ML18139B401

Reload Nuclear Design Methodology

ML18139B401
Person / Time
Site:	Surry, North Anna
Issue date:	04/30/1981
From:	Ahmed S, John Miller, Robins R VIRGINIA POWER (VIRGINIA ELECTRIC & POWER CO.)
To:
Shared Package
ML18139B400	List: ML18139B399 ML18139B401
References
VEP-FRD-42, NUDOCS 8106180188
Download: ML18139B401 (56)

Text

NOTICE THE ATTACHED FILES ARE OFFICIAL RECORDS OF THE DIVISION OF DOCUMENT CONTROL. THEY HAVE BEEN CHARGED TO YOU FOR A LIMITED TIME PERIOD AND MUST BE RETURNED TO THE RECORDS FACILITY BRANCH 016.

PLEASE DO NOT SEND DOCUMENTS CHARGED OUT THROUGH THE MAIL. REMOVAL OF ANY PAGE(S) FROM DOCUMENT FOR REPRODUCTION MUST BE REFERRED TO FILE PERSONNEL.

DEADLINE RETURN DATE RECORDS FACILITY BRANCH

PAGE 1

VEP-FRD-42 RELOAD NUCLEAR DESIGN METHODOLOGY BY S.A. AHMED J.G. MILLER R.T. ROBINS T.L. WHEELER NUCLEAR FUEL ENGINEERING VIRGINIA ELECTRIC AND POWER COMPANY RICHMOND,VIRGINIA APRIL, 1981 M. L. SMITH, SUPERVISOR NUCLEAR FUEL ENGINEERING APPROVED:

>'e7/?J.~~

R. M. BERRYMAN, DIRECTOR NUCLEAR FUEL ENGINEERING

--1

PAGE 2

CLASSIFICATION/DISCLAIMER The

data,

~nformation, analytical techniques, and conclusions in this report have been prepared solely for use by the Virginia Electric and Power Company Cthe Company),

and they may not be appropriate for use in situations other than those for which they are spe~ifically prepared.

The Company therefore makes no claim or warranty whatsoever, eKpressed or implied, as to their accuracy, usefulness, or applicability.

In particular, THE COMPANY MAKES NO WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, NOR SHALL ANY WARRANTY BE DEEMED TO ARISE FROM COURSE OF DEALING OR USAGE OR

TRADE, with respect to this report or any of the data, information, analytic~! techniques,

• or conclusions in it.

By making this report available, the Company does not authorize its use by others, and any such use is expressly forbidden eKcept with the prior written approval of the Company.

Any such written approval shall itself be deemed to incorporate the disclaimers of liability and disclaimers of warranties provided herein.

In no event shall the Company be

liable, under any legal theory whatsoever (whether contract, tort, warranty, or strict or absolute liability),

for any property damage, mental or physical injury or

death, loss of use of property, or other damage r~sulting from or arising out of the use, authorized or unauthorized, of this report or the data, information, and analytical techniques, or conclusions in it.

PAGE 3

TABLE OF tONTENT$

Page TITLE PAGE *****.*.**************.*****. * *.*******.*****.**.***

CLASSIFICATION/DISCLAIMER ************. : *.********************

2 TABLE OF CONTENTS............................................

3 LIST OF TABLES ********************.*******.*********.***** ~..

5

. LIST OF FIGURES **************.****************** -* *** -** *********

6 Section 1.0 Introduction................ ~................

7 Section*2.0 Standard Reload Design.......................

9

2. 1 Introduction......................................

9

2. 2 Design Objectives................................. 10 2.3 Design Initialization... !*******************...... 12 2.4 Analytical Models.......*......................... 13

2. 5 Analytical Methods................................ 15 2.5.1 Core Depletions........*....... ~............ 15 2.5.2 Core Reactivity Parameters and Coefficients................................ 1 6

2. 5. 2. 1 Temperature Coefficients............ 17 2.5.2.2 Differential Boron Worth............ 18 2.5.2.3 Delayed Neutron Data................ 18 2.5.2.4 Power Coefficien~s and Defects...... 18 2.5.2.5 Xenon and Samarium Worths........... 19 2.5.3 Core Reactivity Control..... w *************** 19 2.5.3.1 Most Reactive Rod Stuck............. 20 2.5.3.2 Integral and Di£ferential Rod Worths.............................. 20

PAGE 4

2.5.3.3 Soluble Boron Concentrations....... 20 2.5.3.4 Rod Insertion Limits................ 21 Section 3.0 Nuclear Design Aspects of Reload Safety Analysis.... :*............... 23 3.1 Introduction...................... ~............... 23 3.2 Safety Analysis Philosophy....*.*................. 23

3. 3 Safety Analysis Administration..... :."............. 26 3.4 Overview 0£ Accidents and Key Parameter Dex:ivations....................................... 28

3. 4. 1 Hon-Specific Key Parameters................. 2 9 3.4.1.1 Trip Reactivity Shape............... 29 3.4.1.2 Reactivity Coe££icients............. 31 3.4.1.3 Neutron Data......................... 32 3.4.1.4 Power Density, Peaking Factors...... 33 3.4.2 Specific Key Parameters..................... 34 3.4.2.1 Uncontrolled Rod Bank Withdrawal.... 34 3.4.2.2 Rod Misalignment.................... 36 3.4.2.3 Rod Ejection........................ 37 3.4.2.4 Steamline Break................... *... 39 3.4.2.5 LOCA Peaking Factor Eval~ation...... 41 3.4.2.6 Boron Dilution...................... 45 3.4.2.7 Overpower Evaluations............... 46 3.4.3 Hon-Nuclear Design Key Parameters........... 47 Section 4. 0 Summary and Conclusions...................... 48 Section S. 0 Refe:cences................................... SO

PAGE 5

LIST OF TABLES TABLE TITLE PAGE CS)

Evaluated Accidents 52,53 2

Key Analysis Parameters 54

FIGURE LIST OF FIGURES TITLE Safety Analysis Administ~ation

£0~ a Reload Cycle PAGE 6

PAGE CS) 51

PAGE 7

SECTIOH 1.0 -

IHTRODUCTION Analytical methods used to insure the safety of Vepco nuclear plants after reload core and system changes will be discussed in this report.

The topics covered, primarily from a nuclear design standpoint, will be the standard reload design, reload safety

analysis, and an overview of analyzed accidents and key parameter derivations.

The standard reload design section details: (1) the design bases, assumptions, design limits and constraints which must be considered as part of fulfillment of the design process; (2) the determination and cycle energy requirements; and (3) preparation of the cycle design report and related documents.

The reload safety analysis section discusses systematic ways of insuring the safety Of*

the reactor after reload changes to the plant or core.

The section indicates in general the.analyses performed for the Surry and North Anna Units. However, due to differences in the

units, a

limited number of the analyses described do not pertain to all units. Each unit has specific license requirements that ind~cate exactly what analyses are aecessary for the reload.

Key analysis parameters determine the severity of each accident.

The accident analysis key parameter derivation section presents a conceptual discussion of all the accidents of concern for the FSAR or subsequent licensing submittals, and outlines the procedures

PAGE 8

used to derive each core physics related key parameter. If all key parameters for the reload cycle are bounded by the values used in the reference safety

analysis, the reference safety analysis applies for the reload core.

When any reload parameter is not bounded by the value used in the reference analysis, safety analyses or evaluations must be performed for the affected transients.

This basic reload analysis philosophy has been used by Westinghouse (Reference 1) for all of the reload cores for the Vepco Surry Units 1 an~ 2, and Horth Anna Units 1 and 2. This philosophy will be used fox future reload cycle designs by Vepco.

PAGE 9

SECTION 2.0 -

STANDARD RELOAD DESIGN 2.1 Introduction This section describes the nuclear design effort performed by Vepco for a

reload core.

The design objectives for each of the three phases of the nuclear design are reviewed along with a description of the design codes used. The design procedures.and methodology used for the preliminary and final design phases (i.e., core loading pattern design and optimization; and the design report predictions) are briefly described in this section. The remaining design phase, which is concerned with the determination of nuclear related key safety parameters, is considered in detail in Section 3 of this report.

The three nuclear design phasesi in the chronological order in which they are performed, are:

I.

Core loading pattern -design and optimization.

II.

Determination of core physics related key analysis parameters for reload safety analysis.

III.

Design report predictions.

These phases hereafter will be referred to as design Phases I, II and III respectively.

Section 2.2 below presents a summary of the nuclear* reload design objectives, followed by sections on the design initialdzation process and the analytical models used for reload design. The

PAGE 10 design methodology for Phases I and III are examined in detail in Section 2.S.

Phase II

design, key safety analysis parameter calculations, is described in Section 3.

2.2 Design Objectives The overall objective in the design 0£ a

reload core is to.

determine the enrichment and. number of ne~ fuel assemblies and construct a

core loading pattern which will fulfill the energy

.requirements for the cycle while satisfying the design basis and meeting all applicable safety analysis limits.

The objective of Phase I

design is to produce a core loading pattern which meets the constraints outlined in the design initialization, Cs~e Section 2.3). In addition~ to be acceptabl~.

the loading pattern must fulfill the following conditions:

1.

The radial peaking factor values for the all rods out CARO) and D Bank inserted core configurations at hot full power CHFP),

equilibrium xenon conditions do not exceed the Technical Specifications limits.

2.

The moderator temperature coefficient at operating conditions meets the Technical Specifications limit.

3.

Sufficient r~d worth is available to allow for shutdown with the most reactive rod in the core withdrawn.

The objective 0£ Phase II design is to verify that all coze physics related limits are met £or the core loading pattern. Once.the final loading pattern for th.e reload cycle has been optimized under Phase I,

the co~e physics related key analysis parameters input to the

PAGE 11 safety analysis are verified by comparing the values of the parameters calculated for the reload cycle with the limiting values for these parameters assumed in the reference safety analyses. If a key analysis parameter for the reload cycle exceeds the limiting value,*

the corresponding transient must be reevaluated or reanalyzed.

Physics design predictions for the support of station operations are calculated in Phase III. The analysis techniques used in Phase III are

~onsistent with those of Phase II. These predictions include reactivity parameters and coefficients, control rod worths,

(

boion endpoints, core power distributions and core isotopics as a function of cycle burnup. The predictions are published in the form of a Nuclear Desig~ Report for each reload cycle. In additio~. PD2 IHCORE decks are generated. These decks contain predicted power and flux distributions from PD207. The IHCORE code CRe£erence 2> uses the PD207 predictions and. thimble flux measurements to make predicted to measured power distribution comparisions.

Using IHCORE~

design predictions are compared with measurements during startup physics testing and core follow to:

1.

Verify the design calculations.

2.

Insure that the core is properly loaded.

3.

Verify that the core is operating properly.

PAGE 12 2.3 Design Initialization Before any nuclear design calculations are performed for a reload

~ore, a

design initialization must be performed.

The design initialization marks the formal beginning of the design and safety evaluation effort for a reload core and identifies the objectives, requirements, schedules, and constraints for the cycle being designed.

A design initialization includes the collection and review of design basis information to be used in initiating design work. It also insures that the designer is aware of all information which is pertinent to the design ~nd that the subsequent safety evaluation will be based on the actual fuel and core components that are in the plant, the actual plant operating history, and any plant system changes projected for the next oycle.

The design basis information to be reviewed includes:

1.

Reload cycle energy requirements.

2.

Applicable core design parameter data.

3.

Safety criteria and related constraints on fuel and core components as specified in the Final Safety Analysis Report CFSAR).

4.

Specific operating limitati~ns on the plant as contained in the Technical Specifications.

5.

Reload safety a~alysis parameters (mechanical, nuclear, and thermal/hydraulic) used.in the safety analysis up to and including the previous cycle.

This review will establish or define:

1.

The nom~nal end of cycle CEOC) burnup window for

the p:r:evious cycl.e.

2.

The cycle energy and operational requirements.

3.

Reload design schedul.es.

4.

The availabl.e :r:el.oad fuel. for use in the co:r:e.

5.

Any const:r:aints on the fuel. to be used in the

r:eload design.

6.

Restrictions on the use and location of co:r:e insert components.

2.4 Analytical Models PAGE 13 The major analytical models cur:r:ently used.in the reload design a:r:e:

1.

the Vepco PD207 Discrete Model

2.

the Vepco PD207 One-Zone Model

3.

The Vepco FLAME Model.

The Vepco PDQ07 Models pe:r:fo:r:m two-dimensional C2-D,x-y) geomet:r:y diffusion~depletion calculations for:

two neut:r:on ene:r:gy groups.

These models utilize the NULIF CRefe:r:ence

3) code and seve:r:al auxillia~y codes to generate and format the cross section input, pe:r:fo:r:m

shuffles, and other:

operations.

The two models are diffe:r:ehtiated according to their mesh

size, C~.e.*

either a discrete mesh or one-zone mesh). The discrete model generally has dne mesh line per.,fuel pin, while the one-zone model has a mesh size of 6x6 per fuel.

assembl.y.

A quarter-core symmetric two-aimensional.

geometry or a ful.l. core two-dimensional. geometry may be specified for either model. Effects of nonuniform moderator density and fuel.

temperatures are accounted for:

by

PAGE 14 thermal-hydraulic feedback.

More complete descriptions of these models and their auxilliary codes will be found in Referenc~s 4 and 5

for the discrete and one-zone models, respectively. The PDQ07 Models are used to calculate two-dimensional radial power distributions,.

delayed neutron

data, radial peaking

factors, assemblywise burnup and isotopic concentrations,_ integral rod

worths, differential boron worths and boron endpoints, xenon and samarium worths and core average reactivity coefficients such as temperat~re and power coefficients.

In addition, the PDQ-INCORE decks used in startup physics test1ng and core follow are generated using the PDQ07 Model.

The Vepco FLAME Model is used to perform three-dimensional (3-D, x-y-z geometry) nodal power density and core reactivity calculations using modified diffusion theory with one neutron energy group.

The model utilizes the NULfF code

~nd several auxiliary codes to generate and format cross section ~nput~ perform

shuffles, and other operations. Each fuel assembly in the core is represented by one radial node and 32 axial nodes in the FLAME Model.

As with the PD207

Models, the *effects of nonuniform moderator density and fuel temperature are accounted for by thermal-hydraulic feedback.

A more complete description of this model

~nd its

~uxilliary codes will be found in Reference 6. The FLAME Model is used in calculating and evaluating three-dimensional or axial effects such as differential rod worths, axial power and burnup

PAGE 15 distributions, and control rod operational limits. FLAME Model predictions are normalized to those of the PDQ07 model when applicable.

Specifics on the use of the.analytical codes in key analysis paramater generation are discussed later in this report. Additional support codes are used in conjunction with the PDQ07 and FLAME Models to perform special calculations such as xenon and samarium worths.

Numerical uncertainty factors appropriate to the model used and to the calculation performed are applied to the key analysis parameter determinations.

These uncertainty factors will be detailed in a forthcoming Vepco topical report. The PDQ07 and FLAME Models will be referred to generically in the remainder of.this report Ci.e.,

as the 2-D and the 3-D models respectively).

2.5 Analytical Methods This section presents a

description of the various analytical methods used in Phase I and Phase III design. These methods may be classified into three types of calculations: core depletions, core reactivity control.

parameters 2.5.1 Core Depletions and coefficients, and core reactivity Each reload core loading pattern is depleted at hot full power CHFP),

all rods out CARO) conditions using a

2-D model in

PAGE 16 eighth-core or quarter-core geometry. Criticality is maintained by varying th~ boron concentration.

The calculations provide x-y relative power distributions, burnup predictions and an estimate of the.end of cycle CEOC) reactivity.

During Phase I design, a depletion of the reload core is performed based on a nominal, Ci.e.

best estimate),

EOC for the previous cycle. Additional depletions are performed for an EOC burnup window for the previous cycle (typically

+/-

nominal EOC 25 effective bur.nup).

These full power days CEFPD) about the additional depletions allow the sensitivity of the predicted reload cycle parameters to be examined as a

function of the previous EOC burnup. The majority of design predictions will be based on the nominal previous EOC burnup.

However, the PDQ-INCORE

decks, predictions of assembly average burnups and the HFP, ARO boron letdown curve are calculated based on a

previous EOC burnup that is within +/-

2 EFPD of the actual burnup.

2.5.2 Core Reactivity Parameters and Coefficients The kinetic characteristics of the core are described by the core reactivity parameters and coefficients.

These parameters and coefficients quantify the changes in core reactivity ~ue to varying plant conditions such as changes in the moderator or fuel temperature or core power level. The reactivity coefficients and parameters are calculated on a corewise ~asis and a~e evaluated at a

representative range of core conditions at the beginning,* middle and end of the reload cycle. These conditions include zero power,

PAGE 17 part power and full power operation, with various rodded core configurations, with equilibrium xenon or no xenon. A description of each type of calculation follows.

2.5.2.1 Temperature Coefficients The isothermal temperature coefficient is defined as the change in reactivity per degree change in the moderator, cladi and.fuel temperatures.

Thus, the isothermal temperature coefficient is the sum of the moderator and Doppler temperature coefficients..

Isothermal temperature coefficients are of particular interest at hot zero power CHZP) when the core is uniformly heated and reactivity changes due to temperature changes can be. readily measured and compared to predicted values.

The Doppler temperature coefficient is defined as the change in reactivity per degree change in the fuel and clad temperatures.

The moderator temperature coefficient is defined as the change in reactivity per degree change in the moderator temperature. The moderator defect is the integral of the moderator temperature coefficient over the appropriate temperature range, usually from HZP to HFP.

Temperature coefficients are calculated with a

2-D model. The change in reactivity. is determined due to a

change in the appropriate core temperature parameter(s),

(e.g., the moderator temperature or fuel temperature), with all other conditions in the

PAGE 18 core being maintained at a constant value.

2.5.2.2 Differential Boron Worth The differential boron worth. sometimes referred to as the boron coefficient, is defined as the change in reactivity due to a unit change in boron concentration.

Differential boron worths are calculated with a

i-D model by rioting the change in core average reactivity due to a cha'nge in the corewise boron concentration. all other core parameters being held at a constant value.

2.5.2.3 Delayed Neutron Data Delayed neutron data are used in evaluating the dynamic response of the core.

The delayed neutrons are emitted from precursor fission products a short time after the fission event. The delayed neutron fraction and decay constant for six delayed neutron groups at various core conditions are calculated using a 2-D model, and are found by weighting the delayed neutron fraction

£or each fissionable isotope for each group by the core integrated fission rate of that isotope.

2.5.2.4 Power Coefficients and Defects The total power coefficient is defined as the combined effect on the core reactivity of moderator and fuel temperature changes brought about by core power level changes. The Doppler "only" power coefficient relates to the change in power which produces a change in the fuel and clad temperature. The power defect is the integral

PAGE 19 of the power coefficient over the appropriate power range, usually zero to full power. Power coefficients are calculated using a 2-D mod~l. The total power coefficient is found by noting the change in core average reactivity with core power level. The Doppler "only" power coefficient is calculated by noting the change in core average reactivity due to a change in core power level, but with the moderator temperature maintained at a constant value.

2.5.2.5 Xenon and Samarium Worths Xenon and samarium are fission product poisons with relatively large thermal absorption cross sections.

Their effect on core reactivity requires the calculation of the reactivity worth of xenon and samarium during changes' in core power level under va~ious core conditions, particularly for plant startups, power ramp-up and ramp-down maneuvers and reactor trips. Xenon and samarium worths are determined using information from HULIF and the 2-D model.

2.5.3 Core Reactivity Control

• Relatively rapid reactivity variations in the core are controlled by the full length control rods. The full length control rods are divided into control banks and shutdown banks. The control banks can be used to compensate for reactivity changes associated with changes in operating conditions such as temperature and power level. The shutdown banks are used to provide shutdown reactivity.

Changes in reactivity which occur over relatively long periods of

PAGE 20 time are compensated for by changing. the soluble boron concentration in the coolant.

2.5.3.1 Most Reactive Rod Stuck CMRRS)

The shutdown margin CSDM) is the* amount of negative reactivity by which a

reactor is maintained in a

subcritical state at HZP conditions after a

control rod trip. In caiculating the shutdown margin it is conservative to reduce the total rod worth by the amount of the most reactive stuck rod. Calculation of the MRRS worth is usually performed at both HZP and cold zero power CCZP) core condition~ with a 2-D model. The MRRS worth is found by noting the change in reactivity between a core configuration with all rods inserted CARI).and a core configuration with ARI less the MRRS, all other core conditions remaining constant.

2.5.3.2 Integral and D~fferential Rod Worths Integral rod worths are calculated with a 2-D model using a method similar to that described above _for the MRRS prediction.

Differential rod worths are calculated using a 3-D model. The change in core average reactivity is evaluated as a function of the axial position of the rod or rods in the core to obtain the differential rod worth.

2.5.3.3 Soluble Boton Concentrations Boron in the form of boric* acid is used as.the soluble absorber* in the reactor coolant. At no load, the reactivity change from CZP to

PAGE 21 HZP is controlled by changing the soluble boron concentration. At HFP the boron controls the reactivity changes caused by variations in the concentration of xenon, samarium and other fission product poisons, the depletion of uranium and the buildup of plutonium, and the depletion of burnable poisons. Predictions of the soluble boron concentration.necessary to maintain criticality are performed with a 2-D model.

2.5.3.4 Rod Insertion Limits Rod insertion limits CRIL) are r~quired to maintain an acceptable power distribution during normal operation, and acceptable consequences following a postulated.rod ejection accident, and also insure that the minimum shutdown margin CSDM) assumed in the safety analyses is available.

The rod insertion limits are lines (drawn on a curve showing rod insertion versus power level) which show the d~epest allowed insertion of the control rods at any given power level.

The rod insertion allowance (RIA) is the amount of control bank reactivity which is allowed to be in the core at HFP. The rod insertion limits are primarily a guarantee that the RIA is not exceeded at any power level. Additional amounts of control hank reactivity can be allowed to be in the core at lower power levels if SDM is preserved.

The relationship between the RIA and the RIL is such that RIL lines determined purely from RIA considerations are usually shallow enough that the other considerations (bases for rod insertion

PAGE 22 limits) such as acceptable power distributions and acceptable postulated rod ejection consequences a:r:e satis;fied.

The dete:r:mination of the RIL is made by a 3-D model simulation of the cont:r:ol banks moving into the core with no:r:mal overlap while ascertaining that at least the minimum shutdown ma:r:gin is maintained at all powe:r: levels and insertions f:r:om HFP to HZP. The calculation is pe:r:formed at EOC, and for conse:r:vatism, the model i's depleted in such a way CD Bank partly inserted) that the burnup and xenon distribution fo:r:ce the power to the top of the core.

This guarantees that the calculated RIL lines a:r:e conservative f:r:om a reactivity inse:r:tion standpoint because they predict more reactivity insertion at rod inse:rtions,that are mo:r:e shallow than would normally be seen in the actual core.

When tentative RIL lines have been selected by the method just outlined, they are then checked to see that they satisfy all of the other bases.

If any basis is not satisfied by the tentative inse:r:tion

limits, the insertion limits are :raised until the most limiting basis is satisfied.

They would then become the final rod I

insertion limits.

PAGE 23 SECTION 3.0 -

NUCLEAR DESIGN ASPECTS OF RELOAD SAFETY ANALYSIS

3. 1 Int:roduction This section discusses the derivation of the core physics related key parameters and the relationship of these parameters to reload safety analysis. For each reload cycle, the effects of reload core physics related or plant related changes must be evaluated to determine if the existing safety analysis is valid for the reload.

Mechanisms and procedures used to determine the validity of the current safety analysis are detailed in Sections 3.2. and 3.3.

A conceptual discussion of all accidents of concern for the FSAR and subsequent licensing submittals, and an outline.of procedures used to derive each of the reload nuclear parameters important to the safety analysis is given in Section 3.4.

3.2 Safety Analysis Philosophy The Vepco safety analysis philosophy is: (1) to perform at an early stage in plant design, a bounding conservative safety analysis and (2) to systematically determine whether or not reanalysis is needed when changes occur in the core or plant systems.

Th_is approach is taken to minimize the amount of reanalysis which must be performed as a result 6f plant reload changes.

Nuclear power plants are licensed to operate by the HRC.

To receive and retain an operating license, it must be demonstrated that the public will be safe from any consequence of plant

PAGE 24 operation.

In addition, it is important to show that the plant itself will suffer. at most, limited damage from all but the*.most incredible transients.

Plant safety is demonstrated by accident analysis, which is the study of nuclear reactor behavior under accident conditions.

Accident analyses are usually performed in the initial design.

stages and documented in the FSAR. The Vepco accident analysis is typical in that the complete FSAR analysis was performed by the

• NSSS vendor.

However, Vepco has verified the key Condition I, II, and III FSAR analyses and the s~fety of its plants using its own analysis capability (Reference 7).

Accident analyses must show that the reactor is operated under conditions* that assure complete public protection from hazard in almost all accident cases. The four categories of accidents based on their anticipated frequency of occurance and potential for public harm are described in References 8 and 9.

The-accident analyses consider all aspects of the plant and core including the operating procedures and limits on controllable plant parameters (Technical Specifications) and the engineered safety, shutdown. and containment systems.

There are two stages in the analysis process.

First, steady ~tate nuclear calculations are made for the conditions assumed in the accident analysis.

The nuclear parameters derived from these calculations are called the core physics related key analysis

PAGE 25 pa:z:amete:z:s and se:z:ve as input to the second stage. The second stage is the actual accident analysis, which yields the accident :results as a

function of these key analysis pa:z:amete:z: values. The key analysis pa:z:amete:z:s a:z:e de:z:ived p:z:ima:z:ily f:z:om steady state diffusion theo:z:y calculations. The accident analyses a:z:e t:z:ansient calculations which usually model the co:z:e nuclea:z: kinetics and those pa:z:ts of the plant systems wh~ch have a significant impact on the events u"nde:z: conside:z:ation.

In the FSAR stage, the analyses p:z:oceed by fi:z:st dete:z:mining the key nuclea:z: pa:z:amete:z: values expected to be bounding ove:z: the plant lifetime.

The bounding values fo:z: these key pa:z:amete:z:s may occu:z:

sometime du:z:ing the fi:z:st cycle of ope:z:ation o:z: du:z:ing a subsequent cycle.

The:z:efo:z:e,-

depletion studies a:z:e pe:z:fo:z:med and the key pa:z:amete:z:s a:z:e dete:z:mined fo:z: seve:z:al cycles of ope:z:ation in o:z:de:z:

to obtain a set of key pa:z:amete:z:s which has a high p:z:obability of being bounding ove:z: plant life. These bounding key pa:z:amete:z:s a:z:e called the (initial) cu:z::z:ent limits.

Accident analyses a:z:e pe:z:fo:z:med using these bounding pa:z:amete:z:s.

The FSAR demonst:z:ates by dete:z:mining key nuclea:z: pa:z:amete:z:s and detailing the

z:esults of the accident analyses that the plant is safe. Howeve:z:, an unbounded key analysis pa:z:amete:z: could occu:z: in a

z:eload cycle. Fo:z: this :z:eason, all key analysis pa:z:amete:z:s must be explicitly dete:z:mined fo:z: each reload.

Fo:z:

a typical reload cycle, some depleted fuel is removed from the

PAGE 26 core and replaced by new undepleted

£uel.

The depleted £uel remaining in the core and the new fuel are arranged within the core so.that power peaking criteria are met.

place between cycles oJ: duJ:ing a cycle.

OtheJ: changes may take Examples aJ:e changes in operating temperatuJ:es and pressures, and setpoint changes. These changes may affect the key analysis parameteJ:s. If a key parameter value for a

reload exceeds the cu:1:rent limit, an evaluation ~s peJ:formed* using the reload key paJ:ameter to determine -if a new accident analysis will be requi:1:ed. If an accident reanalysis is peJ:formed, that ke~ analysis parameter then becomes the bounding value and is called the current limit in subsequent cycles.

Therefore, the overall process is as follows:

1)

Determine expected bounding

• k.ey. analysis paJ:ameteJ:s (initial "current limits").

2)

Pe:1:form accident analysis using the bounding key analysis parameters and conservative assumptions.

3)

Determine, for each reload, the value of each key analysis paJ:ameter.

4)

Make a decision on whether to reanalyze accidents based on the effect of the new key analysis parameters.

3.3 Safety Analysis Administratiori The groups responsible for reload core safety analysis at Vepco are

PAGE 27 the Nuclear Design Group and the Safety Analysis Group. These are presently organized as branches of the Nuclear ~uel Engineering CNFE)

Subsection of the Fuel Resources Department CFRD). The roles of these two groups in providing systematic and inclusive safety analysis coverage is outlined in this section.

The first step in the reload safety an~lysis of a core is the preparation of a listing of the physics design calculations to be performed in support of the safety analysis. This list is prepared by the Safety Analysis Group of NFE and forwarded to the Nuclear Design Group of NFE.

The Nuclear Design Group performs the designated calculations (generally.static nuclear calculations) based on this list. The Safety Analysis Group then evaluates and, if necessary, reanalyzes any accidents (using transient methods) as required by the results of the key parameter calculations. A Reload Safety Evaluation CRSE) report is then issued by NFE documenting the results of the safety analysis for the reload cycle~

Before the operation of the cycle, a Nuclear Design Report which documents the nuclear design calculations performed in support of the cycle operation is issued by NFE. This report is used by the Nuclear Fuel Operation CNFO) Group of the*Fuel Resour~es Department in the preparation of operator curves for use by station personnel in the operation of the cycle.

Core physics measurements taken during the cycle startup and operation are compared to the physics design predictions documented

PAGE 28 in the Nuclear Design Report to insure that the plant is being operated within safety limits. Results of the measurements and the comparisons to prediction are published by NFO as a Startup Physics Test Report and a Core Performance Report for each reload cycle.

Figure presents a summary of the documentation and information flow of the safety analysis administration for'a reload cycle.

3.4 Overview* of Abcidents and Key Parameter Derivations The accidents analyzed.for the FSAR and evaluated at each reload cycle are listed in Table 1. The key parameters to be determined at each reload cycle are listed in Table 2. There are three types of key parameters.

Two types of parameters are generated by th~

Nuclear Design Group.* The non-spedific parameters Cdesi~nated "NS" in Table

2) are generated by evalua~ing core characteristics at conservative conditions, and the specific parameters (designated "S" in Table 2) are generated by statically simulating an accident.

The third type of key parameter is not generated by the Nuclear Design Group (designated "MMD" in Table 2).

The methods which will be employed by Vepco to determine these key parameters will be consistent with the methods used for past cycles of the Surry and North Anna units by the fuel vendor (Westinghouse). These methods have been documented in Reference 1.

PAGE 29 3.4.1 Hon-Speci£ic Key Parameters Non-speci£ic key parameters are key parameters derived by evaluating core characteristics at conservative conditions. The conservative conditions assure that the limiting values 0£ the parameter are determined. Each non-specific key parameter generally serves as sa£ety analysis input to several ac~idents including the accidents that also. require speci£ic kei parameters, sudh as rod ejection.

3.4.1.1 Trip Reactivity Shape The trip reactivity shape is a measure of th~ amount 0£ negati~e reactivity entering the core Cin the form of control rods).after a t~ip as a function of trip bank insertion. For conservatism in the accident analysis a

minimum amount (47. delta-Keff is a typical amount) of trip worth is assumed to be available.

This section will. discuss the derivation of the reactivity insertion versus rod insertion curve, also called the trip reactivity shape.

The actual parameter of interest to the accident analysis is reactivity insertion versus time.

To determine this parameter, rod insertion versus time information is combined with the trip reactivity shape. The conservatism of the rod insertion versus time information used for the analysis must be veri£ied by rod drop measurements taken during the startup tests for each cycle.

The trip reactivity shape is generated with a 3-D model.

The model

PAGE 30 is depleted with all rods out at hot full power, equilibrium xenon to the end of cycle CEOC). The calculation is performed at the depletion st~p Ctime in life) which has the most bottom peaked power (usually EOdl.

The D

bank is inserted to push the axial offset to its negative Technical Specifications limit. The trip bank of rods is inserted in several discrete *steps and the Keff at each step noted. Thus. trip reactivity versus rod insertion Ctrip reactivity shape) is deter.mined.

A conservative trip reactivity shape curve is one which shows less negative reactivity insertion for the major part of the rod insertion (i.e., except for the endpoints which are always equal),

than would be expected for an actual best estimate trip calculation based on operational power shape data~

The FSAR safety analysis *is based on a

conservative curve generated using the methodology described above.

A trip reactivity shape is generated for each reload. If the reload shap~

shows the *same reactivity insertion as or more reactivity insertion than the current limit shape Cwhich could* be the FSAR shape) for the rod insertion, it is bounded by the the current limit shape.

If insertion than the reload shape shows less negative reactivity the* current limit shape for any part of the insertion, the reload shape is unbounded and the effect must be evaluated.* If the reload shape has only slight deviations over some parts of the current limit shape,*a simple quantitative evaluation may be made which conservatively estimates the ~agnitude of *he

PAGE 31 effect and explains why reanalyses (of transients affected by trip reactivity shape) do not have to be made.

The current limit reactivity shape is not changed.

But, if the reload shape is clearly more conservative than the current limit

shape, the transients affected by trip reactivity shape are reanalyzed using the reload shape which then becomes the new current limit.

3.4.1.2 Reactivity Coefficients The transient response *of the.reactor system is dependent on reactivity feedbacks, in particular the moderator temperature coefficient and the Doppler power coefficient.

The reactivity coefficients and their generation for the standard reload design were discussed in section 2.0.

For each core there is a

range of possible values for the coefficients to assume.

The coefficients used as key analysis parameters are derived using the appropriate techniques and at the appropriate conditions to obtain the limiting Cthe maximums and minimums which are.physically possible) values.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient

values, whereas in the analysis of other

events, a

small reactivity coefficient value would be conservative. Some accidents and their analyses are not.affected by reactivity feedback effects.

The justification for the use of conservatively large versus small reactivity coefficient values is treated on an event by event basis in the safety analys~s.

PAGE 32 3.4.1.3 Neutron Data The delayed neutrons are emitted from fission products.. They are normally separated into six

groups, each characteriz~d by an in~ividual decay constant and yield fraction. The delayed neutron fractions are calculated with a 2-D model using the appropriate cross-secti~n data. The total ~elaped neutron fraction Ctotal Beta) is the sum of the delayed neutron fractions for the six groups.

The key analysis parameter is the Beta-effective, which is the product 0£ the total Beta and the importance factor. The importance factor reflects the relative effect~veness of the delayed neutrons for causing. fission. For some transients, it is conservative to use the minimum expected value 0£ Beta-effective; for others, the maximum expected value is more conservative. The justification £or the use of conservatively large versus small Beta-effective values is* treated on an event by event basis in the safety analysis.

Since the maximum Beta-effective occurs at the beginning 0£ the reload

cycle, and the minimum Beta-effective occurs at the end,.

Beta-effective is calculated at the beginning and the end of each reload.cycle to obtain the bounding values for the cycle.

The prompt neutron lifetime is the time from neutron generation to absorption.

It is a

core average parameter calculated with the cross section generating code. The key analysis parameter used for transients is the maximum prompt neutron lifetime. The maximum

PAGE 33 occu:r:s at the end of a :r:eload cycle.

Nume:r:ical unce:r:tainty facto:r:s. app:r:op:r:iate.fo:r: the codes used, a:r:e applied to the Beta-effective and p:r:ompt neut:r:on lifetime to*

conse:r:vatively app:r:op:r:iate.

inc:r:ease o:r:

dec:r:ease those pa:r:amete:r:s.

as 3.4.1.4 Powe:r: Density, Peakirig Facto:r:s The

• the:r:mal ma:r:gins of the

r:eacto:r: system a:r:e dependent on the The powe:r:

dist:r:ibution may be initial powe:r:

dist:r:ibution.

cha:r:acte:r:ized by the

r:adial peaking facto:r:, FdH, and the total peaking facto:r:,

facto:r:

limits.

Fq. The Technical Specifications give the peaking The nuclea:r:

design *of the co:r:e, by judicious placement of new and depleted fuel and by the use of burnable

poisons, const:r:ains the peaking facto:r:s to be well within the Technical Specification limits.

Fu:r:the:r:mo:r:e, ope:r:ational inst:r:uctions, such as the axial powe:r:

dist:r:ibution cont:r:ol procedures and the rod inse:r:tion limits also p:r:otect the core f:r:om power dist:r:ibutions more adverse than those allowed by the Technical Specifications.

For transients which may be DNB limited, the radial peaking factor is of impo:r:tance.

The radial peak~ng factor inc:r:eases with dec:r:easing power level and with :r:od inse:r:tion. Fo:r:

t:r:ansi~nts ~hich may be ove:r:powe:r:

limited, the total peaking facto:r:

is of impo:r:tance.*. The allowable value of Fq inc:r:eases with dec:r:easing

PAGE 34*

power level such that the full power hot spot heat flux is not exceeded,* i.e., Fq times Power= design hot spot heat flux.

3.4.2 Specific Key Parameters Specific key parameters are generated by statically simulating an accident.

The parameters are Cor are directly related to) rod*

worths, reactivity insertion rates, or peaking factors.

Th~- stitic conditions selected can be shown to be the most conservative

'conditions for the accident.

For

example, in the rod ejection accident the post~ejected rod condition Crod fully withdrawn) can be shown to be. more conservative Ci.e.,

gives higher peaking factors* and rod worths) than the pre-ejected rod condition or any point between the "pre" and "post" ejected conditions. This is shown by performing static model calculations before the rod ejection and at some bf the intermediate configurations, and noting that the peaking factors and rod worths from these calculations are smaller than the post ejection configuration simulation. For all of the specific key parameter derivations, similar ~rguments can be made for the conservatism of the selected static conditions.

3.4.2.1 Uncontrolled Rod Bank Withdrawal The rod withdrawal accident occurs when the two control rod banks having the maximum combined worth are withdrawn from the core due to some control system malfunction.*

A reactivity insertion results.

The accident can occur at HZP or HFP. A 3-D model is used to perform the calculation.

For the rod withdraw~l from subcritical CHZPl,the parameter of interest is the maximum differential worth of two sequential control banks CD and C, C and B etc.) moving together at HZP with 1007.

overlap.

The parameter is usually recorded in pcm/inch Cwhere, pcm= 100000. times delta-Keff divided by Keff).

This parameter is derived by calculating the maximum differential rod worth for two sequential highest worth.control banks.

The following assumptions are also made:

(1) The shutdown banks are not present in the core.

C2) The axial xenon distribution causing the maximum peak differential w~rth is used.

The peak differential worth obtained in pcm/step is multiplied by the steps to inches conversion factor to obt~in pcm/inch.

The rod withdrawal at power accident differs from the rod withdrawal from subcritical, in that it occurs at power and assumes that the maximum worth sequential banks ~re ~oving with the normal overlap.

It is similar in that a xenon shape which maximizes the peak differential rod worth is used. The para~eter of interest is the maximum differential rod worth.

)

The conservatisms associated with these calculations are:

1) The use of a xenon shape which maximizes the peak differen"tial worth.

2) The performance of the calculations at the cycle burnups which are expected to maximize the peak differential worth.

3) The application to the peak differential worth of a numerical uncertainty factor which is appropriate to the model being used.

3.4.2.2 Rod Misalignment PAGE 36 Rod misalignment accidents result from the malfunctioning of the control rod positioning mechanisms.

Rod misalignment accidents include:

1 )

static misalignment of a control bank,

2) dropped

,/

RCCA (Rod Cluster Control Assembly, i.e., a control rod), and

3) dropped bank.

The important parameter for rod misalignment accidents is the minimum DNBR.

The DNBR in the case of a rod misalignment accident is primarily

a. function of the resultant radial peaking factors CFdH).

These peaking factors are determined using 2-D and 3-D models.

The maximum FdH peaking factors calculated for each of these types of rod misalignments are given to the Safety Analysis group for evaluation.

In the static misalignment accident, an RCCA is misaligned by being a

number of steps above or belo~ the rest of its bank. To simulate this

accident, a

full core 3-D calculation with D Bank in to its respective insertion limits at several power levels is made..

Sequential banks are assumed to be insert~d with the appropriate overlap.

A series of calculations is made with the worst Cthe one*

that causes the highest FdH peaking factor)

D Bank rod fulli

---~----- ---- ----- --

PAGE

. 37 withdrawn over the entire power range.

The dropped RCCA aecident is simulated with a full core 3-D model calculation.

The dropped bank accident is simulated with a quarter core. 3-D model. calculation.

The key analysis parameters £or rod misalignment accidents are the

r:adial

£actors.

For conservatism.

all of the rod misalignment cases are performed at the cycle btirnup which maximizes the radial peaking

£actors.

This is generally at the beginning of the cycle.

but may have to be determined ~rom the depletion. Typically, a search is made to determine worst case rods for each type 0£ rod misalignment. The appropriate 2-D discrete mesh calculations are* made to correct the 3-D coarse mesh results.

Uncertainty factors appropriate to the models used are applied.

3.4.2.3 Rod Ejection The

r:od ejection accident results from the postulated mechanical failure 0£ a control rod mechanism pressure housing such that the coolant system pressure ejects the control rod and drive shaft to the fully withdrawn position.

This zesults in r~pid reactivity insertion and high peaking factors.

Rod ejections that take place at the beginning of the cycle at hot zero power and hot full power.

and at the end of cycle *at hot ze:r:o power and hot full power are assumed to bound all other burnups and power levels.

The key parameters a~e ejected :r:od worth and total peaking factor

PAGE 38 CFq).

From an information flow point of view the key parameters are generated by the Nuclear Design Group using steady state neutron diffusion theory or nodal methods and transmitted to the Safety. Analysis GJ:<?UP to be analyzed using kinetics methods. The rod ejection key analysis parametez:s for the bounding powez leveis and burnups must be derived for each initial and :i::eload co:re.

The following scenario desc:ribes the :i::od ejection.

With. the core critical Cat either HZP or HFP) and the control rods inse:rted to the appropriate inse:i::tion "wo:i::st" ejected rod fails.

limit, the pressure housing of the The rod is ejected completely from the core

r;esulting in a large positive reactivity insertion and a high Fq in the neighho:i::hood of the ejected rod.

The "wo:rst" ejected rod is that rod that gives the highest worth (or positive :reactivity addition) and the highest Fq when ejected f:rom* the co:r:e.

The rod. ejection accident produces ~ brief power excursion which is limited by D~pple:r:

feedback.

The rod ejec~ion accident is a Condition IV event that has a potential for fuel damage and some limited :i::adioactivity :r;eleases.

The detailed procedures for producing the rod ejection key analysis parameters a:re analytical simulations of the above scenario.

The 3-D and 2-D computer models are used.

The

r:od conservative assumption".

ejection parameter derivation is performed in a

manner.

One conservatism is the "adiabatic Although the

r:od ejection accident is limited by

PAGE 39 Doppler feedback. the key analysis parameters are derived with all feedback frozen.

The adiabatic assumption is that any fuel damage is done in some small time increment after the rod ejection and before feedback can reduce the peaking factor.

Deriving the rod ejection parameters with feedback will result in a smaller Fq and ejected rod worth; therefore, deriving them without feedback is conservative.

Another conservatism is that the 3-D model is depleted in such a way as to insure that, at EOC. the top part of the core has less burnup than would be expected from a best estimate calculation based on operational history.

The depletion is performed with D Bank partially inserted.

Less burnup at the top of the the core insures higher worths and peaking factors, for both HZP and HFP. as compared to the best estimate axial burnup shape.

In

addition, numerical uncertainty factors appro~riate to the models used are applied to the calculated ejected rod worth and highest Fq.

3.4.2.4 Steamline Break The steamline break Cor steambreak) accident is an inadvertant depressurization of the main steam system or a rupture of a main

/

steamline.

The first type of event is referred to as a "credible break" and is a Condition II event.

The second type is called a "hypothetical break" and is a Condition IV event.

PAGE 4-0 The credible steambreak accident can occur when any one steam dump,

.relief, or safety valve fails to close. The hypothetical steambreak is a rupture or break in a main steamline.

For the credible break the safety.analysis must show that no DNB and subsequent clad damage occurs.

may

occur, but And for the hypothetical break, DNB or clad damage the safety analysis must show that the 10CFR100 limits are not exceeded.

The starting point for,both analyses is a reference safety analysis using a

system transient code with kinetics capability (Reference 7).

The input parameters for the system transient code include nuclear parameters which are considered conservative for the reload core being analyzed.

This system transient analysis code predicts, for various shutdown margins a~d secondary break sizis, the system trends as a

function of time. The nature of the analysis is such that although the plant

volumes, temperatures and flows are reasonably detailed, more specific core DNB determinations must be made using more detailed methods.

First, a

detailed nuclear calculation (3-D model) is performed at an end of

cycle, hot zero power condition with all rods fully

inserted, except the highest reactivity worth stuck rod. These conditions are conservative assumptions foi steambreak (see References 8

and 9). A non-uniform inlet temperature distribution derived from the system transient code loop temperature data is input to the 3-D model.

PAGE 41 The point in the system transient analysis code which is appropriate for the minimum DNBR is analyzed.

The temperature and pressure information from the system transient calculation and peaking factor info~mation from the detailed nuclear calculation are input to a thermal/hydraulic analysis code Csee Reference 10) to accurately determine the minimum DNBR for the steambreak transient.

3.4.2.5 LOCA Peaking Factor Evaluation A loss of coolant accident (LOCA) is defined as a rupture of the Reactor Coolant System piping or of any line connected to the system.

The LOCA evaluation methodology which will be employed by Vepco is consistent with the methodology used for past cycles of the Surry and North Anna Units by the fuel vendor (Westinghouse). A description of this methodology is found in References 1 and 11.

The two (2) primary LOCA key analysis parameters are the "limiting Fq times relative power versus core height envelope" *and the "maximum Fq times relative power versus core height points".

The first key parameter is a Technical Specifications limit which is based on the total peaking

~actor assumed in the currently

.applicable LOCA analysis.

As discussed in Reference 1,

LOCA analyses assume that the reactor is operating in such a manner that the peak linear heat generation rate in the core is maximized. The most limiting power shape is also assumed. The limiting Fq times relative power versus core height envelope is conservative with

PAGE 42*

respect to the limiting cosine and top peaked power shapes assumed for large and small break LOCA analyses respectively.

The second key parameter is derived by the Nuclear Design Group, and involves determining what the highest cpre Fq will be at each axial point (along the core height) as the core operates throughout the reload cycle.

The reload cycle depletion is simulated using 3-D modeling as described in Reference 11.

Base load and load follow depletion schemes are used in which the control rods are moved and the power level varied in ways that are typical of the way that the plant would be or could be operated.

Beginning, middle, and end of cycle conditions are included in the calculations.

Different histories of operation are assumed prior to calculating the effects of load follow transients on the axial power distribution.

These different histories assumed either base loaded operation or extensive load following.

The following Technical Specification requirements are observed during the load

• follow maneuvers:

C1) Control rods in a single bank move together with no individual rod insertion differing.by more than a pre-specified number of.steps from the bank demand position.

(2) The full length control bank insertion limits are not violated.

(3) The recomrnenaed axial power.distribution control procedures,

PAGE which are given in terms of flux difference (power at top of core minus power at bottom of core) control are observed.

43 The recommended axial power distribution control procedures require the control of the core axial o!fset (flux difference/fractional power) at all power levels within a permissible operating band about a target value that is related to the equilibrium full power value.

Controlling the. axial offset in this manner minimizes xenon transient effects on the axial power distribution.

To insure that the analysis is comprehensive, the load follow maneuvers are simulated using a number of power demand schedules along with the limiting (bounding) permitted variations in the control strategy (i.e.,

control to the center and control to the edge of the permitted band of axial offsets).

To insure that every operational mode is covered, a complete set of shallow, medium, and steep power demand schedules are used with the center of the control band strategy and with the edge of the control band strategy~ in beginning, middle, and end of life load follow maneuvers.

The end of life maneuvers follow both base load and load follow depletion h+/-stories.

For all of the depletions performed, and at each axial position, the magnitude of every *Fq times relative power is compared. The highest Fq times relative power at each axial position is thereby determined for all of the depletions performed.

Numerical uncertainty factors appropriate for the models used are applied to the limiting Fq points for

PAGE 44 conservatism.

If all of the combinations discussed in the previous paragraph are performed the result is 18 unique depletion cases.

However, calculational studies already performed using this methodology. have shown that £or the great majority 0£ reload cycles a 3 case subset of the 18 unique depletion cases p~oduces the limiting Fq points.

In the

£ew* instances in which this 3 case subset did not produce the limi.ting points, the points that were limiting were never more than a certain percentage higher than those £rom the 3 case subset Csee Reference 1, Section 3.3.3.1 in particular).

Therefore, the methodology will be to perform the 3 case subset and multiply the Fq points obtained by a conservative uncertainty factor based on that limiting percentage.

If the points £all below the Fq envelope, this phase 0£ the analysis is complete.

I£ some points fall on or above the Fq envelope, the remaining *15 cases will be performed and the limiting Fq points from all 18 cases Cthe extra conservatism is now removed £rom the initial 3 case subset, and not applied to the remaining 15) will be tabulated and compared to the envelope.

If the 18 cases are bounded by the envelope, this phase of the analysis is complete.

The location of all limiting Fq points below the Fq envelope means that for the reload cycle being analyzed all normal base load and load follow operations can be performed without producing power distributions more limiting than those assumed in the current LOCA

PAGE 45 analysis.

If Fq points still remain on or above the Fq envelope, plant operational adjustments have to be made, the nature o:f which depend on the *magnitude of the violations.

A typical adjustment would be power distribution surveillance above certain power levels to insure that actual power distributions experienced in the plant are less than the LOCA envelope.

To summarize, the procedure for insuring LOCA safety analysis coverage for the reload cycle consists of (1) determining the current limiting (maximum)

Fq times relative power versus core height curve, and (2) determini~g the reload c6r~ ~aximum Fq times relative power values for all normal operational modes, and C3) specifying the appropriate Technical Specifications changes i:f there are envelope violations.

3.4.2.6* Boron Dilution Reactivity can be added to the reactor core by feeding p~imary grade Cunborated) water into the Reactor Coolant System (RCS) through the Chemical and Volume Control System CCVCS).

This addition of reactivitf by b~ron dilution is intended to

.be controlled by the operator.

The eves is designed to limit the rate of dilution even under various postulated failure modes.

Alarms and instrumentation provide the operator sufficient tim~ to correct an uncontrolled dilution if it occurs.

Boron dilution accidents are Condition II events and are ~valuated for all phases of plant

PAGE 46 opex:ation; i.e., box:on dilution dux:ing x:efueling and startup, cold and hot shutdown, and at powex: conditions.

Fox:

each x:eload, the core boron concentrations and the minimum shutdown margins to be.maintained for the different phases of plant operation are specified in the plant Technical Specifications and the Cycle Design Report.

But, it must he determined if the minimum shutdown margins actually exist at the core conditions and boron concentrations specified.

For that determination.

2-D model calculations at the indicated co:r::e conditions and boron conce*ntrations are per:Eormed.

In addition.

the change in boron concentration to make the cox:e cx:itical from *a minimum shutdown margin initial condition must be detex:mined for each phase of plant opex:ation.

also used :Eor these determinations.

3.4.2.7 Overpower Evaluations The 2-D model is An ovex:power condition occurs in a reactor when the 100~ power level is inadvertently exceeded due either to an uncontrolled boron dilution or an uncontrolled rod withdrawal.

The *overpower evaluation key analysis parameter for both o~ these accidents is the overpower peak kw/ft. The methodology used to dex:ive the key

• analysis parameter is described in Reference 11 (Section 6-2 in pax:ticular fox:

rod withdx:awal and Section 6-3 in pax:ticular fox:

boron dilution).

PAGE

47.

3.4.3 Hon-Huclear Design Key Parameters Hon-nuclear design key parameters are safety analysis inputs from non-nuclear areas such as fuel performance and core thermal-hydraulics.

These inputs are derived at the FSAR stage and reviewed for each reload cycle to ensure that the safety analysis assumptions continue to bound the parameter values for the current plant configuration.

• The derivation and use of these parameters is discussed in Reference 1 (Section 4.3 in partic~lar).

PAGE 48 SECTION 4.0 -

SUMMARY

AND CONCLUSIONS Designing a

core that meets all safety criteria is sometimes an iterative process involving interaction and trade-offs between the Nuclear Design and : the Safety Analysis Groups. For the typical

reload, the derived key analysis parameters will be bounded by the current limit key analysis parameters.

If the current limits are exceeded, that event may be handled in a number of ways. If the parameter only slighty exceeds its limits, or the affected transients are relatively insensitive to that parameter, a

~onservatively simple quantitative evaluation may be made which estimates the magnitude 0£ the effect and explains why an actual reanalysis does not have to be made. The current limit is not changed.

If the deviation is large and/or expected to have a

more significant or not easily quantifiable effect on the accident, the accident is reanalyzed following standard procedures (such as those used in the FSAR analyses or other HRC approved methods). After the reanalysis is performed, and if the results of the reanalysis meet all applicable licensing criteria, the parameter which exceeded its limit becomes the new.current limit and the reanalysis becomes part of the reference analysis.

Sometimes reanalysis with out of bounds parameters will produce unsatisfactory results and other steps may have to be taken.

\\

PAGE 49*

Technical Specifications changes or core loading pattern changes are typical adjustments that may be required. Raising the rod insertion limits.in order to reduce the ejected rod Fq and worth, is an example of such a Technical Specifications change. 0£ course, if any Technical Specifications changes are necessary to keep key p~rameters bounded, these changes must be approved by the MRC before they can be used in the plant.

Loadiriif=~attern adjustments may be required to bring some key parameters within the current limits or reduce the size 0£ the deviation.

Interaction between the Nuclear Design and Safety Analysis Groups allows the development for each reload cycle of a safety evaluation strategy which best suits that particular cycle.

PAGE 50 SECTION

5.0 REFERENCES

1.

J. A. Fici, et al., "Westinghouse Reload S~fety Evaluation",

WCAP-9272, Maxch, 1978.

2.

W. D. Leggett, L. D.

Eisenhaxt~ "The INCORE Code",

WCAP-7146, Decembex, 1967.

3.

W. A. Wittkop£, et al., HULIF -

"Heutxon Spectxum Genexatox, Few Gxoup Constant Calculatox, and Fuel Depletion Code",

BAW-10115, June, 1976.

4.

M. L. *smith, "The PDQ07 Discxete Model", VEP-FRD-19, July, 1976.

5.

J. R. Rodes, "The PDQ07 One Zone Model", VEP-FRD-20,

.Januaxy, 1977.

6.

W. C. Beck, "The Vepco Flame Model", VEP-FRD-24, Octobex, 1978.

7.

H. A. Smith, "Vepco Reactox System Txansient Analysis using the RETRAN Computex Code", VEP-FRD-41, Maxch, 1981.

8.

Hoxth Anna Power Station Units 1 and 2*FsAa, Paxt B, Volume VIII, Cha~tex 15 (Accident Analysis).

9.

Suxxy Powex Station Units 1 and 2 FSAR, Paxt B, Volume 4, Chaptex 14 (Accident Analysis).

10. F. W. Sliz, "Vepco Reactox Coxe Thexmal-Hydxaulic Analysis using the COBRA IIIC/MIT Computex Code", VEP-FRD-33, August, 1979.

11. T. Moxita, D. M. Lucoff, et al., "Topical Repoxt Powex Distxibution Control and Load Following Procedures",

WCAP-8385, September, 1974.

PAGE 51 FIGURE 1 SAFETY ANALYSIS ADMINISTRATION FOR A RELOAD CYCLE I

Safety Analysis Group

, I v

Key Par*ameters List I

I v I Nuclear Design Group Nuclear Design Report I

I ------------------------

v Calculated Key Parameter Values I

I

• v

---

~~----------

I Safety Analysis Group I -------------------------

v Reload Safety Evaluation I v Nuclear Fuel I Operation ~roup I v

Startup Physics Test Report v

Core Performance Report

CONDITION II EVENTS TABLE 1 EVALUATED ACCIDENTS a)

Uncontrolled Rod Cluster Control Assembly Bank Withdrawal From A Subcritical Condition b)

Uncontrolled Rotl Clus~er Control Assembly Bank Withdrawal At Power c)

Rod Cluster Control Assembly Misalignment d)

Uncontrolled Boron Dilution e)

Partial Loss 0£ Forced Reactor Coolant Flow

£)

Startup 0£ An Inactive Reactor Coolant Loop g)

Loss 0£ External Electrical Load And/Or Turbine Trip h)

Loss 0£ Normal Feedwater i)

Loss 0£ All 0££-Site Power To* The Station Auxiliaries (Station Blackout) j)

Excessive Heat Removal Due To Feedwater System Malfunctions PAGE 52

TABLE 1 (CONT.)

k)

Excessive Load Increase Incident l)

Accidental Depressufaization 0£ The Reactor Coolant System m)

Accidental Depressurization 0£ Main Steam System CONDITION III EVENTS a)

Complete Loss Of Forced Reactor Coolant Flow b)

Single Rod Cluster Control Assembly Withdrawal At Full Power CONDITION IV EVENTS a)

Rupture Of A Steam Pipe b)

Rupture 0£ A Feedline c)

Single Reactor Coolant Pump Locked Rotor d)

Rupture 0£ A Control Rod Drive Mechanism Housing (Rod Cluster Control Assembly Ejection) e)

Loss Of Coolant Accident PAGE 53

TABLE 2 KEY ANALYSIS PARAMETERS

1)

Core Thermal Limits CNND)

2)

Moderator Temperature Coefficient CNS)

3)

Doppler Temperature Coefficient CNS)

4)

Doppler Power Coefficient CNS)

5)

Delayed Neutron Fraction CNS)

6)

Prompt Neutron Lifetime CNS)

7)

Boron Worth CNS)

8)

Control Bank Differential Worth CNS)

9)

Dropped Rod Worth CS)

10)

Ejected Rod Worth CS)

11)

Shutdown Margin CNS)

PAGE

54.

12)

Initial B~ron Concentration for Required Shutdown Margin CNS)

13)

Reactiyity Insertion Rate CS)

14)

Trip Reactivity Shape CNS)

15)

Power Peaking Factor CS)

16)

Limiting Total Peaking Factor times Power Vs. Core Height CNND)

17)

Maximum (from Depletion) Total Peaking Factor times Power Vs. Core Height (S)

18)

Radial Peaking Factor CS)

19)

Ejected Rod Hot Channel Factor CS)

20)

Initial Fuel Temperature CNND)

21)

Initial Hot Spot Fuel Temperature CNND)

22)

Fuel Power Census CNS)

23)

Densification Power Spike CNND)

24)

Axial Fuel Rod Shrinkage CNND)

25)

Fuel Rod Internal Gas Pressure CNND)

26)

Fuel Stored Energy CNND)

27)

Decay Heat CNND)

28)

Overpower Peak KW/FT CS)

NND: Hon-Nuclear Design NS:

Non-Specific S:

Specific

TABLE 2 KEY ANALYSIS PARAMETERS

1)

Core Thermal Limits CNND)

2)

Moderator Temperature Coefficient CNS)

3)

Doppler Temperature Coefficient CNS)

4)

Doppler Power Coefficient CNS)

5)

Delayed Neutron Fraction CNS)

6)

Prompt Neutron Lifetime CNS)

7)

Boron Worth CNS)

8)

Control Bank Differential Worth CNS)

9)

Dropped Rod Worth CS)

10)

Ejected Rod Worth (S)

11)

Shutdown Margin CNS)

PAGE

54.

12)

Initial B~ron Concentration for Required Shutdown Margin CNS)

13)

Reactiyity Insertion Rate CS)

14)

Trip Reactivity Shape CNS)

15)

Power Peaking Factor. CS)

16)

Limiting Total Peaking Factor times Power Vs. Core Height CNNDl

17)

Maximum (from Depletion) Total Peaking Factor times Power Vs. Core Height CS)

18)

Radial Peaking Factor CS)

19)

Ejected Rod Hot Channel Factor CS)

20)

Initial Fuel Temperature CNND)

21)

Initial Hot Spot Fuel Temperature CNND)

22)

Fuel Power Census CNS)

23)

Densification Power Spike CNHD)

24)

Axial Fuel Rod Shrinkage CNND)

25)

Fuel Rod Internal Gas Pressure CNND)

26)

Fuel stored Energy CNND)

27)

Decay Heat CNND)

28)

Overpower Peak KW/FT CS)

NND: Non-Nuclear D*esign NS:

Non-Specific S:

Specific