ML18247A253
| ML18247A253 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 06/18/2018 |
| From: | Dominion Energy Nuclear Connecticut |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML18199A125 | List:
|
| References | |
| 18-225 | |
| Download: ML18247A253 (12) | |
Text
Millstone Power Station Unit 3 Safety Analysis Report Chapter 15: Accident Analyses
MPS-3 FSAR 06/28/18 15.0-1 Rev. 31 CHAPTER 15 - ACCIDENT ANALYSES
15.0 INTRODUCTION
This chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 of Regulatory Guide 1.70, Revision 3, as they apply to Millstone 3.
Certain items in the guide warrant comment, as follows:
Items 1.3 and 2.1 - There are no pressure regulators in the nuclear steam supply system (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.
Item 6.2 - No instrument lines from the reactor coolant system boundary in the NSSS PWR design penetrate the containment. (For the definition of the reactor coolant system boundary, refer to ANSI-N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, Section 5, 1973.)
Items 7.1 (radioactive gas waste system leak or failure), 7.2 (radioactive liquid waste system leak or failure) and 7.3 (postulated radioactive releases due to liquid tank failures) from Table 15-1 of Regulatory Guide 1.70 have been transferred to Chapter 11.
15.0.1 CLASSIFICATION OF PLANT CONDITIONS Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:
1.
Condition I: Normal Operation and Operational Transients 2.
Condition II: Faults of Moderate Frequency 3.
Condition III: Infrequent Faults 4.
Condition IV: Limiting Faults The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public, and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur.
Where applicable, reactor trip system and engineered safeguards functioning is assumed to the extent allowed by considerations such as the single failure criterion, in fulfilling this principle.
Thereby, only Seismic Category I, Class IE and IEEE qualified equipment, instrumentation, and components, are used in the ultimate mitigation of the consequences of faulted conditions (Condition II, III, and IV events).
MPS-3 FSAR 06/28/18 15.1-1 Rev. 31 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated which could result in an increase in heat removal from the reactor coolant system (RCS) by the secondary system. Detailed analyses are presented for several such events which have been identified as limiting cases.
Discussions of the following RCS cooldown events are presented in this section.
1.
Feedwater system malfunctions that result in a decrease in feedwater temperature.
2.
Feedwater system malfunctions that result in an increase in feedwater flow.
3.
Excessive increase in secondary steam flow.
4.
Inadvertent opening of a steam generator relief or safety valve.
5.
Steam system piping failure.
The above are considered to be American Nuclear Society (ANS) Condition II events, with the exception of steam system piping failures, which are considered to be ANS Condition III (minor) and Condition IV (major) events. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.
15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower/overtemperature protection (neutron overpower, overtemperature and overpower T trips) prevents any power increase which could lead to a departure from nucleate boiling ratio (DNBR) less than the limit.
A reduction in feedwater temperature may be caused by the accidental opening of a feedwater bypass valve which diverts flow around a portion of the feedwater heaters and trip of the heater drain pumps as well as loss of extraction steam to the high pressure feedwater heater. For this event, there is a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling creates a greater load demand on the RCS.
With the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.
MPS-3 FSAR 06/28/18 15.2-1 Rev. 31 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the reactor coolant system (RCS). Detailed analyses are presented in this section for several such events which have been identified as more limiting than the others.
Discussions of the following RCS coolant heatup events are presented in Section 15.2.
1.
Steam pressure regulator malfunction or failure that results in decreasing steam flow.
2.
Loss of external electrical load.
3.
4.
Inadvertent closure of main steam isolation valves.
5.
Loss of condenser vacuum and other events resulting in turbine trip.
6.
Loss of nonemergency AC power to the station auxiliaries.
7.
Loss of normal feedwater flow.
8.
Feedwater system pipe break.
The above items are considered to be American Nuclear Society (ANS) Condition II events, with the exception of a feedwater system pipe break, which is considered to be an ANS Condition IV event. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.
15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW There are no steam pressure regulators in Millstone 3 whose failure or malfunction could cause a steam flow transient.
15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite alternating current (AC) power remains available to operate plant components such as the reactor coolant pumps; as a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves occurs. This causes a sudden reduction in
MPS-3 FSAR 06/28/18 15.3-1 Rev. 31 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE A number of faults are postulated which could result in a decrease in reactor coolant system flow rate. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.
Discussions of the following flow decrease events are presented in Section 15.3.
1.
Partial loss of forced reactor coolant flow.
2.
Complete loss of forced reactor coolant flow.
3.
Reactor coolant pump shaft seizure (locked rotor).
4.
Reactor coolant pump shaft break.
Item 1 above is considered to be an ANS Condition II event, Item 2 an ANS Condition III event, and Items 3 and 4 ANS Condition IV events. Section 15.0.1 contains a discussion of ANS classifications.
15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.3.1.1 Identification of Causes and Accident Description A partial loss-of-coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.
Normal power for the pumps is supplied through individual buses connected to the generator.
When a turbine or generator trip occurs, the buses continue to receive power from an offsite source and the pumps continue to supply coolant flow to the core.
This event is classified as an ANS Condition II incident (an incident of moderate frequency) as defined in Section 15.0.1.
The necessary protection against a partial loss-of-coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8, low flow in any loop actuates a reactor trip.
Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops actuates a reactor trip.
MPS-3 FSAR 06/28/18 15.4-1 Rev. 31 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivity and power distribution anomalies. Reactivity changes could be caused by control rod motion or ejection, boron concentration changes, or addition of cold water to the reactor coolant system (RCS). Power distribution changes could be caused by control rod motion, misalignment, or ejection, or by static means such as fuel assembly mislocation. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.
Discussions of the following incidents are presented in Section 15.4.
1.
Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.
2.
Uncontrolled rod cluster control assembly bank withdrawal at power 3.
Rod cluster control assembly misalignment.
4.
Startup of an inactive reactor coolant pump at an incorrect temperature.
5.
A malfunction or failure of the flow controller in a BWR loop that results in an increased reactor coolant flow rate (Not applicable to Millstone 3).
6.
Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant.
7.
Inadvertent loading and operation of a fuel assembly in an improper position.
8.
Spectrum of rod cluster control assembly ejection accidents.
Items 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II events, Item 7 is an ANS Condition III event, and Item 8 is an ANS Condition IV event. Item 3 entails both Condition II and III events. Section 15.0.1 contains a discussion of ANS classifications.
15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power excursion. Such a transient could be caused by a malfunction of the reactor control or rod control systems. This could occur with the reactor subcritical at hot zero power or at power. The at power case is discussed in Section 15.4.2.
MPS-3 FSAR 06/28/18 15.5-1 Rev. 31 15.5 INCREASE IN REACTOR COOLANT INVENTORY Discussion and analysis of the following events are presented in this section.
1.
Inadvertent operation of the emergency core cooling system during power operation.
2.
Chemical and volume control system malfunction that increases reactor coolant inventory.
3.
A number of BWR transients (not applicable to Millstone 3).
These events, considered to be ANS Condition II, cause an increase in reactor coolant inventory.
Section 15.0.1 contains a discussion of ANS classifications.
15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION This event is analyzed for POWER OPERATION only. Analysis for shutdown modes is not required.
15.5.1.1 Identification of Causes and Accident Description Spurious emergency core cooling system (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels as described in Section 7.3.
Upon receipt of the inadvertent safety injection actuation signal (SI), the reactor will trip, letdown will be isolated, and the centrifugal charging pumps will align to take suction from the refueling water storage tank (RWST) to inject into the RCS cold legs and the Reactor Coolant Pump seals.
However, the opening of the charging pump cold leg injection valves will be controlled by the Cold Leg Injection Permissive (P-19). The Cold Leg Injection permissive is activated when two of four low pressurizer pressure channels indicate less than 1900 psia. With an inadvertent SI signal and no other transient in progress, the RCS pressure will remain above 1900 psia. The Cold Leg Injection Permissive will prevent charging pump flow through the ECCS injection valves during spurious ECCS operation at power. Since RCS pressure will also be above the shutoff head of the Safety Injection and Residual Heat Removal pumps, the only source of water addition to the RCS is the charging pump injection into the Reactor Coolant Pump seals. With letdown isolated, the seal injection will result in an increase in Reactor Coolant System inventory.
15.5.1.2 Analysis of Effects and Consequences Method of Analysis Inadvertent operation of the ECCS is analyzed using the RETRAN computer code (WCAP-14882-P-A, 1999). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief
MPS-3 FSAR 06/28/18 15.6-1 Rev. 31 15.6 DECREASE IN REACTOR COOLANT INVENTORY Events which result in a decrease in reactor coolant inventory as discussed in this section are as follows.
1.
Inadvertent opening of a pressurizer safety or relief valve.
2.
Break in instrument line or other lines from reactor coolant pressure boundary (RCPB) that penetrate containment.
3.
Steam generator tube failure.
4.
Spectrum of boiling water reactor (BWR) steam system piping failures outside of containment (not applicable to Millstone 3).
5.
Loss-of-coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the RCPB.
6.
A number of BWR transients (not applicable to Millstone 3).
15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the reactor coolant system (RCS) could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flow rate of a relief valve, and therefore allows a much more rapid depressurization upon opening, the most severe core conditions are associated with an inadvertent opening of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS pressure which could reach the hot leg saturation pressure without reactor protection system intervention. The pressure continues to decrease throughout the transient. The effect of the pressure decrease would be to increase power via the moderator density feedback. However, the plant (if in the automatic mode) functions to maintain the power essentially constant throughout the initial stage of the transient. The average coolant temperature remains approximately the same but the pressurizer pressure decreases until reactor trip (and beyond) because of the stuck open safety valve.
The reactor may be tripped by the following reactor protection system signals:
1.
Overtemperature T 2.
Pressurizer low pressure An inadvertent opening of a pressurizer relief valve is classified as an American Nuclear Society (ANS) Condition II event, a fault of moderate frequency. Although a stuck open safety valve is classified as an ANS Condition IV event, it is modeled here to bound the stuck open relief valve
MPS-3 FSAR 06/28/18 15.7-1 Rev. 31 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT Events which may result in a radioactive release from a subsystem or component are as follows:
1.
Radioactive Gaseous Waste System Failure (Section15.7.1) 2.
Radioactive Liquid Waste System Leak or Failure (Atmospheric Release)
(Section15.7.2) 3.
Liquid Containing Tank Failure (Section15.7.3) 4.
Design Basis Fuel Handling Accidents (Section15.7.4) 5.
Spent Fuel Cask Drop Accidents (Section15.7.5)
Items 1, 2, and 3 are classified as ANS Condition III events. Item 4 is classified as ANS Condition IV event. Item 5 is not assigned an ANS classification. Section 15.0.1 defines the ANS conditions.
15.7.1 RADIOACTIVE GASEOUS WASTE SYSTEM FAILURE This section has been moved to Section 11.3.3.
15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE (ATMOSPHERIC RELEASE)
This section has been moved to Section 11.2.3.1.
15.7.3 LIQUID CONTAINING TANK FAILURE This section has been moved to Section 11.2.3.2.
15.7.4 DESIGN BASIS FUEL HANDLING ACCIDENTS 15.7.4.1 Identification of Causes and Accident Description This accident results from the dropping of a spent fuel assembly onto another fuel assembly in the spent fuel pool, resulting in the rupture of the cladding of all the fuel rods in the dropped assembly and 19 fuel rods in the impacted assembly.
15.7.4.2 Sequence of Events and Systems Operation The method of analysis used for evaluating the potential radiological consequences of a fuel handling accident complies with Regulatory Guide 1.183, except that 67% of the damaged fuel rods do not comply with footnote 11 of Regulatory Guide 1.183. For these fuel rods, the gap activity fractions used are taken from Regulatory Guide 1.25, as modified by NUREG/CR-5009.
MPS-3 FSAR 06/28/18 15.8-1 Rev. 31 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM The worst common mode failure which is postulated to occur is the failure to scram the reactor after an anticipated transient has occurred. A series of generic studies [1 & 2] on Anticipated Transients Without Scram (ATWS) showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow are initiated in a timely manner. A Millstone Unit 3 specific calculation has been performed to confirm applicability of the generic studies [6].The effects of ATWS events are not considered as part of the design basis for transients analyzed in Chapter 15. The final NRC ATWS rule [3] requires that Westinghouse-designed plants install ATWS Mitigation System Actuation Circuitry (AMSAC) to initiate turbine trip and actuate auxiliary feedwater flow independent of the Reactor Protection System (RPS). The Millstone Unit 3 AMSAC design is described in Section 7.8.
15.
8.1 REFERENCES
FOR SECTION 15.8 15.8-1 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
15.8-2 Anderson, T.M., ATWS Submittal, Westinghouse LetterNS-TMA-2182 to S.H.Hanauer of the NRC, December 1979.
15.8-3 ATWS Final Rule - Code of Federal Regulations 10CFR50.62 and Supplementary Information Package, Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.
15.8-4 NUREG-0460, Anticipated Transients Without Scram for Light Water Reactors, December 1978.
15.8-5 Anderson, T. M., Rule making on Anticipated Transients Without Scram, Westinghouse Letter NS-EPR-83-2833 to S. J. Chilk of the NRC, October3, 1983.
15.8-6 DNC Letter 07-0450, Dominion Nuclear Connecticut, Inc. Millstone Power Station Unit3 License Amendment Request Stretch Power Uprate dated July 13, 2007.
MPS-3 FSAR 06/28/18 15.A-1 Rev. 31 APPENDIX 15A DOSE METHODOLOGY The radiological consequences of design basis accidents evaluated using the Alternate Source Term (AST) are quantified in terms of Total Effective Dose Equivalent (TEDE) at the control room, Exclusion Area Boundary (EAB) and Low Population Zone (LPZ). The dose methodology used is consistent with Regulatory Guide 1.183 and has been implemented via use of the RADTRAD computer code.
The radiological consequences of all other design-basis accidents are quantified in terms of thyroid doses and whole-body gamma doses at the exclusion area boundary (EAB), and at the low population zone (LPZ). The doses at the EAB are based upon releases of radionuclides over a period of two hours following the occurrence of an assumed accident; those at the LPZ are based upon releases over a thirty-day period following the occurrence of this accident.
Thyroid doses for these accidents are calculated based upon Equation 15A-1:
(15A-1) where:
Dthy = thyroid dose (rem)
Ai = activity of iodine isotope i released (curies)
/Q = atmospheric dispersion factor (sec/meter3)
B.R. = breathing rate (meter3/sec) and Cthy = thyroid dose conversion factor (rem/ci) (Reg. Guide 1.109, 1977)
The /Q values presented in Table 15.0-11 were calculated using the methodology described in FSAR Section 2.3.4.
Iodine nuclide contribution to the external whole body gamma dose for the nonrevised accidents is calculated using Equation 15A-2 (derived from equations in Regulatory Guide 1.4, 1974):
(15A-2) where:
D = gamma dose from a semi-infinite cloud (rem)
Ei = average gamma energy per disintegration of isotope i (MeV/dis)
Ai = activity of isotope i released over the given time interval (curies) and
/Q = atmospheric dispersion factor (sec/m3)
Dthy Ai
(
) Q
(
) B.R.
(
) Cthy
(
)
i
=
D 0.25 AiEi Q
(
)
i
=
MPS-3 FSAR 06/28/18 15.B-1 Rev. 31 APPENDIX 15B DELETED BY FSARCR 02-MP3-017