ML19322C014
| ML19322C014 | |
| Person / Time | |
|---|---|
| Site: | Oconee  |
| Issue date: | 01/30/1970 |
| From: | Cady K, Ross D US ATOMIC ENERGY COMMISSION (AEC) |
| To: | Boyd R US ATOMIC ENERGY COMMISSION (AEC) |
| References | |
| NUDOCS 7912200732 | |
| Download: ML19322C014 (9) | |
Text
. -.
4 4
M' R%
UNITED STATES
/h k ATOMIC ENERGY COMMISSION 9
.'2M - l WASHINGTON. D.C. ' 26545
,e
'rern e' January 30, 1970 i
3 Roger S. Boyd, Assistant Director, Reactor Projects Division of Reactor Licensing THRU:
Charles G. Long, Chief, Reactor Project Branch 3
[g(/
Division of Reactor Licensing REQUIRDIENT FOR ADDITIONAL INFORMATION ON SAFETY ANALYSES FOR THE OCONEE POLREVIEU(DOCKETS 50-2p,50-270,50-287)
We expressed a concern to Duke Power Company, at a meeting on January 21, 1970, that there was insufficient information in the safety analysis section (Chapter 14).
Specifically we thought the accident models, assumptions, codes, input parameters, and output results should be fully described.
B&W representatives stated that they thought our request was excessive and perhaps out of line with treatment afforded other vendors.
It is possible, or even likely, that they will pursue this point with their management, and ours.
As an example of our concerns and in support of our request, we have prepared Enclosure A on steam line breaks and Enclosure n nn In==-nf-r coolant accidents.
Examples of requests for similar information may be I
found on page B-5.
/N V'
e f.'s D. F. Ross K. B. Cady
Enclosures:
A&B, as stated above cc:
C. G. Long RP Branch Chiefs B. K. Grimes A. Schwencer Docket Files (3)#
RPB-3_ Reading l
Orig: DFRoss (3)
KBCady- (3)-
7912200737 M:
t
~
ENCLOSURE A STEAM-LINE-BREAK ACCIDENT ANALYSES 1.
ACCEPTANCE CRITERIA Duke has proposed in the FSAR (p 34-17) that three criterfa be met:
a)
The core will remain intact fo. ef fective core cooling, assuming minimum tripped rod worth with a stuck rod.
b)
No steam generator tube loss of primary boundary integrity will occur 6te to loss of secondary side pressure and resul-tant tempera.ure gradients.
c)
Doses will be within 10 CFR 100 limits.
We agree with these criteria, but believe that we should assume that nonsafety systems (such as the integrated control system and the oper-ator) either f ail to act or act in an adverse manner.
If criteria (b) on tube rupture cannot be met, then we believe that much more stringent core criteria, such as no core DNB, would be appropriate.
2.
ANALYSES PRESENTED The app'licant thinks that EOL when the moderator coef ficient is most negative, and full pcwer uhen the once-through s team generator has its maximu= inventory are the most conservative initial conditions for the steam-line-bteak accident.
He nas presented an analysis in the FSAR for these initial conditions, a minimum tripped rod worth of 3.46% ak/k (approximately equivalent to a power defect of 2.3% ik/k and a hot shutdown margin of 1% ak/k) under the additional assumption that the reactor trip signal causes a power demand runback in the integrated control system which in turn closes the feedwater valves to isolate the broken steam generator.
He has also assumed that the operator takes positive action to ensure that the feedwater valves do not reopen on low steau generator level.
The applicant claims that the core remains 0.4% suberitical after reactor trip.
In a cingle paragraph (FSAR 14-20) the applicant mentions three other cases assuming no operator action.
Feu details are given. With nominal or minimum shutdown margins assuming a stuck rod the applicant predicts returns to criticality and 25% to 35% rated power.
Because of the high peaking factors associated with the s tuck-oct rod, this may lead to fuel. pin or cladding damage.
The applicant has not addressed himself to these problems.
Similarly, the applicant has not addressed himself to the problem of failure of the integrated control system to close the feedwater valves.
A-2 3.
INPUT DATA We do not have an adequate description of the input data to the code analysis.
For instance, we do not know the time delays assumed for the load demand runback causing the main feedwater valves to close (the FSAR indicates on page 14-22 a runback to zero flow in 10 seconds (6 seconds af ter reactor trip to 16 seconds); while an oral presentation by B&W used a 25-second runback time.
Similarly, the assumed operation of the emergency FW valves and pumps is not described quantitatively.
4.
SEQUENCE OF EVENTS AND RESULTS We do not have a careful description of the sequence of events for the most severe accidents such as those uhere the operator and/or the integrated control system fail to isolate the feedwater valves.
5.
!!ODEL AND CODE We have a brief description of the physical model contained in the proprietary, nameless code used by B&W.
It is c hybrid, analog-digital model of secondary and primary system and includes many important features of the plant including MJ valves, turbine s top valves, reactor heat transfer, reactor kinetics, and pressurizer.
We have no reason to believe the model is inadequate, but we are not able to evaluate this because it is proprietary.
B&W has not submitted a description giving equations, principal assumptions, required input parameters, etc.
6.
WHY SUCH INFOP2!ATION IS REOUIRED There are several serious concerns which must be resolved:
a)
Will the reactor trip signal guarantee the turbine stop valves will trip as needed to isolate the unbroken steam generator steam outlet? The applicant was unable to tell us whether the turbine trip system sr parts of it would meet IEEE-279 or its equivalent.
b)
Will the integrated control system (a nonprotection system) function to close the feedwater valves? We have serious reserva-tions on relying on an unreviewed nonprotection system to provide a safety function.
c)
Can the operator be relied on to keep the integrated control system from reopening the feedwater valve to the affected stear generator when the icw level limit is reached?
B&W admits this is required to avoid a return to criticality.
A-3 For thi-reason and the possibility that the integrated control system cannot be relied on to isolate feedwater, we believe that more < vere accidents threatening-the reactor core integrity may to possible.
d)
The dif ferential temperatures for the more severe accidents referred to above must be obtained to know whether these accidents cause thermal stresses suf ficient to endanger steam generator tube integrity in the once-through steam generator.
e
ENCLOSURE B LOSS-OF-COOLANT ANALYSIS FOR OCONEE POL 1.
FSAR INFOPJfATION a.
General The core performance aspect of the LOCA is described in Chapter 14 of the Oconee FSAR, pages 14-36 through 14-57, and Figures 14-31 through 14-55.
The accident bases are that the ECCS should ensure core cooling after the accident and that core geometry will not be lost.
It is asserted that this would be accomplished if the clad temperature were kept below melting, but that 2300* F was established as a design limit in considera-tion of metal-water reactions.
Clad temperatures were analyzed for a spectrum of hot-and cold-leg breaks.
b.
Hydraulic Model A modified version of FLASH (reference WAPD-TM-534) was used for blowdown.
Modifications include:
(1)
RC pump cavitation based on cold-leg rather than hot-leg vapor pressure.
(2)
Core flooding tanks have been added.
(3)
A variable bubble rise velocity (function of pressure) has been added.
(4)
Core barrel vent valves were accounted for.
As in FLASH, three control volumes were used.
All of the leak was assumed to occur in the control volume in which the pipe appears.
Core power uas j
dete rmined by CHIC-KIN.
The FLASH outputs of pressuce, tempe ra ture, mass,
energy and hydraulic characteristics are input into the core thermal code (QUENCH) and the reactor building pressure buildup code (CONTEMPT).
c.
Core Thermal Model.
i A digital conputer program, QUENCH, was developed to simulate core thermal transients f rom start of blowdown until recovery.
Transient clad and fuel temperatures are determined; metal-water re actions are considered. Up to 50 equi-volumes of the core can be simulated, with a choice of power distri-bution.
Surface heat transfer coefficients are obtained from FLASH.
l 5
m
B-2 d.
ECCS Desien Bace Accident The 36-inch outlet-pipe rup tu re (14.1 ft ) dictates the ECCS design.
During bloudown it is predicted (by W-3 correlation) that nucleate boil-ing would exist at least for the first 4 seconds; at that time the pressure and heat flux would be beyond the W-3 correlation range.
How-ever DMB vas assumed at 0.25 second, followed by dispersed-flow film boiling.
From 0.25 to 9.5 seconds Quinn's correlation is used for the surface heat transfer coefficient, using FLASH-predicted flow rates.
Af ter blowdcwn no care cooling is assumed until core recovery starts.
In determining peak clad temperatures no cooling is assumed for that portion of the core above the waterline.
When the quiet water level reaches the hot-spot ( 3 feet below core midplane) an h of 20 la assumed.
The maximum clad temperature as a function of core life for the DBA was computed using these assumptions:
(1)
DNB at 0.25 second, (2) heat transfer during remainder of blowdown f rom Quinn's co rrela tion,
(3) no steam cooling during core recovery, (4) no control rod scram (void shutdown only),
(5) variable (with burnup) moderator coef ficient, and (6) design clad gap clearance of 8.5 mils.
The maximum clad temperature is 1850* F and occurs at BOL.
Sensitivity s tudies were perfo rmed.
Raising the moderator coefficient from +0.5 to +0.9 x 10-4 raises maximum clad temperature to 2000* F.
Letting D"B occur at t= 0 (instead of 0.25 second) raises maximum clad temperature 8* F.
Decreasing Quinn's h value by 207. raises maximum clad temperature, from the nominal value of 1850* F, to 1967* F.
c.
Core Integrity
"^"' i" ir pr:grasa un vesification that perforation or deformation failure of fuel rods will net prevant effect ve ECCS action.
These data i
and subsequent analyses should become available later in 1970.
f.
Spectrum of Breaks Core cooling evaluations were performed for 5 additional sizes of hot-leg breaks, and 5 cold-leg break sites (from 3.5 ft2 down to 0.4 2
ft ).
The maximum clad temperature for the cold-leg break is 1622* F.
Steam cool-ing is assumed during the reflooding stage.
~.
.B-3 Analyses were done for reduced effect of vent valves, and for diversion of injection water, g.
Small Breaks A small break analysis was done.
For rupture sizes 4-inch diameter and larger, the primary pressure drops below 600 psig and the core flooding tanks operate.
A 4-inch diameter break was analyzed, assuming only one HP pump works.
The core never uncovers.
Nucleate boiling is assumed in i
the core'for 50 seconds (until pressuriser is empty) at which time pool film boiling (h = 100) is used. Ma:cimum clad temperature is 760' F.
If DNB is assumed at 4 seconds (when reactor and primary pumps trip)
TCLAD-MAX = 1020' F.
l i
h.
Other i
An evaluation was made for the case where one low-pressure injection line i
failed.
The consequences were less than the design basis break.
Per-formance of the ECCS was evaluated for the spectrum of breaks. One HP j
pump can protect the core for leaks up to 4-inch diameter.
One HP ind j
one LP pu=p is sufficient up to 10-inch diameter.
}
pumps protect up to 1 ft2, and for larger areas one HP, one LP and the j
flooding tanks are sufficient.
2.
DRL CONCERNS
)
We have a number of concerns about the LOCA analysis which, when taken l
as a whole, lead to the request for a more complete disclosure by B&W.
To illustrate this point, the following questions have been. formulated.
1 a.
Why is 2300* F conservative, and why is maintenance of clad temperatures "below melting" considered relevant?
b.
What are the limits of a three-volume blowdown code.
c.
How does the variable-bubble-rise velocity model'(which was not described) affect such phenomena as break area quality, froth water level, and height-dependence of vapor density in the two-phase mixtures?
d.
Since ECCS. initiation set-point (1500 psi).is below saturation pressure in the hot-legs, how much pri=ary inventory can be lost when, for small breaks, there is a' pressure hangup above 1600 psi?
Note:
This is a significant. point.
Breaks of area ~0.1 ft2 can have pressure hangups for 1 minute or more. A G-value of >103 lb/see could ' result, with mass-loss of 50-100,000 lbs.
The pressurizer only holds Labout that much.
l l
l l-t L.:
3-4 c.
QUENCH only has 1 fuel node, CE has 2 (MIDAS code), W has 3, and GE has 4.
We wonder to what extent this masks high centerline fuel temperatures.
f.
It is not obvious why Quinn's correlation can be used.
It was 1000 psia, steady-state data.
For 0-6 seconds, this heat-transfer coef ficient is below CE values and above W; af ter that time the situation reverses.
However we observe, from Figure 14-35 of the FSAR, that the core is completely uncovered at the end of 4 seconds.
Perhaps ue can think of a core completely uncovered, but with 20,000 lb/see flow (f rom Figure 14-33).
Perhaps not.
g.
Figure 14-33 shows core flow vs time for the 14.1 f t2 hat-leg bteak.
S teady-s ta te (t : 0) flow is about 40.: 103 lb/sec.
At t = 1.1 sec flow has decreased to 2 x 103 lb/sec, and then increases to 45 x 103 lb/sec at 2.2 sec.
Flow rate creases monotonically thereaf ter.
We would like an explana-tion of the increase, h.
No cold-leg flow rates vs time are presented.
We have run RELAP 2 (also a three-volume code) and get flow reversals for cold-leg breaks.
B&W apparently does not considee this cred1 Lie, oad thetefvie dues not present the duca.
If flow reversal does occur, then it seems that blowdown heat transfer must be codified accordingly.
1.
We do not have a definition of quiet water level.
Is it the collapsed level, ignoring f roth, or is it a level 'iarch ignores boiloff?
The FSAR offers no guidance.
RELAP 2 prints out both.
j.
We don' t understand what is meant by the ESU statement that steam cooling is assumed on cold-leg breaks.
k.
On FSAR Figure 14-46, the curve for a 3.0 f t2 hot-leg break (as an example) has 4 maxima, 4 minima, and 1 bric f steady value in the depiction of clad temperature vs time. We would like to know why.
These questions are intended to establish that we are not sufficiently familiar with the procedures used by B&W to calculate ' core thermal per-formance during a LOCA.
In our wrapup of this firs t-of-a-kind for S&W, we must conclude that the LOCA analysis, admittedly a design basis for ECCS hardware, has been properly' executed. We cannot do this on the basis of the information now available in the FSAR or elsewhere.
B-5 3.
CONSISTENCY WITH OTHER APPLICANTS If it becomes of interec t, the following questions have been asked on other projects:
Indian Point 2 POL 14.3.5 Provide the conditions and results of Westinghouse fuel rod perforation tests, cladding eutectic tests, and clad shatter tests in support of your LOCA analyses and conclusions.
Provide details of the conditions for the perforation, eutectic, and shatter tests, including descriptions of the test rigs and geometries, steam flow, purity of steam and air content, fuel rod fabrication relative to commercial fabrication, fuel rod irradiation, clad heatup rate, and type of heater.
14.3.6 Provide the details of the models used to simulate the reactor internals in the blowdown load calculations using tne BLOWDN program.
Show how the code was used.
Identify those compo-nents which must survive blowdown to ensure a shutdown and coolable core.
Shc,w the logic behind their identification.
Provide the s tresses or limited deformations predicted for these components.
Point Beach POL 5.5 Present sufficient details of the comnuter analysis, described on page 5.1-38, that was performed for the pile founda-ti.on to allow a review of the assumntions and theory involved.
(Jhown for computer analogy.)
Oconee POL We anticipate (draf t question 3.6.1) asking B&W, thrsegh Duke Power,
to supply complete details on the model, cc=puter code, etc used to predict core thermal performance.
We already have several topicals from Westinghouse on their vers. ion (THINC).
-