valve in an LPSI. discharge line would, allow the HPSI pumps to overpressurize the LPSI system.** The motor-operated LPSI discharge valves open automaticalli on an SIS even if RCS pressure is above LPSI system design pressure.

These check valv~s.are now. tested to verify that back leakage is acceptably low.

Interlocks on the LPSI discharge valves are further addressed under SEP Topic V-11.B.

The licensee has considered a break inside containment from full power with loss of offsite power and diesel failure.

The turbine generator assist was assumed to function since it worsens the cooldo~n. This feature is described in Section 4.4.1 of this report.

This analysis was submitted in Amendment 17 (Ref. 19).

This case was not reanalyzed for the power uprating and fuel-vendor change although ~he results of the original analyses show that the consquences of the break without offsite power are more severe than for the case with offsite power.

Limited (<1%) fuel failures are predicted.

A steamline break with loss of offsite power was not analyzed fbr the zero-power case since the licensee does not consider a loss of offsite power simultaneous with the break to be credible if the turbine is not on line.

The Technical Specifications for Palisades require only two charging pumps and two HPSI pumps to be operable for criticality.

One pump must be operable on each bus.

Since the analysis (with offsite power available) assumes two pumps, there is no provision for a single failure.

The licensee has assessed the effect of a lower rate of HPSI flow delivery on

the steamline breaks at full power and zero power with offsite power.

One pump was assumed to be delivering via the redundant HPSI header as compared with two pumps delivering into the common primary header.

Refer to Figure 3 for a schematic diagram o'f the safety injection system showing both headers.

No change in charging pump flow was assumed.

A single check valve serves as the boundary between the HPSI system with 1300 psi shutoff head pumps, and the LPSI system (500 psig design pressure).

This overpressurization could lead to rupture of the LPSI system pressure boundary, and thus insufficient injection flow to the cores.

35

w O'I

(]*-*

--vt-tl-1-*~)}------~--'--:..

MOMll 2

---vt--~~ \\.

llOA>lt

(]1-1 f--Vt--1!1 u

'::"-1/1--- --- ---r

-t-+~1-1 lolOJllOo

[]*-* ~- \\.

o----1/J--- -- --- -- -vt-~*~~

lik>:AOIU 0***

r... --------vt-------- -*- **Vf--tKJ-

... lu..

--)}-- ---*' \\.. ---@~

L'\\llOOI 0 IC

--l~t nx 0

u;

..... ~ -**~

CVD6

VJ.Uol

--~]

llrlil

-'0 cv:aw 1-1 Conl.....,

-~--

-~-?--,-:-;-*

1-1 l--£T.l.*

~*

-~

lPll I *I

~~~

lPlil IC:..................

IP. lud.ed 11t*1 UaJ.uw*""'&ll*.. *l... *dfv*

CV: '"'"'1111*""-*laircip**&NI figure J Pali1H1dos emorooncv core coolino sy&tom (injoction mode)

111w IMDll CVAI

The lower HPSI flow rate results in less boron delivered to the core and thus a higher power level upon return to power.

Sensitivity studies show that the minimum DNB ratio would be 6% lower.

This would result in a minimum DNB ratio less than the criterion of 1.3; however, this is acceptable for a low-probability event such as a steamline break.

Some fuel damage may result, but radiological consequences would be insignificant for a secondary side break inside containment.

(See Sections 4.3.2 and 4.3.3.)

The analyses consider the consequences of auxiliary feedwater addition to the steam generator with a ruptured steamline.

Failure to initiate auxiliary feedwater is not immediately a problem, until after the unaffected steam generator dries out, causing the loss of the heat-removal path.

The operator has several minutes to start auxiliary feedwater system manually in the event it does not automatically start. If feedwater flow cannot be established, the PORVs and the charging system must be used to remove decay heat.

(See the loss-of-feedwater flow analysis discussed in Section 4.2.. )

An accident mode that has not been considered is depressurization of both generators.

This could occur as a result of a steamline break blowing down to containment, and a single active failure of a relief valve or the steam drive controller on the intact steam generator, blowing steam* to atmosphere~ This failure would no~ adversely affect the containment pressure,.but the additional co.o 1 i ng could 1 ead to more severe core consequences.

The Palisades plant employs a swing disc stop valve in each main steamline as.

the main steam isolation valve.

Failure of the MSIV in the unbroken line to close could allow blowdown of both generators via reverse flow through the swing disc MSIV check valve in the broken line for a break upstream of the MSIV.

Figure 4 illustrates this icenario.

This failure has not been consid-ered in the analysis.

The licensee considers such a failure highly unlikely since the MSIVs are swing disc valve held open by air with redundant solenoids.

One set of the solenoid valves is located in a prdtected area outside containment, so they would be unaffected by the steam-break environment or dynamic forces.

Tests show that the valve disc is capable of closing against the forces of the blowdown.

Reference 21 also states that the analyses predict valve closure in response to fluid forces on the disc even before the trip signal is generated.

Based on these cons i derat iOns, the staff considers that the.single fai 1 ures have not been completely addressed.

The licensee should confirm that a steam-line break inside containment, with or without offsite power, from either full power or zero power with the most limiting single failure, does not result in unacceptable consequences.

Single failures to consider include diesel generator such as failure as well as malfunctions in the feedwater system, main steam system (opening of dump or relief valves), or safety injection system.

The steamline-break accident inside containment was also analyzed with one or more reactor coolant pumps out of service (Ref. 25).

Operation in this mode is allowed only for limited periods.

The worst case is for one-loop operation where the rupture occurs in the loop with the two active pumps, at hot zero power.

The analysis shows that there will not be a return to power if the shutdown margin exceeds 3.75%.

The technical specifications for less-than-four-pump operation require that this margin be available. *Therefore, the 37

~---

~~~

8£

~("':'* --~~~~~~~~

I

-E--

1

-')?.--°"

~

I s I

4 ---

I 0

= -'

1--'

~j-;_J LEJ

~I

diesel to start.

The turbine generator assist was also assumed, to slow the coastdown of the RCPs.

This is conservative since it increases the.cooldown.

No return to power occurs because of the lower blowdown rate (relative to a nozzle break).

No fuel damage occurs.

This analysis was submitted in Reference 19 in response to staff questions.

Thus, even if the break is not isolated, the radiological releases are limited to those due to the equilibrium secondary system radioactivity and to the primary-secondary leakage.

The doses are well below the 10 CFR Part 100 guidelines and. are much less severe than those caused by a loss-of-coolant accident.

Section 4.3.3 below presents an independent staff analysis of the radiological consequences of a steamline break outside containment.

4. 3. 3 Radiological* Consequences of Breaks Outside Containment (Topic XV-2)

The rupture of a main steamline is considered a limiting fault not expected to take place during the lifetime of the plant.

Nevertheless, it is postulated because its consequences could include the release of significant amounts of radioactive material.

In particular, the failure of a steamline outside con-tainment would result in the release of activity contained within the secondary system, in addition to opening a potential, albeit small, path for the release of reactor coolant to the environment ~ia postulated steam generator leaks.

An analysis of the radiological consequences of* a main steamline failure at Palisades plant has been performed by the staff following the assumptions and procedures indicated in the Appendix to Standard Review Plan 15.1.5, 11 Radio-logical Consequences of Main Steam Line Failure Outside Containment (PWR) 11 (see Ref. 7).

The specific assumptions made regarding the plant conditions prior to the postulated accident and the expected responses are listed in Table 4.

Supporting documentation is provided in References 2, 6, and 23-25.

It has been assumed that one steam generator is blown dry within 60 seconds following the accident, and that 1 gpm of reactor coolant is released directly to the environment during the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months .

This is in accordance with Technical Specification 3.1.5 (Ref. 25) which limits the allowable steam generator-primary-to-secondary leakage to 0.6 gpm in any one steam generator.

The worst coastdown occurs for a simultaneous loss of power to all four pumps from an initial power level of 102% and beginning-of-cycle (BOC) kinetics.

The positive moderator temperature coefficient keeps power high as the core heats up, worsening the power/flow mismatch.

The reference analysis is in Section 3.3.l of Reference 5.

A reactor trip on low flow occurs 1.58 seconds after the loss of power to th~ pumps.

The minimum DNB ratio of 1.39 is reach~d in 3.1 seconds.

Thermal limits are not exceeded for this event.

In addition, it has been assumed that prior to the accident the primary and secondary coolant activities were at the maximum levels allowed by the Technical Specifications 3.1.4 and 3.1.6, with an iodine spiking factor of 500 for the primary coolant activity.

An evaluation of this accident in Reference 6 concluded that no additional fuel clad failures would occur.

The estimated site boundary doses resulting from this postulated accident (see Table 5) have been found to be within the 10 CFR Part 100 guidelines as specified in the Acceptance Criteria for SRP 15.1.5.

As there is considerable margin to the 40

10 CFR Part 100 limits, the dose cons~quences would still be acceptable with some fuel failures.

On the basis of these results, we conclude that the Palisades plant design is acceptable with respect to the radiological consequences of a possible main steamline failure, and that the risk presented by this postulated accident is similar to that of plants licensed under current criteria.

4.3.4 Containment Response (Topic VI-2, VI-3)

The response of the containment to the steam line rupture are evaluated under Topics VI-2.10 11Mass and Energy Release for Postulated Pipe Breaks Inside Containment 11 and VI-3 11Containment Pressure and Heat Removal Capability. 11 Table 4 A~sumptions made in analysis of radiological consequences of postulated tube failure, main steamline failure~ and control-rod-ejection accidents General assumptions

1.

Reactor power = 2650 MWt

2.

Loss of offsite power following the accident

3.

Primary coolant activity Qrior to the accident of 1.µCi/gm of dose equivalent I-131 and.100/E µCi/gm of noble g~ses

4.

Iodine spiking factor of 500 after the accident

5.

Primary coolant activity of 40 µCi/gm of dose-equivalent I-131 at time of accident for cases assuming a previous iodine spike

6.

Secondary coolant activity prior to the accident of 0.1 µCJ/gm dose equivalent I-131

7.

Iodine decontamination factor of 10 between water and steam

8.

0-2 hour X/Q for ground release at exclusion area boundary; boundary = 3.4 x 10- 4 sec/m3 For the steam generator tube failure accident

1.

Failed steam generator is not isolated during the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months following the accident.

2.

98,000 lb of primary coolant leak to the secondary side of the failed steam generator through the failed tube during the first 2 hours2.314815e-5 days 5.555556e-4 hours 3.306878e-6 weeks 7.61e-7 months (one-half during the first 30 minutes)

3.

All releases through the secondary side safety and relief valves

4.

No additional fuel clad failures as a result of the accident 41

Fbr the main steamline failure accident

1.

Total primary to secondary leak rate of 1 gpm

2.

No additional fuel clad failures as a result of the accident For the control-rod-ejection accident

1.

Total primary to secondary leak rate of 1. gpm

2.

0.3% of rods suffer clad damage

3.

0.1% of rods have at least incipient center line melting Table 5 Accident doses at nearest site boundary 2-hr dose, rem Accident Thyroid Whole Tube failure

12.

0.4 Tube failure with previous

60.

0.4 iodine spike Steamline failure

1. 7

<0.01 Steamline failure with 2.6

<0.01 previous iodine spike Rod ejection 3.6 0.05 Case 1 3.6 0.05 Case 2

1. 0

<0.01

For this accident sequence it is assumed that an iodine spike was initiated some time before the accident resulting in the highest coolant activity allowed by the technical specifications.

- Case 1 assumed all releases through the secondary side safety and relief valves. _Case 2 assumes all releases through the containment.

42 body

4.4.0-. Group IV Events Group IV events involve a loss of ac power.

Loss of power to auxiliaries occurs with moderate frequency; a complete loss of ac power occurs infrequently.

4.4.1 Loss of AC Power to Station Auxiliaries (Topic XV-4)

Loss of ac power to station auxiliaries can result from a failure of transmission lines, or from loss of a station transformer as well as from a malfunction in the onsite ac distribution system.

In general, redundant equipment, connections, and buses are provided to minimize adverse effects so that power can be supplied to vital loads considering single failures.

However, the Palisades design has a single distribution system and single breaker-closing devices so that it may not be possible to isolate incoming lines, buses, or paths to the onsite class lE power system.

A single failure of the line to the startup transformer or of the single startup transformer could cause a loss of offsite power.

The delayed-access circuit is established by removing disconnect links at the main generator so that the main transformer can be used.

The electrical distribution system is discussed in more detail in Topic VII-3.

Loss of offsite power will result in turbine and reactor trip. The turbine

generator coastdown circuits are designed to. utilize the kinetic energy of the.

turbine generator to maintain a constant ratio of voltage to frequency down to 80% of rated speed.

The circuits delay tripping of the 4160-V breakers, and.

thus loss of power to the reactor coolant pumps for the duration of the gen-erator coastdown.

The turbine generator coast down was designed to provide power to the RCPs for 30 seconds.

Startup testing results showed that the coastdown took 80 seconds.

This circuitry is utilized only when offsite power is not available following the reactor/turbine trip.

This feature retards the flow reduction that results from loss of reactor toolant pumping power, if being supplied by the main generator, and consequently lessens the severity of the transient.,Each pump is also provided with a flywheel which reduces the rate of flow decay on loss of pump power.

This feature ensures a less-than-instantaneous coastdown regardless of power supply for the RCPs.

The main feedwater pumps trip, resulting in the auxiliary feedwater system automatically starting to provide water to the generators for decay-heat removal.

Loss of offsite power leads to loss of the circulating water for the main condenser and a rapid loss of vacuum.

Therefore, the atmospheric dump valves must be used to remove decay heat.

The diesel generators start automatically, and vital safe shutdown loads are supplied through the normal shutdown sequencers.

Single active failures considered during this event include failure of a diesel generator, failure of steam dump valves, and failures of auxiliary feedwater to start.

One diesel is capable of providing power to the minimum set of shutdown equipment. Failure of heat-removal paths (that is, steam dump valves) is discussed in Section 4.1.1.

The auxiliary feedwater system is designed so that a single failure will not prevent its safety function.

43

The licensee has not analyzed this event separately.

Howeve~, analyses of loss-of-feedwater flow and loss-of-reactor coolant flow have been provided (see Sections 4.2.5 and 4.5.1).

Since the reactor trips sooner for the loss-of-power case than for the loss-of-reactor coolant flow, the core consequences are less severe.

The vendor (Combustion Engineering (CE)) has performed generic analyses for all CE plants (Ref. 20) of loss-of-off~ite-power events.* These analyses were performed to establish when pressurizer heaters would need to be energized to maintain pressure.

The results show adequate subcooling for several hours without heaters.

Some of the pressurizer heaters for Palisades can be powered from emergency buses by operator action from the control room.

The initial stages of this transient resemble those of a loss-of-feedwater-flow event.

Later, after the reactor coolant pumps begin to coast down, the response is similar to a loss-of-forced-coolant flow.

Natural circulation is established, and heat is being removed by means of the steam generators.

Immediately after a loss of ac power with accompanying turbine and reactor trips, no operator action is required, other than verification of all auto-matic responses.

Subsequently, if power is not restored; the operator establishes full charging flow to maintain pressurizer level, controls plant cooldown using the steam dump valves, and initiates plant boration to prepare fo~ cooldown.

Based upon a review of plant procedures for this event, the generic CE analyses, and for other reasons as discussed above, we find that the plant is adequately protected for a lo~s of offsite power to station auxiliaries.

4.4.2 Loss of All AC Power (Station Blackout) (Topic XV-24)

This event is being considered as an unresolved safety issue (A-44).

No licensing position has been established; therefore, this topic has not been*

deleted from the SEP.

44

4.5.0 Group V Events Group V events involve a decrease in reattor coolant system flow rate. A reactor coolant pump rotor seizure occurs infrequently, and a loss of flow because of loss of power occurs with moderate frequency.

4.5. l Loss of Forced Coolant Flow A loss of all forced flow may result from a loss of electrical power to the pumps.

The flow coastdown is retarded by the inertial energy of the flywheel.

The loss of flow through the core reduces the heat-removal capability so coolant temperature increases, reducing the margin to DNB.

Reactor power also decreases as the temperature increases, but the DNB ratio limit can be approached since the rate of power decrease is slower than the flow coastdown.

Reactor protection is provided by a trip on low reactor-coolant flow.

Loss of fewer than all four pumps would cause a less severe flow coastdown.

Loss of even one pump would cause a reactor trip on low flow.

The worst coastdown occurs for a simultaneous loss of power to.all four pumps from an initial power level of 102%* and be.ginning-of-cycle (BOC) kinetics.

The positive moderator temperature coefficient keeps power high as the core heats up, worsening the power/flow mismatch.

The reference analysis is in Section 3.3.l of Reference 5.

A reactor tri~ on low flow occurs 1.58 seconds after the loss of power to the pumps.

The minimum DNB ratio of 1.39 is reached in 3.1 seconds.

Thermal limits are not exceeded for this event.

4.5.2 Primary Pump Rotor Seizure/Shaft Break A loss of flow can also occur as a result of a mechanical failure such as a primary pump seizure.

The early stages of the flow coastdown from a rotor seizure are faster than for the loss of power since instaneous stopping of the pump is assumed.

This is an extremely unlikely event and only one pump is assumed to fail.

Protection is provided by the low flow reactor trip.

This event is more severe than a loss of flow due to loss of power because of the faster coastdown~ Analysis of the lo~ked rotor event is presented in

.Section 3.3.2 of Reference 5.

The sequence of events is:

Time (sec) 0 0.9 2.4 Event Locked rotor Reactor trip on low fl ow Minimum DNB ratio of 1.27 attained Core average temperature reaches 579°F with peak pressure of 2080 psia.

The minimum ONG ratio is 1.27; however, this is a low probability. event so a 45 I*iI i

I i

I,

m1n1mum DNB ratio of less than 1.3 is acceptable.

The radiological consequences will not exceed the acceptance criteria since the possible fuel

damage is limited.

The Standard Review Plan for this event requires that the analysis considers the consequences of a turbine trip, with coincident loss of offsite power following the reactor trip.

This would cause the remaining pumps to coast-down, so that the core must be cooled by natural circulation. This procedure (natural 'circulation cooling) was satisfactorily demonstrated through testing in 1972.

Natural circulation with one loop, blocked by a seized pump will have less core cooling capability than during this test.

However, the power/

flow.ratio durfog the test was considerably less than one, so there is margin to inadequate core cooling.

The turbine generator assist would maintain power to the reactor coolant pumps for several seconds, following the turbine trip. If no credit is taken for this feature, the three unaffected pumps would begin to coastdown.

Even if the coastdown is assumed to start as soon as the pump rotor seizes, the flow reduction at the time of minimum DNB ratio does not result in a significant decrease in DNB ratio.

The reactor trip on low flow would occur earlier for the case with coastdown at event initiation.

Long-term cooling of the core following a rotor seizure or shaft break must also be considered.

As discussed in* Section 4.4.1, generic analyses of plant response during natural circulation have been done.

Heat removal through the steam generators is the preferred path for decay-heat removal.

If natural circulation can be maintained, h~at can be removed via this path until the system is cooled down to the shutdown cooling system cut-in point. If natural circulation cannot be maintained~ or if feedwater is lost, heat must be removed using a primary feed and bleed method employing the charging pumps and power-operated relief valves.

The pump shaft break has not been specifically addressed, but the consequences are typically no greater than those for the locked rotor.

The Palisades plant

.has anti-rotation devices on each primary coolant pump, which prevent reverse rotation of the impeller in the broken pump, therefore, the steady-state core.

flow will be the same as for the rotor seisure event.

46

4.6.0 Group VI Events Group VI events involve reactivity and power distributing anomalies associated with control-rod malfunctions.

These events are of moderate frequency except for single rod withdrawal, which is an infrequent event, and the rod ejection, which is a limiting fault.

4. 6. l Uncontrolled Rod Assembly Withdrawal at Power (Topic XV-8)

The inadvertent withdrawal of one or more control rods becuse of operator error or a reactor regulating system or rod-drive control-system malfunction causes an increase in both core-power level and heat flux.

An.increase in primary coolant temperature and pressure also results.

Many modes of reactor protection (trips) are available to terminate a rod withdrawal, including the high neutron flux, thermal margin, and high pres-surizer pressure trips.

Which trip terminates the event is determined by core parameters such as reactivity.feedback and rod-withdrawal rate.

No credit is*

taken in the analysis for a reactor trip on high rate of power change, which would be effective for some transients initiated 'from low powers.

Operator action in response to a high pressurizer water-level alarm may be necessary to terminate some very slow rod-withdrawal transients.

There is adequate time, alarms, and indications for the operator to act before a limit is approached.

The Exxon analysis of Section 3.1 of Reference 5 considered events at 102%

power and52% power for a range of withdrawal rates and*reactivity feedback parameters.

A rod speed of 46 in./minute was assumed.

Rod worths were conservatively chosen consistent with rod-insertion limits.

For ail events, the minimum DNB ratio was greater than 1.30.

4.6.2 Uncontrolled Rod Assembly Withdrawal--Low Power Startup Topic (XV-8)

The startup rod-withdrawal event was analyzed in the FSAR.

Protection is afforded by the neutron flux trip c~1s% power), by the high rate of change in power trip (no credit.taken in the analysis), and by Doppler feedback.

High-.

peak n~utron powers are reached but the heat flux remains well below core limits.

The FSAR analysis assumed conservatively large reactivity-insertion rates, and is considered to remain applicable for later cycles.

Furthermore, in Reference 19 the licensee assessed the effect of a startup from low power assuming the reduced neutron flux trip failed, Depending on the reactivity-addition rate, either a high flux, high reactor pressure, or

. low steam generator level trip would scram the reactor before the DNB ratio app~oached its lim1t.

4.6.3 Control-Rod Misoperation (Topic XV-8)

Control-rod misoperation through operator erro~ or actions of the rod~control system can result in decreased margin-to-thermal limits.* Situations considered

'include rod misalignment, withdrawal of a single rod, rod drop, and operation in the automatic mode of rod control.* This latter system drives the rods in and.but in response to rod position, flux, pressure, and temperature indications.

For each transient, both manual and automatic mode are considered to see which is more severe.

For a depressurization event, for example, automatic mode may 47

produce more severe results because the system will withdraw rods in response, and there may be overshoot before equilibrium is restored.

Mispositioning of the part-length rods is not a problem since these rods are fully withdrawn during operation and are not used.. Rod misalignment can be detected by two rod-position-indication systems.

The analysis considers effects due to misalignments.

The technical specifications limit the allow-able amount of rod misalignment to ensure operation is within th~ bounds of the safety analy~is.

For a single rod withdrawal, severe localized radial peaking is of concern.

Manual control mode is more severe since the power transient continues until a reactor trip, or until full withdrawal of the rod.

In automatic mode, control rods wouJd be inserted as power and temperature rise increases.

Analysis by Exxon in Section 3.9 of Reference 5 showed that no thermal limits would be exceeded.

The inadvertent drop of a control rod into the* core as a consequence of mechanical or operator error results in an initial rapid decrease in reactor power, pressure, and temperature.

Depending on the worth of the rod, there could be a return to power with a distorted power distribution.

Dropped rods can be detected by the high negative rate of change in flux or by limit switches on the rods that indicate full insertion.

The turbine load remains unchanged throughout the transient.

The drop of a rod of low worth.results in a higher return to power, but the drop of a rod of high worth is more severe because of radial peaking.

The original design of the Palisades plant included a turbine runback upon detection of a dropped rod.

Later analysis showed that at the beginning of

. cycle, in manual mode, turbine runback could have unacceptable effects on reactor performance.

Thus, the turbine runback feature has been disabled and is no longer used in response to a dropped rod.

This change was approved when the power increase to 2530 MWt was granted.

The rod-control system automatically withdraws rods when reactor power decreases.

Detection of a dropped rod inhibits the withdrawal of other control rods by the automatic rod-control system.

This prevents an increase in core power with a power tilt induced by flux depression around the dropped rod.

No

reactor trips are initiated.

Following a rod drop, the operator should not withdraw rods.

When conditions stabilize, the operator should reduce power until T and T f match.

The Exxon analysis of the dropped-rod event is avg re presented in Section 3.2 of Reference 5.

The results show that margin to DNB is maintained.

4.6.4 Spectrum of Control-Rod-Ejection Accidents (Topic XV-12)

The complete, sudden ejection of a control rod from the core can be caused by a failure of the control-rod housing such that system pressure expels the control rod.

Ejection of a control rod results in a rapid increase in reactivity, energy production, and a corresponding pressure surge.

48

~--

Signs that indicate a control-rod ejection include:

(1) Off-scale neutron channel traces (2) High-power-level trip (3) High-startup-rate alarm (4) Decrease in primary pressure (5)

LOCA signs Operator and automatic response to a control-rod ejection is similar to 'that for a los~-of-c6olant accident, since ejection of the control rod could rupture the reactor coolant pressure boundary.

The consequences of this loss-of-coolant event are bounded by the analyses discussed in Section 4.7.0.

The control-rod-ejection event was analyzed in Section 14.16 -of the FSAR (Ref. 2).

Fuel rods with an average enthalpy greater than 200 cal/gm were assumed to experience clad damage, and those above 250 cal/gm, incipient centerline melts.

Given these assumptions, a small fraction of fuel rods would suffer damage.

For the Exxon reload core, this event was reanalyzed using the criteria given in SRP 15.4.8.

The Exxon reanalysis in Section 3. 10 of Reference 5 utilized the XTRAN space-time code.

This code is used in order to account for the very rapid changes in heat generation in response to the ejected control rod.

The highest integral control-rod worth is used to assess this event.

To maximize the peaking factors, a fully inserted control rod is assumed to be in the quadrant diagonally opposite to that containing the ejected rod.

The power transient is turned by the Dqppler coefficient of reactivity.

A high neutron flux trip may also occur.

Two cases were considered:

(1) beginning of cycle, hot zero power and (2) end of cycle, hot full power (102%).

These conditions result in high worths and peaking factors.. The zero-power case results in the highest enthalpy rise since.the ejected worth is highest.

The peak enthalpy is less than 250 cal/gm.

The pressure rise does not reach the pressurizer safety valve setpoint, and

. thus is below design limits.

The hot full-power case is less severe.

Therefore, the consequences of this accident satisfy the acceptance criteria of SRP 15.4.8.

Radiological effects are discussed below in Section 4.6.5.

4:6.5 Radiological Consequences of a Rod Ejection (Topic XV-12)

An analysis of the radiological consequences of a postulated control-rod~ejection accident has been performed by the staff following the assumptions and proce-dures indicated in Regulatory Guide 1.77 (Ref. 40) and the Appendix to SRP 15.4.8, "Radiological Consequences of Control Rod Ejection Accident (PWR) 11 (see Ref. 7).

The specific assumptions made regarding the plant conditions prior to the postulated accident and the expected responses are listed in Table 4 (see Section 4.3.3). Supporting documentation is provided in References 2, 6, 23, and 24.

In. particular,* it has been conservatively assumed that the accident is followed by a complete loss of offsite power.

Therefore, the plantis cooled down by releasing secondary steam to the environment through the safety and relief valves.

In addition, it has been assumed that 0.3% of the rods suffer 49

clad damage and 0.1% of the rods have at least incipient centerline melting as a res~lt of the accident.

These assumptions are in accordance with current NRC licensing practice.

The estimated site boundary doses resulting from this postulated accident (see Table 5. in Section 4.3.3) have been found to be within the 10 CFR Part 100 guidelines (Ref. 9) as specified in the Acceptance Criteria for SRP 15.4.8 (Ref. 7).

On the basis of these results, we conclude that the Palisades plant design is acceptable with respect to the radiological consequences of a possible control-rod-ejection accident, and that the risk presented by this postulated accident is similar to that of plants licensed under current criteria.

4.6.6 *Spectrum of Rod Drop Accidents (Topic..XV-13)

This event as defined ~n the topic is not applicable to PWRs.

The effects of rod drop on power distributions are discussed in Section 4.6.3.

50

4.7~0 Group VII Events Group VII events are infrequent incidents or limiting faults that involve a decrease in reactor coolant inventory, which leads to plant depressurization.

The loss of inventory is caused by a breach of the reactor coolant system pressure boundary, from a valve epening, crack, or rupture of primary piping.

4.7. 1 Spectrum of Loss-of-Coolant Accidents (Topic XV-19)

A loss of reactor coolant can result from a rupture of the primary coolant system piping.

The break can range in size from a small leak which ca~ be controlled by makeup flow to a double-ended rupture.of the largest pipe.

The extent of system response depends on the size and location of the break; however, in general, a loss of coolant leads to plant depressurization and possible core heatup (resulting from stored energy and decay-heat generation).

Severe accidents can cause core uncovery and fuel failures.

One of the issues raised as part of the TMI Acticin Plan (Ref. 38) is consideration of core degradation and melting beyond the design basis.* The U.S. Nuclear Regulatory Commission (NRC) will conduct rulemaking on this subject, and this will be done outside of the SEP.

Reactor protection for loss"'."of-coolant accidents is initiated by low pressurizer pressure (thermal margin trip).

For large breaks, no credit is taken for the negative reactivity insertion from the rods based on the assump-tion of deformation of the rod channels.

Core Voiding shuts down the core~.

Safety injection is actuated by either* low pressurizer pressure or high cont-ainment pressure.

Different safety injection systems are avai 1 able to provide.*

core cooling; which systems are most effective in providing cooling depends on the size and location of the break.

For a small break, the pressure drops at a relatively slow rate, and high pressure injection and charging pumps provide.

the needed fl ow.

The charging pumps are re.aligned to draw suction from the concentrated boric acid tanks via the concentrated boric acid pumps.

Flow is *.

injected into the normal charging connections.

The HPSI pumps take suction on the SIRW tan.k and inject through the HPSI 1 i nes, into the cold 1 egs, once pressure drops below the HPSI shutoff head o~ 1225 psig.

The LPSI pumps would also start, but would not inject until pressure drops.below the shutoff head.

For a large break, the plant depressurizes very rapidly, and the low-pressure injection ~umps-and injection (SI) tanks function to provide:~ore cooling.

The LPSI pumps and SI tanks discharge into the same injection lines as the HPSI pumps.

The LPSI pumps also take suction off the SIRW tank.

The SI tanks are a passive device, requiring only that a check valve open when system pressure drops below the combined head of the nitrogen overpressure and the elevation head of the SI tanks.

For all break sizes, the actuation of the engineered-safeguards system requires a signal from eithe~ the low pressuriz~r pressure or high containment pressure instrumentation.

Each of these signals has a 2 out of 4 coincident logic.

The actuating signal opens isolation valves in the injection lines and starts the emergency core cooling system (ECCS) pumps.

Containment iSolation occurs on either high containment pressure or high radiation.

51

Large Breaks--Extensive analyses have been performed fo~ a sp~ctrum of break sizes.. The most recent ana.lysis was performed by Exxon using the WREM-II PWR ECCS evaluation model.

This analysis was done at a reactor power level of 2530 MWt and is presented in Reference 11.

The analysis model has been found by NRC to be in conformance with Appendix K.

This analysis shows that the most limiting break is a double-ended guillotine break at the pump discharge with a discharge coefficient (C0) of 0.6.

For this break, the peak clad temperature (PCT) is 2179°F.

The maximum local oxidation is less than 12%, with total oxidation percentage much less than 1%.

The PCT is reached 241.6 seconds after the break.

For later cycles, the licensee evaluated the limiting break to ensure that the acceptance criteria are satisfied with the technical spei:ifiCation maximum allowable heat generator rate (Ref. 22).

Based upon the loss of offsite power and a single active failure, the minimum level of safety injection assumed is 1 high head pump,. 1 of 2 low head pumps, and all safety injection tanks; also, 25% of the total flow is assumed spilling to containment through. the break.

The HPSI pumps are assumed to start within 21 seconds after the SIS.

The LPSI pumps are assumed to start 28 seconds after the SIS.

The worst single failure assumed for the large-break analysis is loss of a low pressure injection pump (Ref.

17)~ This failure is worse than a diesel gen-erator failure for ECCS performance since all containment-pressure-suppression systems would function, thus reducing backpressure and refloodrate.

This effect overrides the lower.flow delivery with. injection valves not opening with a dies.el fai 1 ure.

For the same reason, the event with offsite power available is more limiting sihce the pressure suppression begins earlier.

For containment temperature/pressure response, other single-failures, such as a diesel, may be more limiting.* The calculated PCT and oxidation percentages are less than the limits of 10 CFR 50.46 (Ref. 9).

The NRC safety evaluation approving these analyses is found in Reference 6.

As discussed in Section 4.3.1 a single failure of a check valve in an LPSI discharge line could result in overpressurization of the LPSI system by the HPSI pumps.

The need for interlocks to prevent opening of the LPSI motor-operated valves until RCS pressure decreases below the LPSI system design pressure is addressed under Topic V-11.B.

Following a large-break LOCA, there are two main phases of ECCS operation:

injection and recirculation.

The injection.phase is short term, and involves the rapid delivery of a large volume of borated water into the core for removal of stored energy.

The SIRW tank is the source of water forthe safety injection pumps.

The SI accumulator tanks also discharge.

This phase continues until a low-low SIRW level is reached.

Upon low-low level; the tank-control logic automatically transfers the suction*

for safety injection and containment spray to the containment sump.

The sump suction valves open, the SIRW suction valves are closed, and the LPSI pumps are tripped.

Component-cooling water is provided to the shutdo~n heat exchanger, which is used to cool,the containment spray flow.

52

In the recirculation mode, water from the sump is used to supply the HPSI and containment spray pumps.

This mode of operation can continue indefinitely, as water is recirculated from the sump, through the injection pumps to the core, out the break, and back to the sump.

The LPSI pumps can also be used for reci rcul ati on.

For long-term core cooling, and as the preferred method of preventing boron precipitation, the HPSI system is realigned for hot-leg injection.

Flow is directed from the sump by cross-connecting the HPSI system to the charging

. system header, into the auxiliary spray 1 i ne of the pressurizer and thus into the RCS via the pressurizer.

The realignment is done within 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months after the LOCA.

As an alternate to the above method, components of the shutdown cooling system are used.

The LPSI pumps take suction from a hot leg and pump reactor coolant through a shutdown cooling heat exchanger into the containment sump via a containment spray header.

The HPSI pumps continue to inject flow into the cold legs and thus to the core.

If RCS pressure drops below 20 psig, the LPSI pump discharge is also directed into the LPSI lines for return to the cold legs.. Hot-leg suction to LPSI cold-leg injection is also used during a normal cooldown from hot shutdown to cold shutdown.

The above methods of preventing boron precipitation are interim procedures for use until a permanent solution is implemented.

Prevention of boron precipitation is further discussed under Topic IX-4.

Containment cooling is a required function after a LOCA.

The cooling systems reduce containment pressure and temperature to limit escape of radioactivity.

There are two independent, diverse, full-capacity systems to accomplish the containment cooling function.

The containment spray system, which is used to reduce containment pressure and temperature, initially takes suction from the SIRW tank, with hydrazine gravity fed to the spray Tine.

During the recircu-1 ati on mode, sodium hydroxide is added to the sump water at the suction to the pump.

These additives improve i.odine retention in the water so that less airborne radioactive iodine can leak from the containment.

The containment fan coolers can also be used for containment heat removal.

The safety injection signal trips the low horsepower fans and starts the high power fans for the coolers.

Service water is used as the cooling medium.

Component cooling water is needed to provide water for the shell side of the shutdown. heat exchanger and for engineered-safety-feature pump cooling.

The service water system is the heat sink for the component cooling water system and also for the fan coolers.

The SIS automatically aligns these systems for emergency operation.

Nonessential loads are isolated.

Small Breaks-*Plant-specific analyses of both large and small breaks were prepared in 1971 by Combustio~ Engineering (Ref. 35).

The CE analysis demon-strated that the large breaks are much more limiting than small breaks are~

The Exxon analysis, therefore, concentrated on the large-break spectrum.

The CE small-break analysis was considered applicable by the staff for the composite core.

Later generic analyses by CE in 1974* confirmed that large-break LOCA resulted in higher PCT than do small breaks.

53

The generic CE analysis of small breaks (Ref. 45), conducted for the Calvert Cliffs plant at a power rating of 2560 MWt, are applicable for Palisades.

The limiting break of the spectrum is the 0.1 ft2 break, with a PCT of 1855°F.

For small breaks, the HPSI provides injection flow.

The worst single failure is a failure of one diesel generatot, since this can result in only one HPSI pump being available.

Loss of offsite power is also assumed.

The minimum ECCS flow delivered to the core is, therefore, 75% of the flow from one HPSI and 50% of the flow from one LPSI pump.

This is based on one HPSI and one LPSI pump on the diesel, all injection valves in the redundant HPSI header operable, with 25% of the HPSI flow spilling to the containment.

Since two of the four low-pressure injection valves are powered by the failed diesel, two injection points are left.-

One of these two lines is assumed to be connected to the break, so that only the remaining path, with 50% of the one LPSI pump flow, delivers to the core.

Small-break LOCAs do not result in the rapid depressurization which occurs for the large breaks; For some break sizes, decay-heat removal through the steam generators is required since the energy removal through the break is less than core decay-heat input, and additfonal heat-removal capability is needed.

The auxiliary feedwater system provides water to the generator, and steam is released via the atmospheric dump or safety valves.

If heat removal via the generators cannot be maintained, the PORVs must be opened to reduce reactor pressure to remove decay heat (see below).

The licensing basis, small-break LOCA analysis, with a single active f~ilure showed that the consequences of a small break are well within the acceptance criteria of 10 CFR 50.46 (Ref. 9).

Small-Break Post-TMI--In response to post-TM! requirements, Combustion Engineering has provided generic analyses of various small-break LOCA scenarios (Ref. 29).

Coincident loss of offsite power and loss of one diesel generator were assumed.

Although not all of the modeling assumptions and techniques are consistent with an Appendix K-type calculation for all cases, these analyses do provide useful information on plant response for a spectrum of small breaks with failures of the PORVs, or the auxiliary feedwater system.

These analyses go beyond current licensing requirements in that multiple concurrent failures such as a total loss of feedwater are postulated. -

A spectrum of cold-leg breaks were analyzed to illustrate the plant response.

Depending on the break size, the primary system may experience pressurization, a pressure plateau, or repressurtzation d~e to the HPSI flow.

Small-break LOCAs with loss of both main and auxiliary feedwater were also analyzed.

For the larger breaks (0.1 ft2 ) within the small-break spectrum, loss of auxiliary feedwater has little effect since sufficient steam generator heat transfer is provided by boiling off of the initial inventory in the generators.

The two-phase level in the vessel slowly decreases because of decay-heat boiloff.

Some core uncovery occurs, but it is recovered by HPSI flow.

Clad temperatures remain below the acceptable criteria of 10 CFR 50.46 during core uncovery.

54

For smaller breaks (0.02 ft2 ), the effect of loss of auxiliary feedwater and thus of the steam generator heat sink~ can be significant.

Since the leak rate is insufficient to remove decay heat, the primary system repressurizes above th~ HPSI shutoff head.

When steam begins to flow from the break, pressure drops and HPSI flow is reinitiated.

However, the flow rate is not enough to match core boiloff, so level drops, resulting in core uncovery about 1 hour1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months after the break.

Initiation of auxiliary feed within 30 minutes would prevent core uncovery.

Initiation within an hour would maintain core tempera-tures within acceptable limits.

For very small breaks (0.0005 ft2 ), auxiliary feedwater is also required.

However, because of the slow leak rate, more time exists for corrective actfons before core uncovery occurs.

The effect of reactor coolant pump operation on small-break LOCAs has also been assessed.

For hot-leg breaks, RCP operation has a potentially detrimental effect because of redistribution of the coolant inventory.

Increased core uncovery can occur unless appropriate and timely corrective action is taken.

A best-estimate (1.0 x ANS decay heat) evaluation was performed (Ref. 29) in which offsite power was assumed available and thus two HPSI pumps were

. operating.

No operator action was assumed so the RCPs remained on.

Also, no detrimental single failure was assumed.

The results bf this analysis show*

that core uncovery does not take place.

However, if the pumps stop running, the vessel inventory depletion can be greater than the limiting licensing calculation; for this best-estimate case, the peak clad temperature would not exceed the reference analysis peak clad temperature.

Since RCP operation can degrade performance following small LOCAs, licensing calculations with an Appendix K model, were also performed in Reference 46 to determine possible corrective actions.

The results show that the peak clad temperature will remain below the reference small-break licensing analysis if the reactor coolant pumps are tripped within 6 minutes*of scram and safety injection system actuation.

Emergency procedures have.been revised to require the operator to trip the pumps very shortly after safety injection.

A small delay is advisable so that the flow coastdown occurs.after the reactor scram.

The staff is continuing its review of small-break LOCAs as part of the TM!

Action Plan.

Sma 11-break LOCAs caused by inadvertent opening of a PORV ar.e further discussed in Section 4.9.1.

4.7.2 Radiological Consequences of Loss-of-Coolant Accidents (Topic XV-19)

An analysis of the radiological consequences of a postulated loss-of-coolant accident was performed in support of Amendment No. 31 to the Provisional

Operating License issued on November 1, 1977 (Ref. 6).

This analysis was performed following the assumptions and procedures indicated in the SRP 15.6.5 (Revision O) (see Ref. 7) and Regulatory Guide 1.4 (Ref. 41).

Supporting documentation is provided in References 2, 6, 26, and 27.

The estimated doses resulting from these postul~ted accidents have been modified to take into account the updated dispersion coefficients established in Topic II.2.C, 11Atmospheric Transport and*Diffusion Characteristics for 55

Accident Analysis, 11 and are listed in Table 6.

These doses are within the 10 CFR Part 100 guidelines (see Ref. 9) as specified in the acceptance criteria*

for the SRP 15.6.5 (Revision 0).

Table 6 Estimated offsite doses for postulated loss-of-coolant accidents Dose Thyroid, 0-2 hr Whole body, 0-2 hr Thyroid 0 - 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 8 - 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 24 - 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months 96 - 720 hour0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months Total, 0-30 day Whole body 0 - 8 hour9.259259e-5 days 0.00222 hours 1.322751e-5 weeks 3.044e-6 months 8 - 24 hour2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months 24 - 96 hour0.00111 days 0.0267 hours 1.587302e-4 weeks 3.6528e-5 months 96 - 720 hour0.00833 days 0.2 hours 0.00119 weeks 2.7396e-4 months Total, 0-30 day Containment leakage contribution, rem ECCS leakage contribution, rem Exclusion area boundary dose 110.

2.

20.

9.9 9.3

19.

58.

.24

. 060

.016

.024

.34

60.

.15 Low-population-zone dose

15.

8.4

16.

13.

52.

.025

.012

.0070

.0034

.047

Total, rem 170.

2.2

35.

18.

25.

32.

110.

.27

.072

.023

.027

.39 On the basis of these results, NRC staff concludes that the radiological consequences resulting from this postulated accident at the Palisades plant are similar to those of plants licensed under current criteria.

4.7.3 Containment Pressure/Temperature Response (Topics VI-2 and VI-3)

The effects on a LOCA on the containment are evaluated under SER Topic VI-2.D and VI-3.

4.7.4 Radiological Consequences of Failure of Small Lines Carrying Primary Primary Coolant Outside Containment (Topic XV-16)

Rupture of small lines carrying primary coolant outside containment can allow

. primary cool ant and the radi oacti vi ty contained therein to escape to the 56

environment.

SEP Topic XV-16 addresses the radiological consequences of such

failures, encompassing those lines which carry primary coolant outside con-,

tainment during power operation.

The *scope included those lines that are not normally expected to be open to the primary system but can be opened. during power operation (that is, reactor coolant sample lines, instrument lines, etc.).

All small lines carrying primary coolant outside containment were reviewed to ensure that any release of radioactivity from their postulated failure was a small fraction of the 10 CFR Part 100 (see Ref. 9) exposure guidelines.

11Small fraction 11 is defined in the Standard Review Plan to be no more than 10%

of the 10 CFR Part 100 exposure guidelines.

Lines which were excluded from the review included lines in which interlocks prevent opening during power operation such as the PWR residual-heat-removal lines.

These lines are covered by two SEP topics, V-10. B, *iRHR System Reliability, 11 and V-11.B, 11 RHR Interlock Requirements. 11 Main steamlines are considered in SEP Topics-III~5.B, 11 Pipe Break Outside Containment, 11 and XV-2, 11 Radiological Consequences of Main Steamline Failure Outside Containment.

11 The review of small lines carrying primary coolant outside containment was conducted in accordance with SRP 15.6.2 (see Ref. 7).

The licensee was requested to provide plant-specific information such as the identification of lines covered by this topic, the size of these lines, break locations, flow, etc.

The licensee responded to this request in a letter dated May 6, 1980

. (Ref. 32).

A review of the May 6, 1980 Consumers Power submittal as well as an independent review of all lines connected directly to the primary system, was conducted.

The analysis assumed that all the iodine contained in.the leaked coolant was released directly to the auxiliary-building atmosphere.

Operator action to isolate breaks was assumed to occur after a 20-minute delay. *The primary coolant activity was set at the Palisades Technical Specification eguilibrium limits of 1 µCi/gm I-131 dose equivalent and gross activity of 100/E µCi/gm.

The assumed primary coolant loss is within the*makeup capability of the charging system and the time required to isolate the break (20 minutes) is reasonable for operator action and produces no significant reactor depressurization nor change in power level.

As a result, no iodine spike was assumed to occur.

A flow rate of 133 gpm was selected because it bounded the break flows for all the small lines penetrating containment which are connected qirectly to the primary system.

The analysis did not take credit for plant features that could potentially result in much earlier break detection and, therefore, earlier isolation and consequent dose reduction.

For example, one of the lines analyzed for breaks, the letdown line in the chemical and volume control system (CVCS), has an automatic isolation feature on high letdown temperature as well as eves alarms such as high flow or low discharge pressure or rlow at the outlet of the charging pumps which could result in break i-olation earlier than assumed.

Using the assumptions outlined above, the resultant thyroid.and whole-body doses, 1.8 rem and 0~2 rem, respectively, are below the exposure guidelines of 10% of the 10 CFR P~rt 100 limits and, therefore, comply with the SRP criterion.

57

4.8.0 Group VIII Events These events are infrequent occurrences that lead to possible radioactive releases from fuel damaged by dropping a heavy load or through fuel handling.

4.8~1 Drop of Cask or Heavy Equipment (Topic IX-21)

This event is being considered as an unresolved safety issue (A-36) and

therefore has been deleted from tne S~P.

4o8.2 Radiological Consequences of Fuel-Damaging Accidents (Inside and Outside Containment) (Topic XV-20)

The safety objective of this topic is to assure that the offsite doses resulting from fuel-damaging accidents resulting from fuel handling are well within the guideline value of 10 CFR Part 100 (see Ref. 9).

The design-basis fuel-handling accident is postulated to damage one fuel assembly during fuel-handling operations either inside the spent fuel building or inside containment.

The postu1ated consequences are given in Table 7.

The assumptions and input parameters used in calculating the potential consequences are given in Table 8.

Previous staff reviews are included in References 33 and 34.

The analysis was performed following the assumptions and procedures indicated in SRP 15.7.4 (see Ref. 7) and Regulatory Guide 1.25 (Ref. 42).

The acceptance criteria of SRP specify that the doses should be 11appropriately within the guidelines 11 of10 CFR Part 100.

11Appropriately within the guidelines 11 has been defined.by the staff as a thyroid dose less than 100-rem.

This is based on the probability of these accidents relative to the probability of other accidents which are evaluated against the Part 100 exposure guidelines.

Whole-body doses were considered but they.are not controlling because of the decay of the short-lived radioisotopes prior to fuel handling.

On the basis of the results as given in Table 7~ we conclude that the radiological consequences are appropriately within the guidelines of 10 CFR Part 100.

Table 7 Calculated do?eS for fuel-handling accidents Location of accident In fuel-handling building Inside containment 58 2-hr dose, rem Thyroid Whole body Exclusion area boundary 9

91 0.4 0.4

Table 8 Assumptions used in analysis of fuel-handling accident Parameter Value or basis for value Power level 2650 MWt Operating time 3 years Peaking factor

1. 65 Number of fuel assemblies in core 204 Shutdown time before start of refueling 48 hours5.555556e-4 days 0.0133 hours 7.936508e-5 weeks 1.8264e-5 months Activity release from pool Containment isolation for inside containment Filter efficient for filter on spent fuel pool building ventilation system 0-2 hr, X/Q value, exclusion area boundary (ground level release) 59 Regulatory Guide 1.25 Puff release assumed with no isolation or effluent filtration 90%

3.4 x 10-4 sec/m3

4.9.0 Group IX Events Group IX events involve a loss-of-coolant inventory due to inadvertent opening of a valve.

These events are of infrequent occurrence.

4.9. l Inadvertent Opening of a PWR Pressurizer Relief Valve or BWR Safety Relief Valve (Topic XV-15)

The setpoint for opening of the power-operated relief valves (PORVs) is the same as the reactor high-pressure scram, so PORV opening would not prevent a scram.

The Palisades PORVs are isolated during normal operations by closing the block valves.

This prevents inadvertent blowdown through the relief valve by a single active failure.

No credit is taken in any of the analyses for automatic operation of the PORVs.

However, given certain cases of multiple failures, such as a total loss of auxiliary feedwater, the PORVs may be manually operated to depressurize the reactor coolant system and.remove decay heat.

The safety valves have sufficient capacity for the most severe overpressurization events.

The spring=loaded safety valves are set to open at reactor pressures of 2485, 2525, and 2565 psig.

Normal system pressure is 2060 psia, so there is considerable margin for operation without approaching the safety valve setpoints.

Thus, the most likely time for an inadvertent safety-valve blowdown to occur would be following an event, in which the safety valve lifts and fails to eseat.

Since the safety valves cannot be isolated, the blowdown would ontinue either until the valve reseats or until the plant is brought to cold shutdown.

The probability of blowdown due to inadvertent PORV opening at Palisades is lower than at other CE plants since the block valves are closed.

Post-TM!

modifications have also resulted in improved valve-position indication, and assurance that the PORV and block valve can be closed (or opened) from the control room with emergency power.

These features are important since the PORVs may need to be opened follow*ing some DBEs if the steam generator heat sink is unavailable.

Testing of the relief and safety valves for two-phase or liquid flows is also required by the NRC post-TMI task forces.

Before the accident at Three Mile Island, inadvertent openin*g of a PORV or safety valve was considered only as a small-break LOCA, and no specific analyses df PORV opening and its unique response characteristics were done.

Generic analyses have been performed by CE in response to post-TMI require-ments for PORV opening together with failures in the feedwater system or loss of ac power and diesel failure.

However, these are not licensing calculations since the decay-heat rate assumed was 20% less than that required by Appendix K (see Ref. 9).

These analyses however, assumed multiple rather than single failures.

Loss of offsite power, and thus RCP coastdown, was also assumed.

The response to a stuck-open PORV is similar to that for a very small cold-leg reak LOCA such as the O. 0005 ft2 break discussed in Se.ction 4. 7.1.

Since the reak is in the hot side of the primary system, the effects are less severe han for the equivalent size cold-leg break.

60

Initially pressure ~nd level in the vessel drop as fluid is lost out the PORV.

As the system continues to depressurize, HPSI flow begins to exceed leak flow and the reactor coolant system refills.

No core uncovery occurs.

If main and auxiliary feedwater.are lost, the transient proceeds as above until steam generator heat transfer is degraded as the generation empties.

Then RCS pressure begins to rise above the HPSI shutoff head when heat can no longer be removed through the steam generator.

The core remains covered for more than an hour after the initiating event of the PORV opening providing time for operator action to restore auxiliary feedwater.

61

4. 10.0 Group X Events Group X events have a moderate frequency of occurring and lead to an.increase in primary coolant inventory.

These events could cause an increase in pressure and power.

4. 10. 1 Inadvertent Operation of ECCS or CVCS Malfunction That Causes an an Increase in Coolant Inventory (Topic XV-14)

An increase in primary coolant inventory can result from inadvertent safety injection or from malfunctions of the pressurizer level controls (chemical and volume control system).

At normal operating conditions, ~tarting~n~PSI pump will not result in adverse consequences, since no flow will be delivered until pressure is below 1500 psi (HPSI pump shutoff head).

A minimum-flow line back to the SIRW tank protects the pumps from overheating.

An inadvertent HPSI actuation could permit the HPSI to overpressurize the LPSI if one check valve leaked excessively, as discussed in Section 4.3.1.

Startup of an HPSI pump during solid plant operations (low temperature/low pressure) was considered in the evaluation of the overpressure-protection system.

Assuming the failure of one.PORV, the consequences of this transient do not violate 10 CFR Part 50 Appendix G limits (see Ref. 9), and are con-sidered acceptable (Ref. 16).

(See further discussion in Topic V-3.)

A malfunction of the pressurizer level control system, such as failure of a level transmitter, could result in the starting of all three charging pumps and closing of the letdown orifices.

Assuming this situation continued unchecked, it would take 30 minutes to fill the pressurizer.

After the pres-surizer fills, pressurizer pressure will increase sharply until a high-pressure reactor trip occurs.

The analysis shows that the safety-valve setpoint is not reached, even assuming the steam dump system does not operate.

No credit is assumed for the operator action throughout the course of the transient.

Alarms would sound for the mismatch of letdown and charging flow and for low level in the volume control tank. _This analysis was performed in response to staff questions during the licensing review and is presented in Reference 2.

62

4.11.0 Group XI Events The Group XI events involve misleading of fuel assemblies in the core.

Undetected errors could lead to power distribution anomalies and exceeding fuel limits.

4.11.1 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (BWR) (Topic XV-11)

This topic is not applicable to a PWR, such as Palisades.

63

4.12.0 Group XII Events The Group XII events involve failures of steam generator tubes.

Leak~ from steam generator tubes are of moderate frequency but a tube rupture is an

infrequent occurrence.

4.12.. 1 Steam Generator Tube Fai 1 ure (Topic XV-17)

Leakage from or rupture of a steam generator tube can result from corrosion or other material failure.

The analysis assumes a leakage rate equivalent to a double-ended break of one tube.

A steam generator tube rupture allows leakage of primary coolant, and thus radioactivity, into the secondary system.

For a small leak, the chemical and volume control system (CVCS) can maintain the core inventory so no reactor trips occur.

The fluid loss associated with a double-ended tube rupture exceeds the capacity of the charging pumps, so reactor coolant inventory and primary pressure* decrease.

After "-15 minutes, the thermal margin/low pressure scram trip setpoint would be reached.and a reactor scram would occur.

The turbine also trips and the atmospheric dump valves and the turbine bypass valve to the main condenser open.

The continu-ing decrease in reactor. pressure initiates the high pressure safety injection system.

With offsite power available, the atmospheric dump valves will close in response to the decreasing reactor temperature,. and the bypass valve :to the condenser will handle the steam from decay heat.

By procedure, the reactor coolant pumps (RCPs} are tripped when a safety injection is initiated.

Although the RCPs are. tripped after the safety injection, this scenario is less limiting than the loss-of-offsite-power case when the RCPs as well as the main condenser are unavailable.

If loss of offsite power is assumed, the main circulating pumps a.re lost, so the condenser and bypass be.come unavai 1ab1 e.

Steam is then re 1 eased to the atmosphere through the atmospheric dump valves or safety valves.

The radiological consequences are thus more severe for the event with 7oss of offsite power.

After 30 minutes, the operator is assumed to start plant cooldown with the nonfaulted steam generator until the shutdow;i cooling system can be started, and the steam generators are isolated.

The above discussion considers only automatic actions of the plant systems for 30 minutes.

Earlier operator action could greatly reduce the adverse effects of a steam generator tube rupture.

Upon detecting signs of a steam generator tube rupture, such as high radioactivity alarms, decreasing pressure, or additional charging pump initia-tion, the operat6r reduces plant load before the reactor trips.

This minimizes the steam load to be dumped.

By terminating feedwater to the generator having the ruptured tube and feeding only the intact generator, the operator can cool the plant down, minimize steam generation in the leaking geherat,ar, and thus minimize release of radioactivity.

The motor-driven auxiliary feedwater pump is used instead of the turbine-driven pump since the turbine exhaust is a release path for radioactive steam.

Timely depressurization of the primary 64

system with spray (if RCPs are running), auxiliary spray, or with the PORVs also minimizes the radiological consequences.

This event was analyzed in the FSAR (Ref.. 2) in Section 14.15, at a reactor power level of 2650 MWt, assuming offsite power is available.

Tube rupture with loss of offsite power was considered 'in Reference 19.

The leaking steam generator was assumed to be isolated only after cooldown to the shutdown cooling system initiation point (3.6 hours6.944444e-5 days 0.00167 hours 9.920635e-6 weeks 2.283e-6 months ).

The analysis showed that the acceptance criteria were satisfied, since the doses were within the limits of 10 CFR PartlOO ((Ref. 9) (see Section 4.12.2).

These analyses are appl i cab.le for present operating conditions at 2530 MWt.

Consequences of multiple tube ruptures (Topic XV-23) are currently not a licensing basis for plants.

They are, however, being considered generically within the scope of the NRC Unresolved Safety Issue Program for Tasks A-3,

A-4, and A-5.

4.12.2 Radiological Consequences of Steam Generator Tube Failure (Topic XV-17)

The double-ended severance of a steam generator tube is analyzed because the consequences of this postulated event could include the release of significant

.amounts of radioactive material.

As compared to a small loss-of-coolant accident, this event assumes significant proportions because of the path created for the release of reactor coolant via the secondary side of the steam generator, out of the reactor containment structure to the turbine and/or condenser; should there be a concurrent loss of offsite power, radioactive.

material could pass to the environment through the safety and dump valves.

Based on analyses of th.e types of tube degradation that have been observed at the Palisades steam generators, the most likely event would be the gradual increase of the primary to secondary leakage over a time period.

To assure that the integrity of the steam generator tubes is maintained throughout the life of the plant,. periodic inspections are performed as specified in the Palisades Technical Specification 4.14.

In addition, Technical Specification 3.1.5 limits the allowable primary to secondary leakage to 0.6 gpm in any one steam generator.

An analysis of the radiological consequences of a steam generator tube fail~re at the Palisades plant has been performed by the staff following the assumptions and procedures indicated in the SRP 15.6.3, 11 Radiologic~l Consequences of a Steam Generator Tube Failure (PWR) 11 (see Ref. 7).

The specific assumptions.

made regarding the plant conditions prior to the post~lated accidents and the expected systems response are listed in Table 4..

Supporting documentation is provided in References 2, 23, 24, and 25.

It has been conservatively assumed that the accident is followed by a complete loss of offsite power.

Therefore, the plant is cooled down by releasing secondary steam to the environment through the safety and dump valves.

It has also been assumed that prior to the accident the primary and secondary coolant

The systems response to a steam generator tube rupture are discussed in Section 4.12.1.

65

act1vities were at the maximum levels allowed by the Technical*

Specifications 3.1. 4 and 3.1. 5 (Ref. 25).

The estimated site-boundary doses resulting from this postulated accident (see Table-5) have been found to be within the 10 CFR Part 100 guidelines (see Ref. 9) as specified in the Acceptance Criteria for SRP 15. 6. 3 (Ref. 7).

On the basis of these r~sults, the staff concludes that the Palisades plant design is acceptable with respect to the radiological consequences of a possible steam generator tube failure, and that the risk presented by this postulated accident is similar to that of plants licensed under current criteria.

66

4.13.0 Group XIII Events 4.13.l Anticipated Transients Without Scram (ATWS)

Unresolved Safety Issue (USI) A-9 addresses Anticipated Transients Without Scram.

Therefore, the topic has been deleted from the SEP.

67

5 OCCURRENCES OF DESIGN-BASIS EVENTS The operational history of. the Palisades Nuclear Plant was rev.iewed to determine occurrences that initiated a design-basis event (DBE) as described in chapter 15 of the Standard Review Plan, or that compromised safety function of systems designed to mitigate the consequences of a DBE.

Loss of normal feedwater flow, eithe~ partial or total, has caused three to four plant shutdowns per year.

This appears to cause a high number of demands on the auxiliary feedwater system, and thus emphasizes the importance of auxiliary feedwater system reliability.

The rate of occurrence of other moderate frequency events is about as expected.

Inadvertent closure of main steam isolation valves (MSIVs) has led to reactor shutdown in four instances.

Plant systems functioned as required to protect the plant.

Failure of an MSIV to close on demand is of concern from an accident-mitigation standpoint.

There have been four instances of such failures, only two of which have occurred since 1975.

In 1971, prior to commercial operation of the facility, inadvertent opening of a power-operated relief valve (PORV) caused system depressurization for 3 minutes unti.l the operator closed the block valve.

The plant now operates with the block valves closed.

Palisades has experienced numerous losses of offsite power sources.

In itself,

. this is not a significant safety concern, since the plant is designed to safely shut down with loss of offsite power.

However, coupled with the large number of failures in the emergency diesel generator power system, the loss of offsite power could lead to degradation of safety functions.

Other occurrences of possible safety concern include failures in safety systems affecting the ability to perform their safety function if required.

One example is the loss of containment integrity that existed when two manual isolation valves were left open after some testing.

68

As discussed in Section 1.6, the staff is reevaluating some boron dilution events on a generic basis to ensure that the time available for operator action is adequate under shutdown conditions with a reduced PCS volume.

It has been noted elsewhere (Ref. 26) that the CE small-break LOCA methods sho~ld be revised and resubmitted for NRC approval, and that e plant-specific analysis with the revised methods should be provided.

The schedule for this resubmittal, as part* of the TMI Action Plan, is for after 1982.

The licensee has stated that he may address small-break LOCA analyses (for conformance to 10 CFR Part 50.46) through bounding analysis by the reactor vendor (CE), and that he does not believe that additional analyses are needed from the fuel supplier, Exxon.

These subjects will be resolved as part of the TMI Action Plan and not within the SEP.

The radiological consequences of the postulated accidents and transients have been shown to be within the limits of 10 CFR Part 100.

The staff has performed independent calculations of the doses for some of these events.

. For each of the accidents and transients, the staff has determined which systems function to mitigate the event and to bring the plant to a safe shutdown (Figure 1).

SEP topics potentially applicable to these systems are identified in Figure 2.

The systems are evaluated through the SEP topics to assess their ability to respond as required.

Deviations identified by the topic reviews will be evaluated in the integrated assessment to see how they affect design-basis-event performance.

Based on the interrelationships among topics, systems, and DBEs, balanced judgments concerning corrective measures will be made.

70

7 REFERENCES

1.

Consumers Power Co., Palisades Plant, Final Safety Analysis Report, November 1, 1968. 1

2.

Consumers Power Co., Palisades Plant, Final Safety Analysis Report, updated by Amendments, December 15, 1973. 1

3.

Letter from D. A. Bixel, Consumers Power Co., to R. A. Purple, NRC,

Subject:

Cycle 2 Reload Fuel, Corrections, and Transmittal of Report, Plant Transients Analysis (XN-75-67); dated February 4, 1976. 1

4.

Letter from D. A. Bixel, Consumers Power Co., to R. A. Purple, NRC,

Subject:

Answer to Question on Transients (4.B.l), dated March 29, 1976. 1

5.

Exxon Nuclear Co., Inc.,

11 Plant Transient Analysis of the Palisades Reac-tor for Operation at 2530 Mwt, 11 XN-NF-77-18, July 1977.1

6.

Letter from A. Schwencer, NRC, to D. Bixel, Consumers Power Co.,

Subject:

Transmittal of (1) Amendment No. 31 to DPR-20, (2) Safety Evaluation, (3) Environmental Impact Appraisal, and (4) Notice/Negative Declaration; dated November 1, 1977. 1

7.

U.S. Nuclear Regulatory Commission, 11Standard Review Plan for the Review of Safety Analysis Reports for Nuclear Power Plants--LWR Edition, 11 USNRC Report NUREG-75/087, December 1977. 2

8.

Letter from NRC to Consumers Power Co.,

Subject:

Transmittal of Safety Evaluation for Issuance of a Provisional Operating License, dated March 6, 1970.1

9.

Code of Federal Regulations, Title 10, 11 Energy, 11 Parts Oto 199, U.S.

Government Printing Office, Washington, D.C., 1980. 3

10.

Exxon Nuclear Co., Inc.,

11 Palisades Stretch Power LOCA Analyses Using the ENC WREM-Based PWR ECCS Evaluation Model--Example Problem, 11 XN-NF-77-9, May 1977. 1

11.

Exxon Nuclear Co., Inc.,

11 LOCA Analysis for Palisades at 2530 Mwt Using the ENC WREM-II PWR ECCS Evaluation Model, 11 XN-NF-77-24, July 1977. 1

12.

J. D. Kahn, "Description of the Exxon Nuclear Plant Transient Simulation Model for Pressurized Water Reactors (PTSPWR),

11 Exxon Nuclear Co., Inc.,

XN-74-5, Revision 1, May 1975. 1

13.

J. N. Morgan, 11 XTRAN-PWR:

A Computer Code for the Calculation of Rapid Transients in PWR's With Moderator and Fuel Temperature Feedback, 11 Exxon Nuclear Co., Inc., XN-CC-32, September 1975. 1 71

14.

Exxon Nuclear Co., Inc.,

11 Exxon Nuclear Company WREM-Based Generic PWR ECCS Evaluation-Model Update ENC WREM-II, 11 XN-76-27:

July 1976; Supple-ment 1, September 1976; Supplement 2, November 1976. 1

15.

Letter from G. Lear, NRC, to W. Nechedom, Exxon Nuclear Co.,

Subject:

NRC Review of Exxon Nuclear Co. Topical Reports XN~76-72 and XN-76-27, Supplements 1 and 2 [Ref. 14, above],

11 dated March 9, 1977. 1

16.

Letter from Consumers Power Co. to NRC,

Subject:

Open Items Related to Safety Evaluation of the Subject Facility Cycle II Reload Amendment Number 21 to Provisional Operating License No. DPR-20 dated April 29, 1976, dated January 24, 1978. 1

17.

U.S. Atomic Energy Commission, 11Status Report by the Directorate of Licensing in the Matter of Combustion Engineering, Inc., ECCS Evaluation Model Conformance to 10 CFR Part 50, Appendix K, 11 October 10, 1974. 1 18; Letter from R. L. Haueter, Consumers Power Co., to J. F. O'Leary, USAEC,

Subject:

Request for Change to the Technical Specifications, License No. DPR-20; Amendment 4, transmitting Special Report No. 6, R~vision 1, titled 11Analysis of Postulated High Energy Line Breaks Outside of Con-tainment, 11 dated July 13, 1973. 1

19.

Consumers Power Company, Answers to NRC Questions, Amendments 14, 15, 16, and 17 (Vol. IV of Ref. 2). 1

20.

Combustion Engineering, Inc.,

11 Input for Response to NRC Lessons Learned RequiremeMts for Combustion Engineering Nuclear Steam Supply Systems,"

CEN-125, December 1979. 1

21.

Letter from D. A. Bixel, Consumers Power Co., to A. Schwencer, NRC,

Subject:

Transmittal of 11Analysis of Disc Impact Velocity for Palisades Main Steam Isolation Valve as a Result of a Main Steam Line Rupture,"

MPR-500, dated July 20, 1976. 1

22.

Exxon Nuclear Co., Inc.,

11 ECCS and Thermal-Hydraulic Analysis for the Palisades Reload H Design," XN-NF-80-18, May 15, 1980. 1

23.

Letter from D. Hoffman, Consumers Power Co., to Director, NRR,

Subject:

Palisades Plant Steam Generator Operating History Questionnaire, dated June 26, 1978. 1

24.

Letter from D. Hoffman, Consumers Power Co., to D. Ziemann, NRC, forwarding "Palisades Plant Steam Generator Repair Report," dated January 3, 1979.1

25.

Consumers Power Co., Appendix A to Provisional Operating License DPR-20, Technical Specifications for Palisades Plant, Docket No. 50-255. 1

26.

Letter from 0. Hoffman, Consumers Power Co., to O. Ziemann, NRC, dated March 9, 1978.1 72

27.

Letter from D. Ziemann, NRC, to D. Hoffman, Consumers Power Co.,

Subject:

Amendment 40 to Provisional Operating License DPR-20, dated April 12, *-

1978. 1

28.

Letter from D. Ziemann, NRC, to D. Bixel, Consumers Power Co.,

Subject:

Forwarding Safety.Evaluation of Fuel Handling Accident Inside Containment, dated June 21, 1979. 1

29.

Combustion Engineering, Inc., "Review of Small Break Transients in Combustion Engineering Nuclear Steam Supply Systems, 11 CEN-114P, July 1979. 1

30.

U.S. Nuclear Regulatory Commission, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Combustion E ngineering-Designed Operating Plants, 11 USNRC Report NUREG-0635, February 1980. 4

31.

Letter from D. Hoffman, Consumers Power Co., to D. Crutchfield, NRC,

Subject:

Response to SEP Topic XV-16, dated May 6, i980. 1 32~

Letter from D. P. Hoffman, Consumers Power Co., to A. Schwencer, NRC,

Subject:

Proposed Technical Specifications Changes for.Requested Power Increase, August 12, 1977. 1

33.

Letter from R. W. Huston, Consumers Power Co., to D. L. Ziemann, NRC;

Subject:

Automatic Initiation of Auxiliary Feedwater System at Palisades Plant,. dated January 21, 1980. 1

34.

Letter from D. P. Hoffman, Consumers Power Co., to J~ G. Keppler, NRC,

Subject:

Update to Licensee Event Report 80-003--Containment Spray, dated May 13, 1980. 1

35.

Letter from D. P. Hoffmann; Consumers Power Co., to D. L. Ziemann, NRC,

Subject:

Potential Boron Dilution Incidents, dated July 6, 1978. 1

36.

Letter from D. P. Hoffman, Consumers Power Co., to u. L. Ziemann, NKt;,

Sub.iect:

PWR Moderator Dilution Analysis, dated March 30, 1979.

37.

Letter from D. J. Skovholt, USAEC; to R. L. Haueter, Consumers Power Co.,

Subject:

Change No. 9 [High Energy Line Break] to the Technical Specifi-cations, dated October 9, 1973. 1

38.

U.S. Nuclear Regulatory Commission, 11 NRC Action Plan Developed as a Result of the TMI-2 Accident, 11 USNRC Report NUREG-0660, May 1980. 4

39.

U.S. Nuclear Regulatory Commission, 11TMI-2 Lessons Learned Task Force:

Status Report and Short-Term Recommendations, 11 USNRC Report NUREG-0578, July 1979. 5

40.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.77, 11Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors. 116 73

)

~J,

41.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.4, 11Assumptions Used for Evaluating the Potential.Radiological Consequences of a.

Loss-of-Coolant Accident for Pressurized Water Reactors. 116

42.

U.S. Nuclear Regulatory Commission, Regulatory Guide 1.25, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors (Safety Guide 25). 116

43.

Letter from D. P. Hoffman, Consumers Power Co., to D. M. Crutchfield, NRC,

Subject:

Palisades Plant--Auxiliary Feedwater Modifications, dated December 1, 1980.1

44.

Letter from S. R. Frost, Consumers Power Co.~ to J. G. Keppler, NRC,

Subject:

Response to IE Bulletin 80-04--Analysis of a PWR Main Steam Line Break With Continued Feedwater Addition, dated May 9, 1980. 1

45.

Combustion Engineering, Inc. "Calculative Methods for the CE Small Break LOCA Evaluation Model, 11 CENPD-137P, August 1974 and CENPD-137P, Supplement 1-P, January 1977. 1

46.

Combustion Engineering, Inc.

11 Response to NRC IE Bulletin 76-06C Items 2 and 3 for Combustion Engineering Steam Supply Systems, 11 CEN-115-P, August 1979.

47.

U.S. Nuclear Regulatory Commission, 11Systematic Evaluation Program

Status - Summary Report, 11 NUREG-0485 Volume 3, Number 5, April, 1981.

1Available in NRC PDR for inspection and copying for a fee.. The Public Document Room is located at 1717 H St., NW., Washington,. D. C. 20555.

2Available for purchase from National Technical Information Service, Springfield, Vi rgi ni a 22161.

3Available for purchase from U.S. Government Printing Office, Washington, D.C.

20402.

4Available for purchase from NRC/GPO Sales Program, Washington, D.C. 20555 and National Technical Information Service, Springfield, Virginia 22161.

5Single copies are available free upon written request to Division of Technical Information and Document Control, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555.

6Available for purchase from NRC/GPO Sales Program, U.S. Nuclear Regulatory Commission, Washington, D.C. 20555.

74

ML18046A822

Contents

Text

Dear Mr. Hoffman:

SUBJECT:

Dear Mr. Hoffman:

SUBJECT:

Enclosure:

SUMMARY

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Navigation menu

ML18046A822

Text

Dear Mr. Hoffman:

SUBJECT:

Dear Mr. Hoffman:

SUBJECT:

Enclosure:

SUMMARY

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Subject:

Navigation menu

Search