ML20005B171

Forwards SEP Topic Assessments,Including II-2.C,III-4.D, VI-7.A.3,VI-10.A,XV-2,XV-3,XV-5,XV-7,XV-9,XV-10,XV-12,XV-14 & XV-15

ML20005B171
Person / Time
Site:	Yankee Rowe
Issue date:	06/30/1981
From:	Kay J YANKEE ATOMIC ELECTRIC CO.
To:	Crutchfield D Office of Nuclear Reactor Regulation
References
TASK-02-02.C, TASK-03-04.D, TASK-06-07.A3, TASK-06-10.A, TASK-15-02, TASK-15-03, TASK-15-05, TASK-15-07, TASK-15-09, TASK-15-10, TASK-15-12, TASK-15-14, TASK-15-15, TASK-15-2, TASK-15-3, TASK-15-5, TASK-15-7, TASK-15-9, TASK-2-2.C, TASK-3-4.D, TASK-6-10.A, TASK-6-7.A3, TASK-RR FYR-81-95, NUDOCS 8107060402
Download: ML20005B171 (83)

Text

{{#Wiki_filter:'"'**"* -*'

• YANKEE AT03C ELECTRIC COMPANY p*

2.C.2.1 ff 1671 Worcester Road, framingham, Massachusetts 01701 IYE 01~95 YANKEE June 30,1981 United States Nuclear Regulatory Commission Washington, D.C. 20555 Attention: Division of Licensing Mr. Dennis M. Crutchfield, Chief Operating Reactors Branch #5 Re ferences : (a) License No. DPR-3 (Docket No. 50-29) (b) YAEC Letter to USNRC, dated February 27, 1981, FYR 81-34 Subject : Systematic Evaluation Program Topic Assessments

Dear Sir:

Enclosed please find our assessments of the following topics: II-2. C. Atmospheric Tr'ansport and Diffusion Characteristics for Accident Analysis III-4. D Site Proximity Missiles (Including Aircraf t) VI-7. A.3 ECCS Actuation System VI-10.A. Testing of Reactor Trip System and Engineered Safety Features Including Response Time Testing XV-2 Spectrum of Steam System Piping Failures Inside and Outside of Containment (PWR) XV-3 Loss of External Load, Turbine Trip, Loss of Condenser Vacuum, Closure of Main Steam Isolation Valve (BWR), and Steam Pressure Regulatory Failure (Closed) XV-5 Loss of Feedwater XV-7 Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Sha f t Break XV-9 Startup of an Inactive Loop or Recirculation Loop at an Incorrect Temperature XV-10 Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentratin in the Reactor Coolant (PC) XV-12 Spectrum of Rod Ejection Accidents (PWR) 8107060402 81068 Apd PDR ADOCK 05000 9 5 t P P f

^ U. S. Nuclsar Regulatory Commission June 30, 1981 Attention: Mr. lDennis M. Crutchfield, Chief Page 2 XV-14 Inadvertent Operation of ECCS and Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory XV Inadvertent Opening of a PWR Pressurizer Safety Relief Valve We trust that you find this information satisfactory. However, if you have ~ any questions, please contact us. Very truly yours, YANKEE ATOMIC ELECTRIC COMPANY C# J. A. Kay Senior Engineer - Licensing JAK: dad Enclosures f ,-c.,' -. ~.. - n-. ,--..m+,, -..w .m.m, s n , -, ~ -. ~,, ~.,...-,,-.--y. --v.- -,,,. ~, + - -+

YANKEE NUCLEAR POWER STATION Topic II-2.C: Atmospheric Transport and Diffusion Characteristics for Accident Analysis The objective of this review is to determine the appropriate on-site and near-site atmospheric transport and diffusion characteristics necessary to establish conformance with the 10CFR Part 100 Guidelines. In particular, the short-term relative ground-level air concentrations (CHI /Q) are used to estimate offsite exposures resulting from postulated accidents. Short-term CHI /Q values for a ground-level release have been computed for various time intervals at the exclusion area boundary (EAB), a circle with a radius of 3,100 feet, and the outer boundary of the low population zone (LPZ), an approximately S-shaped boundary reflecting the fact that releases from the f plant under certain meteorological conditions will remain within the valley (Topic II-1.B). Meteorological data collected onsite from January 1,1980 l through December 31, 1980 were used in the analysis. Estimates of effluent plume dispersion and transport are complicated by the plant's location in the Deerfield River Valley whose sides rise over 800 feet above' plant grade. There is evidence that the 32-foot wind sensors are often l affected by localized nocturnal drainage winds flowing down the east slope of Ithe river valley, thus biasing the lower level wind rose frequencies toward 1 l the east. As such, the 196-foot wind direction values were use# to determine whether the wind flow for any given hour followed the valley or 4s l I

2-j cross-valley. The 32 f.oot wind speed values were used in the analysis. Vertical atmospheric stability was determined from the vertical temperature ~ gradient between the 32-foot and 196-foot levels. Horizontal atmospheric stability was defined by fluctuations of t'he 196-foot horizontal wind direction (sigma theta) when winds were greater than 1. 5 mps (3 3 mph) and by the vertical temperature gradient betwecn the 32-foot and 196-foot levels when the wind speed was less than 1 5 mps. Hourly CHI /Q values were calculated using a modified Gaussian dispersion model outline below. In order to account for the valley terrain at the site, dilution factors were calculated using a 10-sector downwind wind rose for both the EAB and LPZ. For all winds from the S clockwise through WSW cardinal wind direction sectors, it was assumed that effluents would remain in the valley. As such, winds from these four cardinal direction sectors were assumed to affect one ' upstream' downwind sector. Likewise, winds from the N clockwise through ENE cardinal wind direction sectors were also assumed to romain in the l valley and affect one ' downstream' downwind sector. Winds from the other I eight cardinal wind direction sectors, W clockwise through NNW and E through l SSE, were assumed to be cross-valley flows which affected the E through SSE and W through NNW downwind sectors, respectively. 1 THb procedure for deternining the dilution factors for the design basis accident evaluation reflects variations in atmospheric dispersion that occur as a function of wind direction frequencies and downwind rece,ater distances. Dilution factors were computed for each sequential hour of measured meteorological data and for receptors positioned in each of the ten downwind a y e +

- These hourly CHI /Q values were calculated using a modification of sectors. the Gaussian dispersion model ou' 'ned in Regulatory Guide 1.145 Plume centerline values were used to deterLine the short-term dilutio'n factors (up through 8 hours) and sectr ' > arage values were used for the longer term The dispersion model for the plume centerline CHI /Q values dilution factors. considered the following effects: 1) Plume horizontal and vertical standard deviations were adjusted to account for building wake effects. Lateral plume meander was allowed during periods of low wind speed 2) and neutral and stable atmospheric conditions. 3) Lateral dispersion in the upstream and downstream downwind sectors was limited by the valley walls and included an increase in concentration due to multiple eddy reflections from the valley walls. In addition, the sector width used to determine the hourly sector average CHI /Q values for the upstream and downstream downwind sectors was adjusted to account for the limited lateral dispersion potential due to the valley walls. 0$1ng the hourly CHI /Q values calculated as described above, average CHI /Q values for each downwind sector were then determined for successive overlapping time intervals of 1, 2, 8, 24, 96 and 720 hours corresponding to time periods of 0 to I hour, 1 to 2 hours, O to 8 hours, 8 to 24 hours, 1 to 4 days and 4 to 30 days, respectively. For each selected downwind sector and -+ ~ w er- ,--w-

- interval size, the averaging process began with the first hourly dilution value on record and was then repeated for the same interval size starting with each subsequent hour of dispersion data. En the averaging proc ss, the only non-zero values within a given time interval which were considered in evaluating the average dilution factor for the interval were those hours during which the wind was blowing into the downwind sector of interest. The averaged CHI /Q values were then classified into groups as a function of interval size and downwind sector, and corresponding cumulative frequency distributions of non-zero values f or each group were prepa' red. The CHI /Q value which was exceeded 0.5% of the total time was then determined from each group, and the maximum 0.5% downwind sector value from each time interval was chosen as the design-basis CHI /Q valu. for that time interval. The following CHI /Q values were determined using the above model for an 9 assumed ground level release for the various accident time intervals at the EAB and LPZ: Time Period Distance & Direction CHI /Q (sec/m3) 0-1 hours EAB (3100 feet upstream) 2.84 x 10-4 1-2 hours EAB (3100 feet downstream) 2.27 x 10-4 0-8 hours LPZ (2 miles upstream) 2.84 x 10-6 8-24 hours LPZ (6 miles downstream) 1.92 x 10-5 24 - 96 hours LPZ (6 miles downstream) 1.62 x 10-5 96 - 720 hours LPZ (6 miles downstream) 1.04 x 10-5 l We conclude that the dilution factors listed in the table above are appropriate for estimating off-site exposures resulting from po~stulated accidents, and that this evaluation meets the intent of current licensing 1 l practice. l L i l- -- -, ~,.,.

YANKEE NUCLEAR POWER STATION Topic III-4.D: Site Proximity Missiles (Including Aircraft) The safety objective of this section is to assure that the Yankee Rowe nuclear power station is adequately protected and can be operated within an acceptable degree of safety with respect to site proximity m3.ssiles. The review was conducted in accordance with the guidance given in the USNRC Standard Review Plan's (SRP), sections 2.2.3, 3 5.1.5, and 3 5.1.6. The scope of possible hazardous activities on the vicinity of the Yankee Rowe plant has been discussed in SEP Topic II-1.C, " Potential Hazards Due to Nearby ( Industrial, Transportation, Institutional and Military Facilities." As indicated, there is minimal industrial activity in the plant vicinity. The separation distance and valley terrain between the plant and any industrial l facilities, highways, railroads, gas pipelines, or military facilities is such l l that the risk associated with potential missiles from these concerns are well within the SRP 2.2 3 guidelines. In addition to the review of fixed facilities and ground transportation routes in the site area, the potential of aircraft accident generated missiles has also been evaluated in detail. The methodology employed in this analysis is the same as that outlined in SRP 3 5.1.6. t There are four airports within thirty miles of Yankee Rowe:

1) Harriman-and West (North Adams), 2) Bennington State, 3) Pittsfield, and 4) Turners Falls.

Each can be described in general as being small airports typically handling light, single-engine, private aircraft. The loca*. ion and description of each

airport, along with an estimate of the number of annual operations (take-offs and landings). is contained on FAA Forms k LO-1 in Appendix A. Table 1 summarizes each airport's annual operations. As shown, none of the i airports are within ten miles of Yankee, and all of the airport s reported annual operations are well within the 1,000 times distance squared criteria of SRP 3 5.1.6 which, if exceeded, would indicate the possible need for further analysis of aircraft from these airports effecting plant operations. TABLE 1 Distance (d) Annual Number Statute Miles 1000 x d2 of Operations North Adams 12.0 144000 32500 Bennington 19 0 361000 10950 (a) Pittsfield 28.0 78h00J 50000 Turners Falls 22.0 484000 34873 (a) Annual operation information obtained directly from Bennington Airport Manager, April 1, 1981. l In addition to the above noted airports, there are two federal airways, V2-14 l and J16-94, which could bring aircraft near the plant site. V2-14 is used by i aircraft below 18,000 feet, whereas J16-94 is used by aircraft at altitudes of 18,000 feet and above. Both airwayr,have a total width of 8 nautical miles Yankee is (9.2 statute miles); i.e. 4 nautical miles each side of centerline. l jocatedapproximately2.5nauticalmilesnorthoftheV2-16 centerline,and5 l l i nautical miles north of the J16--94 centerline. In estimating the annual number of aircraft that may pass near the site due to these airways, a count 1 was made of the IFR traffic on both these airways for the " peak traffic day" of 1980 (August 22). Federal Aviation Administration radar records associated with these corridors indicate a total of 155 aircraft could have flown near ,the plant site during the peak day. Based upon the peak day traffic, an annual estimate of 56,575 aircraft passing near the site was calculated. Employing the analytical model given in SRP 3.5.1.6, it is calculated on a i conservative basis that the overall probability of an aircraft associated with ~ these air corridors striking the plant is approximately 1.4 x 10 per year. This is an acceptable level of risk in accordance with the acceptance i l criteria of SRP 2.2 3 I I In calculating the risk probability, an effective plant area of 0.0075 square miles was used. This was determined by assuming an aircraft crash angle of 30 l l degrees relative to the principal plant structures, including non-safety l related buildings attached to the plant. Since Yankee Rowe is located in a l valley, the crash angle was based on the kinds of aircraft identified within 1 the V2-14 and J16-94 airways, and the width of the valley and height of the mountains surrounding the plant. An inflight crash rate of 3 x 10-9 per aircraft mile was used in the calculation (SRP 3.5.1.6). No information was identified from the FAA on future growth of traffic in these corridors. ~ However, since the calculated probability of 1.4 x 10 conservatively assumes that a single day peak traffic load in the corridors is maintained throughout the year, any future real growth in aircraft activities in these corridors over the remainder of plant life would not be expected to change significantly the calculated risk factor. l 1 ! ~__

^.... :.....:.. - ---":.w. Wi conclude that the risk of missile impacts (including aircraft) on the d Yankee Rowe plant from offsite sources is acceptably low within the criteria of SRP 2.2 3 5 i [ i l l i ( 1 i' 4-

.. w a, a uw.....- AIR POR T C AST E R R EC 0'.D er 01 sy AL T rtD saet.A-t o.si. l tw a s a ~ ieanacc. Cet, mL4TP &cer5 p si> ss Cite es, Me Taseo C ami h[W TCRE tLaan iCi-so F B 6 __ ",8 pa s s air a h-a L C-WE ET 13s[ .,se ase.c ast. seroni -ane MA lae aar,acasaGr si es asa s, Cev, usip ar195 1,7 e is =e netsi C.,, aa (. se cri= to sut sc T l's svise aart ne e h fe T

• 1 is C Ants ree.omi en EE'E5*38[

6 tr e ns> sr $ auarst eel e iis o=we rI11 DF hrs 1P &DaP5 ps asas va.= 1ee }lJ' e noe1n a5TM5, M& #1741 iaccuess ina5; = 01Ty >aLL O esati*o O sioteosn tro s=om ec.- ..'n _413 664-4S45 ^t it E. Pwatic om=to O P='vais o=asto I E aPo"' O as sata =a sass mu ita f * ~ "DAlp &Da*.5 PU43 ARei lis ),77 h051H 304:45 MA S1247 e 'is mismaGre hn tLIEL a eaa s,.ases, pen =. se. vene esom i s se. eross es ene, is n a ',8 4 fITT OF NOE1H & CAM $ NO e,. e.g3 h m e ss 6 a.sa.

• I# 4 EI* Af.= A40-W C f T AIRPORT 2.v, ess a ALS ANT C3TT M8LL NO

a. r. e i.n o

..n e. ')

4. pss n

8

• !Os Tee aDAES, M A fireT 3-8s8-833-4589 er. n v=.tss.uu 538-869-9225 y e een no stat its wies 83 osuction W t

i ossia =ce awo oau cicne so ammont saons assoCsavvo ctrr: s73-1f-16W t is apr h las tavaincre 8 3 654 $ _ 8 s 33 amaomi tamuos 42-41-4 % sattsesntos g$.fg"y"g* 8 aa,G,m"5 s'y,"G"*ig86* g

• %ges L al eana.neG 4,

GhaD $ = 1TPE a CoNohto= as Aa pwys as as suns acs ggg py 4 auns= 4, , ts = Gin,,actni CohdPosR ADN g g4 w,,g , g gg .35 BA5IC-F le M a,,TT/it 4228 188 AEPH, ,25 I l I e' APPaoaCu suesaCf Data s7m,.g y ,a,s t esset e=G 0, de { mig si aroe', ,g g,,g gagnggi,og.,,,, c,,,C,,g,,,,c,, s2 sa .a gg g 'LP**' atiE*e =1 ,,s c u g eva ev., si e. s tri ,g 48 AP"no*C" ' y'D l'c ista g 2f*1 7 h h 8 8F' e T [ M N IIEE5 280 3-1 eV N Y II 29 N k N0ht N N TEEES t t F-

• -~~ W CO O C1.

4+- M e OM< r-taoismoto i ta=osaesta= Gin tant oss ta =Gtn esc ys,ucs y nea, _igeveGeet i,1. o4, g=,Gws n_garsvor J _i o.,Gn vo, y_s t a v. gg jaa 5 'y < cntd sis a. 80 3 Il gL St8 w* O 19 I Z t >< Z M< OE f Zw LM N C1. M C1. < < :n De Amecai atte=oaneCG SCWloutl + f 5 i,'s aCs ortesCMi3ut.I (73 man LGT OFf a sato 4 72 0*visGwi savw=G iend T DU54-DITTe [ DUIM-DAbN eO=1 HL Davs modts i to siancana inte ions ALL LLL CAbh-DU5K as aie+omi staccpv toGni i,73 tassoms seg som eecy. con..g aceat uttas N 6 I wont O Ctsan a Gass = D 7, Cusvoias==ao=> os =rev E Cttaa Q Cttaa s vfilom 3 to Cusioh6 tanomG e*Guis astroaf 85 34 199 =o otwte as Ges e N 11C amGo mamote=G [te no. i.ee a=Gaas T iOO Pes 10ee Td 9' f assmat toGwis ,, te:Gaset T

• 1ie.uoines use acau tus =v F triwt sawo=G e.G=vs

( ost istsum me Yi ar==o >=o.Cavom i i of pams muuos me.seon 33 sqGne astID C mCLE Y et F sattosa.g & Tv8E opf as its viet a no wtstase a.nCtast h0E ( Emate 307 T iC3 T< 93 mLaiPAD on men

• Cat Nh i

(

w 0

T 05 T .a i aie. asia on, aari iC6 -..*e s sume T ysmoniin 1sagstog T sa1ED Glee aviation aces 5 50 7 a o 'es lawa I sit Isto not at a==u t amt opists a 2F33 s*= Gal EseGeset iCO-omi ttwe T 170 is1D AN=uat a's f ase OPtst5 i244PtaCEs ovta IS g { , os, mist aslemaafsD Gasetaat aviateOoo o*taatso=5 2 *L aus scoe s e ca creess e aC i2i a==uaa toCat l 927 amenvat syss g nAssi l '23 iolan PL as adoNTH 37sUNDE#8PtACf I e 8 3'1ti s 3 0gio.ee nsome 7 ~ 22 f ff l 23555 1 asII issaanvas=G 6_. "~T,,,iis s.im etat eopata6st saa i>> itCO 'ea = 3 >2DisOnO>oO - u ' aa ' >> C o-o< = ire st art aast 'ies ueseCCmd f af 0 322 8 (i_fl T8C rafilme ats Jal ]3s{ le0[les[] I $1 aptaest Sast _ oat a ('79 saettvialD 430 LOOP.seG Duovs (33 DOCe 4:37 hanap (133 et ACnmG Gg as i 131 alianas4 05PLCD THR. 29 APCM R ATIO 28-1 FROM [ E856 RWY 29 *s' EL A57 FChts T2' CUT FROM P ATEMENT thD. 8 Ef5T eLT FILCD F CP RECORC PURPOSES ChLT. Elle FUEL CCCC5* Iff. A. 112T St PASED CL1LC45 4 3 s s' N AT ELEV 2254

• e 188 3 9' T12T-f3
• 14 R AhGES 91t s' N AT ELET 1294',

$ AT ELEY 2951'e 12ttf' S AT (LEV 26958 a E13T-c2 f rit%51TE GLIDER OPh! 98vN-Cu1K 5FC 38888 T[4R ROUhDIPRIMARILY etLECL35 L MCL3OLT5. 2 3 hDQ79 [us seesne T e fi2ssaissiesseon.eaosso ~* .s a ,se,n..s2.s.a .=e6:. a .u a.u 04. a.s. s as4.e..es. e most s era a a3.,. e.s =. en.. ( sue c5a. a. ees.t. t as. ee.e.% se. es.e. aan. .. s. e = e as C.

e. n. a. o., nee c supinsa ou rie vets so ison.

( 8aar sess.sse.w 4 m

a srrt no. 9127 N ^' " " *4 q' Q .e..aru 6 O hNb-.~ki -7 > / 1-i i r 2 a g 3 ~_ $i l ) rt* *- r ...k 1! e. 1 F w

.r I..J :*.f,.,.;!

<ru-r:'-- . l,.,i %~, 3 5 v e a.* i e .m.d a 'T 4* ** g%e.,.,, 9 e _.lgJ. ,. ) Q,,,,,, J *,':.M ~ . s_ ;

g. D q, y

i. gjl .J- }; i

• ao -

Q3g, j.2-

{A'.'.,.6 ,,a,, ",,.aah _o g ~ 'M

1. bQ"b ~"'

l [~.. >,,l,%. n Y .% 'i 4 _ _q

• ?> C.. % rQ,f. Wavy,

g.,,,,,, "= ' esa - ...r...,

• sa.

- w r-n """==-.~~m' t 600* AIRPORT LAYOUT APPENDIX A (Page 2 of 8) HARRIMAN-AND-WEST AIRPORT

Sii

• ivis sF5eoTio a sust_. UC T 2 ou m e. %== or v o

... a neaca s.s crismes goate v reat eta 6#79 l .L saa o. ra m aa, eviai en t o.s.omi.o.c u taat = AIRPORT CASTER RECORD 7 07 a attft0 p ers. aner e.si. I 29361.a p s> > is cm.= vT Lap e.o c ami htw Totu e. inet. cis, etssasic= tra-i sci - e ses { o...c.a < oas.. g r e.hi ms T 0s. STaft

i. Ne amu st C n.

OL D B! A r. 3 A Gi O9 Isisi is e ases, ceiv e. vt too ami acu ace last I. siais sei e y1 46 esri crs = to na c T is ccx,=i, a.awoes.* t E N = I t.( 10 h 12lL as. ito asuJ.d es hGT i is om.ee 514TL or vgaa0NT pe enac vaa acomu.ea l. " 5141[ Moult 533 fraft 57 le)T r ' s*0es 1 Pt L 3 te 3V1 A5697 is E esuc o.mio O *=.=ain o.as o I E **o D ** *** *** *ans o as**asi O sios oni e erem oa no -a.--. apr-eer-6328. i ie ussace e Daw 3D crate lis Ir** st hw i n G 10ec e v t esten assasass ien U =' 6[h%IhET0h state aapt e.. ea.a eria.ea .es. ,,siy. se. es 5.s en ers&e of s aee. es no-o pm.a.e S1a1C 0F y(aM0NT e, e sm ees.t h.sp e .d ss t e.sa. NO Stulh6704 state AIRPORT 3.v ess. ale auf STa f t MOUSC 133 Sf ait ST

4. rss en e NO

1. 9. e e.n m me e.

8L0418tLittevi 85682 y rss.u.e 1-001-833-4S89 menmn - 510 -8 69-9 7 F5 .-w e s,-a.a. een e neo. staivis ee. ins se eina ci.o% v si osiaws a ; o.au ciso= to ameo.mi soon, anoc avvo ca, n a - int u-3.. u. c co., .33-35-.s. r -a = i-mai.c..u i s agg r,emo n =[ gin o.. ,,c r 4c ',** o,m en sg cianegym.ju,m, inesa cce. onion es.c, tceamosn.ce ne stasa as w aves m g %.g, o= smemmas . ta= cia,, mioin < 33/33 arra 6a 45PM a f.S .se pasit-E h M ..oaca sues ace omia sv a.cus =c O.",<.c,,i

n. A.a si se arcC+0, - e3o sa.a,.cn oc<

5 ee .e cisc aesmat:on,,... ,e,a,,c,s,ic,,, a.o s was. at.5%s a= es j y c,,, e y,L .. a o c g g e,, se

• v2-h M

1RCt1 358d 20-1 m h a 3: h TY~ 31 N N N WONC N N 5840 888 23-2 N Y W N. (O cr O 8+- cl. O cr. e-F) 4 d> LaJ CDF-ao a:C egs cio hf-g w 4"g g <;yg.' ass 3 sotescia vs.teu.esce= 1Do Gavot latie r. g 3.inaci-o D. e fis c*i o EE _ipcai ALiayduoe 4 <' e

s.,

3J --<Z O l 31 >< V-l wc C3 Z Z.-e t.tJ Z cl. Z cl LaJ atC CD I.

• F"

<J. oChoose g(ngovat (i) nurt tot oPte s.go te a.eeces atit%Ds cs scalouLt ?> sta=o-a: int 20%8 uo i.s ones oves 1 uusa-san 1 ALL LLL 5980-DutK n o ar,-i savac i e n e a% sac ess eoe so% cowe et.aa utees N A am.) i saacoET.cui

• 4 h

.O casao6c= A is cusicas am osi or see, , osa n tetese ql ctise a vitaom g escusious in.c c..c-is amacmi 2 v nc anco na=oimo 1,emei .=cae a n 1.no on.ie-=c.s V 1 < si in... e.c-rs ac,y T " sit so.=s uss ac= eue i In q.3sa=o+ cec i n r wo e.sto= K i os

o. sv n.%:

's os...s o.c aio. sis i.ei a n.o u.in am a.ec east e Y e r eastow.a s ivas oains <.ea es.es wa;on w.%os si sicae us o c acis hME a a .a.e ior 1 ies 1< es.e. so o a.,oni ee i an. Tesia os awi.Y ~7*U ice i ios i I t e.uo ces av.ai.o acei = es now+ i ico o us. ms iis asio ioint a%v s u.i o.iss s.= cts a=c= e ici.e m-is in asio a= vai am iss ories in a esace a ovie ios-ua ,,o., es,. isi. iso cew mai av.ai.o o.inar.o=s

• 2e a==vas tocat ] en awvatsi=ena=1 1 in ionat et a. anwi=

in v.ege a eiacs 8.. = soittas io... m in uvo.s=c _ m_o ..o o.==.ac l[]Mf) I i E .n ue s.c crise ,iis sa-i esso ussa.st sai.a suame 3 isniennDatan

• isa e an in com moen us u ania.a m MasMeg les[]

o. su.cce.sano 3<<.a (m,,c,ane att waeu w e saoain tin s-ios eio eino oce. c evovs eisi oec e tin eau-On et c-+c cio IsSt caF1C4 RWT LIGnis att CW..ut? 122 8 3 TIME 5 FOR RtILS.

<.ias e mains Es53 SWT 23 UPW3hD OF avi 13 Et:0 150'. t#*3 RWT 13 vail LOCalCD eteF T E 9asFT FM RWT th0. (FOR 8WT LIGNIS NCY 322 8 5 f! Pts. LOC a1CO Lat.42-53-St LONG o. 73-16-s t. E Lt v 3 33 0 M5Lt10P. 08 StaCONr [s73 Is75 1894 Sawas ONLT. 1881 tal5TED PEIOR 10 1959. ESS6 WUCL C00tS* 330e 7 n H 3777 los ans== Pn saissi se on e.a o = o es2. s. a .a s a. a ... swa 04 a. a.== =e P.ae. +a8 \\ moiss .na23.,.v.a=.s .s ..,ne ) Aen... e e e.a e aa c. . cme, nee e ~i o. ..s. s..... ~... surensoss ese vama so ies. 844 8, seied s6sto 6 -W m

I I j s./ t %'. : ~. _--~-. Nt ? ?l[

• ~

n .j E J., f e -- - ? <... s-Cl. l. %,, 'S -nw .{ o o. oy,. s' ?% e e .?. s hl 3 ? I i f

t..!

J. r ~ ~ j I [ s p r '1-s *' ~ ; . ~ ~ ~. ~ t t s '(A I t. t M. = .. i ~ [ s* i N /r O 0 s x

.y

/ i. o E g

• u*y s-

/'s*...* i o '.e.:.' e --~~.-._, l 1 ~ ~.. ~. ~ APPENDIX A (Page 4 of 8) BENNINGTON STATE AIRPORT

. E.n n. e e f oam appoowtp. me a. e.agyg. If f af Vf alt &#0f 704 m1FM f s0=1 ggraevisst er Teastsgegavis. pseteat agnatgo ans.watantem .gs angp.gg.,.g,D6 8E1ptes [oall EP 8h I 1e#18/ 79 l .l. S.84 s. =,. AIRPORT a& STER RECORD . met seaLv2tp I* is&. amt est. I stres.a e anac. cm r viseatto p siave cm = ma Lat aase cmasi mEv 90es rTTT5rsLe muni ttasy, sci. e psf 4 ,.e o..c.= naros, =assFITTBFTTIO ava sines.sa=si cm e. ma im aar, ace ase fait , em aass em .s camr, a. macs m. sfMBMEL

13. oave am en e a to asr. wi= vo na e v s a TTV FTTTtrT[Lc Ire mar wasm.

In s eup um.am.s m6v <... ames I.ely - Plut sq{0 na s12sl TNm zm 4 D.stsics O s'aroa too aos ne.-... '. Wac omens D *= wan a==so I E *.*Po"' O m *** *as **as e33-999-s233 < se en.=ae,. siE N TYII1EDI --I'.=" rTTTEFTI'LD NUETTD ' ' i, 1 e l.',- Pi t t sF it LO ma sif s t 1 eaa are6e aason. ei,e Clif 0F PITTSFIELS e, e es,es.a. e, - - e ss n ess. NO + * *

• e e ssa.n ersse es e e

e. = s==ames PITISFIELD NUNI AIRPORT

, PITTSFIELO Ra,51288

3. s., ess s ts ANT

4. Pas en e=see he

s. se e en e ese =

, rsa. m 1 ess-833-4589 seam =

s. e s.e Sl8-869 922S 79 osia.cs ns.c oascsom vo aarme eaca.asnociavvo cm eso sia.spe amas 82 cietgt.p W n ame T 1m asvaace.119e 4TIF3 1573E

s. a.on e.

s73-17-36.fw as a one ssensas c.,su.a.cs eae,5,== s7,.c.-o g-r y,a%.,= d, im a.,.c.oa.ou,,g g ,a e = u s.umoi-no s osa ..,m.,,a, .a. u Turrs -ssst rrrumsen ."A se 1.se easiE-s = P. 34#32 3Sas Its asPn 25 .es sastE-F u a f l _ _] .j su. ace casa s. a s an = e.%

• • • no ac a

an=r .,g=.= vi in a, oac. e., w,,,,,n.-~er is cu caru,= n O.C, e e .c ea .e a.a. g ,.c.,,,c,a,e o. se u,.c g c 1

== a. aa YT-NL m u TBETE ISH 22 1 h h h W 35= m 26 fee n .naLSF N N NONE N N TREES 2 Ts s 28-1 N Y W E H 6 14 122 m a a host a N TREES 2ss 1-1 Y h k o Cf 32 38 2 m a b hoht a a TREES 6ss 13-8 m v m C3 in EL Cf. e e-i tD e7 eu CL C3 .J LaJ ett e l La-i = s.oio

• m = <

... o.. e =r. =, o s ano.=6 in ui 373k*ic=ca ee44 8 ;335 fbF U M IITT .,,,,, *I.".' XE noa. 4 n=.cas 4 l 2dimensee2 5~.3 3 T-s h hoagn=.c,= ee g3 es 26 l2-2$-4 6. f f 9 373-17-Is.28S$ 1844 g i le 12 25-46.887 s73 17-e9.8355 1878 ' LaJ E3 9 32 12*25-27.399 873 17-18.6825 1842 c6 + EL cC i 4 n a.m..a neo==tesc sosai (

1. sia.oa.o i.e av.4 m...

ec.om ic osai tra to, me s.so ra oansme sa. c =a v u v5E W8VW i uu sUD 3 Bit ~ no.s.s os notas a att itt 'T78f42FT- <a a c=i st.co. ica '95 a ca.s ess eon.,o=<cmaeV.m ise,s ao=s O ctena a casa D tocssions aemm os esce. = l l l a I casan C(casaa n esuos Q escussowiime o e sars *** opt = si vas.=av as=vs r c eaco =*=-os=c les =o v.*%aan 33 is.=ri onaie==cas D a .es p.svo= IseTit a a.e q 's.c,=es ' " ' T ' p,s., v c==o =o.canos ,;,;(=G= Tuss ace ser =, v a os .ei vve.=e = na im a no inn am a.acea.s~*- ~ i en eses mama e.=ce u ssc.e =no c acts n e sasson= a sm one~~ a ~ ~ ~ ~ si L A [ " ' ~ ~ ~ ~ ' - ~ 7~ ig~7'- T .g y 4.M met emo o a.eron, "T.saa.ew['%. T,eW i.~d;Tirv5akeV'Y ~~~ ~~ l 1 = wi ao.= i.a ousc, ,is -.. t sa savo u av.anta a.e = ... esio soisi ae v=.= one e ",,5,8 s _ _ in e aacs a eine s c eeas=e o c u av.4,.c.,'o% us.o.s = ore a sto a= vae a= iao on= 3.e _.====

• I

,,o., .a = asi.ma,l eoitus 1e Ura. v= tecai--Tn .l.v~ i ii.04 i., 1 ins eota. m e..o. - in v+ e n *.e

m..e..u.

b..e - 3sser iseer - T m ie . n,a, = = , ' n...insiespaa x.=a

• ~j iv an<r i.n

..c m.. 1 J. nJ.e e..,n.nn(nan *

u....n c.e g,.g* 3[otz e l (a 7 " )).ase-i; T a i 12237 j.fl uc ania. =,

..w.c o=..s o a t 3J,et at .or. i.e as,,,,,,,, I se ana asahe4 ('se b-ea tt = c (isuyoca % ovo.s. ... u m u.ma (see RVF 26 (Fee mal 5F BUT 26 RET 128 85 5 TIRE $e ? TIPES 70s 0FF. i o Is ESTS ROTG SEN LETO af LAT 42-2S-22.7N 8 LONG 873-If=27.SW. i l Este SawtS OmLt. Elli SUILT Palot 10 1959 Ell 4* FUEL CODEst se lesLL. Elts SEMEDULED alR f ans avaltaett av retEISI0m alettatsa e E137-01 085tm L610 P0t ts 6588' E AT 14e6' PSL, SSep' SE st ISTS* R$Le SSas' S si is6s' R$Le asiss' Su at 2166

• ptL. 141888 by si 33398 e 5L.

.f137-82 C0453STS OF 9 Sat $ ai SEVEN STal10ms. TME InaEE OWitaaOST Sta110h5 ..snart st out=EE rLasmans Lsts. sur.sessa <Ls0 70 sta nst Ges. g1837-83 l e

==. - s w. a. f,g ami y,*..., o, o, s sT* m9 } &,';.,~ r'.~.l i.T....= a ;* UToMT. - o G sin S =o.i s.t..*W is.. a= .s.. -is e. a.oass .e. n.ee = =.

e.,s.o rn i. m aeo...=

e t

G e 8-9 me o % .-t tr 9 e 4. I h' ~ .n N u 4 ).. 'q g 2 Jd i l O. 2 9.. h w } / -..~~.q 1 e-4 t~ W ) ,/ -,. ,'V / t .~ g s o, t,, s + .~ y / %s ~ 4 's ts e_ !? .2 i l '/ t3 w& w< / 00 ss 5' / + LaJ t 'N 1f- [ ^ k UN ar g D. a ~,w 'n y\\ \\ l -i \\ ~ t. .,.~ ~ s s.. o o e* 0 ?.. (., w I og en g 5 I !., R rf

-e.7{.,T 7/pt. #-1!

,/.. ti.l' q. 9 F% .. x.. O y ,;.,.;l } ss ~.::,.., t s / . -Fi g ! NyT_- 1. '.., y .c <..l'!,,,.!.(".;ts, t k

l p; e r

. l.- - .... ~.., ~.. .,I 1!.t l 6 jj ll 6a // ~ Z l s

e e ( e Il l l g -s. aqji==i.

=ngu e f.p

@p.ye..gl m Ig 3g =

.i lm j i l n ~~ ' a, j j j j j,; >;: I !My H ! !l i s ~ qi,gri a : sq - s.,n... a-h. A .ss ,h; l s. e 3 g o;

a. o s

er r o r n $,Ng j.I -c o, in.] j %. l ,4 ,n s 2.C i l ' 5 LM< s o 3 d k[b I I 3* U gy t .1 e,mz o 8 O gj =_ 1 5.2 A l l i h :a ec.

*i a

ga,, ., o e s g h:. s ; ag .- g sh _g ,. e g C-a g ar .o -c-o 9 ?" O5 : ,"m 6 c

t. x g

ir. 'a,. d ' ' f" A $2 m {- 3J; 8 lW *s w. 4 1 3..m o nom * ~ r m -m-c

g

: St e c c:gg

?" u o am 3 -o r e I

• 5i

."-f i : %7 =! g t" u :' I j ;: B a i p ;5 g l*

• s ! E l i s s :

5 ! ! o: ? : su: : fly 5-- = a g a g a - s i n a g s s ! - E i s g 35:

: [

s ::: oi a is, 5 2 = :e i g n .I l ! !, ! d l sf H a - j=as !. - ? = n < =.1 .;*2 I ? re = c a o 1, t i = ~ e,, g-f >-A s-.ss g"A o.g g 2 c.,5 o = gs p vg. i t. g . 8 { { c 6 t ;

== 5 g s-g e = g a i ~. --i l i .e.d-i ~5 - s -. R o l I s[ {g g g - s s e a l i iEHI d gi.. i. Tl 5.:;. f I e a .g s to is.- r

5 3

.g P !

eg r: := g3 ?

=.

a -gg 5o 8 D a l g r o n e a !ll 5 l%eS } G g; g j E 39 gi [ 5 E! l $l l Je

== i.i 3 Ik, Es i ! '.i! !! !I !fj. l s to g 2 s g e 1 i 5 'i g 2 =" = a s { 5 3 h 5 h t 8 hR ,0 YSE' s

• e5 Rt n l!

i' j f-l' = gp i

l

~1 75 a = 1 A a s o o 1 ag t E o, te .x

g s = - r r it ETI 5 2. r F s

a..

= 8 i g,s o g =i ( = t O. - s A

• se t

g l g e a 1 h>:(. i s t. 1:l.. E. % a 5 E o = ~j i ) )

! 8

_ d-c F = ' an 1 l

• m-

= s, ~.'. * : ~7 ? i $ I g o o - 4 A j! _ . o 3 ] t gigs :' ta r o I s 2 5 5 g g

r I

_ :_:_:_

s .,eg tl o ~~ t s o s g 1 n { m z . - r :; i.., i da h. : .i 3 6 i a

e.

= = s, I x 3 O ,-l c ! a s cE 3 o o =5 x = -.s g .=m i ls35 g x I[i;.[i :':lI e. 5 I. [ a

== a. E s-a a s e = g xgs + a l [ ' i " A i j s k E h 458 o ~{. o 5$82 ~ I n 3 z

== {$jf ijI-=I 5 i ! 5 $s U 5 ,p j I ~

== e-l ii i l l j APPENDIX A (Page 7 of 8) TURNERS FALLS AIRPORT L

i ~ O n < r n o n O-6 i, 5 r, I 4 // c. ~ Nl N 7 8 es +,d i; p Rffe i,N-[4 a .I 9 '.a, N.. i - f. -,t s. t i' tg N "r we s, oo + s a l A. t I mE mE e h 1 A e* To 5 b < < ta, d ' . U I Mg. </ m t w i ite ) < u. L. '.",( / t; xm ( e a ~W c. h O g/ I 5m o 2L - .. I t*t. 't '/ L^ 3l E &R ~ + c g 4:,,k 15 i I ki I I (. 1 $fkV'sI Q "o + l ) i., ' ~s~ 'g s' - l i

l

[p.w. reg, s \\ ^3 ,t ..M i "N h=t 1.1,2 f.1 T + 5 j, j,. -.. ..- y e j - pg-f,. s 11 ^ .e-h i ji..-..k., R Tr y ? ' fliTW+.. t--rv 0$ ? ' 'I 3 iib.n :. e wos 2 tr V 1/

. z... a ~.: r ;;;.-.. ' - ---^ -- :: -- - - ~ ^ - ---m ~ YANKEE NUCLEAR POWER STATION Topic VI - 10.A: Testing of Reactor Trip System and Engineered Safety Features, Including Response Time Testing Topic VI - 7.A.3: ECCS Actuation e I. Introduction The goal of this assessment is to show that the Reactor Trip System and Engineered Safety Features test programs demonstrate a high degree of availability of the systems and that the response times assumed in the accident analysis are within the design specifications. This assessment addresses Topics VI-10.A and VI-7.A.3 in one evaluation report since ECCS actuation is an integral part of the Engineered Safety Features System. This report reviews the plant design to determine if all RTS and ESF components are included in the component and system tests, if the frequency and scope of the periodic testing is adequate, and if the test program meets the requirements of the following review criteria: (a) -General Design criteria 21 - Protection system reliability and testability I (b) General Design Criteria 37 Testing of emergency core cooling system (c) Regulatory Guide 1.22 - Periodic testing of protection system actuation functions. l (d) Regulatory Guide 1.118 - Periodic testing of electric power and protection systems. l (e) Regulatory Guide 1.105 - Instrument setpoint I (f) Branch Technical Position ICSB 24 - Testing of Reactor Trip System and Engineered Safety Feature Actuation System Sensor response times. (g) Branch Technical Position ICSB e5 - Guidance for Interpretation of General Design Criterica 37 for testing and operability of the ECCS as a whole. [ I (h) Standard Review Plan Section 7.2 .__,_--..,,-.,,.--_m.-. - -..,.... _, ~, - - - _..

~.. Page 2 of 8 In addition to those items required by the review criteria, the following will also be verified: i (a) That test conditions come as close as possible to the actual performance required by RTS and ESF. (h) That compliance with the single failure criterion during' testing is met. (c) That the results of the licensee response time testing data for the RTS and ESF are within the delay times used in the FHSR accident a nalysis. (d) That tests can be made to ensure the readiness or operability of system components. (e) That the " Auto" mode of actuation does not inhibit the " Manual" mode of actuation, and vice-versa. (f) That the power supplies satisfy the single-failure criteria. (g) That the overlapping tests indeed overlap from one test segment to another. (h) That equipment calibrations are adequate. II. Testing of RTS and ESF at Yaakee 1. Reactor Trip System - General Description The Reactor Trip System automatically trips the reactor to protect against Reactor Coolant System damage and fuel rod cladding damage. i i Two reactor trip breakers are provided to interrupt power to the control rod drive mechanisms, which are powered by Battery #2. These breakers are opened upon de energizing the scram relays (which allow the breaker trip coils to operate) or by directly energizing the breaker trip coils. l The reactor shutdown function of the rods is coupletely independent of the normal control functions once power to the rods is interrupted. Response to any rod control signal is then impossible until the breakers are manually reclosed. I Power to the analog circuits is provided by the vital bus, which is fed by a de-ac motor generator set. The de motor is powered from l station battery #1. Backup power to the vital bus is provided by manual action from a 480V station service bus section through a 480/120 volt transformer. Loss of vital bus power causes a reactor I-trip. The scram breakers are tripped when the following trip actuation signals are received: l l l . _,. - _,, - _ _., -.,,,.,, - _ - -. _ _ - -. ~. - -.

Page 3 of 8 (a) Manual A manual reactor trip allows the operators to trip the The manual actuation devices are independent of the reactor. automatic reactor trip circuitry and operate directly on the scram breaker trip coils. (b) Main Steam Line Isolation Trip This trip is generated upon occurrence of one or more of the following situations and protects the reactor against excessive voids and resultant high fuel temperature. (3) High main coolant system pressure (2) Low main coolant system pressure (3) Low main steam line pressure (4) Containment isolation system actuation (high vapor container pressure only) (5) Manual initiation (c) Low steam generator level This trip is generated when a low level signal is received from any two of the steam generators (when above 15 MWe) and protects the reactor from a loss of heat sink. (d) High Pressurizer Level This trip is generated on a high water level signal from the pressurizer and is indicative of system overpressure. (e) Low Main Coolant Flow (Steam Generator [ip) Thir trip is generated on low differential pressure in any two of tour steam generators (above 15 MWe) and is indicative of low main coolant flow. (f) High intermediate range neutron flux start up rate This circuit trips the reactor when one of the two intermediate range channels reads above the trip setpoint (below 15 MWe). The intermediate range start-up range channels are separate from the intermediate range power range channels. This trip is generated to protect the reactor against transients caused by excessive start up rates. l ~~

Page 4 of 8 (31 High neutron flux level This circuit trips the reactor when neutron flux levels within the intermediate range power range or power range exceed the trip setpoint. This trip protects the reactor against transients caused by excessive reaction rates. ~ (h) Turbine stop valve closure (Turbine Trip) Th19 trip occurs when one of the following signals has been received by the Turbine Stop Valve, and is designed to protect the turbine from being damaged: (1) Any of the turbine protective trip conditions (2) Manual Turbine Trip (1) Low main coolant flow (MC pump current) This trip is generated by a low or high current level in any 2 of a main coolant pump motors (above 15 MWe) an1 anticipates low main coolant flow. 2. Reactor Trip System - Testing Provisions are made to manually place the output of the bistables or i trip relays in a tripped condition for "at power" testing of all portions of each trip circuit, with the exception of the High Pressurizer Water Level, Turbine Trip, and Main Coolant Low Flow l (SG Ap) trip units. I I Provision is made for the insertion of a test signal in each channel. Verification of the test signal is made at specified l l points within the circuit in accordance with the appropriate l surveillance procedure. This allows for testing and calibration of meters and bistables; t~ansmitters and sensors are checked out l against each other and against specified read-out equip 2ent during normal power operation with the exception of the High fressurizer l Water Level, Turbine Trip, and Main Coolant Low Flow (SG/1p) trip units. In accordance with Technical Specifications, the High Pressurizer Water Level and Main Coolant Low Flow (SG/Sp) functional tests are performed when shutdcun longer than 24 hours if they have not been performed in the previous 31 days. The Turbine Trip functior.a1 test is performed prior to each start-up. I I Each reactor trip system channel is checked by one or more of the i following means: i (a) Varying the monitored variable (b) Introducing and varying a substitute transmitter signal (c) Cross-checking between identical channels or between channels l which bear a known relationship to each other and have readouts l available. l ~

Page 5 of 8 The means for manually bypassing e.hannels or protective functions are adminis'tratively controlled, and access to all trip rettings, module calibration settings, test points and signal injection points are controlled by keylock or administrative controls. 3. Engineered Safety Features - General Description Engineered Safety Features are provided at the facility to mitigste the consequences of any design basis accident. ESF's have been designed to cope with any reactor coolant pipe break and with any steam or feedwater line break. ESF's at Yankee are comprised of the following systems: (a) Safety Injection System (ECCS) (b) Recirculation System (ECCS) (c) Cont.sinment Isolation System A. Safety Injection System Emergency core cooling is provided by the SIS which constitutes the Emergency Core Cooling System. The function of the SIS is to provide sufficient bo;ated water to the reactor vessel to prevent core damage that would interfere with continued core cooling and to limit clad metal to water reactions to negligible amounts in the unlikely event of a major loss-of-coolant accident. In conjunction with the Recirculation System, the SIS provides for a constant and l unobstructed flow of coolant to the reactor vessel. SIS consisto of the following: (a) Three pumping trains, each comnosed of one low pressure l safety injection pump and one high pressure safety injection pump. f i (b) An accumula*.or filled with borated water. l (c) High pressure nitrogen storage flasks to pressurize the accumulator. l { (d) A reserve of borated water in the safety injection tank. A failure of the reactor coolan_ system boundary and its l attendant loss of coolant results in a system depressurization and the initiation of a safety injection actuation signal l (SIAS) as the pressure drops within the main coolant system or as the pressure increases within containment. i L l i l I c-

Page 6 of 8 B. Recirculation System The recirculation system is designed to provide long-term decay heat removal from the reactor core by recirculating cooled water collected in the vapor container sump back to. the reactor vessel. The system is sized to provide sufficient flow to remove reactor decay heat. The vapor container fuactions as a passive decay heat exchanger transferring decay heat of the spilled water and vapor to the outside atmosphere through the steel shell of the vapor container. The system utilizes valves and piping, the LPSI and HPSI pumps, and other portions of the safety injection system. A suction is taken from the vapor container through the sump strainer to either the low pressure or high pressure safety injection pumps. Recirculation flow returns to each loop of the reactor coolant system through the high pr_ essure safety injection discharge piping. Hot leg injection flow is from the high pressure safety injection discharge header and into the normal charging line which is connected to the hot leg of loop #4. Flow elements are provided in each of the injection legs with readout in the control room to verify the continuation of flow. The pumps and valves are operated from the control room by the operator. C. Containment Isolation System Containment isolation is initiated automatically when a safety injection signal (non-essential valves only), a CIAS signal, or a manual signal is received by one of the two CIS logic trains. Normally, open valves on each outgoing line used for the operation of the plant are closed upon actuation of CIS with the exception of those valves which perform safeguard functions. Incoming lines are isolated by two check valves on each line, one inside containment and one outside containment. The containment isolation actuacion signal is provided by one of two identical pressure sensors. When either switch senses high containment pressure, the switch contact closes to energize a master trip relay which in turn energires a pair of lockout relays which trip the isolation valves. No manual cutout is provided in the initiation circuit, and the integrity of each master trip relay coil is continuously monitored by an indication light next to each manual actuating switch. Provisions are made to manually bypass the actuation signal to each individual valve should the situation warrant such action.

Page 7 of 8 4. Engineered Safety Features - Testing A. The Safety Injection System is tested at each reactor refueling interval when main coolant pressure is less than 1000 psig. A pressure is applied to the proper side of the actuating pressure switches which initiates actuation of the system (with the exception of the accumulator). Once per 31 days when not shutdown, each pump, pressure switch, and active valve in the system is tested on a staggered test basis to ensure that it performs in accordance with technical specifications. This test program demonstrates cperability of both the SIS and the Recirculation System. Operability of the accumulator is based on: (a) Verifying borated water level and concentration (b) Verifying nitrogen supply bottle pressures (c) Verifying isolation and relief valves position and/or operability B. The Recirculation System valves and motors are tested in the same manner as those in the Safety Injection System as per Technical Specifications. C. Containment Isolation System testing is performed during cold shutdown when the main coolant pressure is less than 300 psig. / A pressure is applied to each sensor which initiates the system, and measurements are taken to ensure that each valve operates in accordance with Technical Specifications. III. Evaluation and Conclusion The Yankee test programs for the Reactor Trip System and Engineered Safety Features are in conformance with the review criteria listed in Section I of this assessment with the following exceptions: (1) IEEE Std. 279 requires a capability for testing reactor protection system functions during reactor operation. The Turbine Trip, High Pressurizer Water Level, and Low Main Coolant Flow (SG /1 p) trip units are not testable during reactor operations. These trip units are norna11y tested in accordance with Technical Specifications (see Section II.2). It should be noted that the High Pressurizer Water Level and Low Main Coolant Flow (SG 21 p) trips are backup trips to the High Main Coolant System Pressure trip portion of the Main Steamline Isolation trip and the Low Main Coolant Flow (MC pump current) trip. l I e- -.y ~ n. ~.,. -,- a ~,.. -.., - - - -,

Page 8 of 8 (2) Periodic tests for verification of system response times of reactor trip systems and engineered safety feature actuation systems are not performed at Yankee Rove. Branch Technical Position EICSB 24 requires such periodic response time verification. Periodic tests for functional channel operability are performed in accordance with Technical Specifications. For those portions of trip systems that require a measured response time, response time tests are performed in accordance with Technical Specifications. (3) Bypass and/or test annunciatior. is not provided for some of the RTS functions and ESF functions. IEEE Std. 279, section 4.13, requires continuous control room indication when any part of a protection system has been deliberately rendered inoperative. A system bypass or test is administrative 1y covered in procedures and includes concurrence of the control room operator and Shif t Supervisor. (4) General Design Criteria 37 requires that testing of emergency core cooling systems adequately determine the proper functioning of the l full operational sequence that brings the system into operation. Yankee surveillance procedures require periodic testing of the l individual components and subsystems of the Safety Injection System to assure proper functioning. These procedures, however, do not I require the full nitrogen pressurization of the Safety Injection accumulator and the injection line leading to the loop injection l point. These procedures adequately determine the proper functioning of the equipment required for the full operational sequence that brings the ECCS into operation. I 1 i I l I l t l

YANKEE NUCLEAR POWER STATION 1. Topic XV-2: Spectrum of Steam System Piping Failures Inside and Outside of Containment (PWR)

• I.A Introduction A steamline break results in an increase in the flow of steam from one or more steam generators. The main steam system conducts steam from each of four steam generators to the turbine throttle valves. Steam leaves each of the steam generators through a 14-inch schedule 80 carbon steel pipe, which connects to a 24-inch main steam header. The flow is then directed via two 18-inch schedule 60 pipes to the turbine throttle valves.

Each of the main steamlines is protected by three safety valves with relief capacities and setpoints of 80,872 lb/hr at 935 psig,118,260 lb/hr at 985 psig, and 573,329 lb/hr at 1035 psig. A non-return valve is j located outside the vapor container in each steamline before the lines join to form the main steam header. The non-return valves (NRV) were not originally designed for automatic closure. Thus, a break in any steamline that occurred on the turbine-side of the NRV's could result in blowdown from all four steam generators. During the Core XV refueling outage, however, each NRV was equipped with a stored energy actuator to provide for automatic closure within 3-5 seconds. In addition, each main steamline was equipped with $three redundant pressure sensors to provide a signal to: (1) close all NRV's, (2) trip the reactor, and (3) isolate containment upon a 2 out of 3 coincidence of low pressure signals for any single main steamline. This - - _ _

design modification will prsvant tha lowdown of tha remaining oteca generators subsequent to automatic NRV closure and limit the primary plant cooldown transient to the equivalent of the inventory of a single steam generator. The same 2 out of 3 coincidence of low main stesaline pressures will generate a newly-added permissive signal to trip the main condensate pumps. Thus, for steamline breaks inside containment, a high vapor container pressure signal will result in reactor trip, NRV closure, containment isolation, and main condensate pump trip. A description of this design modification was provided to the NRC in Attachment B of Reference I.l. In either case, an automatic trip of the main feedwater pumps occura at power levels in excess of 15 MWe (Section I.B). i Prior to Core XV operation, safety analyses of the consequences l I of a main steamline break reflected the absence of automatic NRV closure. Typically, two separate types of steamline break analysis were performed: (1) a single steam generator blowdown inside the vapor container (break location upstream of NRV), (2) a four steam generator blowdown outside the vapor container (break location downstream of NRV). Reference I.2 (response l l l to NRC IE Bulletin 80-04) discusses main steamline ruptures, focusing on the effects of feedwater system operation. Steam generator blowdowns both inside and outside the vapor container were considered; reactor plant performance and containment pressure response were also discussed. A subsequent letter to the NRC, Reference I.3, more specifically addressed the issue of environmental qualification of safety-related electrical 3 equipment during a single steam generator blowdown inside the vapor I container. Attachment D of Reference 1, the Core XV Performance Analysis Report, presents the analysis of a four steam generator blowdown to outside.

the vapor container. The objective of the analysis was to confirm that sufficient shutdown margin is required by the Technical Specifications to prevent the cooldown transient imposed on the reactor core following scram from causing a recurrence of criticality, which would raise operational , concerns during the conduct of emergency recovery procedures.. The references cited above address the major considerations of a main steamline break, namely: (1) core thermal performance and radiolegical consequences of a break outside the vapor container, (2) shutdown margin adequacy for a four steam generator blowdown outside the vapor container, and (3) vapor container temperature and pressure response for a single steam generator blowdown inside containment. The analyses performed have characterized the steamline break accident in terms of the adequacy of plant design features and reactor protection system functions. These evaluations are discussed in the following paragraphs. The analysis of a four steam generator blowdown outside containment is only applicable for operation f prior to the Core XV refueling outage, when automatic NRV closure was I ( implemented. However, the consequences of this type of steamline break event are presented for information to show that recurrence of criticality is precluded without crediting the automatic NRV closure feature, which will prevent this cooldown transient during subsequent plant operations. I.B Plant Response A steamline break results in an increased rate of energy removal ITrom the main coolant system. The amount of energy removed depends upon the mass of secondary coolant that escapes at the break location. Thus, the event is characterized in part by the number of steam generators that..

participate in creating the mismatch between increased energy removal via The stesa production and decreased energy production by the reactor core. consequences of this mismatch are a main coolant system cooldown and depressurization and a secondary system inventory reduction and steam , pressure decrease. If the break occurs inside the vapor contat.ner, containment pressure and temperature will increase. Numerous indications of this event are available to the operator, and numerous automatic protection system features are provided to shut down the reactor and ensure i l l a safe recovery to a stable condition (see Sections I.C and I.D). During the cooldown, total core reactivity is determined by several i competing sources. The cold leg water temperature reduction adds positive reactivity via the moderator temperature coefficient. Insertion of control rods following scram and a safety injection flow of borated emergency supply water provide sources of negative reactivity. Core thermal performance prior to scram or safety injection is primarily affected by: (1) initial i core power level or margin to suberiticality (operating-mode-dependent), (2) initial pressure and temperature of the primary and secondary coolants, (3) duration of the core power / steam flow mismatch prior to scram (e.g., amount of cooldown), (4) scram delay time associated with the trip producing parameter, (5) power-dependent insertion-limit / scram worth, (6) moderator temperature coef ficient, and (7) the break size. Core reactivity response following scram is determined by: (1) shutdown margin requirements, (2) initiation time of safety injection flow, (3) safety injection water I kemperature, flow rate, and boron concentration. (4) steam generator feedwater initial flow rate, temperature, and post-trip operation. Finally, i the vapor container pressure and temperature response for inside breaks ~ l l l l

the vapor container pressure and temperature response for inside breaks is affected by: (1) steam generator liquid and vapor mass and energy inventories, (2) feedwater initial flowrate, temperature, and post-trip operation, and (3) the high vapor container pressure trip-setpoint value , that will cause NRV closure and reactor scram. The analyses to determine reactor plant and vapor container responses to a steamline break are performed separately, so that appropriate conservatisms may be freely applied to result in worst-case results. Feedwater system performance affects the consequences of any steamline break. Two recent design modifications will reduce the severity of this transient and enhance the offectiveness of plant emergency procedures. They were discussed in Reference 1.2 and include: (1) equipment modifications made during Core XIV operation to ensure that an automatic trip of boiler feed pumps occurs following reactor scram at power levels greater than 15 MWe (based upon turbine first stage nozzle pressure); and (2) installation of automatic trip logic for the condensate pumps, based on coincident signals for high vapor container pressure and low steamline pressure, performed during the Core XV refueling outage. These changes ensure that feedwater addition will be rapidly terminated subsequent to reactor scram to minimize reactor cooldown effects and, for rupture inside j containment, to minimize the vapor container pressure and tamperature increases. In addition, emergency procedures emphasize isolation of feedwater flow to the affected steam generator and selective feedwater Isddition to steam generators that are not losing their inventories out the break.

I.C Plant Protection A reactor trip during a steamline break accident may result from I the following trip conditions: (1) high neutron flux trip, l (2) low steam generator water level (>15 MWe power level), I l (3) low main coolant system pressure, (4) high vapor container pressure, or (5) low main steam system isolation trip logic (effective Core XV). I.D Ev. int Indications Indications of a steamline break include the following: (1) reduced steam generator pressure, (2) reduced main coolant system pressure and temperature, (3) abnormal steam generator level and steam flowrate indications, (4) high containment pressure, (5) mismatch in steam /feedwater flowrates, l (6) actuation of safety injection, (7) containment isolation actuation, (8) automatic closure of all NRV's (effective Core XV). -

I.E Analysis I.E.1 General Information The maximum credible size for a main steamline break results from s a circumferential rupture of the 24-inch main steam header. Fdllowing the Core XV refueling outage, the automatic closure of all NRV's will prevent the blowdown of all steam generators. Analysis has been performed, however, for the four steam generator blowdown. It represents the most severe case, since all four steam generators could suffer complete losses of inventory until atmospheric pressure is reached. Thus, this break location results ~ in the largest cooldown transient and the largest addition of positive reactivity. With respect to (1) concerns of acceptable core thermal performance (see Section I.E.2) and (2) confirmation of adequate shutdown margin (see Section I.E.4), the four steam generator blowdown is a limiting event if credit is not taken for automatic closure of the NRV's. The core thermal performance is based upon analysis presented in Reference I.4, the Core XI refueling submittal to the NRC. The most recent confirmation that recurrence of criticality is precluded is contained in Reference I.1, the Core XV refueling submittal. A rupture that occurs inside the vapor container must be located upstream of the NRV's. These valves were originally designed to act as reverse-flow check valves. Thus, the analysis for a steamline break inside containment applies to a single steam generator blowdown and considers all fpossible sources of mass and energy (see Section I.E.3). This analysis was presented in Reference I.3 for purposes of environme.tal qualification of safety-related electrical equipment..-

...c 1 i l I l I.E.2 Analysis: Core Thermal Performance Following a Main Steamline Header l Break Outside Containment l l Two initial conditions were assumed for a four steam generator e ~ l blowdown to outside the vapor container: full load and no load. The following additional assumptions apply to predict a conservative DNB ratio: (1) the moderator temperature coefficient was most-negative and varied with temperature (uncertainties included); (2) minimal full temperature reactivity feedback (uncertainties l l included); l (3) minimum available scram rod worths minus allowance for most reactive rod failing to insert (6.93%Ap-fu11 load /4.72%Ap-no load, consistent with technical specifications); (4) steam phase blowdown assumed to maximize energy removal; (5) feedwater flow decreases to zero at 30 seconds following trip on nuclear overpower signal; and l (6) boron concentration of safety injection water initially at 2200 ppm and boron reactivity worth of one percent 6p per 147 ppm assumed. The plant transient response was calculated using the CEMINI-II computer code; the hot channel DNBR analysis was performed using the COBRA-III-C computer code. The break initiated at full power results in a high neutron flux.-

trip signal at approximately 4 seconds; the low-initial power case results in this trip at 28 seconds after event initiation. Safety injection is initiated for the full-and zero-initial power cases at 9 and 10 seconds, respectively, based upon a low main coolant pressure signal. The respective ~ t' peak power levels were determined to be 125 percent and 113 per' cent of rated power, respectively. A DNB analysis was made for these two cases using the Westinghouse W-3 correlation in the COBRA-III-C subchannel analysis code. In both cases, the minimum DNBR exceeds 1.30 and no fuel melting is predicted. 1.E.3 Analysis: Vapor Container Pressure Response Following a Main Steamline Break Inside Containne.nt Each of the four main steamlines contains an NRV located outside the vapor container. These valves act as reverse-flow check valves and are being provided with automatic actuators during the Core XV refueling outage to permit automatic and rapid closure upon receipt of either a low steamline pressure or a high vapor container pressure signal. A steamline break that occurs inside the vapor container could result in a discharge inside containment of the contents of a single steam generator and the associated main steam piping upstream of the NRV's of the remaining steam generators. Reference I.3, provided to the NRC, described the consequences of 4*this event with respect to vapor containment pressure and temperature The analysis was performed using the RELAP4 computer code for response. blowdown calculations and the CONTEMPT-LT026 code for the containment thermodynamic response. -

l l l The most adverse initial conditions were assumed for the analysis in Reference I.3, covering the full range of operating conditions from zero to full power operation. The initial power level was assumed to be 112% I jof 618 MWt, the maximum high neutron flux trip point, and was held constant during the calculation until a reactor trip occurred based on high vapor container pressure. A steam generator inventory of 31500 lbm was assumed 1 for conservatism, although the inventory at full power operation is actually i' 20000 lbm. Full feedwate.r system operation with all feed pumps was assumed, l with all feedwater being directed to the steam generator blowing down through the ruptured steamline. Thus, the feedwater control valve of the affected j i steam generator was assumed to open fully following the break. The feedwater system operation was reviewed in the Reference I.2 response to IE Bulletin 80-04. A double-ended guillotine break of the main steamline was assumed, t to maximize the blowdown rate and energy addition to containment. j In addition to the assumptions discussed in the preceding paragraph, other initial conditions and assumptions are listed below: l 1. Feedwater System Operational Mode - three boiler feed pumps l operational, 2. Break Size - double-ended guillotine (.8522 ft2), f 3. RCS Main Coolant Pumps - remain active, ) i i I 4. Primary Loop Heat Transfer to SG Liquid - variable heat transfer coefficients used, but degradation in heat transfer due to i l reduced area during bundle uncovering was neglected, l l, V ~- ~~ -.. - - _ -

5. SG Tube Area - the entire SG tube area was assumed active, 6. Reactor Trip Signal - occurs 1.0 second af ter vapor container high pressure signal, 4 7. Feedwater Termination - occurs 10.0 seconds after r'eactor trip i

signal, 8.

Flow to Turbine - zero at all times. The RELAP4 blowdown analysis indicates a trip on high containment t pressure at 5 seconds, but for conservatism the reactor trip was delayed until 11 seconds. This trip time includes a 1 second delay time. The affected steam generator was emptied via blowdown at 112 seconds into the transient A CONTEMPT code thermodynamic analysis was then performed. The i maximum containment pressure was determined to be 31.7 psig, which is less l than the containment design pressure of 34.5 psig. This result was transmitted together with temperature response to the NRC per Reference I.3 to confirm vapor container integrity using conservative assumptions for a major steamline break. On May 23. 1980, the NRC issued Memorandum and Order CLI-80-21 which required that the D0R Guidelines and NUREG-0588 form the requirements that l must be met regarding environmental qualification of safety-related gelectricalequipment. In compliance with this order, Reference I.5 presented results of an exhaustive re-evaluation of environmental qualifications for i safety-related electrical equipment at Yankee Rowe required to function under the harsh environments associated with design basis accider<ts.. O g r-" w -w we-- m-

Steamline breaks inside and outside the vapor container were reviewed in confirming the availability of electrical equipment and instrumentation required to bring the plant to a cold shutdown condition. .I.E.4 Analysis: Primary System Cooldown Response and Core Reactivity Following a Main Steamline Break The subject of core reactivity response during the cooldown imposed after a major steamline break was discussed in the Reference 1.2 response to IE Bulletin 80-04. A review was performed of the potential for recurrence of criticality following scram, which could result if core shutdown margin was reduced to zero during cooldown. In Reference 1.2, tOo design modifications were discussed that reduce the amount of cooldown during a steamline break. These modifications, discussed in Section I.A, include automatic tripping of the main condensate pumps on coincident signals of high containment pressure and low steamline pressure, and ensured main feed pump auto-trip at power levels greater than 15 MWe. These design changes l were implemented in addition to the automation of non-return valves, which provides for main steam system isolation upon receipt of either a high containment pressure or low steamline pressure trip signal. The potential for a return to power exists when the primary coolant system is rapidly cooled by increased energy removal due to the blowdown l' of secondary coolant. The combined effect of all various reactivity contributions determines whether recriticality can occur following shutdown. Ultimately,the amount of cooldown depends upon the available secondary l coolant inventory and feedwater system performance follow.ng rdactor trip. Following automation of NRV closure during the Core XV refueling outage, l l !

blowdown of more than one steam generator either inside or outside containment will be prevented when credit is taken for either (1) automatic closure of the NRV's in fulfilling their function as isolation valves, or (2) prevention of reverse flow through the NRV's of the remaining unbroken steamlines in fulfilling their function as reverse flow check valves. . Analysis was performed for each reload core to determine the shutdown margin required to prevent recurrent criticality due to a cooldown associated with complete blowdown of all secondary coolant from each steam generator. Most recently, the Core XV analysis presented in Reference I.1 indicated that recriticality was prevented without crediting main steam system isolation on reactor trip on low maic steamline pressure. The Core XV analysis is similar to the Core XIV analysis. The Core XIV analysis demonstrated for both full power and zero power cases that if cooldown of the primary loop to 700F is assumed following shutdown, the core retains I sufficient shutdown margin to ensure suberiticality. This calculation included moderator temperature defect, fuel temperature Doppler defect, provision for the most reactive control rod stuck out, boron insertion with l safety injection, and conservative nuclear design uncertainties. Based upon performing this calculation for Core XV, the required shutdown margin for Mode 3 operation at hot suberitical conditions was increased from 4.72%Ap i j to 5.5% Ap to provide additional margin to suberiticality. The value is f l reduced to 4.72% during plant cooldown as shutdown requirements lessen. l l 'Thus, rod insertion limits are imposed to provide adequate shutdown margin o ( to preclude recriticality, even when main steam isolation is not credited ( l and blowdown of all four steam generators is assumed. An evaluation was performed by the Westinghouse Corporation of ! L l.

reactor vessel integrity during a stsamlina brstk cooldown trinaisnt. This analysis shows that accepteble vessel integrity for the primary cooldown resulting from blowdown of the entire inventory of a single steam generator. The minimum expected temperature for this event is 3000F, if the event is finitiated at a maximum allowable value of Tc = 519 F (Technica( Specification value of < 5150F plus 40F uncertainty). Westinghouse analysis showed that system repressurization during the cooldown was permissible to values in excess of the pressurizer code safety setpoint of 2500 psig. In observance of vessel integrity consideration, plant emergency procedures for loss of secondary coolant currently instruct the operator to terminate safety injection when the cold leg temperature of any loop reaches 3100F, but only after verifying the existence of adequate subcooling and system pressure control. However, operator termination of SI flow is not required to prevent violation of vessel integrity limitations during cooldown. i l I l l l t 1 I i ( l 1 t

I.F References I.1 FYR 81-52, YAEC Letter to NRC, Core XV Refueling Proposed Change No. 173, 26 March 1981. i ' I.2 YAEC Letter WYR 80-50 to NRC, Response to IE Bulletin No.: 80-04, 8 May 1980. I.3 YAEC Letter WYR 80-62 to NRC, Environmental Qualification of Electrical Equipment, 5 June 1980. I.4 YAEC Letter to NRC, Proposed Change No.115 (Core XI Refueling), 29 March 1974. 1.5 YAEC Report 1227, Environmental Qualification of Safety-Related Electrical Equipment, October 1980.. i l f ! l

YANKEE NUCLEAR POWER STATION II. Topic XV-3: Loss of External Load (Turbine Trip), Loss of Condenser Vacuum, Steam Pressure Regulator Pailure III.A Introduction I A rapid and large reduction in power demand on the reactor while l it is operating at full power results in a corresponding reduction in the rate of heat removal from the main coolant system. Such an incident could lead to system overpressurization if suitable protection was not provided. The most probable cause of a rapid loss of load is a turbine trip. Following a turbine trip, the reactor would be tripped directly (except i for power levels below 15 MWe) from a signal derived from the turbine stop valves.- The steam bypass system would accommodate the excess steam generation. The steam bypass functions to limit the increase in main coolant temperature and pressure for this transient. Primarily, the turbine trip event is analyzed to evaluate the protection provided to prevent overpressurizing the primary system. The following design features exist to prevent primary system overpressurization: 4 1. Pressurizer power operated relief valve, 2. Stear dump system (steam bypass valve), 3. Pressurizer spray, 4. Main coolant loop safety valves, 5. Pressurizer safety valves, ___

6. Steam generator safety valves, i 7. Charging volume and control system, and j 8. Reactor protection system (reactor trip). The reactor protection system would scram the reactor, in the event of a turbine trip, on a variety of signals listed below: 1. Turbine trip signal, 2. High pressurizer level trip, 3. Steam generator low level trip, 4. High main coolant system pressure (implemented during Core XV refueling outage). II.C Plant Response Both the pressurizer power-operated relief valve and the steam dump valve are provided to prdvent the spring-loaded safety valves from opening and are not intended to be\\} part of the system cverpressurization l l protection. In the event the steam dump valves f ail to open following complete loss of load, the steam generator safety valves may lift and the l reactor may be tripped by the high pressurizer water level signal. The steam generator and pressurizer safety valves are sized to protect the main i !*toolant system and steam generators against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valve, automatic rod control, or direct reactor trip following turbine trip. I - - +. , ~.

The steam generator safety valve capacity is sized to remove the maximum calculated steam flew from the steam generator (105 percent of maximum guaranteed steam flow) without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity.is based i Inn a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load, assuming operation of the steam generator safety valves. The pressurizer safety valves are then able to maintain .Ne main coolant system pressure within 110 percent of design pressure withsat direct or immediate reactor trip action. In order to demonstrate that the mair. aoolant system is adequately protected from overpressurizing during a complete loss of load transient, the analysis did not 'ake credit for either the steam dump system or the When credit is not taken for the pressurizer power-operated relief valve. immediate turbine trip or subsequent steam generator low level signal, the reactor is tripped by the high pressurizer level trip (or the high main coolant loop pressure logic, effective with Core XV operation). Loss of condenser vacuum can also result in turbine trip and Since the steam dump is assumed precludes use of the steam dump system. to be unavailable in the analysis of the turbine trip event, no additional analysis is necessary to include separate effects from loss of condenser Also, the plant design does not include a steam pressure regulator vacuum. so the failure of this device is not an applicable design basis event. ? II.D Analysis l The analysis of the complete loss of load, reported in Reference II.4 for Core XI, was performed using the GEMINI-II digital computer program 1 --

to simulate the nuclear steam supply system response. The hot channel analysis was performed with the COBRA-III-C computer program. The following assumptions were made: a 1. A turbine trip occurs instantaneously without activating a reactor trip; 2. The moderator coefficient is the least negative expected at beginning of life for power operation, including calculational uncertainties; 3. The beginning of life fuel temperature coefficient is increased by 25 percent to account for calculational uncertainties; 4. The pressurizer control is assumed to be in the manual mode. Thus, no credit is taken for the effect of the spray or letdown systems in reducing the r:te of pressure increase; 5. One safety valve in each steam generator is inoperative. Results show that.high level trip occurs at 20 seconds after initiation of the incident. The pressurizer safety valves act to keep the main coolant system pressure below 2545 psia and the operational steam generator safety valves limit secondary pressure to 1040 psia. The minimum DNB ratio and fuel temperatures improve during the transient. A bounding analysis was performed for the reference Core XI analysis using the design value of moderator temperature coefficient at.BOC. In general, this incident is not sensitive to minor changes in core parameters. In addition to the Core XI reference analysis, numerous parametric analyses l ! l t

were performed in support of the Core XIV reload submittal. These parametric studies were requested by NRC (Reference II.1), submitted via Reference II.2, and subsequently approved via issuance of Amendment No. 54 (Reference II.3) to the Facility Operating License. These sensitivity studies on I y moderator temperature coefficient and Doppler coefficient demonstrated the ainar impact of core physics parameters on the loss of load transient. These parametric studies provided in Reference II.2 conservatively bound Core XV core parameters, reported in Reference II.S. In addition, the high main coolant pressure trip function implemented during the Core XV refueling outage will reduce challenges to code safety valves for this event. h II.E References II.1 NRC Letter from D.L. Ziemann to R.H. Groce, YAEC, 8 November 1978. II.2 WYR 78-99, YAEC Letter from D.E. Vandenburgh to NRC, Additional s^ Information -- Core XIV Refueling, 21 November 1978. II.3 NRC Letter from D.L. Ziemann to R.H. Groce, YAEC, Amendment No. 54 (Core XIV), 6 December 1978. II.4 YAEC Letter to NRC, Proposed Change No.115 (Core XI Refueling), 29 March 1974. 11.5 FYR 81-52, YAEC Letter to NRC, Core XV Refueling Proposed Change No.173, 26 March 1981. i i e l l L

.-.~. - YANKEE NUCLEAR POWER STATION III. Topic XV-5: Loss of Feedwater Flow ,III.A Introduction I i The feedwater system is designed to provide a continuous flow of water to the four steam generators during normal plant operation. A rapid and large decrease in feedwater flow, when operating at power without a corresponding reduction in steam flow, would lead to a decrease in water iuventory of the steam generators. The main feedwater system consists of three electric motor-driven parallel boiler feedwater pumps with a common suction and discharge header that provide normal feedwater flow. The pumps take suction from the condenser via three parallel condensate pumps. Flow is controlled by four separate control valves. In the event of a total loss of main feedwater, an emergency feedwater system is available to provide water to the steam generators. Furthermore, the turbine trip follows reactor trip and the steam dump system is available for decay heat and stored energy removal. The emergency feedwater system includes one positive-displacement steam-driven pump with minimum capacity of 80 gpm. This pump does not rely Steam on electrical power and can function following total loss of AC. tu drive the pump may be supplied from either the main steam system or the auxiliary oil-fired boilers. In the event of total loss of AC, natural

• .circulation cooling would be procedurally controlled and this steam-driven pump would provide feedwater to the steam generators. Decay heat removal would occur via blowdown through the steam generator safety valves. The.

i steam-driven feed pump takes steam from upstream cf the nnn-raturn valvas and suction from the demineralized water storage tank. A back up system to supply water to the steam generators in the event of failures in the emergency feedwater system is the plant's three charging pumps with a total (capacityofapproximately100gpm(33gpm/ pump). The system is connected permanently by a spool piece that connects to the main feed line header. The charging pumps can take suction flow from the 135,000 gallon Primary Water Storage Tank. High Pressure Safety Injection and Low Pressure Safety Injection pumps provide another back-up source to supply water through the same permanently connected spool piece used for the charging pump path. More than 100 gpm flow is available from the combination of a single high pressure safety injection (HPSI) pump and low pressure safety injection (LPSI) pump, and there is a total of three HPSI pumps and three LPSI pumps. Upon loss of AC power, and LPSI pumps can be directly powered by the diesel generators. In addition to the steam-driven pump, a modification to increase the emergency feedwater capabilities is being made during the Core XV refueling outage. This modification was described to the NRC in Reference III.1, Attachment C. Two motor-driven emergency feedwater pumps of >150 gpm capacity each will be installed to increase the capability and redundancy of the emergency feedwater system, thus providing a more reliable method of mitigating the consequences of a complete loss of main feedwater. Additional piping will be installed to permit feedwater addition, with either fpump,througheitherthenormalfeedwaterpipingviathesteam-driven emergency pump header or through the blowdown piping via the alternate emergency feedwater header. These motor-driven pumps can be started either 4 - .. u -..

l remotely from the control room or locally by operator action. Upon loss of AC, one of the three on-site diesel generatcrs can be used to power either of these motor-driven pumps. Remote indication of emergency feedwater flowrates through the normal feedwater path will be available in the control i room. Local flow indication will be available in the combined; pump minimum-recirculation-flow piping. Thus, a redundant and versatile emergency feedwater system is available, consisting of one >80 gpm steam-driven pump and two >150 gpm motor-driven pumps. Also, the 100 gpm total charging pump capacity and the safety injection pumps (one HPSI and one LPSI provide >100 gpm) are available as back-up feedwater sources. Adequate emergency feedwater supplies are provided from these numerous alternative sources of pumping capacity. III.B Plant Response The feedwater system is designed to minimize the probability of cer: 7. I' - loss of flow to the steam generators. Three boiler feed pumps having a common suction and discharge are provided and the feedwater control valves are designed to fail in position on loss of air from the air controller system. However, in addition to loss of power to the main feedwater pumps, a complete loss of normal feedwater flow might occur from: ( t i 1. a malfunction in the feedwater regulating system that drives all the feedwater regulating valves closed; 2. a rupture located downstream of the feedwater check valves, such as at the feedwater header; or 3. an operator error that 1 cads to closure of all ieedwater regulating valves when feedwater control is in manual mode. Feedwater flow to the steam generators would not stop instantly for any sof these events, but would begin rapid coastdown when reactor trip occurs. Primary system pressure increases with the reduction in steam generator inventory. Pressurizer safety valves and main coolant loop safety valves are available to limit the pressure increase while core power reduction terminates the heat addition; however, challenges to these valves are not expected to occur. III.C Plant Protection Protection system diversity exists to provide a reactor trip signal . based upon either low steam generator level, high pressurizer water level, or high main coolant system pressure (implemented during Core XV refueling outage). I l III.D Analysis s Reference III.2 provided to the NRC an analysis of a total loss of feedwater event from a full power operating conditions (increased 3% l t to 618 MWt to include uncertainties). A step-change of the normal feedwater f flowrate to zero was assumed. The steam bypass system was conservatively l assumed to function normally af ter turbine trip to maximize both fluid pnventory loss and energy removal. No credit was assumed for pressurizer spray effects or for letdown and charging system operation to reduce the primary pressure increase. Conservative values of the moderator temperature and fuel temperature coefficients of reactivity were assumed, in addition l _

to assuming the_ Technical Specification minimum main coolant flow and maxi-stesa pressure during normal operation. The maximum allowed core ialet temperature and nominal main coolant pressure were assumed. No credit was taken for emergency feedwater from the >150 gpm motor-driven feedvater pumps being installed during the Core IV refueling outage. Emergency feedwater from the steam-driven pump at 80 gpm was delayed for fifteen minutes. The two main coolant pumps normally powered from the turbine generator were assumed to trip af ter sixty seconds. The pumps were assumed to be restarted within ten minutes to provide additional heating of the primary system. Analysis of the loss of feedwater flow transient was performed using two basic methods:

1) the CEMINI-II computer code, and 2) calculations which considered the total conservation of mass and energy of both the primary system and the secondary system.

The CEMINI-II computer code was used to determine the initial transient response of the primary and secondary system and to provide a comparison to the previous analysis, Core XI, which was submitted to the NRC via Reference 111.2. Primary system structural heat capacity is modeled with GEMINI-II. Additional calculations considered the total mass and energy j of the primary and secondary systems and supplemented the CEMINI analyses by accounting for the following parameters not modeled in CEMINI-II: 1. main coolant pump energy input to primary system, ? 2. steam generator secondary side structural heat capacity, and 1 3. ANS 5.1 decay heat (Referenet: III.3). l l l

A low steam generator level trip occurs at 18 seconds. Results showed that primary pressure peaked at 2178 psia at 22 seconds, followed by rapid decrease to 1860 psia at 60 seconds. The maximum pressure is significantly lower than the pressuriser power operated relief. valve setpoint i of 2400 psia. The turbine throttle valve closed at 20 seconds'aud steam pressure settled to the steam bypass system setpoint of 760 psig for the duration of the transient. Prim.ry system temperature reached a maximum of 5330F, but settled to the temperature that c'orresponds to the steam bypass system setpoint, spproximately 5140F. This is the plant no-load Taye value. Steam generator inventory loss was maximized by not assuming a reduced rate of heat transfer with decreasing water level and by not I crediting the availability of the motor-driven emergency feedwater pumps. l Without accounting for heat transfer rate degradation, the minimum inventory I was 14 percent of the initial value at 74 minutes, when inventory recovery occurred. This result is made more conservative since no credit was taken I for heat losses to ambient from either the primary or secondary system. i I Neglecting feedwater addition from any auxiliary source, steam generator inventories are sufficient to delay dryout for approximately 40 to 70 minutes when AC pcwer is available, depending upon initial conditions. If AC power was not available, the main coolant pumps and steam bypass system would not be in operation. Neglecting main coolant pump heat addition and limiting the steam generator blowdown to the secondary code safety valves results in more favorable steam generator inventory retention. Dryout times for this case are approximately 85 minutes. Thus AC power g was assumed to be available for conservatism. l l.

The most recent analysis of this event used Core KV nuclear design parameters and demonstrated the conservatism of the Reference III.2 analysis, which utilized Core XIV values. In conclusion, the combination of the rea tor protection system and the auxiliary feedwater system ensures the i s integrity of the core, and primary and secondary system pressure boundaries by (1) reactor trip on low steam generator water level, and (2) auxiliary feedwater flow sufficient to assure adequate steam generator liquid inventory for primary system cooldown, decay heat removal, and main coolant pump heat removal for the entire course of the event. The addition of (1) the high main coolant loop pressure instrumentation and trip logie, and (2) the two >150 gpm motor-driven auxiliary feed pumps (which may be operated from the control room) during the Core XV refueling outage provides even greater protection for this event. I! if . m.,

References III.1 FYR 81-52, YAEC Letter to NRC, Core XV Refueling, 26 March 1981. - III.2 WYR 79-104, YAEC Letter to NRC, Yank',? Rowe Loss of Fee'dwater ~ Analv-i s_,12 September 1979. III.3 ANS Standard 5.1, Decay Heat Power in Light Water Reactors, September 1978. l f I..

YANKEE NUCLEAR POWER STATION IV. Topic XV-7 : Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Shaft Break 1 IV.A Introduction The main coolant pumps do not possess a large ir.ertial mass because they were not designed with flywheels. Thus, following loss of power to a pump's m; tor the flow rate rapidly coasts down. Tests were conducted in 1971 to determine the pump coastdown characteristics. Results showed that the flowrate from a single pump, which was tripped from normal Tave and pressure conditions, was reduced by one-half in 0.58 seconds. Loss of pumping power from all four main coolant pumps is prevented by using independent sources of powar for pump pairs: one pump is powered by an incoming line and another is powered by an independent incoming powerline; the other pair is powered from a transformer connected to the main generator leads. The loss of two main coolant pumps during four-loop operation is considered to be the most severe anticipated operational occurrence. Reactor protection for t!is event is provided by either a low main coolant flow trip or a '.tip on high or low current to (1) two or more pumps during four-1 loop operation or, (2) one or more pumps during three-loop operation. Currently, three-loop operation is not permitted. l l Loss of flow from a single main coolant pump during four-loop r I oneration, will not result in direct reactor trip based upon a high or low ' pump current signal. Loss of power to all four main coolant pdmps with reactor trip, however, is a more severe event than rotor seizure or shaft I l ! l

inertial mass of the pumps. This was confirmed in Reference IV.1, the performance analysis for Core XI. The Core XI analysis showed that the steady-state DNB ratio during full power four-loop operation at 618 MWt (includes 3% uncertcinty), following instantaneous loss of flow from a single j pump without reactor trip, is greater than the minimum DNB ratto following complete loss of pumps, reactor trip, and flow coastdown during four-loop operation at 618 MWt. The analysis of the complete loss of flow accident is discussed in the next section. IV.B Analysis The results of the complete loss of flow accident performed for Core XI indicated that the DNBR ratio decreased to below 1.30 in 2.16 seconds af ter pump coastdown was initiated. No credit was assumed for the coastdown delay associated with the two pumps powered by the turbine generator. Using conservative heat transfer correlations, the maximum clad temperatures remained below 12000F. Assuming that all cladding in excess of 11000F fails, l the amount of failed fuel was estimated at less than 1.25 percent. This i analysis was approved by the NRC in Reference IV.2. The minimum DNB ratio for three-loop steady-state operation at full rated power was 2.54 (normally, l power level during approved three-loop operation is restricted to 75% rated). l A seized-rotor or shaf t-break event could not result in a more limiting DNB ratio. A two pump loss of the flow and reactor trip during normal three-loop operation resulted in a minimum DNB ratio of 2.51 seconds at 1.6 I seconds. Thus, seized-rotor or shaft-break events that result in loss of 1 l l a single pump without reactor trip are less limiting than a complete loss t I 'of pumps with reactor trip, and the DNB ratio for these events is greater than 1.30. -

A more recent analysis of the four-loop loss of pumping power accident res performed for Core XV and submitted to the NRC via Reference IV.3. This analysis was performed using methods similar to those approved f'f by Reference IV.2 for the Core XI analysis. Namely, the CHIC-IN code was used to determine core power and fuel pin thermal responses and the COBRA-III-C subchannel analysis code was used to determine the hot channel thermal-hydraulic response and minimum.NB ratio. Results for Core XV presented 5 in stference IV.3 indicated that no fuel damage was expected following a complete loss of pumping power during four-loop operation. Based upon the comparison made for Core XI, a seized-rotor or shaf t-break is a less 119Ating event. The seized-rotor and shaf t-break events would not result in DNB ratios much less than 2.54 or 2.51, and are not the limiting loss of flow event for the plant. No fuel damage is predicted; no radiological consequences occur. If this event occurs in coincidence with a turbine trip and loss of offsite AC power, the core would be cooled by natural circulation using the remaining three loops. Sufficient secondary coolant inventories exist for adequate primary-to-secondary heat transfer and controlled cooldown. I i l l l l I .,-,.-w.- n m. ,n w,., -,..n

IV. References I IV.1 YAEC Letter to NRC, Proposed Change No.115 (Core XI Refueling), 29 March 1974. + I IV.2 DOL /AEC Letter to YAEC, Amendment No. 9, 30 July 1974. IV.3 YAEC Letter FYR 81-52 to NRC, Core XV Refueling Proposed Change No.173, 26 March 1981. 1 r l I l l t i _33_ l

YANKEE NUCLEAR POWER STATION V. Topic IV-9: Startup of an Inactive Loop (PWR) V.A Introduction If a reactor coolant loop is isolated from the remainder of the primary system and subsequently opened into the system, without first matching the boron concentration and temperature of the isolated loop to the system, an increase in core reactivity and power may occur. Such an incident could lead to loss of margin to core thermal limits unless suitable 4 procedures and protection are provided. Operation of the plant with only three active loops is currently not permitted. However, when supporting LOCA analysis for this mode is available, three-loop operation at power levels up to 75 percent is anticipated. Normal plant operation presently requires closed and locked isolation valves with power removed, in both the hot and cold legs of the i l inactive loop on the primary side and in the main steamline on the secondary side of the inactive loop. The Technical Specifications require a I suberitical condition of at least a 1% AP before an isolated loop may be placed into service. 1 l When the plant is operating with one loop isolated from the remainder of the primary system, the isolated loop is allowed to cool below the temperature in the active loops. In order to bring the isolated loop back $into the system, administrative procedures have been established to prevent ' a mismatch in either boron concentrations or coolant temperatuIes between f the isolated and active loops. These procedures require the isolated loop l l l . l l l

temperature to be greater than or equal the highest cold leg temperature of the operating loops. The boron concentration of the inactive loop must be greater than that of the active portion of the primary system prior to opening the loop isolation valve and placing the loop into service. f In order to provide addition 1 protection against the ccurrence of a cold water incident, interlocks have been placed on the cold leg isolation valve controls so that they cannot be opened unless the isolated loop temperature is within 300F of the hottest active loop cold leg temperature. Administratively, this temperature difference is restricted to 200F. Furthermore, the slow-opening loop isolation valve permits gradual mixing of the isolated loop water with water of the active loops. The loop transit time is short compared to valve opening time, which favorably increases mixins. Administrative procedures for handling the startup of an isolated loop require at each stage of the startup that the boron concentration in the inactive loop is always greater than or equal to the concentration in the remainder of the primary system. In order for a lower boron concentration to exist in the isolated loop when brought into service, more than two administrative procedures will have to be violated. Although the occurrence of the cold water incident is considered highly unlikely, an analysis has been performed to demonstrate that the reactor protective system precludes fuel damage for the largest temperature Inismatch possible between the active and isolated loops. This analysis l was submitted via Reference V.1 and approved in Reference V.2., l l l l

V.B Analysis The following assumptions were used in the analysis: 1. The temperature of the borated water in the isolated loop is i ? 680F, the lowest value considered possible for this incident; f 2. The moderator temperature coefficient is the most negative value expected; 3. The fuel temperature coefficient is the least negative value expected at hot, operating conditions, including calculational uncertainties. This will result in the largest power overshoot above the high neutron flux trip setpoint; 4. The initial core flow rate is 78 percent of the normal four loop flow rate. The flow increase resulting from the isolation valve opening is proportional to the cross-sectional flow area of the gate valve; 5. The core inlet temperature variation with time is determined from a complete mixing model. l Results show that core inlet temperature and primary pressure decrease with time as the cold water from the isolated loop mixes with the higher temperature water in the reactor inlet plenum. Decreasing temperature adds reactivity to the core, reactor power rises, and the high neutron flux IItrip point is reached at 9 seconds. The minimum DNB ratio during the ' transient is greater than 2.97 and peak fuel temperature does not exceed 34850F. t

~. More recently, this event was analyzed using Core XV nuclear design parameters. Results were submitted to the NRC in Attachment D to Reference V.3. Since the Core XV moderator temperature coefficient of reactivity is less negative than assumed for Core XI, results for Core II are bounding. I. I ~ In conclusion, adequate margin to DNB exists for this accident even for the highest possible temperature mismatch between the active loops and the isolated loop. In addition, procedural controls and the cold leg isolation valve interlo<.k minimize the probability that the event will occur. The high neutron fitix trip provides automatic protection. i V.C References V.1 YAEC Letter to NRC, Proposed Change No.115_ (Core XI Refueling), 29 Maren 1974. V.2 DOL /AEC Letter to YAEC, Amendment No. 9, 30 July 1974.- V.3 FYR 81-52, YAEC Letter to NRC, Core XV Refueling, 26 March 1981. ? e f i - \\

i YANKEE NUCLEAR POWER STATION VI. Topic XV-10: Chemical and Volume Control System Malfunction That Results in a Decrease in Boron Concentration in the Reactor Coolant fVI.A Introduction { Boron concentration in the main coolant system is diluted during normal operations to compensate for fuel depletion and changes in xenon inventory. Strict administrative controls are exercised to limit both the rate and amount of any change in boron concentration required for reactivity control. Boron dilution is accomplished according to procedure by transferring charging pump suction from the Low Pressure Surge Tank to the demineralized water supply. Technical Specifications prohibit dilution during any mode of operation unless at least one reactor coolant pump or the shutdown cooling system is in operation. The reactivity change must be <l.5(10)-4 p /sec A with main coolant temperature >2300F. The demineralized water is introduced into the primary coolant using the charging and volume control system. Normally, charging pump flow passes through the shell side of the feed and bleed heat exchangers for warming before entering the loop 4 hot leg. Following a loss-of-coolant accident, direct hot leg injection would be used to prevent undesirable precipitation of boron in the core from blocking coolant flow. Charging water can also !!be directed into any loop frcm the low pressure safety injection header,

which is normally isolated from the charging and volume contro.1 system. !

L.-.-... ... -..... ~,, -, -,... _... -...,.

Dilution of boron concentration in the main coolent cystco or the low pressure surge tank can be terminated by (1) isolation of the charging system via motor-operated valves, (2) shutting of f charging pumps or the low pressure surge tank make-up pump, or (3) by isolation of the primary Thelowpressuresurgetanklevelindicftionis ! make-up water system. i ' equipped with high and low alarms that could provide indications of a possible change in boron concentration. An inadvertent boron dilution would require multiple operator errors and procedural violations or multiple equipment malfunctions. This could lead to an increasing core reactivity level either from cuberitical ~ conditions or while operating at power. Analysis of this event has been performed for each mode of plant operation permitted by the Technical Specifications. Aa evaluation was also performed of the consequence of a failure to borate during a controlled cooldown, which could also result in a reactivity increase. The analysis reported below was submitted to the NRC via Reference VI.1, the Core XV performance analysis. l VI.B Plant Protection I An automatic reactor trip would terminate any reactivity transient 1 1 due to boron dilution or failure to borate. The available trip functions are (1) high neutron flux, (2) high startup rate, (3) high pressurizer water level, and (4) high main coolant loop pressure (effective with Core XV i operation). In addition, a manual scram may be inserted by the operator 1 ' based upon many indications and alarms. Standard Review Plan 15.4.6 presents minimum allowable time intervals for operator recognition and manual action ~? to avoid complete loss of shutdown margin. During startup, cold chutdown,

hot standby, and power operation, an interval of 15 minutes is specified. During refueling, the interval specified for recognition and prevention is 30 minutes. Boron dilution at power operation is less limiting than an inadvertent rod-withdrawal accident (Topic XV-8), for which automatic . protection is adequate. I VI.C Analysis VI.C.1 Boron Dilution During Mode 1 (Power Operation) and Mode 2 (Startup) The Technical Specifications currently require that all four primary loops must be operating in these modes. However, one loop is assumed to be isolated to introduce conservatism in the analysis. This assumption 3 to 2400 f t3, reduces the available volume for boron dilution from 2900 f t resulting in a higher race of reactivity change. The maximum capacity of all three charging pumps le assumed, 100 gpm, although it is unlikely that all three would be used to deliver makeup water to the primary system. The minimum initial shutdown margin is 4.72% , which is considerably less than normally exists during operation in Modes 1 and 2. Minimum inverse boron worth was also assumed. Using these assumptions, the minimum time available for operator recognition and action exceeds 45 minutes. l l Should the reactor be in the automatic control mode during a boron dilution at power, the control rod group selected as the controlling group by the operator would insert to of fset any resulting temperature change. Even if rods move at the rate of 6 in/ min, it would require 15 minutes to Dfully insert the control group. During this time, the operator would be 5 alerted by the high average temperature and high core power aldrms. In I l addition, the vapor container intercom system would normally provide an i

audible indication cf rod motien. Th2s2 indienticus cnd cicras would clart the operator in sufficient time to terminate the dilution and restore adequate shutdown margin. VI.C.2 Boron Dilution During Mode 3 (Hot Standby) f. 5-At least one loop must be in operation during Mode 3, with a minimum of 1% AP suberiticality and >4.72% AP shutdown margin. The maximum charging flowrate of 100 gpm is assumed, although feed and bleed operations are not normal;; conducted using all charging pumps. If this occurred, four alarms would indicate to the operator that boron dilution could be occurring. These alarms are (1) high flux recorder alarm, (2) pressurizer high level alarm, (3) pressurizer high pressure alarm, and (4) pressurizer surge line low temperature alarm. In addition the bleed line radiation alarm could occur. Results show that loss of shutdown margin during a boron dilution event in Mode 3 would not occur for at least 30 minutes. VI.C.3 Boron Dilution During Mode 4 (Hot Shutdown), Mode 5 (Cold Shutdown), and Mode 6 (Refueling) The shutdown cooling system may be used during operations in either Mode 4, Mode 5, or Mode 6. Thus, the active main coolant volume excluding could be approximately 1486 f t3 Assuming that the upper vessel head is 3 drained, the minimum volume during Mode 6 operation (refueling) could be 1276 f t 5this volume was assumed for conservatism to apply to Mode 4 and Mode 5 operation. A Technical Specification requiring 4% AP suberiticality and E 5% o hutdown margin when in Modes 4 and 5 was proposed in Reference IV.I. A ~ s a

Ap Thio allowa partici cithdrawal cf a centrol rod grcup to prcvida 1% reactivity worth, which is required by Technical Specification. Control rods are not routinely withdrawn during the Mode 4 or Mode 5 operation, hP hutdown margin will however, a requirement of 4% Apsuberiticality and 5% i 00 . allow 1% to be withdrawn. Assuming 100 gpm charging flow and the most limiting combiaation of coolant temperature, in'tial boron concentration, and inverse boron worth, j more than 20 minutes is available for operator recognition and action before shutdown margin is lost. This time period is sufficient for operator acknowledgement and ccrrective action following alarms of high flux level, or Low Pressure Surge Tank high level, high temperature, or high pressure. VI.C.4 Failure to Borate Prior to Cooldown Because of the large negative temperature coefficient of reactivity at end of cycle, any decrease in main coolant system temperature increases l the core reactivity state. Consequently, during the process of cooldown i of the main coolant system, adequate shutdown margin must exist from boron concentration and control rod worth. Failure to ensure adequate shutdown margin prior to cooldown was evaluated using the following basic assumptions: a) The moderator temperature coefficient is the most negative value expected with all rods in the core, including uncertainties. f b) The reactor is initially 1% soberitical at an average temperature of 5150F, the maxioum allowed temperature at hot stendby (Mode

3) conditions. l

c) The shutdown margin at 515cF is 4.72%AP, less than the minimum required by the Technical Specifications. 4 d) The main coolant system temperature is reduced at the maximum allowable rate of 500F/hr. 1 In order to make the reactor critical from these initial conditions, i the average coolant temperature must be reduced to approximately 4900F. t This temperature reduction requires approximately 30 minutes, which is ample time for the operator to diagnose the condition and take necessary corrective action. A cocidown below 3500F would be required for a complete loss of shutdown margin. This would require ir excess of 3 hours, which is adequate time for the operator to correct the situation. VI.C.5 Conclusion The probability of erroneous dilution is considered very small because of the equipment, controls, and administrative procedures provided i for boron dilution activities. However, in the unlikely event that an l unintentional dilution of boron in the main coolant system occurs, numerous alarms and indications are available to alert the operator of the condition. If the reactor is critical at the time dilution begins, automatic safety features of the reactor protection system would ensure acceptable plant performance without operator intervention. For boron dilutions initiated l during any operational mode, adequate time exists for the operator to l

• • determine the cause of the di;; tion and take corrective action before a complete loss of shutdown margin occurs.

E l

l l' ... _,_-..,. _.,,, ~.. .-z.- ~ - -

1-l VI.D References VI.1 FYR81-52, YAEC Intter to NRC, Core XV Refueling Proposed Change No. 173, 26 March 1981. s ~ i [ f ~ i 4 t i n P e r S [ e 6 i. l l'

YANKEE NUCLEAR POWER STATION VII. Topic XV-12: Spectrum of Rod Ejection Accidents (PWR) The mechanism postulated to result in ejection of a control rod ffromthecoreisamechanicalfailureofthecontroldrivemech'anismhousing (CRDM). The CRDM housing and CRDM nozzle are an extension of the reactor coolant system boundary and are designed and manufactured to Section VIII of the ASME Boiler and Pressure Vessel Code (1956 Edition). Rod ejections are considered to be a limiting-fault event by Reference VII.1 ANSI N18.2 standards, which is an event that is not expected to occur within the lifetime of the plant. It is postulated for analysis becsuse of the potential for radiation release due to possible fuel pin damage caused by extreme temperatures. NRC Regulatory Guide 1.77, Reference VII.2, places a limit of 280 cal /gm on the maximum radially-averaged fuel enthalpy during the accident. If the radially-averaged enthalpy the fuel pin hot spot exceeds 280 cal /gm, by NRC standards the pin is assumed to fail and all gap radioactivity is assumed to be released. Currently, however, Yankee Atomic Electric Company employs more conservative criteria to measure fuel d amage. These criteria are identical to those adopted by Combustion Engineering for preparation of the Maine Yankee Plant Final Safety Analysis 1 l Report. They are as follows: l Failure Mode Basis Fuel Enthalpy Criteria Clad Damage Radial Average >200 cal /gm 4 at Axial Hot Spot Incipient Fuel Melting Axial Hot Spot >250 cal /gm I I Fully Molten Fuel Axial Hot Spot >310 cal /gm i i i l 1 l

m. 1 l t The amount of reactivity which can be introduced into the core as a result of a rod ejection is minimized by operation with chemical reactivity shim. Most of the control rods are withdrawn before reaching full power, thus minimizing the severity of any rod ejection accident. Furthermore, should a rod ejection occur, the resulting high power level in tiates a i high neutron flux trip signal which causes the shutdown rods to insert, thus reducing the neutron generated power to negligible levels. The loss j l of coolant resulting from the primary system r.w'ure and its consequences are similar to those for small breaks, which are discussed in the section describing the Loss-of-Coolant Accident, Topic VI-2.D. VII.B Analysis The analysis of the rod sjection accident is performed using the CHIC-KIN digital computer program to simulate the core hot channel response. This model incorporates the standard six-delayed neutron groups representation along with explicit reactivity contributions from rod motion, fuel temperature effect and moderator temperature variations. The principal reactivity feedback mechanism affecting the course of the nuclear transient is caused by fuel temperature increase. Although j the axial shape does not change significantly during the course of a rod ejection accident, the radial shapes at various axial slices undergo marked changes. However, the use of the static, non-Doppler flattened radial pin peaking factor (obtained from two-dimensional diffusion theory results)

• !in conjunction with the average core energy re ease (obtained from the point l

2 kinetics results) yields hot spot energy releases that are conservative, since the fuel temperature effect during a transient is strongest at the l ..,--,,.---,----,n,. ,,,,,,,,.,,,,yp,.,,..,,,.n ,,,,w. e-s ,n,.., ,-__,,._,.,-n,

radici peck loccticn. Thus, the rcdici peck 10 licitcd to e valu2 below that obtained from the static ejected rod configuration far the major portion of the transient. Rod ejections are evaluated for each reload core using methods fsimilartotheCoreXIanalysis,submittedviaReferenceVII.3fandapproved by the NRC via Reference VII.4. Typically, results vary from core to core because of changes in rod worth, moderator and fuel temperature reactivity coefficients, axi'l power distributions, and radial two-dimensional peaking factors. Analysis is performed for both zero power and full power operating conditions. Most recently, the rod ejection analysis for Core XV, Reference VII.5, showed results to be less limiting than for Core XIV. Core XI results were more limiting than either Core XIV or Core XV, The following assumptions applied for the Core IV analysis: 1. The most worthy control rod ejects instantaneously; 2. The fuel temperature coefficient is the least negative value expected throughout core life during power operation; i 3. The ejected rod worth is the maximum throughout core life; i 4. The calculated maximum ejected rod peaking throughout core life l l l is increase 6 by 10 percent in order to account for calculational l uncertainties. I Results for Core XV were that radially-averaged enthalpy for both i low power and full power cases was less than 200 cal /gm, sono-{fuelpin l I l l l

damage was predicted. In conclusion, together with established rod insertion limits, the reactor protection system ensures that no clad damage occurs during a rod ejection cransient. I n .s i VII.C References VII.1 ANSI N18.2, N2 clear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants,1973. VII.2 Regulatory Guide 1.77, Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors, US AEC, May 1974. VII.3 YAEC Letter to NRC, Proposed Change No.115 (Core XI Refueling), 29 March 1974. VII.4 DOL /AEC Letter to YAEC, Amendment No. 9, 30 July 1974. VII.S FYR81-52, YAEC Letter to NRC, Core XV Refueling, 26 March 1982. l D i l !

= ~ -,,. -. -. YANKEE NUCLEAR POWER STATION Topic XV Inadvertent Operation of ECCS or CVCS Malfunction that causes an increase in reactor coolant inventory. N 5 An increase in main coolant system inventory can result frod inadvertent safety injection or from a malfunction in the pressurizer level control system (CVCS). Depending upon boron concentration and temperature of the injected water, a power level increase could result. A malfunction of the pressurizer level control system could at most result in the starting of all three charging pumps and in the closing of all three letdown orifices. This situation results in a maximum charging rate of 100 gpm (33 gpm/ pump). At this rate, the pressurizer level will increase at approximately 17 inches per minute from its normal level of 120 inches ( 1/3 full). A high pressurizer water level trip will scram the reactor when the pressurizer level reaches 200 inches. However, a high main coolant system pressure trip _ would most likely have already occurred when the MCS pressure reached 2200 psig. During the level increase, a high pressurizer level alarm will occur at 150 inches, alerting the operator to the overenarging condition, giving him time to stop the charging pumps before the MCS reaches an overpressure condition. In addition to the pressurizer level and MCS pressure increase, the overcharging condition could result in a boron dilution of the MCS resulting in an increase in reactor power. Should the reactor be in the automatic control mode during a boron dilution at power, the control rod group selected by the operator would insert to offset any temperature increase resulting from l the core power-steam flow mismatch. During this time, the operator would be alerted by the high average temperature and high core power alarms. In adgition, the Vapor Container Intercom System would normally provide an audible indication of rod motion. These indications and alarms would alert the operator of the condition in suf fficent time to terminate thej dilution and restore adequate shutdown margin. If the reactor should be in the manual mode, the same alarms and indications would occur but the control rods would not be inserted. Boron dilution at power is discussed in detail in the Core XV licensing submittal, Reference XV-14A. l l

Inadvertent operation of the ECCS during normal operating conditions will not result in adverse consequences since no flow will be delivered to the MCS due to the fact that the ECCS shutoff head of 1560 psig which is well below MCS operating pressure. Individual recirculation lines from each HPSI pump discharge to the Safety Injection tank (SIT) provide minimum rec.irculation flow ptsop protection. In addition, inadvertent HPSI pump operadkon will not kesult in overpressurization of the LPSI pumps. First, it is highly improbable that the five check valves in series would leak excessively. Second, the respective heads of the LPSI pumps and HPSI pumps are of nearly the same magnitude - 870 psi for the HPSI pumps and 690 psi for the LPSI thus damage to either pump is unlikely. Third, flow back to the SIT through LPSI recirculation orifices would prevent pressure buildup. The inadvertent operation of the ECCS during low temperature / low pressure ~ conditions was addressed in the evaluation of the reactor Low Temperature Overpressure Protection System (LTOP). Pressure transients resulting from the mass addition from one SIS train between MCS temperatures of 300 F to 324 F and from the mass addition from one low pressure safety injection pump below 200 F MCS temperature were excluded as design considerations from the Yankee Rowe LTOP system. The justification for excluding these events is best summarized in the NRC's Safet; Evalution of the Yankee Rowe Low Temperature Overpresure Protection System, Referen:e XV-14B. Based upon this review, it is concluded that the Yankee Nuclear Power Station is adequately designed to cope with an inadvertent operation of the ECCS or CVCS. 3 i \\

? 'I References XV-44 XV-14A " Yankee Nuclear Power Station Core XV Performance Analysis", YAEC-1240, March 1981. XV-14B " Safety Evaluation by the Office of Nucear Reactor Regulation Supportiong Amendment No. 59, Facility Operating Licesnse No. LPR-3, Yankee Atomic Electric Company, Yankee Nuclear Powt Station (Yankee Rowe), Docket No. 50-29", USNRC, September 14, 1979. h l l l

YANKEE NUC1. EAR POWER STATION Topic XV Inadvertent opening of a PWR pressurizer safety / relief valve The design pressure of the Yankee Rowe main coolant system 1s 2485 PSIG. hrmal system operating pressure is 2,000 PSIC. Two pressurizer [ code safety dives and a single pressurizer power operated relief valve are provided to limit any main coolant pressure transient to 110% of the design pressure (2735 PSIG). In addition, a 1-inch water relie f valve (90 GPM at 2735 PSIG) is provided in each main coolant loop

• .o prevent overpressurization of an isolated main coolant loop. Technical specifications do not t.llow power operation with an isolated loop.

The two pressurizer code safety valves are designed to relieve 92,000 lbs per hour of saturated steam at set pressures of 2485 PSIG and 2560 PSIG respectively. The combined relief capacity of these valves is greater than the maximum surge rate resulting from a complete loss of load assuming no reactor trip until the first RPS setpoint is reached and no credit for PORV or steam dump valve operation. The single power operated pressurizer relief valve has a capacity of 70,000 lbm per hour at its set pressure of 2385 PSIG. It is provided primarily to limit cha11anges to the code safety valves but in certain accident situations it may be relied upon to depressurize the MCS and provide for core cooling via feed and bleed. It should also be noted that PORV actuation would not prevent a reactor trip in an overpressurization event since its set pressure is well above the high main coolant system pressure l I trip of 2,200 PSIG J Since the normal s; em pressure at Yankee is 2,000 PSIG, considerable l margin exists between that pressure end the set pressures of the PORV (2385 PSIG) and the code safety valves (2485 psia and 2560 psia). Thus, the most likely time for an inadvertent relief or safety valve blowdown to occur would bf follow lng an event such as a loss of load without prompt reactor trip in which a relief or saf ety valve lifts and f ails to reseat. In the event of the PORV remaining open, the operator can terminate the ensuing blowdown by closing the PORV block vave. Since the saf ety valves cannot be' isolated, blowdown from a stuck-open safety valve would continue until either the va e 1 l rescats or until the plant is brought to cold shutdown. l' l l y e e e. -y w .e , _ ~ ~m

It should be noted that in 20 years of Yankee operation, neither the code saf ety valves nor the PORV have been challenged. This is due to the wide margia between operating pressure and valve setpoints as noted above. With the installation of the new MCS high pressure trip of 2,200 PSIG for Core XV, the potential for future challenges to the PORV or the code safeiy valves is $2bstantially reduced from the already low probability that currd[ntly exists. t. In the unlikely event of a stuck-open pressurizer PORV or safety valve, blowdown from the main coolant system via the pressurizer to containment would A 240 PSIG rupture disk is provided on the relief valve discharge occ ur. piping. Perforatien of the rupture disk would direct the blowdown into containment. Relief valve elischarge piping is designed such that normal valve " weeping" is directec to the low pressure surge tank and any other higher flow rat muld cause ti:e ruptue disk to blow to containment. The rate of MCS depressurization from the stuck-open valve would depend upon the venting capacity of the relief or safe':y valve in the unseated condition. Reactor scram would occur upon reaching the low main coolant system pressure sce. point of 1,800 PSIG. The rate of depressurization f ollowing reactor trip increases because of the cooldown of the primary The ensuing system " shrink" results in a rapid transition from 1,800 sys':em. PSIG MCS pressure to approximately 935 PSIG or 760 PSIG depending upon the second ~y side configuration. The automatic rod control syrtem at Ya..kee would not attempt to maintain constant reactor power prior to reactor trip since it has a rods in function only whien is controlled by the average coolant temperature (T,y, g). As such, the automa ic rod control system can only serve to decrease reactor power in such an event. A sa fety injection actuation signal (SIAS) will occur wl.en the pressure d ops below 1,700 PEIG, thus starting safety injection pumps. The high on SIAS but do not pressure and low pressure safety injection pumps stat; 1 ~* ~

bzgin dalivsring ficw to the MCS until the MCS pressura drops below their combined shut off head of 1,560 PSIG. This will occur quite quickly following reactor trip. Once the MCS temperature equilibrates with the secondary side temperature, MCS depressurization continues (at a slower rate due to saturated conditions) until the ECCS recovers the situation, refills the MCS and long term cooling is established. I t

~

The inadvertent opening of a pressurizer relief or pressurizer safety valve has not been specifically analyzed. Such an event would represent a break area equivalent to an internal diameter of 0.8 inches for the PORV to approximately 0.9 inches for the safety valves. Since these breaks are on the hot side of the system, the system effects are less severe than for the equivalent size cold leg break. The system response to inadvertent opening of the pressurizer relief or safety valves are bounded by the small break LOCA analyses performed for Core XIII which meet Appendix K criteria (References XV-15A and XV-15B). That analysis consisted of a spectrum of cold leg breaks with ECCS spillage ranging in size from 2.25 inches ID to 10.0 inches ID. The limiting break was identified to be a 4.0 inch ID break. Analysis of any breaks less than 4 inches ID would prove to be non-limiting. The system response to a stuck open PORV or safety valve is much less limiting than the equivalent cold leg break for several reasons. First, the break is at the highest point in the MCS, facilitating steam venting and ultimately system refill. Second, safety injection will occur at all four loop injection points versus only three in the Core XIII Analysis since no pipe break exists, maximizing system refill. Finally, the relieving capacity of these valves are such that decay heat can be removed from any of them early in the blowdown ' ancient. For example, the PORV can remove decay heat by removing steam at approximately 15 minutes to one-half hour into the accident. This capability allows the initial inventory on the secondary side of the steam generators to handle decay heat requirements amply until the PORV handles it on its own coupled with ECCS injection. l Based upon this review, it is concluded that the Yankee Nuc} ear Power e Station is adequately designed to cope with an inadvertent openi'ng of a pressurizer relief or safety valve. ..,-a y gus..w

E L References {. XV-15A Proposed Change No. 145, Supplement No. 5, Yankee Rowe Core XIII ECCS Performance Evaluation, August 1, 1977. XV-15B _ Proposed Change No.145, Supplement No. 7, WYR 77-90, Additional Yankee Rowe Core XIII Small Break Analysis, September 21, 1977. h S 5 "s -}}