ML19114A140
Text
PBAPS UFSAR SECTION 6.0 CORE STANDBY COOLING SYSTEMS 6.1 SAFETY OBJECTIVE The safety objective of the core standby cooling systems (CSCS's),
in conjunction with the primary and secondary containments, is to limit the release of radioactive materials to the environs following a LOCA or from Mark I hydrodynamic loads due to Safety Relief Valve (SRV) discharge, so that resulting radiation exposures are kept to a practical minimum and are within the values given in 10CFR50.67.
CHAPTER 06 6.1-1 REV. 22, APRIL 2009
PBAPS UFSAR 6.2 SAFETY DESIGN BASIS
- 1. To provide adequate cooling of the reactor core under abnormal and accident conditions, various cooling systems are provided with diversity, reliability, and redundancy such that inadequate cooling of the core is highly improbable.
- 2. In the event of a LOCA, the core standby cooling systems (CSCS's) remove residual heat such that excessive fuel clad temperature is prevented.
- 3. The CSCS's provide for continuity of core cooling over the complete range of postulated break sizes in the nuclear system process barrier.
- 4. CSCS's are initiated automatically by conditions which sense the potential inadequacy of core cooling, to limit the degree to which safety is dependent upon the operator.
- 5. Operation of the CSCS's is not dependent upon the availability of off-site power supplies or the power conversion system.
- 6. Action taken to maintain containment operable does not negate the ability to achieve core cooling.
- 7. Each component of the CSCS's required to operate in a LOCA is capable of being tested during normal operation of the nuclear system to provide assurance that the systems operate effectively.
- 8. The components of the CSCS's within the reactor vessel are designed to withstand the transient mechanical loadings during a LOCA so that the required standby cooling flow is not restricted.
- 9. The physical effects of the design basis LOCA do not prevent the CSCS's from effectively cooling the core. These effects are missiles, fluid jets, high temperature, pressure, radiation, and humidity.
- 10. The CSCS's are capable of withstanding design seismic forces and Mark I hydrodynamic loads without impairment of their functions.
- 11. A reliable source of water for the CSCS's is provided. The source is located in the primary containment in such a manner that a closed cooling water path is established during the operation of the CSCS's following a LOCA.
- 12. CSCS pumps operate with sufficient NPSH following a LOCA without credit for containment accident pressure.
CHAPTER 06 6.2-1 REV. 26, APRIL 2017
SUMMARY
DESCRIPTION During planned operations, when normal electrical power for the plant auxiliaries is available, heat is removed from the reactor core through the boiling water-steam-turbine-condenser-feedwater cycle during power operation or, during shutdown, through use of the RHRS. For postulated accident conditions, when coolant is lost from a breach in the nuclear process system, the reactor is shut down by a reactor low water level or high drywell pressure scram. As the water level in the reactor vessel continues to drop, the main steam line isolation valves are closed and the HPCIS and the RCICS are started. High drywell pressure or various reactor vessel low water level signals start one or more CSCS's automatically to maintain core cooling.
The CSCS's consist of the:
- 1. High-pressure coolant injection system (HPCIS).
- 3. Core spray system.
- 4. Low-pressure coolant injection system (LPCIS) (an operating mode of the RHRS).
The CSCS's are designed to limit fuel-clad temperature over the complete spectrum of possible break sizes in the nuclear system process barrier including the design basis break. The design basis break is defined as the complete and instantaneous circumferential rupture of the largest pipe connected to the reactor vessel with displacement of the ends so that blowdown occurs from both ends. The range of operation of the CSCS's to cover the break spectrum is illustrated in Figure 6.3.1.
The individual CSCS's are described in the following paragraphs. A summary of the principal parameters of the CSCS -- core cooling capacity, flow, pressure, and backup systems -- is given in Table 6.3.1.
This section gives the safety analysis of the CSCS's from the system viewpoint. As applicable, process diagrams are included in this section to show a simplified schematic of each system and the principal operating parameters (flow, pressure, temperature) in the typical operating, test, and accident design modes. Other sections of this report which give further specific details are the following:
CHAPTER 06 6.3-1 REV. 21, APRIL 2007
- 1. "Reactor Vessel Internals Mechanical Design" (Core Spray), subsection 3.3.
- 2. "Nuclear System Pressure Relief System" (relief valves), subsection 4.4.
- 3. "Residual Heat Removal System" (LPCI function and RHRS-High Pressure Service Water intertie), subsection 4.8.
- 4. "Core Standby Cooling Systems Control and Instrumentation," subsection 7.4.
The piping and instrumentation diagrams, and the functional control diagrams, are included in subsection 7.4, "Core Standby Cooling Systems Control and Instrumentation," which also evaluates the controls and instrumentation for all of the CSCS's.
The equipment and operation of each of the CSCS's are discussed followed by a description of the analytical model. Using this analytical model, reactor vessel pressure and coolant inventory are calculated assuming individual operation of each of the CSCS's for some typical size breaks in the nuclear system process barrier. The results of the analyses are presented to give an idea of the capability of each system. The analytical model is then used to calculate reactor vessel pressure and coolant inventory assuming the design basis LOCA has occurred and the CSCS's operate in an integrated manner as designed. The results of the analyses show how operation of the CSCS's satisfies the safety objective.
This section includes a discussion of the testing and inspection which are performed to provide assurance that the CSCS's will operate as required. The final discussion (subsection 6.7) in this section is historical information on conformance to interim AEC/NRC acceptance criteria for light water reactors.
CHAPTER 06 6.3-2 REV. 21, APRIL 2007
PBAPS UFSAR TABLE 6.3.1 CORE STANDBY COOLING SYSTEMS EQUIPMENT DESIGN DATA
SUMMARY
No. Power Installed Required (Individual Design Flow Range for Source Function Capacity) (each) (psig) Initiation of water Backup Systems Pressure Flow psid*
HPCI Pumps 1 (100%) 5,000 gpm @ 1,170-150 1,170 to 150 dc Condensate Auto Depressurization Storage Tank + Core Spray and Suppression + LPCI Pool Automatic 5 (Note 1) 800,000 lb/hr @ 1,080 1,167 to 50 dc - Remote-Manual Depressurizing (Note 1) Relief Valves Valves Core Spray 4 (50%) 3,125 gpm @ 105 289 to 0 ac/dc Suppression LPCI Pumps Pool LPCI Pumps 4 (33-1/3%) 8,600 gpm @ 20 295 to 0 ac/dc Suppression Core Spray (Note 2) Pool System Note 1: See Table 4.4.1 for information of relief valve capacity.
Note 2: Minimum required flow for Technical Specifications Operability.
- psid - pounds per square inch differential between reactor vessel and primary containment.
CHAPTER 06 6.3-3 REV. 27, APRIL 2019
6.4 DESCRIPTION
6.4.1 High-Pressure Coolant Injection System The HPCIS consists of a steam turbine driving a constant-flow pump, system piping, valves, controls, and instrumentation. The HPCIS is shown schematically in Drawing M-1-DD-6.
The HPCIS is installed in the reactor building. The turbine-pump assembly is located in a shielded area to assure that personnel access to adjacent areas is not restricted during operation of the HPCIS. Suction is from the condensate storage tank or the suppression pool. Injection water is piped to the reactor feedwater pipe at a T-connection. Steam supply for the turbine is piped from the "B" main steam line in the primary containment.
This piping is provided with an isolation valve on each side of the drywell barrier. Remote controls for valve and turbine operation are provided in the main control room. The controls and instrumentation of the HPCIS are described, illustrated, and evaluated in detail in subsection 7.4, "Core Standby Cooling Systems Control and Instrumentation."
The HPCIS is provided to assure that the reactor is adequately cooled to limit fuel-clad temperature in the event of a small break in the nuclear system and loss of coolant which does not result in rapid depressurization of the reactor vessel. The HPCIS permits the nuclear plant to be shut down while maintaining sufficient reactor vessel water inventory until the reactor vessel is depressurized. The HPCIS continues to operate until reactor vessel pressure is below the pressure at which LPCI operation or core spray system operation maintains core cooling. In addition, HPCI fulfills the objectives of the RCIC system in the event that the RCIC system fails.
If a LOCA occurs, the reactor scrams upon receipt of a reactor low water level (level 3) signal or a high drywell pressure signal.
The HPCIS starts when the water level reaches a preselected height above the core (level 2), or if high pressure exists in the primary containment. The HPCIS automatically stops when a high water level in the reactor vessel is signaled.
The HPCIS is designed to pump water into the reactor vessel for a wide range of pressures in the reactor vessel. Two sources of water are available. Initially, the condensate storage tank is used and, upon being drawn down to a low level, automatic transfer to the suppression pool occurs. In addition, a high suppression pool water level condition also causes an automatic transfer of the pump suction flowpath. Manual transfer may also be made from the control room. Water from either source is pumped into the CHAPTER 06 6.4-1 REV. 27, APRIL 2019
PBAPS UFSAR reactor vessel via the feedwater line. Flow is distributed within the reactor vessel through the "A" feedwater line spargers to obtain mixing with the hot water or steam in the reactor pressure vessel. With HPCI suction aligned to the suppression pool, this establishes a closed loop for recirculation of water escaping from a break and satisfies safety design basis 11.
The pump is located below the level of the condensate storage tank and below the water level in the suppression pool to assure positive suction head to the pump. Pump NPSH requirements are met by providing adequate suction head, adequate suction line size and suppression pool water temperature control.
The HPCIS turbine-pump assembly is located so as to be protected from the physical effects of design basis accidents and satisfies safety design basis 9.
The HPCIS turbine is driven by steam from the reactor which is generated by residual heat. The steam is extracted from the "B" main steam line upstream of the main steam line isolation valves.
The two HPCIS isolation valves in the steam line to the HPCIS turbine are normally open to keep the piping to the turbine at elevated temperatures to permit rapid startup of the HPCIS. A bypass line and valve around the outboard isolation valve on the HPCI steam supply line in Unit 2 permits controlled steam line heatup prior to opening the outboard steam line isolation valve.
It also permits drainage of condensate from between the inboard and outboard isolation valves. Typically, this line is used when returning the HPCI steam line to service, after it has been removed from service for maintenance during power operation.
Signals from the HPCIS control system open or close the turbine stop valve. Unit 3 HPCI steam supply isolation valve is used to permit controlled steam line heatup.
A condensate drain pot is provided upstream of the turbine stop valve to prevent the HPCIS steam supply line from filling with water. The drain pot normally routes the condensate to the main condenser, but upon receipt of an HPCIS initiation signal, or a loss of control air pressure, isolation valves on the condensate line automatically shut.
The turbine has two devices for controlling power: (1) a speed governor which limits turbine speed to its maximum operating level, and (2) a control governor which is positioned by a demand signal from a flow controller to maintain constant flow over the pressure range of HPCIS operation. Manual operation of the governor is possible when in the test mode, but it is automatically repositioned by the demand signal from the flow controller if system initiation is required.
CHAPTER 06 6.4-2 REV. 27, APRIL 2019
PBAPS UFSAR As reactor steam pressure decreases, the HPCIS turbine control valve opens further to pass the steam flow required to maintain the necessary pump flow. The capacity of the system is selected to provide sufficient core cooling to prevent excessive fuel clad temperature while the pressure in the reactor vessel is above the pressure at which core spray and LPCI become effective.
Exhaust steam from the HPCIS turbine is discharged to the suppression pool. A drain pot at the low point in the exhaust collects condensate which is discharged through a restricting orifice to the suppression pool or bypassed to the gland seal condenser.
To ensure pressure stability at low flow rates in the turbine exhaust pipe during turbine operation, a sparger and vacuum breakers are provided. In addition, the vacuum breakers prevent siphoning suppression pool water into the turbine exhaust line during post operation cooldown.
The sparger is located at the end of the turbine exhaust line inside the suppression pool.
Vacuum breakers are connected between the HPCIS turbine exhaust line upstream of the penetration through the torus shell and the torus air space. The vacuum breakers are arranged to prevent a negative pressure in the section of turbine exhaust piping between the sparger and the upstream stop check valve (Drawing M-365, Sheets 1 and 2). To ensure proper vacuum breaker operation, and to provide single failure protection against a vacuum breaker valve sticking in the open position, there are four vacuum breakers arranged in a one-out-of-two-twice logic.
The HPCIS turbine gland seals are vented to the gland seal condenser and part of the water from the HPCIS pump is routed through the condenser for cooling purposes. Noncondensible gases from the gland seal condenser are exhausted to the standby gas treatment system.
The system piping and pump casings are designed as described in Appendix A. The pumps were initially designed and tested in accordance with the Standards of the Hydraulic Institute.
The HPCIS equipment, piping, and support structures are designed to seismic Class I criteria. This satisfies design basis 10.
Startup of the HPCIS is completely independent of normal AC power.
Only DC power from the station batteries and steam from the nuclear system are necessary. This satisfies safety design basis CHAPTER 06 6.4-3 REV. 27, APRIL 2019
The HPCIS controls automatically start the system and bring it to design flow rate within 55 sec from receipt of a reactor vessel low water level signal or a primary containment (drywell) high pressure signal.
The HPCIS turbine is shut down automatically by any of the following trip signals:
- 1. Turbine overspeed - This prevents damage to the turbine and turbine casing.
- 2. Reactor vessel high water level - This indicates that core cooling requirements are satisfied.
- 3. HPCIS pump low suction pressure - This prevents damage to the pump due to loss of flow.
- 4. HPCIS turbine exhaust high pressure - This indicates a turbine or turbine control malfunction.
A probabilistic missile evaluation has been performed on the HPCIS pump turbine and is described in subsection 11.2.
If an initiation signal is received after the turbine is shut down, the system is capable of automatic restart if no trip signals exist.
Because the steam supply line to the HPCIS turbine is part of the nuclear system process barrier, certain signals automatically isolate this line, causing shutdown of the HPCIS turbine.
Automatic shutoff of the steam supply is described in subsection 7.3, "Primary Containment and Reactor Vessel Isolation Control System." However, automatic depressurization and the low pressure systems of the CSCS act as backups, and automatic shutoff of the steam supply does not negate the ability of the CSCS to satisfy the safety objective.
In addition to the automatic operational features of the system, provisions are included for remote-manual startup, operation, and shutdown (provided initiation or shutdown signals do not exist).
All operated valves are equipped with a remote-manual functional test feature.
HPCIS initiation automatically actuates the following valves:
- 1. HPCIS pump discharge test bypass valves CHAPTER 06 6.4-4 REV. 27, APRIL 2019
- 2. HPCIS pump CST suction shutoff valve
- 3. HPCIS pump discharge shutoff valve
- 4. HPCIS steam supply shutoff valve
- 5. HPCIS turbine stop valve
- 6. HPCIS turbine control valve
- 7. HPCIS steam supply line drain isolation valves
- 8. HPCIS condensate drain isolation valves.
Startup of the auxiliary oil pump for the hydraulic control system is required to open the turbine valves. Operation of the gland seal condenser components is required to prevent outleakage from the turbine shaft seals. Startup of the gland seal condenser components is automatic, but its failure does not prevent the HPCIS from fulfilling its core cooling objective. During turbine startup, the lower of the signals from the startup ramp generator and the flow controller positions the control valve. The control valve hydraulic operator is biased to start the control valve open as hydraulic pressure is developed. Once sufficient hydraulic pressure is developed to reposition the control valve operator, the control valve starts to reclose, controlled by the idle ramp generator signal. The stop valve opens completely as hydraulic pressure is developed. When the stop valve starts open, a limit switch on the stop valve initiates the ramp generator to provide an increasing opening signal to the control valve to ramp the turbine up to rated flow within 55 seconds of the initiating signal. When the turbine reaches rated flow, the flow controller adjusts the control governor setting so that design flow is maintained.
A minimum flow bypass is provided for pump protection. The bypass valve automatically opens on a low-flow signal, and automatically closes on a high-flow signal. When the bypass is open, flow is directed to the suppression pool. A system test line is provided to recirculate either to the condensate storage tank or the suppression pool during system tests. The line to the condensate storage tank is sized for full HPCI system flow. The line to the suppression pool is sized for only partial flow. Shutoff valves are provided with interlocks to automatically close the test line upon receipt of an HPCIS initiation signal.
To ensure rapid delivery of water to the RPV and to minimize water hammer effects, all ECCS pump discharge lines are filled CHAPTER 06 6.4-5 REV. 27, APRIL 2019
PBAPS UFSAR with water. This meets the requirements of Generic Letter 2008-01 and Technical Specifications (TS) Amendment Nos. 297/300. The LPCI and CS System discharge lines are kept full of water using a "keep fill" system. The HPCI System is normally aligned to the CST. The height of water in the CST is sufficient to maintain the piping full of water up to the first isolation valve. The relative height of the feedwater line connection for HPCI is such that the water in the feedwater lines keeps the remaining portion of the HPCI discharge line full of water. Therefore, HPCI does not require a "keep fill" system when aligned to the CST. A connection to the CST maintains HPCI full when HPCI is aligned to the torus, and the CST level is at or above elevation 149'-6" (14.5' above tank bottom).
6.4.2 Automatic Depressurization System The ADS reduces the reactor pressure so that flow from LPCI and the core spray system enters the reactor vessel in time to cool the core and prevent excessive fuel-clad temperature.
The ADS uses five of the nuclear system safety/relief valves to relieve the high-pressure steam to the suppression pool.
The design, description, and evaluation of the safety/relief valves are discussed in detail in subsection 4.4, "Nuclear System Pressure Relief System," and it is shown that safety design bases 5, 9, and 10 are satisfied.
The ADS safety/relief valves automatically open upon coincident signals of reactor vessel low water level, primary containment (drywell) high pressure, and discharge pressure of either low-pressure cooling system (LPCI or core spray), but only after a time delay. The primary containment high pressure signal is bypassed after an extended time period following receipt of a reactor vessel low water level signal. This causes the ADS safety/relief valves to automatically open upon coincident signals of low reactor vessel water level and discharge pressure of either low pressure cooling system. The time delays provide time for the operator to cancel the automatic depressurization signal if control room information indicates the signal is false or is not needed.
6.4.3 Core Spray System The core spray system consists of two independent loops. Each loop includes two 50 percent capacity centrifugal pumps driven by electric motors, a spray sparger in the reactor vessel above the core, piping and valves to convey water from the suppression pool to the sparger, and the associated controls and instrumentation.
CHAPTER 06 6.4-6 REV. 27, APRIL 2019
PBAPS UFSAR Large capacity passive suction strainers have been installed on each core spray suction line in the suppression pool via plant modification, in response to NRC I.E. Bulletin 96-03, Potential Plugging of Emergency Core Cooling Suction Strainers by Debris in Boiling Water Reactors.
In the case of low water level in the reactor vessel or high pressure in the drywell plus low reactor vessel pressure, the core spray system automatically sprays water onto the top of the fuel assemblies in time, and at a sufficient flow rate, to cool the core and prevent excessive fuel clad temperature. (The LPCIS starts from the same signals and operates independently to achieve the same objective by flooding the reactor vessel.)
The core spray system provides protection to the core for the large break in the nuclear system. Either loop provides sufficient protection.
The protection provided by the core spray system also extends to a small break (Figure 6.3.1) in which the ADS has operated to lower the reactor vessel pressure so the LPCI and the core spray system can provide core cooling.
The core spray system can be used to transfer water from the CST to the refueling area to support refueling operations.
The four core spray pumps receive power from the 4kV emergency auxiliary buses. Each core spray pump motor and the associated automatic motor-operated valves receive ac power from separate buses. Similarly, control power for each loop of the core spray system comes from separated dc buses. This arrangement satisfies design basis 5 (see subsections 8.5, "Standby ac Power Supply and Distribution," and 8.7, "125/250-V and 250-V dc Power Supplies and Distribution").
The core spray pumps and all automatic valves can be operated individually by manual switches in the control room. Operating information is provided in the control room by pressure indicators, flow indicators, and indicator lights.
The major equipment for one loop is described in the following paragraphs.
When the system is actuated, water is taken from the suppression pool. Flow then passes through a locked-open, motor-operated valve which can be closed by a remote-manual keylock switch from the control room to isolate the system from the suppression pool in case of a leak from the core spray system. This valve is CHAPTER 06 6.4-7 REV. 27, APRIL 2019
PBAPS UFSAR located in the core spray pump suction line as close to the suppression pool as practical.
A local pressure gauge for each pump indicates the presence of a suction head for the pump. The core spray pumps are located in the reactor building below the water level in the suppression pool to assure positive pump suction. The pumps, piping, controls, and instrumentation of each loop are separated so that any single physical event cannot make both core spray loops inoperable. The switchgear for each loop is in a separate room for the same reason. This arrangement satisfies safety design basis 9.
A low-flow bypass line is provided from the discharge of each pump to below the surface of the suppression pool. The bypass valve automatically opens on a low-flow signal and automatically closes on a high-flow signal. The bypass flow is required to prevent the pump from overheating when pumping against a closed discharge valve. An orifice limits the bypass flow.
A relief valve protects the low-pressure core spray system upstream of the outboard shutoff valve from reactor pressure. The relief valve discharges to the liquid radwaste system.
A full-flow test line permits circulating water to the suppression pool for testing the system during normal plant operations. A normally closed, motor-operated valve in the line is controlled by a remote-manual switch in the control room. Partial opening of the valve and an orifice in the test line can provide rated core spray flow at a pressure drop equivalent to discharging into the reactor vessel. A loop flow indicator is located in the control room.
Two motor-operated valves are provided in each loop to isolate the core spray system from the nuclear system. These valves admit core spray water to the reactor when signaled to open. Both valves are installed outside the drywell to facilitate operation and maintenance, but as close as practical to the drywell to limit the length of line exposed to reactor pressure. The valve nearer the containment is normally closed to back up the inside check valve for containment purposes. The outboard valve is normally open to limit the equipment needed to operate in an accident condition. By closing the outboard valve, the inboard valve can be operated for test with the reactor vessel pressurized. A vent line is provided between the two shutoff valves which can be used to measure leakage through the inside check valve or the inboard shutoff valve. The vent line is normally closed with two valves and a pipe cap to assure containment.
A check valve is provided in each core spray line, just inside the primary containment, to prevent loss of reactor coolant outside CHAPTER 06 6.4-8 REV. 27, APRIL 2019
PBAPS UFSAR the containment in case the core spray line breaks. A normally locked-open manual valve is provided downstream of the inside check valve to shut off the core spray system from the reactor, during shutdown conditions, for maintenance of the upstream valves. The two core spray system pipes enter the reactor vessel through nozzles 120 deg apart. Each internal pipe then divides into a semicircular header with a downcomer at each end which turns through the shroud near the top. A semicircular sparger is attached to each of the four outlets to make two practically complete circles, one above the other. Short elbow nozzles are spaced around the spargers to spray the water radially into the tops of the fuel assemblies.
Core spray piping upstream of the outboard shutoff valve is designed for the low pressure and temperature of the core spray pump discharge. The outboard valve and piping downstream are designed for reactor vessel pressure and temperature. All piping and pump casings are designed as described in Appendix A.
The core spray equipment, piping, and support structures are designed in accordance with seismic Class I criteria and safety design basis 10 is satisfied.
Upon signals of reactor low water level or concurrent drywell high pressure and low reactor pressure, the automatic controls start the core spray pumps and place system valves in the spray mode.
Flow to the sparger begins when the pressure differential opens the inside check valve. Subsection 7.4, "Core Standby Cooling Systems Control and Instrumentation," contains further details and evaluation.
6.4.4 Low-Pressure Coolant Injection In case of low water level in the reactor or concurrent high pressure in the containment drywell and low reactor pressure, the LPCI mode of operation of the RHRS pumps water into the reactor vessel in time to flood the core and prevent excessive fuel-clad temperature. (The core spray system starts from the same signals and operates independently to achieve the same objective.)
LPCI operation provides protection to the core for the case of a large break in the nuclear system for which the CRD water pumps, RCICS, and HPCIS are unable to maintain reactor vessel water level.
Protection provided by LPCI also extends to a small break (Figure 6.3.1) in which the CRD water pumps, RCICS, and HPCIS are all unable to maintain the reactor vessel water level, and the ADS has operated.
CHAPTER 06 6.4-9 REV. 27, APRIL 2019
PBAPS UFSAR Drawing M-1-DD-9 shows a schematic process diagram of LPCI. LPCI operation consists of using the four ac motor-driven centrifugal pumps taking water from the suppression pool and pumping it into the recirculation loops. The water enters the reactor through jet pumps to restore the water level in the reactor vessel.
The LPCI pumps receive power from the 4-kV emergency auxiliary buses. Each LPCI pump motor and associated automatic motor-operated valves receive ac power from separate buses. Similarly, control power for each LPCI pump motor comes from separate dc buses. This arrangement satisfies safety design basis 5 (see subsections 8.5, "Standby ac Power Supply and Distribution," and 8.7, "125/250-V and 250-V dc Power Supplies and Distribution").
Transfer switches to backup power supplies for select RHR motor operated valves have been provided so that upon loss of the normal ac power feed or bus, backup power can be provided to the motor operated valves. This feature allows operators to align the system for RHR HX cross-tie operation upon loss of either one of the two ac power buses in an RHR loop.
LPCI pumps and piping equipment are described in detail in subsection 4.8, "Residual Heat Removal System," which also describes the other functions served by the same pumps if not needed for the LPCI function. The portions of the RHRS required for accident protection are designed in accordance with seismic Class I criteria and safety design basis 10 is satisfied.
6.4.5 Core Standby Cooling System NPSH The NPSH available for the CSCS pumps takes no credit for the pressure within the containment. Possible operating modes of the core standby cooling network have been examined for adequacy with regard to NPSH at the CSCS pumps. There are no circumstances where there would be insufficient NPSH at any of the pumps throughout the event.
The following major assumptions were used to calculate the suppression pool temperature following the postulated design basis loss of coolant accident:
- 1. Offsite power is assumed lost at the time of the accident and is not restored during the period of interest (approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).
- 2. One of the onsite diesel-generators fails to start and remains out of service during the entire transient.
CHAPTER 06 6.4-10 REV. 27, APRIL 2019
- 3. The service water temperature remains at its maximum possible value of 92°F throughout the transient. Normal service temperature would be at least 10°F less than maximum.
- 4. The RHR heat exchanger is operating with a K-value of 305 BTU/sec/F prior to 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, when the RHR heat exchanger cross-tie is NOT in effect. After 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, when the RHR heat exchanger cross-tie is in effect, the K-value is 500 BTU/sec/F.
The result of the above assumptions is to maximize the peak suppression pool temperature. With no offsite power and with one diesel-generator out of service, the pool will be cooled by one RHR heat exchanger with 100% service water flow from 10 minutes, when the HPSW pump is started, until one hour into the event. At 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, the analysis assumes the RHR HX cross-tie is in service (one RHR pump with 8600 gpm total flow split to each of two RHR HXs and 100% service water flow to each of the two HXs). This together with the maximum service water temperature and dual unit interaction, results in a peak pool temperature of 187.2°F.
However, the worst-case peak pool temperature of 187.6°F occurs after a small steam line break.
The combination of maximum fluid temperature coupled with no credit for containment pressure above local atmospheric pressure is the most severe condition for which adequate NPSH must be shown to exist.
6.4.6 Gas Management Program On January 11, 2008, the NRC issued Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems (Reference 1). Generic Letter 2008-01 requested licensees to evaluate the licensing basis, design, testing, and corrective action programs for the Emergency Core Cooling, Decay Heat Removal, and Containment Spray systems to ensure that gas accumulation is maintained less than the amount that challenges operability of these systems, and that appropriate action is taken when conditions adverse to quality are identified. The piping systems addressed in the response to Generic Letter 2008-01 have the potential to develop voids and pockets of entrained gases. Maintaining the impacted system process piping sufficiently full of water is necessary to ensure that the system will perform properly and will inject the flow assumed in the safety analyses into the Reactor Coolant System or containment upon demand. This prevents damage from pump CHAPTER 06 6.4-11 REV. 27, APRIL 2019
PBAPS UFSAR cavitation or water hammer, and pumping of unacceptable quantities of non-condensable gas (e.g., air, nitrogen, or hydrogen) into the reactor vessel following an ECCS start signal or during shutdown cooling.
Requirements of Generic letter 2008-01 have been addressed by TS Amendment Nos. 297/300. A description of the process for meeting these requirements is contained in Sections 4.7.3 (RCIC), 4.8.5 (RHR and CS), and 6.4.1 (HPCI) of the UFSAR.
CHAPTER 06 6.4-12 REV. 27, APRIL 2019
PBAPS UFSAR 6.4 Description References
- 1. NRC Generic Letter 2008-01, Managing Gas Accumulation in Emergency Core Cooling, Decay Heat Removal, and Containment Spray Systems, dated January 11, 2008 CHAPTER 06 6.4-13 REV. 27, APRIL 2019
PBAPS UFSAR 6.5 SAFETY EVALUATION 6.5.1 Summary In order to satisfy the safety design bases, four systems for core standby cooling are provided. These are HPCI, automatic depressurization, core spray, and LPCI. These are in addition to the other systems which supply core coolant: feedwater, CRD, and RCIC.
To provide diversity, two different cooling methods are provided:
spraying and flooding.
Evaluation of the reliability and redundancy of the controls and instrumentation for the CSCS's shows that no failure of a single initiating sensor either prevents or falsely starts the initiation of these cooling systems. No single control failure prevents the combined cooling systems from providing the core with adequate cooling. The controls and instrumentation can be calibrated and tested to assure proper response to conditions representative of accident situations.
The intent of the CSCS's temperature criterion is to prevent gross core meltdown. Since core cooling cannot be easily shown to be effective unless the geometry is defined, a no clad melt criterion is established. However, because under some conditions highly oxidized Zircaloy is known to fracture upon cooling, concern exists that the core geometry may not remain defined after cooldown. Based on the worst experimental data, clad fragmentation upon cooldown can be prevented for the time scale of interest here if the maximum cladding temperature is limited to less than 2,200°F. Thus, this is the design temperature criterion against which the CSCS's performance must now be judged, i.e., the systems shall prevent clad fragmentation upon cooldown, which translates to a peak temperature of 2,200°F.
It should be noted, however, that since the clad fragmentation would not occur until after the core is cooled and flooded, it is most likely that a considerable portion of the core could be fragmented without leading to gross core melting. In addition to this margin inherent in the criterion, the actual performance of the core cooling systems is such that peak temperatures much lower than 2,200°F result across the complete break spectrum.
All of the safety design bases for the CSCS's are shown to be met by the previous descriptions, the referenced descriptions, evaluations in other sections, and by the following safety evaluations of the individual and combined CSCS's.
CHAPTER 06 6.5-1 REV. 27, APRIL 2019
PBAPS UFSAR Peak clad temperatures are determined in accordance with the standby cooling system model described herein and the core heatup model described in Reference 10. Core heatup calculations begin for each section of the core as the liquid level falls below that section. Heat is transferred from the surface of the fuel rods by convection to the water, steam, or hydrogen formed in the metal-water reaction. In addition, thermal radiation between fuel rods and from the rods to the channel is accounted for in the overall heat balance.
For the design basis LOCA, core flow and quality as a function of time is used to determine the film boiling heat transfer coefficient from experimental data (References 1, 4, 5, 10).
The reactor core is divided into several hundred axial, radial, and local zones, and the power distribution becomes an input to a computer program. Thus, the temperature distribution throughout the core and along each fuel rod can be calculated through the course of the accident.
Evaluation of the cooling performance of the individual and combined CSCS's is calculated by an analytical model and digital computer program to cover the spectrum of conditions in detail and assure that core cooling is adequate across the entire spectrum of break sizes.
In conjunction with rerating the plant to 3458 MWt the ECCS LOCA analysis was performed using General Electric's SAFER/GESTR methodology. The input assumptions and results of this LOCA analysis are provided in Reference 10. The previous analysis employed GE's SAFE/REFLOOD methodology. As discussed in Reference 10, the reference analysis was performed for a full spectrum of break sizes and assumed very conservative values for ECCS equipment performance to ensure the analysis would be bounding for future applications. These ECCS parameters included values for diesel generator startup time, ECCS system flows, injection valve stroke times, and water level initiation setpoints that are more conservative than those specified in the plant's Technical Specifications. Analyses were also performed using the design basis ECCS equipment parameters (used in the previous SAFE/REFLOOD analysis). The analyses were performed to demonstrate adequate ECCS performance following a LOCA for core thermal power levels up to 3623 MWt (which corresponds to 110% of the original licensed power level).
Subsequent to implementation of EPU, an ECCS-LOCA analysis was performed for the implementation of MELLLA+ utilizing SAFER/PRIME for the most limiting ECCS-LOCA scenarios (as opposed to the full spectrum of scenarios in the licensing base). The ECCS performance for large recirculation line breaks is affected by CHAPTER 06 6.5-2 REV. 27, APRIL 2019
PBAPS UFSAR MELLLA+ because the reduced core flow in the MELLLA+ region leads to earlier boiling transition lower in the fuel bundle. For small breaks the fuel remains in nucleate boiling until uncovered. Therefore, MELLLA+ will not significantly affect the small break LOCA response. The subcooling in the downcomer increases as the core flow is decreased, which tends to increase the flow for breaks drawing water from the subcooled regions of the vessel (e.g., recirculation and LPCI breaks). For small breaks, the increased break flow helps to depressurize the reactor and permits the ECCS to inject earlier, which tends to decrease the small break PCTs. The ECCS-LOCA analysis incorporated all previous LOCA model error corrections and/or input changes at the time the analysis was performed, resulting in a licensing basis PCT of less than 1930°F for the limiting small break.
The LOCA analyses described in Reference 18 were performed using both realistic (nominal) model assumptions and the more conservative licensing basis model assumptions specified in Appendix K of 10CFR50 for a full core of GNF2 fuel. The results of the Appendix K analysis using the design basis ECCS parameters yield a calculated licensing basis peak clad temperature (PCT) of less than 1930°F for the limiting break. Figures 6.5.1 to 6.5.8 present the response of the reactor pressure, reactor water level, peak clad temperature and heat transfer coefficient as a function of time for the limiting large and small break sizes.
These analyses are bounding for operation at 4016 MWt (MUR conditions).
The calculated peak cladding temperature for the LOCA analysis may be impacted by LOCA model error corrections and/or input changes subsequent to the original analysis; the impact of these changes on peak cladding temperature is reported by the fuel vendor.
Changes, when implemented, are documented in the most recent 10 CFR 50.46 report.
6.5.2 Analysis Models The performance analysis of the CSCS's is based upon analytical models used to conservatively predict reactor vessel pressure, liquid inventory, and fuel cladding temperature variations with time after a break. These models are identified, exemplified, and fully explained in References 8, 9, and 17.
6.5.3 Individual System Adequacy The manner in which the CSCS's operate to protect the core is a function of the rate at which coolant is lost from a break in the nuclear system process barrier. The HPCIS is designed to operate while the nuclear system is at high pressure. The core spray CHAPTER 06 6.5-3 REV. 27, APRIL 2019
PBAPS UFSAR system and LPCIS are designed for low-pressure operation only. If a break in the nuclear system boundary is of a size that the loss of coolant exceeds the capacity of the HPCIS, nuclear system pressure drops fast enough so that the core spray and LPCIS will limit the maximum clad temperature to less than 2,200°F. The ADS provides backup depressurization capability in the event that the HPCIS does not function in the small break region.
The capability of the individual systems for both liquid and steam line breaks is shown in the CSCS's bar chart (Figure 6.3.1). A whole bar represents the capability of an individual system to protect the core without assistance from any other system. A half bar represents the range of break sizes for which an individual system acts in conjunction with a complementary system. It can be seen from the figure that for small breaks, the HPCIS acting alone is capable of preventing excessive cladding temperatures. For large breaks, the HPCIS acts in conjunction with the core spray or LPCIS. The low pressure systems are sufficient for large breaks; however, each requires a complementary system (HPCIS or ADS) for small breaks. The half bar for the ADS shows that it acts only as a complementary system.
The safety-related core cooling system piping is provided with two water makeup sources to ensure that the pump discharge lines are filled. The condensate transfer system fulfills this requirement during plant operation and plant shutdown. The second source is condensate pump discharge (Drawings M-362, Sheets 1 and 2 and M-361, Sheets 1 through 4). With discharge line drainage thus precluded, excessive hydraulic forces (e.g., water hammer and steam compression) will not occur. HPCI makeup is provided by condensate storage tank head pressure during normal system alignment, and also while aligned to take suction from the suppression pool, via stay-fill piping.
To clarify the action taken by each system of the CSCS's during a LOCA, the results of the analysis as applied to individual systems of the CSCS's are presented in references 4, 5, 6, 8, 9, and.
6.5.3.1 High-Pressure Coolant Injection System The HPCIS provides adequate reactor core cooling for small breaks and depressurization of the reactor primary system so that the LPCIS and core spray system can be initiated. A detailed discussion of the performance of the HPCIS in conjunction with the LPCIS and core spray system is given in references 4, 5, 6, 8, 9, and 10.
When the HPCIS begins operation, the reactor depressurizes more rapidly than would occur if the HPCIS were not initiated, due to the condensation of steam by the cold fluid pumped into the CHAPTER 06 6.5-4 REV. 27, APRIL 2019
PBAPS UFSAR reactor vessel by the HPCIS. The effect of the mass additions by the HPCIS is also reflected in the changing slope of the liquid inventory trace. As the reactor vessel pressure continues to decrease, the HPCIS momentarily reaches equilibrium with the flow through the break. Continued depressurization causes the break flow to decrease below the HPCIS flow and the liquid inventory outside the shroud begins to rise. This type of response is typical for small breaks. The core never uncovers and is continuously cooled throughout the transient so that no core damage of any kind occurs for breaks that lie within the range of the HPCIS.
The HPCI turbine has been designed for high reliability under its design requirements of quick starting. The HPCI turbine efficiency is not of paramount importance. Moreover, the turbine has adequate capacity to accept the small losses in efficiency due to any credible moisture carryover.
6.5.3.2 Automatic Depressurization System When the ADS is actuated, the flow of steam through the valves provides a maximum energy removal rate while minimizing the corresponding fluid mass loss from the reactor vessel. Thus, the specific internal energy of the saturated fluid in the reactor vessel is rapidly decreased causing pressure reduction. Since the ADS does not add coolant to the reactor vessel, performance analysis of the ADS is considered only with respect to its depressurizing effect in conjunction with LPCIS or core spray system. The effective range of the ADS is presented in Figure 6.3.1. The system provides backup for the HPCIS. Actuation of the automatic depressurization function does not require any source of off-site or ac power. The safety relief valves are controlled by dc power from the unit batteries and are pneumatically actuated from nitrogen accumulators.
Vessel pressure decreases rapidly when the ADS safety relief valves automatically open, allowing the LPCIS to pump water into the vessel in time to keep the peak cladding temperature well within the design limit. ADS performance, operating with the core spray, is given in references 4, 5, 6, 8, 9, and 10.
6.5.3.3 Core Spray System The core spray system is designed to provide continuous and direct reactor core cooling for LOCA's. It provides adequate cooling for intermediate and large line break sizes up to and including the design-basis double-ended recirculation line break, without assistance from any other CSCS. The integrated performance of the core spray system in conjunction with other CSCS's and the core CHAPTER 06 6.5-5 REV. 27, APRIL 2019
PBAPS UFSAR spray system operating alone is given in references 4, 5, 6, 7, 8, 9, and 10.
When vessel pressure decreases to a value below the shutoff head of the core spray pump, core spray injection begins. The core is thus covered with water and the cladding temperature drops to near saturation value.
As shown in Figure 6.3.1, there is a break size below which core spray alone cannot protect the core. For these small breaks the vessel pressure would not drop rapidly enough to allow sufficient core spray injection before the cladding hot spot reaches an excessively high temperature. Below this break size, either the HPCIS or the ADS extends the range of the core spray system by providing additional depressurization of the vessel.
6.5.3.4 Low-Pressure Coolant Injection System The LPCIS is provided to automatically reflood the reactor core in time to limit cladding temperatures after a nuclear system LOCA when the reactor vessel pressure is below the shutoff head of the pumps. LPCIS cools the core by flooding. With assistance of the ADS, HPCIS, or Core Spray System the LPCIS can independently supply sufficient cooling to meet the safety objective for any rupture of the nuclear system boundary up to and including the design basis accident. For large Recirculation suction line breaks, the core is quickly reflooded with a two-phase mixture and the fuel rods are cooled to saturation temperature. Eventually as the decay heat falls off, reactor water level drops to approximately 2/3 core height which is below MSCRWL. To maintain long-term adequate core cooling one loop of Core Spray injection at design spray flow (6250 gpm) is required in addition to LPCI injection when reactor water level is below the MSCRWL.
For the first few seconds of a LOCA the feedwater and recirculation pumps coast down, providing makeup to the system and nearly normal recirculation flow. Reactor pressure is initially maintained primarily as a result of the release of stored energy in the core and the action of the initial pressure regulator closing turbine control valves to maintain reactor pressure. The liquid inventory decreases rapidly, limited by the critical flow rate through the break.
The LPCI control system opens its injection valves on each LPCI line to the reactor vessel. When the nuclear system pressure decreases to the shutoff head of the LPCI pump, a check valve in each injection line opens and water is pumped directly into the core region of the reactor vessel via the reactor recirculation piping. Once the vessel pressure drops below the shutoff head of the pumps, the LPCI flow accumulates inside the shroud and raises CHAPTER 06 6.5-6 REV. 27, APRIL 2019
PBAPS UFSAR the water level. As the level reaches the bottom of the core and enters the fuel channels, the coolant contacts the hot fuel rods and causes the water to flash vigorously to steam. Flashing increases the void fraction and momentarily raises the pressure.
Consequently, the water level rises. Because evaporation and spill-over through the jet pumps depletes the liquid mass, the water level drops again. This effect recurs until the fuel rods have cooled to a point where flashing can no longer be sustained.
At this point the water level no longer cycles and provides the flooding required to cool the fuel rods. Note that intermittent cooling associated with the reactor level cycling is almost entirely suppressed by the depressurization action of HPCIS or auto-depressurization.
The capability of the LPCIS to limit cladding temperatures for the design basis accident is illustrated in references 4, 5, 6, 8, 9, and 10.
6.5.4 Integrated Operation of Core Standby Cooling Systems The previous discussion describes the individual performance and operation of each of the CSCS's.
The maximum average planar linear heat generation rates (MAPLHGR) calculated in the LOCA performance analysis provide the basis by which conformance to the acceptance criteria of 10CFR50.46 is ensured. For each core reload, a cycle specific analysis is performed to determine the MAPLHGR for each new reload fuel design. The new MAPLHGRs are documented in the cycle specific Supplemental Reload Licensing Report (SRLR). The MAPLHGR information from the SRLR is used in the development of the cycle specific Core Operating Limits Report (COLR).
CHAPTER 06 6.5-7 REV. 27, APRIL 2019
PBAPS UFSAR 6.5 SAFETY EVALUATION REFERENCES
- 1. Slifer, B. C., "Loss-of-Coolant Accident and Emergency Core Cooling Models for General Electric Boiling Water Reactors,"
General Electric Company, Nuclear Energy Division, NEDO-10329, April 1971.
- 2. Deleted.
- 3. Deleted.
- 4. "Loss-of-Coolant Accident Analysis for Peach Bottom Atomic Power Station Unit 2," General Electric Company, NEDO-24081, December 1977, including Revision 5 of January 1980.
- 5. "Loss-of-Coolant Accident Analysis For Peach Bottom Atomic Power Station Unit 3," General Electric Company, NEDO-24082, Addendum 3, February 1981.
- 6. "Evaluation of ECCS Performance in Conformance with 10CFR50 Appendix K." For Peach Bottom Atomic Power Station submitted to the NRC, July 1975.
- 7. "Core Spray Line Crack Analysis for Peach Bottom Atomic Power Station Unit 3," General Electric Company, MDE-227-1085, October 1985.
- 8. "The GESTR-LOCA and SAFER Models for the Evaluation of the Loss-of-Coolant-Accident, Volume III, SAFER/GESTR Application Methodology," NEDE-23785-1-PA, General Electric Company, Revision 1, October 1984.
- 9. "General Electric Company Analytical Model for Loss-of-Coolant Accident Analysis in Accordance with 10CFR50 Appendix K," NEDO-20566A, General Electric Company, September 1986.
- 10. "Peach Bottom Atomic Power Station, Units 2 and 3 SAFER/GESTR-LOCA Loss of Coolant Accident Analysis NEDC-32163P, January 1993.
- 11. GE Letter, G. R. Hull to H. J. Diamond, "Peach Bottom 2 and 3 SAFER/GESTR-LOCA Report, GRH: 93-015, February 5, 1993.
- 12. PEOC Energy Company to U.S. Nuclear Regulatory Commission, 10CFR50.46 Reporting Requirements (submitted annually as needed).
- 13. Deleted.
CHAPTER 06 6.5-8 REV. 27, APRIL 2019
- 14. Deleted.
- 15. Deleted.
- 16. Deleted.
- 17. Final Safety Evaluation of NEDC-33256P, NEDC-33257P, and NEDC-33258P, "The PRIME Model for Analysis of Fuel Rod Thermal-Mechanical Performance," dated January 22, 2010 (ADAMS Package Accession No. ML100210284).
- 18. PEAM-MPLUS-15: GEH Task Report 0000-0162-2354-R0, MELLLA+
T0407, ECCS-LOCA Performance.
CHAPTER 06 6.5-9 REV. 27, APRIL 2019
PBAPS UFSAR 6.6 INSPECTION AND TESTING Each active component of the CSCS provided to operate in a design basis accident is designed to be testable during normal operation of the nuclear system. However, not all components are tested during normal operation. Exceptions are described in appropriate sections of the SAR.
The HPCIS, ADS, and core spray system have no normal process uses and, therefore, are tested to provide assurance that the CSCS will operate to effectively cool the reactor core in an accident. The four LPCI pumps may be placed in use as part of the RHRS and, if so, their status is known from normal process uses. However, the LPCI pumps are tested no less frequently than the rest of the CSCS.
Pre-operational tests of the CSCS were conducted during the final stages of plant construction, prior to initial startup. These tests assured the proper functioning of all controls and instrumentation, pumps, piping, and valves. System reference characteristics, such as pressure differentials and flow rates, were documented during the pre-operational tests and were used as base points for measurements obtained in the subsequent operational tests.
During plant operations, the pumps, valves, piping, instrumentation, wiring, and other components outside the primary containment can be visually inspected at any time. Components inside the primary containment can be inspected when the drywell is open for access. Spargers and other internals can be inspected when the reactor vessel is open for refueling or other purposes.
Inspections are in accordance with the Inservice Inspection Program. The testing frequencies of most components of the CSCS are correlated with the testing frequencies of the associated controls and instrumentation. When a pump or valve control is tested, the operability of the pump or valve and the associated instrumentation is also tested by the same action.
When the system is tested, the operation of most of the components is indicated in the control room. There are exceptions which require local observation at the components and may require special tests for which there are special provisions and methods.
The main steam relief valves are removed as scheduled at refueling outages for bench tests, which include "as found" data, and setting adjustments. Bench tests of the automatic depressurization valves are discussed in subsection 4.4, "Nuclear System Pressure Relief System."
CHAPTER 06 6.6-1 REV. 22, APRIL 2009
PBAPS UFSAR Process flow-operated check valves are tested in place either with the system pump or through test connections provided for this purpose.
The proper position of manual valves which do not have control room position indication for the accident mode is indicated by flow or pressure instrumentation during the system tests and after maintenance. Credit is also taken for administrative controls to ensure proper manual valve position.
Containment penetrations for CSCS processes are local leak rate tested in accordance with 10CFR guidelines.
The portions of the CSCS requiring pressure integrity are designed to specifications for in-service inspection to detect defects which might affect the structural and pressure retaining performance. The reactor vessel nozzles receive particular attention. Records are kept of the number of design basis thermal cycles which affect such components.
A design flow functional test of the HPCIS up to the normally closed pump discharge valve is performed during normal plant operation by pumping water from the condensate storage tank through the full flow test return line back to the condensate storage tank. The HPCIS turbine-pump is driven at its rated output by steam from the reactor. The suction valves from the suppression pool and discharge valves to the reactor feedwater line remain closed during the test.
HPCIS test conditions are tabulated on the HPCIS process flow diagram (Drawing M-1-DD-6). If an initiation signal occurs while the HPCIS is being tested, the system returns to the automatic startup mode. If testing does prohibit the automatic initiation of the system, the system must be in a Technical Specification Action statement.
The HPCIS may be tested at full flow to/from the CST at any time except when the reactor vessel water level is low, drywell pressure is high or the suction valves from the suppression pool are open. Low CST level indirectly inhibits the testing by opening the suppression pool suction valves which then close the CST suction valves.
The pump discharge valves are tested by operating the remote control switch and observing the valve position lights.
The air-operated testable check valve outside the drywell is tested by using a remotely controlled actuator and observing the indicating lights in the control room. To assure proper operation of the valves and strainers when pumping from the suppression pool, Torus Suction Valve, CHK-2(3)-23B-61 is tested by disassembly per IST program requirements and the Torus Suction CHAPTER 06 6.6-2 REV. 22, APRIL 2009
PBAPS UFSAR Strainer is tested by visual inspection per ISI program requirements.
Each loop of the core spray system may be tested during reactor operation. The test conditions are tabulated on the core spray system process diagram (Figure 6.4.2). Testing of the system involves operating each pump individually from the torus back to the torus. To test the injection portion of the system, using demineralized water, the reactor must be shut down and depressurized. This prevents unnecessary thermal stresses.
The core spray pumps may be tested at rated flow through the full flow test valve to the suppression pool by use of the remote manual switches located in the control room. Proper operation is determined by observing the instruments in the control room. The core spray system outside the drywell is checked for leaks once per operating cycle.
The two motor operated injection valves are tested by alternately closing one and cycling the other, and observing the position indicator lights. The test ends with the inboard valve closed (nearer the drywell) and the outboard valve open.
The pneumatically operated testable check valve inside the drywell is tested during reactor cold shutdown conditions and when primary containment is deinerted and accessible, using a remotely controlled actuator and check equalizer valve by observing the indicating lights in the control room.
If an initiation signal occurs during the test, the core spray system is signalled to start and the system returns to the automatic startup mode.
Similarly, LPCI pumps and valves can be tested during reactor operations. With the injection valves closed and the return line open to the suppression pool, full flow pumping capability is demonstrated. The testable check valves can be operated as described previously for the core spray valves, and the injection valves can be tested separately. The system test conditions during reactor shutdown are shown on the RHRS (LPCI) process diagram (Drawing M-1-DD-9). The portion of the LPCI outside the drywell is also inspected for leaks once per operating cycle.
Controls and instrumentation are tested as described in subsection 7.4, "Core Standby Cooling Systems Control and Instrumentation."
Upon receipt of an LPCI initiation signal during tests, the valves in the test bypass lines are closed automatically to assure that the LPCI pump discharge is routed properly to the reactor vessel.
In addition, shutdown cooling system valves would automatically close on decreasing reactor level prior to the LPCI initiation signal.
It is concluded that safety design basis 7 is satisfied.
CHAPTER 06 6.6-3 REV. 22, APRIL 2009
PBAPS UFSAR 6.7 CONFORMANCE OF PEACH BOTTOM ATOMIC POWER STATION UNITS 2 AND 3 EMERGENCY CORE COOLING SYSTEMS TO AEC/NRC INTERIM ACCEPTANCE CRITERIA FOR LIGHT WATER REACTORS This subsection is historical data which was submitted to AEC/NRC to document the acceptance of the emergency core cooling system (ECCS) under reference 2 of this subsection. The present ECCS is described in subsections 6.1 through 6.6.
6.7.1 Introduction The following report is submitted in response to an AEC/NRC request for additional information(1) on the conformance of the Peach Bottom Units 2 and 3 facility to the newly adopted AEC/NRC interim criteria which have since been incorporated into 10CFR50.46(2). This document (its contents and references) fully describes the basis for the acceptance of the ECCS's for Peach Bottom Units 2 and 3.
6.7.2 Request for Additional Information "1. Provide curves of peak clad temperature and percent clad metal-water reaction as a function of break size for the various combinations of ECC subsystems evaluated by using the single failure criterion indicated in Table 2-1 of the topical report: 'Loss-of-Coolant Accident and Emergency Core Cooling Models for General Electric Boiling Water Reactors,' NEDO-10329. A discussion should be included showing the justification for the ECC subsystem combinations used in the evaluation.
- 2. For several breaks that typify small, intermediate, and large breaks, provide curves of (a) peak fuel clad temperature for various rod groups, (b) core flow, (c) fuel channel inlet and outlet quality, (d) heat transfer coefficients, (e) reactor vessel water level, and (f) minimum critical heat flux ratio (MCHFR) as functions of time. Indicate the time that effective core cooling is initiated, the time the fuel channel becomes wetted based upon Item 4 of Appendix A, Part 2, and the time that the temperature transient is terminated.
- 3. For the analyses performed in 1 and 2 above, discuss the range of peaking factors studied and the basis for selecting the combination that resulted in the most severe thermal transient. Curves of peak clad CHAPTER 06 6.7-1 REV. 27, APRIL 2019
PBAPS UFSAR temperature versus time for the range of peaking factors studied should be included.
- 4. Discuss in detail any deviations in the evaluation model used in the foregoing studies from that described in Appendix A, Part 2 of the Commission's Interim Policy Statement."
6.7.3 Additional Information Response The enclosed information is supported and supplemented by the appropriate cited references previously submitted on these dockets.
General Following General Electric's request for a generic review of the ECCS's analytical models approximately 1 yr ago, the AEC/NRC DRL staff has been re-evaluating the models and assumptions employed in the design and performance of the ECCS's for the BWR.
No major concern was uncovered during this review, completed in December, 1970, that changed the confidence of the General Electric Company nor the Applicant that the systems provided on BWR's were fully adequate in every respect. Following the review, the General Electric Design Basis Assumptions and models were documented in detail in General Electric Topical Report NEDO-10329 and submitted on April 9, 1971. Following submission of that report and further study by a senior DRL task force and the Advisory Committee on Reactor Safeguard (ACRS), an additional series of sensitivity studies were orally requested by the AEC/NRC on April 16, 1971, from General Electric. In response to these specific questions, Supplement #1 to the cited topical report was submitted on April 29, 1971. These sensitivity studies encompassed a number of key assumptions including most of those later included in the AEC/NRC "Interim Acceptance Criteria." The ECCS's were again found to be fully acceptable. On May 24, 1971, the AEC/NRC requested an additional set of calculations employing all the assumptions included in the AEC/NRC "Interim Acceptance Criteria for ECCS" of June 19, 1971, and the ECCS's were again found to be fully adequate. Oral responses to this request were transmitted to the AEC/NRC task force on May 28, 1971.
The General Electric and Applicant position is that the prior design bases employed by General Electric as fully documented in Topical Report NEDO-10329 summarized in all FSAR/PSAR's are still appropriate and do indeed provide a conservative evaluation of the ECCS's performance. The new AEC/NRC "Interim Acceptance Criteria for ECCS" issued on June 19, 1971, are viewed by the General CHAPTER 06 6.7-2 REV. 27, APRIL 2019
PBAPS UFSAR Electric Company and the Applicant as providing a more conservative index for further assurance of ECCS's acceptability.
In order to be fully responsive to all aspects of the new AEC/NRC criteria, conformance to this new index of acceptability is being documented herein to complete the safety analysis for this project. To place all the results in proper context, the previously submitted General Electric and Applicant Design Basis documentation is compared in Table 6.7.1 with all the temperatures and models considered. This comparison provides an appropriate indication of the magnitude of margin which exists in the General Electric/Applicant Design Basis, as well as the extensive margin which exists in this new AEC/NRC index to appropriate limits.
Included below in this document is a discussion of the application of all the AEC/NRC Criteria, assumptions as well as the results demonstrating acceptability and the results of the requested analyses. The responses to the cited questions provide further details which give insight into the analytical models and provide an understanding of the effect of key parameters in regard to the calculated peak clad temperatures.
Discussion of AEC/NRC General Criteria The general acceptance criteria which must be met by all light water reactors are listed in Section IV A, page 7, of the AEC/NRC Interim Acceptance Criteria and are discussed below.
A. AEC/NRC Criteria (for all light water power reactors)
The general requirements have been the basis of AEC/NRC safety review for some time. On the basis of today's knowledge, the performance of the ECCS is judged to be acceptable if the calculated course of the LOCA(1) is limited as follows:
(1) "A loss-of-coolant accident is a postulated accident that results from the loss of reactor coolant at a rate in excess of the capability of the reactor coolant makeup system from breaks in the reactor coolant pressure boundary, up to and including a break equivalent in size of the double ended rupture of the largest pipe of the reactor coolant system."
CHAPTER 06 6.7-3 REV. 27, APRIL 2019
- 1. "The calculated maximum fuel element cladding temperature does not exceed 2,300°F. This limit has been chosen on the basis of available data on embrittlement and possible subsequent shattering of the cladding. The results of further detailed experiments could be the basis for future revision of this limit."
- 2. "The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1%
of the total amount of cladding in the reactor."
- 3. "The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling, and before the cladding is so embrittled as to fail during or after quenching."
- 4. "The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core."
B. GE/Applicant Position On AEC/NRC General Acceptance Criteria
- 1. The maximum temperature limit of 2,300°F for any size break anywhere in the reactor system is met, even when using the new conservative AEC/NRC assumptions. This index of acceptability is based upon limiting the oxidation of the Zircaloy cladding to avoid embrittlement and possible fragmentation upon cooldown. General Electric believes there is considerable margin in this number which should be recognized as being present. As discussed in detail in Pilgrim Nuclear Power Station, Unit 1, Amendment #14 (AEC/NRC Docket No. 50-293), a limit of 2,700°F appears reasonable for the times of interest to BWR ECCS's. Even this latter value is conservative since the test data show embrittlement only for material which was taken to considerably higher temperatures than 2,700°F.
- 2. The metal-water reaction limit of 1 percent of the active fuel cladding in the core is met, since the maximum metal-water reaction for this plant is less than 0.12 percent of the active fuel rod cladding using all the AEC/NRC assumptions. This CHAPTER 06 6.7-4 REV. 27, APRIL 2019
PBAPS UFSAR is conservative by at least a factor of 2:3 when compared to data. Therefore, it is well below the AEC/NRC limit of 1 percent. For breaks smaller than the design basis accident, the core metal-water reaction is even less. The AEC/NRC limit of 1 percent metal water appears reasonable provided it is used consistently, and is recognized that it is nearly a decade above the calculated value.
However, metal-water reaction is a surface phenomenon and a better criterion would be to base the metal-water reaction on cladding surface area rather than the total weight Zircaloy in the cladding.
- 3. Clad embrittlement is avoided for all breaks up to and including the design basis accident, since the temperatures are well below 2,300°F. Locally and throughout the core, the degree of metal-water reaction is very low compared to that which causes embrittlement upon cooldown. Even at a postulated peak of 2,250°F and for times well in excess of those which occur in the reactor, the maximum local metal-water reaction is only 5.1 percent, determined experimentally and reported in a GE report (GEAP 13112, p. 49). This compares to about 17 percent required to reach fragmentation.
It should be recognized, however, that even with clad fragmentation, the ECCS's have a high probability of success in terminating the temperature transient and this is built-in margin that is present.
- 4. For any single failure as outlined in NEDO-10329, there will be at least one core spray. Also, within a short time the core refloods to the 2/3 elevation. Thus, once the core is flooded, the temperature remains at saturation indefinitely.
However, even with no sprays, the core when flooded to the 2/3 elevation will limit the peak temperature to below 900°F as documented in detail in Quad Cities, Units 1 & 2, Amendment #26 (AEC/NRC Docket Nos. 50-254/265). This is applicable to all BWR's. Thus, the long-term core cooling is assured redundantly in the BWR.
Whenever there is either a core spray in operation or flooding action occurring, long-term cooling occurs. This situation is outlined in NEDO-10329 and is documented in both Quad Cities, Units 1 &
2, Amendment #26 (AEC/NRC Docket Nos. 50-254 & 50-CHAPTER 06 6.7-5 REV. 27, APRIL 2019
PBAPS UFSAR 265) and Zimmer Nuclear Station, Unit 1, Amendment
- 12 (AEC/NRC Docket No. 50-358).
Discussion of AEC/NRC Assumptions The evaluation was performed using the new conservation AEC/NRC Assumptions with no deviations. The AEC/NRC assumptions to be used in conjunction with the models in Topical Report NEDO-10329 are given in Appendix A, Part 2, of the AEC/NRC policy statement of June 19, 1971, "Interim Criteria for Emergency Core Cooling Systems for Light Water Reactors," Page 17, which states:
"Analyses should be performed for the entire break spectrum, up to and including a double-ended severance of the largest pipe of the reactor coolant pressure boundary. The combinations of systems used for analysis should be derived from a failure mode and effects analysis, using the single failure criterion as indicated in Table 2-1 of the topical report 'Loss of Coolant Accident and Emergency Core Cooling Models for General Electric Boiling Water Reactors,' NEDO 10329." The analytical techniques described in NEDO-10329 and its supplement should be used with the following exceptions.
AEC/NRC Exception 1:
"During the period of flow coastdown after the minimum critical heat flux ratio at the hot spot is less than one and until the top of the jet pumps uncover, the heat transfer coefficient should be calculated using the D.C. Groeneveld correlation (AECL-3281, equation 5.7)."
GE/Applicant Comment:
In most BWR plants, including Peach Bottom Units 2 and 3, the LOCA leads to uncovering the tops of the jet pumps prior to the occurrence of the critical heat flux condition. Therefore, this exception is not necessary.
AEC/NRC Exception 2:
"During the period of lower plenum flashing until the core becomes uncovered, the heat transfer coefficient should be calculated using Groeneveld's Correlation as in 1 above."
GE/Applicant Comment:
The Groeneveld Correlation was applied during this period as directed. However, it is grossly conservative for two reasons.
First, when the hot spot reaches the critical heat flux, it has CHAPTER 06 6.7-6 REV. 27, APRIL 2019
PBAPS UFSAR been experimentally determined that actual dryout and film boiling is delayed for several seconds, thus removing an additional amount of stored heat during blowdown. Secondly, preliminary data indicate that rewetting will occur and nucleate boiling become re-established during lower plenum flashing when a surface temperature drops below a given value. The General Electric design basis heat transfer coefficient is an attempt to include in an analytically simple manner the combined phenomenological effects above. It is hoped that additional future experimental work in this area will demonstrate with sufficient assurance to the AEC/NRC that the GE design basis is, indeed, sufficiently conservative.
AEC/NRC Exception 3:
"The heat transfer coefficients associated with rated core spray flow should correspond to those derived from experimental data, assuming the cladding and channel box emissivity is equal to 0.9."
GE/Applicant Comment:
As indicated in Supplement 1 to NEDO-10329, the best agreement with the data for core spray convection coefficients is obtained with an assumed emissivity of 0.6 or 0.7. Actual measurements of the emissivity of the heaters used in the tests also indicate a value of 0.6 to 0.7 should be used. However, as shown in Supplement #1 to NEDO-10329, the assumed value of emissivity has only a small effect on the resulting coefficients and only a minor effect on the predicted cladding temperature response if applied in a consistent manner. The analyses using AEC/NRC assumptions employ a test bundle emissivity of 0.9.
AEC/NRC Exception 4:
"It should be assumed that channel wetting does not occur until 60 seconds following the wetting time calculated using the Yamanouchi analysis."
GE/Applicant Comment:
For those cases in which core spray is the ECCS cooling mechanism, the time at which the channel box is cooled by rewetting is an important variable on which extensive experimental data now exists. The Yamanouchi analysis is one of the more rigorous treatments of this effect. The General Electric design basis involves a conservative fitting of the Yamanouchi-derived data encompassing two-thirds of all the points. As required by the AEC/NRC exception, the fitting has been made more conservative by adding 60 sec to the best fit of the Yamanouchi data and thus encompassing over 96 percent of data. This is obviously more CHAPTER 06 6.7-7 REV. 27, APRIL 2019
PBAPS UFSAR conservative; however, it has been employed in the analyses as instructed.
AEC/NRC Exception 5:
"A range of conservatively calculated peaking factors should be studied and the combination selected which results in the most severe thermal transient for the break spectrum and combinations of systems analyzed."
GE/Applicant Comment:
A parametric study was performed to determine the worst set of peaking factors for the two assembly gadolinia fuel design of Peach Bottom Units 2 and 3. The range of peaking factors studied included variations of the outside rod peaking factors from 1.24 to 0.94; central rod peaking factors varied from 0.85 to 1.02. The combination that resulted in the most severe thermal transient was selected by performing the core heatup analyses with the various possible distributions of peaking factors which occur as a function of bundle exposure.
Due to the nature of the heat transfer during core spray cooling, the "highest" local peaking is not the worst peaking factor combination in the bundle which results in the highest temperatures. The worst peaking combination is the flatter shape in which the central rods have higher relative power. Thus, the peaking factor distributions calculated as a function of exposure have been examined and the one which results in the highest fuel cladding temperatures following a LOCA is the one chosen as the "worst" local peaking. The maximum linear power generation used in conjunction with this range of peaking factors corresponds to the maximum attainable within Technical Specification limits for the particular fuel exposure/peaking factor combination studied.
The same approach of using the worst peaking was used to determine the maximum temperatures for the small break analyses.
Figures 6.7.13 through 6.7.18 are curves of peak cladding temperature versus time showing the results of this generalized study. Figure 6.7.18a shows that, for this class of cores, the maximum cladding temperatures are not significantly affected by the change in local peaking factors with exposure. The exposure, resulting in the worst-case peaking factors for this class of cores, is shown in Figure 6.7.18a.
AEC/NRC Exception 6:
"The decay heat curve described in the proposed ANS Standard, with a 20 percent allowance for uncertainty, should be used. The fraction of decay heat generated in the hot rod should be CHAPTER 06 6.7-8 REV. 27, APRIL 2019
PBAPS UFSAR considered to be 100 percent of this value unless a smaller value is justified. The effect of voids on reactivity during the blowdown may be taken into account."
GE/Applicant Comment:
The design basis for power generation within the fuel rods during the LOCA has been a standard for a considerable period of time.
This standard, which is reported in NEDO-10329, involves the use of the ANS standard for decay heat with a conservative treatment of the heavy isotopes as well as no credit for voiding or flow decay. This was felt to be sufficiently conservative to become an appropriate standard for all BWR analyses.
By AEC/NRC Exception 6, this standard was modified as instructed.
Rather than using the ANS standard, a value which is 20 percent greater is being used. A conservative interpretation of the voiding which occurs during the LOCA is now being included in the AEC/NRC requested index analyses, as well as in all future GE design basis calculations. A plot of this new power generation function is included in this report as Figure 6.7.19.
Although it is felt that the GE design basis was conservative, this AEC/NRC Exception 6 makes the power generation assumption even more conservative.
Discussion of Requested Analyses Results The following summarizes the results of the analyses requested.
The paragraph numbers correspond to the specific questions asked.
- 1. Figure 6.7.1 is a break area spectrum analysis of the peak clad temperature for the worst single failure, i.e., failure of the LPCI valve. Also shown in the Figure is the design basis accident (X) and worst intermediate break (dashed line) temperature for the worst single failure of a diesel generator. Failure of the LPCI valve in the unbroken recirculation loop will disable the entire LPCI subsystem, leaving two complete core spray systems to cool the core. Failure of the most critical diesel-generator will result in having three LPCI pumps and one core spray system.
2a. Figures 6.7.2, 6.7.3, and 6.7.4 show the peak clad temperature for four rod groups for a small, intermediate, and large break, respectively. The intermediate break size is the specific one which results in the highest peak cladding temperature in the smaller break size range.
CHAPTER 06 6.7-9 REV. 27, APRIL 2019
PBAPS UFSAR 2b. Figure 6.7.5 shows the core flow versus time for the design basis accident. The core flow transient for small and intermediate breaks is much less severe than that for the design basis accident and is similar to a pump trip transient.
This was discussed in detail in NEDO-10329.
2c. Figure 6.7.20 shows core inlet and outlet quality versus time for the design basis accident. The curve is shown for only the design basis accident because quality affects the film boiling heat transfer coefficient. For small and intermediate size breaks, nucleate boiling is assured as long as the core is covered and nucleate boiling heat transfer coefficients are independent of fluid quality. When the core uncovers, the heat transfer coefficient is assumed to be zero, even though a significant steam cooling coefficient would actually exist.
2d. Figures 6.7.6, 6.7.7, and 6.7.8 show the heat transfer coefficient versus time for the small, intermediate, and large break, respectively. The intermediate break size is the one which results in the highest peak cladding temperature in the smaller break size range.
2e. Figures 6.7.9, 6.7.10, and 6.7.11 show the reactor pressure vessel water level versus time for the small, intermediate, and large breaks. Note that core cooling is accomplished by reflooding the fuel before core spray reaches rated flow for small and intermediate break sizes. Thus, the time of channel wetting is not of interest for these cases.
2f. Figure 6.7.12 shows the MCHFR versus time for the design basis accident. Because the flow transient for the small and intermediate break sizes is very mild compared to the design basis accident, it is not shown. The MCHFR for the smaller breaks is always greater than unity as long as the core is covered and nucleate boiling is always assured.
- 3. Figures 6.7.13, 6.7.14, and 6.7.15 show the peak cladding temperature response for PBAPS Units 2 and 3 cores for three fuel exposures throughout the lifetime of the fuel for an intermediate break event. Figures 6.7.16, 6.7.17, and 6.7.18 show CHAPTER 06 6.7-10 REV. 27, APRIL 2019
PBAPS UFSAR similar results for the design basis accident.
Figure 6.7.18a clearly shows that the maximum cladding temperature occurs at 10,000 MWD/ton for the intermediate break event and for the design basis accident. These peaking factors were then used in conjunction with the actual flow and other ECCS parameters to determine the maximum temperatures for this power station.
- 4. There are no deviations from the evaluation model described in Appendix A, Part 2, of the AEC/NRC Interim Policy Statement in the above analyses.
Conclusions It is concluded that:
(a) Peak clad temperatures are well below the 2,300°F acceptability limit (b) The amount of fuel cladding reacting with steam is nearly an order below the 1 percent acceptability limit (c) The clad temperature transient is terminated while core geometry is still amenable to cooling (d) The core temperature is reduced and the decay heat can be removed for an extended period of time.
6.7.4 Summary The ECCS's for PBAPS Units 2 and 3 are in conformance with the AEC/NRC criteria of acceptance using all the assumptions requested.
6.7.5 Effect of Revised Core Design on Emergency Core Cooling System's Analysis The recent changes in core design as described in Amendments 20, 21, and 28 of the Browns Ferry Nuclear Plant FSAR have been evaluated to determine their effect on this ECCS's analysis. The following items were evaluated:
- 1. Additional gadolinia for power shaping.
- 2. Increased cladding thickness.
CHAPTER 06 6.7-11 REV. 27, APRIL 2019
PBAPS UFSAR The results of this evaluation indicate that the modified core has lower peak clad temperatures than those listed in Table 6.7.1.
Therefore, the existing analysis is conservative for the modified core design, and it will not be revised to show the increased margins to the 2,300°F peak cladding temperature criteria.
CHAPTER 06 6.7-12 REV. 27, APRIL 2019
- 1. Deleted.
- 2. Interim Policy Statement, US AEC, dated June 19, 1971;
Subject:
AEC Adopted Interim Acceptance Criteria for Performance of ECCS for Light Water Power Reactors which have since been incorporated into 10CFR50.46.
CHAPTER 06 6.7-13 REV. 27, APRIL 2019
PBAPS UFSAR TABLE 6.7.1 PEAK CLAD TEMPERATURES Large Worst Single Break Intermediate Break Failure Temp Temp Area Assumed(1) (°F) (°F) (sq ft)
AEC/NRC Index of Acceptability 2,300 2,300 Case
- 1. AEC/NRC LPCI 2,090 1,770 0.05 assumptions Valve(2)
- 2. AEC/NRC Diesel- 1,930 1,835 0.05 assumptions Generator(3)
- 4. GE design None 1,730 1,020 0.5(4) basis
- 5. GE "best LPCI 1,400- 1,100- 0.05 estimate" Valve(2) 1,600 1,300 NOTE: Calculated metal-water reaction is less than 0.12 percent of cladding for all cases above.
AEC/NRC acceptability index is 1 percent.
(1) In addition, HPCI neglected except for Case 4.
With HPCI included, intermediate break temperature would be approximately 100°F less and worst intermediate break size would be several times larger.
(2) Two core spray systems remaining.
(3) Three flooding pumps and two 50 percent core spray pumps (one core spray subsystem) remaining.
(4) No distinct peak.
CHAPTER 06 6.7-14 Rev. 21, APRIL 2007