ML20112J766

Steam Generator Tube Rupture Analysis Methodology to Determine Margin to Steam Generator Overfill

ML20112J766
Person / Time
Site:	Ginna
Issue date:	12/31/1984
From:	Huang P, Robert Lewis, Volpenhein E WESTINGHOUSE ELECTRIC COMPANY, DIV OF CBS CORP.
To:
Shared Package
ML19269A919	List: ML20112J761 ML20112J766
References
WCAP-10750, NUDOCS 8501180365
Download: ML20112J766 (127)

Text

(

WCAP-10750 SGTR ANALYSIS METHODOLOGY TO DETERMINE THE MARGIN TO STEAM GENERATOR OVERFILL R. N. Lewis E. C..Volpenhein P. Huang D. H. Behnke R. L. Fittante A. Gelman December 1984 APPROVED BY:

E. P. Ralfe, Jr., Mana 6 Nuclear Safety Depart t

Work Perfortned Under Shop Order MUHN-5000 For the SGTR Subgroup of the Westinghouse Owners Group WESTINGHOUSE ELECTRIC CORPORATION Nuclear Energy Sy. stems P. O. Box 355 Pittsburgh, Pennsylvania 15230 hh k!O O 00 77870:1P /121284 P

s o

ACKNOWLEDGEMENTS The authors wish to acknowledge the support and contribution to this program provided by the SGTR Subgroup of the Westinghouse Owners Group, Alan Ladieu, Chairman.

i 7187Q:10/113084

l TABLE OF CONTENTS Section Pace 1.0 Introduction and Summary 1-1 2.0 Operator Action Times 2-1 2.1 Operator Actions for SGTR Recovery 2-1 2.2 Data for Operator Action Times 2-8 2.2.1 Simulator Data 2-9 2.2.2 Plant Data 2-11 2.3 Evaluation of Operator Action Times 2-15 3.0 Model Development 3-1 i

3.1 General Description of LOFTRAN Program 3-1 3.2 LOFTRAN Program Modifications 3-2 3.2.1 Break Flow Model 3-2 3.2.2 Secondary Side Representation 3-6 3.2.3 Capability to Simulate Operator Actions 3-11 3.3 Validation of LOFTTR1 3-15 4.0 Development of Analysis Methodology 4 -1

-4.1 Selection of Reference Plant 4-2 4.2 Base Case SGTR Transient with Operator Actions 4-7 4.2.1 Method of Analysis 4-7 4.2.2 Description of Base Case SGTR Transient 4 -7 4.2.3 Margin to Overfill for Base Case SGTR Transient 4-11 4.3 Sensitivity Studies 4-20 4.3.1 Identification of Conservative Assumptions 4-20 4.3.2 SGTR Analysis with Conservative Plant Parameters 4-40 4.3.3 SGTR Analysis with Turbine Runback 4-45 4.3.4 Reduced Power SGTR Analysis 4-48 4.4 Equipment Failure Evaluation 4-51 4.4.1 Dejign Basis Equipment 4-51 4.4.2 Single Failure Evaluation 4-60 4.4.3 Generic Applicability 4-74 4.5 Analysis of Design Basis Accident for the Reference Plant 4-95 1

77870:1D/121284

l TABLE OF CONTENTS (Continued)

Section P_4it 5.0 Sunnary of SGTR Design Basis Analysis Methodology 5-1 6.0 References 6-1 1

l k

9 11

LIST OF TABLES IAltli I.1111 EtSi 2.1 -1 SGTR Recovery Actions in E-3 Guideline 2-6 2.1-2 Time Intervals for SGTR Recovery Actions 2-7 2.3-1 SGTR Operator Action Times

.2-24 2.3-2 Operator Action Times for Design Basis SGTR Analysis 2-25

3. 2-1 Simulated Operator Actions 3-13 3.3-2 Plant Parameters 3-14 4.1 -1 Comparison of Relative Times to Steam Generator Overfill 4-4

4. 2-1 Sequence of Events for Base Case SGTR Transient 4-12 4.3-1 Comparison of Sequence of Events for a SGTR With and 4-29 Without Offsite Power 4.3-2 Margin to Overfill Sensitivity Study 4-30 4.3-3 Comparison Between Base Case and Conservative Plant 4-42 Parameters

4. 3-4 Comparison of the Sequence of Events for the Base Case 4-43 and Conservative Case SGTR 4.4-1 Comprehensive Equipment List 4-77 4.4-2 Design Basis Equipment List for Reference Plant 4-80 4.4-3 Sequence of Events for Ruptured SG PORY Failure 4-83 Cases with-20 and 30 Minute Isolation Times 4.4-4 Summary of Single Failure Evaluation 4-84

4. 5-1 Sequence of Events for Design Basis SGTR 4-97 4.5-2 Design Basis Margin to Overfill for the Reference Plant 4-98 iii 3bTilWVhWiErY\\. _.

LIST OF FIGURES F1aure Titig Pg.ge, 3.3-1 LOFTTR1 Validation - Short Term Core Power 3-26 3.3-2 LOFTTR1 Validation - Short Tern Steam Flow 3-27 3.3-3 LOFTTR1 Validation - Short Tern Intact Steam Generator 3-28 Pressure 3.3-4 LOFTTR1 Validation - Short Term Ruptured Steam Generator 3-29 Pressure 3.3-5 LOFTTR1 Validation - Short Term Intact Loop Feedwater Flow 3-30 3.3-6 LOFTTR1 Validation - Short Term Ruptured Loop Feedwater Flow 3-31 3.3-7 LOFTTR1 Validation - Short Term Pressurizer Pressure 3-32 3.3-8 LOFTTRI Validation - Short Term Pressurizer Level 3-33 3.3-9 LOFTTR1 Validation - Short Term Intact Loop Cold Leg 3-34 Temperature 3.3-10 LOFTTR1 Validation - Short Term Ruptured Loop Cold Leg 3-35 Temperature 3.3-11 LOFTTR1 Val'4ation - Pressurizer Level 3-36 3.3-12 LOFTTR1 Validation - Intact Cold Leg Temperature 3-37 3.3-13 LOFTTR1 Validation - Ruptured Loop Cold Leg Temperature 3-38 3.3-14 LOFTTRI Validation - Core Exit Fluid Temperature 3-39 3.3-15 LOFTTR1 Validation - Reactor Coolant System Pressure 3-40 3.3-16 LOFTTR1 Validation - Intact Steam Generator Pressure 3-41 3.3-17 LOFTTR1 Validation - Ruptured Steam Generator Pressure 3-42 3.3-18 LOFTTR1 Validation - Upper Head Fluid Temperature 3-43 3.3-19 LOFTTR1 Validation - Break Flow And Total Safety Injection 3-44 Flow 3.3-20 LOFTTR1 Validation - Short Term Intact Steam Generator 3-45 Narrow Range Level 3.3-21 LOFTTR1 Validation - Short Term Ruptured Steam Generator 3-46 Narrow Range Level 3.3-22 LOF(TR1 Validation - Ruptured Steam Generator Narrow Range 3-47 Level 3.3-23 LOFTTR1 Validation - Pre-Trip Tube Rupture Flow 3-48 iv

~

LIST OF FIGURES (Continued)

Fioure Title Pace 4.1 -1 RCS Pressure After A SGTR Event 4-5 4.1-2 Equilibrium Break Flow Rate For A SGTR Event 4-6

4. 2-1 Base Case SGTR Transient - Pressurizer Level 4-13 4.2-2 Base Case SGTR Transient - RCS Pressure 4 14 4.2-3 Base Case SGTR Transient - Secondary Pressures 4-15 4.2-4 Base Case SGTR Transient - Intact Loop Cold Leg And Hot 4-16 Leg Temperatures 4.2-5 Base Case SGTR Transient - Steam Generator Narrow Range 4-17 Levels 4.2-6 Base Case SGTR Transient - Break Flow Rate 4-18 4.2-7 Base Case SGTR Transient - Steam Generator Secondary Water 4-19 Volume 4.3-1 Sensitivity to Initial RCS Pressure - Secondary Water Volume 4-32 4.3-2 Sensitivity to Initial Pressurizer Water Level - RCS Pressure 4-33 4.3-3 Sensitivity to Offsite Power Availability - Reactor Coolant 4-34 Temperatures with Offsite Power Available 4.3-4 Sensitivity of Offsite Power Availability - RCS Pressure 4-35 l

4.3-5 Sensitivity of Offsite Power Availability - Secondary Water 4-36 Volume 4.3-6 Sensitivity to SI Flow Rate 4-37 4.3-7 Sensitivity to Decay Heat Level - RCS Pressure 4-38 l

4.3-8 Sensitivity to Decay Heat Level - Secondary Water Volume 4-39 l

4.3-9 Comparison of the Conservative Case and Base Case -

4-44 Secondary Water Volume i

4.3-10 Effect of Turbine Runback on Conservative Case Results 4-47

- 4.4-1 Failure of Ruptured SG PORY - Ruptured and Intact SG 4-85 Pressures For 30 Minutes Isolation Time 4.4-2 Failure of Ruptured SG PORY - Ruptured SG Secondary 4-86 L

Side Water Volumes 4.4-3 Failure of Ruptured SG PORY - Ruptured SG PORV Steam 4-87 Flow Rate and Break Flow Rate for 30 Minutes Isolation Time y

______ 7 787_0;_] D/1_20E3__ _ _

LIST OF FIGURES (Continued)

Fiaure 2

PARE 4.4-4 Failure of Ruptured SG PORY - RCS and Ruptured SG 4-88 Pressures fo'r 30 Minute Isolation Time 4.4-5 Failure of One Intact SG PORY - Intact Loop Hot Leg 4-89 Temperatures 4.4-6 Failure of One Intact SG PORY - Ruptured SG Secondary 4-90 Side Water Volume 4.4-7 Steam Flow Rate From The SG Relief Valves 4-91 4.4-8 Loss of Pressurizer Pressure Control - RCS and Ruptured 4-92 SG Pressures 4.4-9 Loss of Pressurizer Pressure Control - Indicated Pressurizer 4-93 Level 4.4-10 Loss of Pressurizer Pressure Control - Ruptured SG 4-94 Secondary Side Water Volume

4. 5-1 Design Basis SGTR Transient - RCS Pressure 4-99 4.5-2 Design Basis SGTR Transient - Intact Loop Cold Leg And 4-100 Hot Leg Temperatures

)

4.li-3 Design Basis SGTR Transient - Pressurizer Water Level 4-101 4.5-4 Design Basis SGTR Transient - Steam Generator Pressures 4-102 4.5-5 Design Basis SGTR Transient - Ruptured SG Steam Flow Rate 4-103 4.5-6 Design Basis SGTR Transient - Intact SG Steam Flow Rate 4-104 4.5-7 Design Basis SGTR Transient - Ruptured SG Break Flow Rate 4-105 4.5-8 Design Basis SGTR Transient - Steam Generator Water Mass 4-106 4.5-9 Design Basis SGTR Transient - Ruptured SG ucondary Water 4-107 Volume 4.5-10 Design Basis SGTR Transient - Steam Generator Narrow 4-108 Range Levels 4.5-11 Comparison of Margin to SG Overfill 4-109

{

vi wonoce m o-

I

1.0 INTRODUCTION

AND

SUMMARY

The analysis for a design basis steam generator tube rupture (SGTR) accident is included in the Chapter 15 analyses of Final Safety Analysis Reports (FSARs). The accident which is analyzed is the complete severance of one e

steam generator tube which results in the leakage of reactor coolant into the secondary side of the steam generator. Based on the assumptions used previously in the FSAR analyses, it was concluded that the consequences of a design basis SGTR meet the appropriate acceptance criteria. However, following the SGTR which occurred at the Ginna Plant in January, 1982, the traditional assumptions which have been used for the FSAR analysis of a design basis SGTR have been questioned.

In particular, it appears that the time required for the operator to terminate the leakage into the ruptured steam generator may be longer than the 30 minutes which has been assumed in the FSAR analysis.

In addition, the qualification of certain equipment which is used to mitigate a SGTR may not conform to licensing basis criteria.

The consequences of a SGTR depend largely upon the ability of the operator to take the necessary actions to terminate the primary to secondary leakage.

If the leakage continues significantly beyond the 30 minutes previously assumed in the FSAR accident analysis, the secondary side of the steam generator may become filled and water may enter the steamline.

If the leakage continues, the release of liquid through the secondary side relief valves to the atmosphere could result in an increase in the radiological doses. The

(

structural integrity of the main steamlines may also br of concern due to the accumulation of water in the steamline. Thus, one of the major concerns related to a SGTR is the possibility of steam generator overfill and the pitential consequential effects.

The concern over the potential for overfill has resulted in the following three issues regarding the FSAR analysis for an SGTR: (1) the operator action time required to terminate the primary to secondary leakage following a design basis SGTR, (2) the qualification of the equipment which is assumed to be used in the SGTR recovery, and (3) the evaluation of the worst case single failure for the SGTR analysis.

In order to resolve these issues, a subgroup of i

l.

77870:10/120384 1 -1

utilities in the Westinghouse Owners Group (WOG) was formed and a program was initiated to address the issues on a generic basis.

The program to resolve the SGTR issues is based on the development of a design basis analysis methodology and model to detemine the margin to overfill for a design basis SGTR. The margin to steam generator overfill is defined as the steam space volume remaining below the steam generator outlet nozzle when the i

primary to secondary leakage is teminated. The analysis methodology includes

~

the simulation of the operator actions for SGTR recovery based on Revision 1 of the WOG Emergency Response Guidelines (ERGS) which was transmitted in i

Reference (1). The operator action times required to perform the recovery actions following a SGTR have also been determined for use in the analysis and the results are presented in Section 2.

The available data from reactor plant simulator studies and plant SGTR events was evaluated to establish the licensing basis operator action times.

The LOFTRAN analysis model (Reference 2) which is used for SGTR analysis has been modified to incorporate changes in the break flow model and the steam generator secondary side representation, and also to improve the capability to simulate the operator actions. The LOFTRAN break flow model was modified to predict a more realistic break flow rate for a double-ended rupture. The secondary side representation was changed from a single region, homogeneous, saturated mixture for the steam and water phascs to a two region model with the steam and water phases represented separately. The modifications to the LOFTRAN program have been incorporated into a revised program, designated as LOFTTR1, for the analysis of the margin to overfill for a design basis SGTR.

The LOFTTR1 program has been validated by comparing the calculated results with the transient data from the Ginna SGTR event on January 25, 1982. The modifications to the LOFTRAN program and the validation studies for the LOFTTR1 program are presented in Section 3.

For the development of the analysis methodology, a preliminary analysis was performed to determine a reference plant to be used as the basis for the generic analysis. A series of sensitivity studies have been performed for the i

reference plant to identify conservative initial conditions and assumptions 4

77870:1D/113084 1-2 F

with respect to the margin to overfill. The equipment which is used during the recovery from a SGTR has been reviewed to identify the equipment for which credit must be assumed to prevent overfill for the reference plant.- The potential single failures were identified from the design basis equipment list and an evaluation has been performed to determine the worst single failure.

An analysis has been performed for the design basis SGTR for the reference plant using the revised methodology, including the improved model, the cperator action times, conservative assumptions, and assuming the worst single failure. The results of this analysis demonstrate that there is margin to steam generator overfill for the reference plant. The development of the analysis methodology for a design basis SGTR and the results of the analysis for the reference plant are presented in Section 4, and the analysis methodology is summarized in Section 5.

J 1

i l

l l

77870:1D/120304 1-3

2.0 OPERATOR ACTION TIMES In the event of an SGTR, the operator is required to take actions to stabilize the plant and terminate the primary to secondary leakage. An evaluation has been performed to establish the operator action times for use in the analysis of a design basis SGTR to determine the margin to steam generator overfill.

The operator actions which are required for recovery from an SGTR and the available data on the times to perform these actions have been reviewed. The available data on operator action times for an SGTR includes information which has' been obtained from reactor plant simulator studies as well as plant data from five actual SGTR events. Using this data, operator action times have been established which are considered to be appropriate for a design basis SGTR event. These operator action times will be used as input for the analysis of the design basis SGTR to determine the margin to steam generator overfill.

2.1 OPERATOR ACTIONS FOR SGTR RECOVERY The actions which the operator is required to perform to recover f rom a SGTR are specified in the plant Emergency Operating Procedures (EOPs). There has been a significastt effort to upgrade the E0Ps since the incident at the Three Mile Island Plant in March,1979. The Westinghouse Owners Group (WOG) has developed Emergency Response Guidelines (ERGS) which can be used as the basis for preparing plant specific E0Ps. The Basic version of the ERGS was completed in 1982 and was validated in June, 1982. The Basic version of the ERGS was reviewed by the NRC, and the ERGS were approved for implementation by an SER which was issued in June, 1983. The ERGS were subsequently revised to incorporate improvements identified during the development of the Basic version and during the validation testing, and also to include NRC comments.

Revision 1 of the ERGS was issued in September,1983 (Reference 1) and was validated in November 1983. The Revision 1 ERGS represent the most recent and comprehensive guidelines for emergency response to CGTR events and other accidents. Thus, the operator actions specified in Revision 1 of the ERGS will be used as the basis for establishing the required operator action times for SGTR recovery.

77870:10/121284 2-1

1 For an event resulting in a reactor trip or safety injection (SI) initiation, the operator enters the ERGS with the E-0 guideline. The operator actions in E-0 include the verification of automatic actuations and diagnostics to determine the appropriate recovery procedure.

If symptoms of an SGTR exist, the operator is directed to the E-3 guideline which contains the actions for the recovery from an SGTR. The high level actions for the first 23 steps from the E-3 guideline for high pressure SI plants are presented in Table 2.1-1.

te nerator pres u e d th o te in he pr mary secondar leakage. Additional steps are also provided in the E-3 guideline to prepare the plant for cooldown to cold shutdown conditions.

However, since these actions are implemented after primary to secondary leakage has been stopped, they are not considered in the evaluation of the margin to overfill. There are five major actions required in order to stop primary to secondary leakage which are provided for in the steps in Table 2.1-1.

The five major recovery actions are discussed below.

1.

Identify the ruptured steam generator (step 2).

High secondary side activity, as indicated by the air ejector radiation monitor, steam generator blowdown line radiation monitor, or main steamline radiation monitor (if available), typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by high activity in the corresponding steam generator blowdown 2

line, main steamline, or water sample.

For an SGTR that results in a high power reactor trip, the steam generator water level will decrease off-scale on the narrow range for all steam generators. The auxiliary feedwater (AFW) flow will begin to refill the steam generators, typically l

distributing approximately equal flow to all steam generators. Since primary to secondary leakage adds additional inventory which accumulates in the ruptured steam generator, level will return to the narrow range in that steam generator significantly earlier and will continue to increase more rapidly. This response provides confirmation of an SGTR event and also identifies the ruptured steam generator.

In some cases, the ruptured steam generator may be obvious prior to reactor trip due to steam flow / feed flow mismatch alarms or steam generator level deviation alarms.

7787Q:10/113084 2-2

2.

Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.(steps 3 and 4).

Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of filling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.

3.

Cool down the Reactor Coolant System (RCS) using the intact steam generators (step 14).

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than saturation at the ruptured steam generator pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. With offsite power available, the normal steam dump system to the condenser will provide sufficient capacity to perform this cooldown rapidly. If offsite power is lost, the RCS is cooled using the power-operated relief valves (PORVs) on the intact steam generators since neither the steam dump valves nor the condenser would be available.

It is noted that RCS pressure will decrease during the cooldown as shrinkage of the reactor coolant expands the steam bubble in the pressurizer.

4.

Depressurize the RCS to restore reactor coolant inventory (steps 17 or 18).

When the cooldown is completed, SI flow will increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable 7787Q:10/113084 2-3

j pressurizer level indication after SI flow is stopped. Since leakage from the primary side will continue after SI flow is stopped until RCS and ruptured steam generator pressures equalize, an " excess" amount of inventory is needed to ensure pressurizer level remains on span. The

" excess" amount required depends on RCS pressure and reduces to zero when RCS pressure equals the pressure in the ruptured steam generator. To establish sufficient inventory, RCS pressure is decreased by condensing steam in the pressurizer using normal spray if the reactor coolant pumps (RCPs) are running. This will increase SI flow and will reduce break flow to refill the pressurizer. With RCPs stopped, normal pressurizer spray will not be available. In that case, the RCS is depressurized using either a pressurizer PORV or auxiliary pressurizer spray in order to restore pressurizer inventory.

I 5.

Terminate SI to stop primary to secondary leakage (steps 21-23).

The previous actions will have established adequate RCS subcooling, secondary side heat sink, and reactor coolant inventory following an SGTR to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage.

Primary to secondary leakage will continue after SI flow is stopped until RCS pressure and ruptured steam generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.

Since these major recovery actions will be modelled in the SGTR analysis, it is necessary to establish the times required to perform these actions.

Although the intermediate steps between the major actions will not be explicitly modelled, it is also necessary to account for the time required to perform the steps.

It is noted that the total time required to complete the j

recovery operations consists of both operator action time and system, or j.

i

- plant, response time. For instance, the time for each of the major recovery operations (i.e., RCS cooldown, RCS depressurization, etc.) is primarily due to the time required for the system response, whereas the operator action time 7787Q:10/113084 2-4 4

E l

l is reflected by the time required for the operator to perform the intermediate action steps and to initiate the major recovery operations. Thus, the time which is required to complete each of the major recovery operations will be determined, as well as the operator action time required for the actions in the intervals between each of the iaajor recovery operations. The time intervals for the major recovery operations, and for the operator actions between the major recovery operations, are illustrated in Table 2.1-2.

The times which are determined for each of these intervals will then be used as the basis for the SGTR analysis to detenmine the margin to steam generator overfill.

1

~

e 7787Q:10/113084 2-5

TABLE 2.1-1 SGT! 4'COVERY ACTIONS IN E-3 GUIDELINE 1.

Check if RCPs should be stopped 2.

Identify ruptured SG(s) 3.

Isolate flow from ruptured SG(s) 4.

Check ruptured SG(s) level 5.

Check pressurizer PORVs and block valves 6.

Check if SGs are not faulted

, 7.

Check intact SG levels 8.

Reset SI 9.

Reset containment isolation Phase A and Phase B

10. Establish instrument air to containment

11. Verify all AC busses - energized by offsite power

12. Check if low-head SI pumps should be stopped 13.

Check ruptured SG(s) pressure 14.

Initiate RCS cooldown

15. Check ruptured SG(s) pressure - stable or increasing 16.

Check RCS subcooling based on core exit TCs 17.

Depressurize RCS - using normal spray

18. Depressurize RCS - using pressurizer PORV

19. Check RCS pressure - increasing

20. Check if SI flow should be terminated

21. Stop SI pumps and place in standby 22.

Establish 60 gpm charging flow 23.

Isolate BIT 7787Q:10/113084 2-6

TABLE 2.1-2 TIME INTERVALS FOR SGTR RECOVERY ACTIONS 1.

Identification of ruptured SG 2.

Operator action time to initiate isolation 3.

Isolation of ruptured SG 4.

Operator action time to initiate cooldown 5.

Cooldown of RCS 6.

Operator action time to initiate depressurization 7.

Depressurization of RCS 8.

Operator action time to initiate SI termination 9.

SI termination and pressure equalization 7787Q:10/113084 2-7

2.2 DATA FOR OPERATOR ACTION TIMES The available data on operator action times for an SGTR was reviewed to determine the acceptability of the data for use in establishing licensing basis operator action times. There is a significant amount of data available from reactor plant simulator studies which was reviewed for this purpose.

This includes data f rom 1) simulator tests performed at the Zion Training Center in 1982 to study operator behavior under accident conditions, 2) simulator training exercises for plant operators for SGTR events, and 3) the simulator validation tests for the Basic version of the ERGS in June,1982 and for Revision 1 in November,1983.

In addition, there have been five SGTR events which have occurred at plants that may be relevant and the information from these events was also reviewed for applicability. These events occurred at Point Beach Unit 1 in February,1975, at Surry Unit 2 in September,1976, at Doel Unit 2 in June,1979, at Prairie Island in October,1979, and at Ginna in January,1982.

In reviewing the data, there were several general requirements which were used to determine the acceptability of the data for use in establishing operator action times. The general requirements which were used are as follows:

1.

The documentation of the data must be sufficient to permit determination of the operator action times for the major actions identified. This resulted in elimination of much of the data since the times at which many of the actions were taken were not, recorded and could not be correlated with the other data obtained.

2.

For simulator data, the simulator should provide an accurate representation of an SGTR so that the time responses will be meaningful.

It has been determined that the SGTR model used in some simulators did not provide an accurate representation of the plant response during the recovery operations and that this may influence the operator actions and result in non-representative recovery times. Information on simulator limitations for an SGTR has been provided to all WOG members through the SGTR training program sponsored by the WOG.

77870:10/120384 2-8

3. 'The SGTR recovery actions which were used to obtain the data should be representative of the actions in Revision 1 of the ERGS. Some of the SGTR recovery actions being used prior to the development of the ERGS were significantly different from the ERGS and the information obtained with these procedures would not be consistent with the recommended recovery 3

actions to be modelled in the analysis.

4.

The break size for the SGTR should be representative of a design basis rupture since the break flow will influence the plant response and be a factor in the time at which recovery actions are initiated.

s 2.2.1 SIMULATOR DATA In 1982, there were a series of simulator tests performed at the Zion Training Center to study operator behavior during accident conditions. As part of this study, operator action times were determined for simulated SGTR events.

In total, the data obtained was based on 22 operator crews from four utilities, at two different simulators (SNUPPS and Zion), and for four variations in SGTR events. The results of this study indicated that a mean time of approximately 20 minutes was required from the time of reactor trip following the SGTR until the beginning of SI termination, with a 95% upper tolerance limit time of approximately'34 minutes. However, a review of the data indicates that the simulator representation of the SGTR events was not realistic and that this difference affected the recovery actions and influenced the operator action times. In addition, the SGTR procedures being used were either based on an initial draft of the ERGS or predated the ERGS and were somewhat different than the current guidelines in Revision 1 of the ERGS. Thus, it was concluded that use of the data from the Zion tests is not appropriate to establish the operator action times for the design basis analysis.

There has also been a significant amount of data generated during the simulator training of reactor plant operators for SGTR events. Data which was obtained from several plant simulator training exercises was solicited and reviewed for the purpose of establishing operator action times. However, since the data was obtained primarily for training purposes, there is not 7787Q:10/113084 2-9 I

w

i

}

sufficient documentation provided for this data to enable the individual operator action times to be determined or to assess the fidelity of the simulators.

It was therefore concluded that the simulator data which is available from operator training runs is not suitable for establishing the design basis operator action times.

5 Another source of data was obtained from the simulator validation of the ERGS. To demonstrate the effectiveness of the ERGS, both the Basic and j

Revision 1 guidelines were subjected to comprehensive validation test programs i

which were witnessed by a representative from the NRC.

The validation was I

performed by using the ERGS as the basis for responding to various simulated 3

accident scenarios. The Basic version of the ERGS was validated in June, 1982 j

using Union Electric Company's Callaway training simulator and Revision 1 was validated in November,1983 using Public Service of New Hampshire's Seabrook v

i training simulator. The results of the validation programs for the Basic N

- version and Revision 1 of the ERGS are presented in References (3) and (4),

=

respectively. There were two separate operator crews used for both the Basic

?

version and Revision 1 validation tests, which were rotated between successive tests. The operating experience level of the four crews varied from operators with no plant experience to seasoned plant operators. A one week training program was provided to familiarize the crews with the use of the ERGS prior 5

to 'the validation tests since none of the crews had any prior experience in j

using the ERGS. There was extensive documentation provided for the tests, including a video tape recording of the operator actions in the control area.

A time clock was superimposed on the video screen to provide a record of the

[

time when specific actions were performed. The data from the simulator runs y

was also used to generate plots of the important parameters for an SGTR which were used to confirm that the simulator representation of an SGTR was 2

reasonable. There were several runs of SGTR events performed to check out j

specific actions in the E-3 procedure and other SGTR related procedures.

]

Since the results were obtained using procedures based on the ERGS and using j

simulators which provide a realistic representation of an SGTR, the simulator f

data obtained during the validation of the ERGS provides a good source of data for establishing the operator action times for an SGTR. The evaluation of the i

operator action times from the ERG validation data is presented in Section 2.3.

I N

5 9

77870:10/120384 2-10 g

2.2.2 PLANT DATA There have been five SGTR events which have occurred at Westinghouse designed plants. These events occurred at Point Beach Unit 1 in 1975, at Surry Unit 2 in 1976, at Doel Unit 2 in Belgium in 1979, at Prairie Island in 1979, and at Ginna in 1982. A brief description of each of these SGTR events is presented below. Additional information on the Point Beach, Surry, Doel, and Prairie Island events can be found in Reference (5) and additional details on the Ginna event are provided in References (6) and (7).

Point Beach Unit 1 On February 26, 1975, a steam ger.erator tube leak developed in the "B" steam generator while the plant was operating at full power. The licensee estimated the leak rate to be 125 gal / min. The air ejector high-radiation alarm was the first indication of any problem. The operators then heard alarms indicating that the operating charging pump was at maximum flow and pressurizer level was decreasing. Two, then three charging pumps were placed in. service in an attempt to control the pressurizer level. The unit load was decreases to about 25 percent, at which time the plant was tripped manually. The SI system did not automatically or faanually start, but an SI pump was intermittently used during the subsequent cooldown to control RCS inventory. The RCPs were optrating during most of the cooldown, and only the intact "A" steam generator was used to cool the plant. The plant was then placed in a cold shutdown condition.

Surry Unit 2 On September 15, 1976, a steam generator tube leak occurred in the "A" steam generator while the plant was operating at full power. The licensee estimated the leak rate at about 80 gal / min, although subsequent NRC calculations indicated that the leak rate may have been as high as 330 gal / min. Flux mapping for nuclear instrument calibration was in progress when the air ejector high-radiation alarm was heard.

In an effort to control the rapidly decreasing pressurizer pressure and level, a second l

7787Q:1D/113084 2-11

charging pump was started. Control rods were moved to return T back gyg to program because the operator ordered a stop to flux mapping when he began to suspect a problem. The leak started slowly and was barely apparent for'several minutes. The plant operators restored T to gyg eliminate any masking effects due to slight tempirature variations.

A reduction in turbine load to 10 percent was manually initiated. The turbine load had been reduced approximately 30 percent when a manual turbine trip (and subsequent reactor trip) was initiated. This occurred before RCS pressure reached the low-pressure trip. The SI system was manually initiated. The damaged steam generator was positively identified, and the secondary side was isolated. The RCS was cooled using the intact steam generators and the normal steam dump system. The plant was placed in a cold shutdown mode.

Doel Unit 2 Doel Unit 2 is a two-loop, 390 MWe plant located in Belgium. The plant began consnercial operation in November 1975.

It has Model 44 U-tube steam generators.

On. lune 25, 1979, a steam generator tube leak developed in the "B" steam generator while the plant was at normal operating temperature and pressure with the reactor shut down.

Primary system pressure dropped rapidly, and two additional charging pumps were started. The "B" steam generator level increased rapidly, and the steam generator was isolated. The "B" RCP was stopped to reduce heat addition. The SI system automatically started due to low pressurizer pressure. This caused RCS pressure to rapidly increase. Normal pressurizer spray was started.

Pressurizer spray flow in combination with continued SI flow caused the water level in the pressurizer to rise above the indicating range. Cooldown and depressurization of the RCS were started by feeding the intact steam generator with the auxiliary feedwater pumps and steaming to the condenser. The operators stopped safety injection and started normal letdown about one hour af ter the event began. Cooldown was eventually completed using the residual heat removal system. The maximum leak rate was estimated to have been 135 gpm.

7787Q:10/113084 2-12

Prairie Island Unit 1 On October 2,1979, a steam generator tube leak developed in the "A" steam generator while the plant was operating at full power..The licensee estimated the leak rate at about 390 gal / min. The air ejector high-radiation alarm was the first indication of any problem. Two more charging pumps were manually started in an effort to control the rapidly dropping system pressure and pressuriter level. However, an automatic reactor trip on low pressure occurred. Automatic SI on low pressurizer pressure resulted and the operator manually tripped both RCPs. Because normal pressurizer spray was not available, the increase in RCS pressure was reduced by the manual operation of one pressurizer PORV. The RCS pressure dropped, and the operator shut the PORV and secured the SI pumps. The RCS was cooled using natural circulation flow and steaming the intact steam generator. Later, the RCPs were restarted and the cooldown continued until the system was placed in a cold shutdown condition.

Ginna On January 25, 1982, a single steam generator tube ruptured in the "B" steam generator at the R. E. Ginna Nuclear Plant. The plant, which had been operating nornelly at full power conditions, began a sudden primary coolant system depressurization as coolant leaked through the ruptured tube into the "B" steam generator. Alarms occurred indicating a possible SGTR, and the operators began reducing power. A reactor trip occurred on low pressure, followed by initiation of SI flow and containment isolation. The RCPs were stopped as required by procedures.

The "B" steam generator was suspected as the location of the rupture based on steam flow / feed flow mismatch and rapidly increasing steam generator level. Feedwater flow f rom the motor-driven AFW pump to the "B" steam generator and steam flow from the "B" steam generator to the turbine-driven AFW pump were then stopped. The main steamline isolation valve on the "B" steam generator was closed when high activity in the "B"

i steam generator was confirmed. The SI flow held the RCS pressure at about l

77870:10/113084 2-13

1300 psig, while flow through the ruptured tube caused the "B" steam generator water level to go off-scale high and 'its pressure to approach the safety valve setpoint. The PORV on the "B" steam generator was isolated during this time based on ambiguous instructions in the emergency operating procedures. Without RCPs, the operators were forced to depressurize the RCS by opening a pressurizer PORV instead of using pressurizer spray.

During depressurization, the PORV stuck open. The operators immediately closed the block valve, but the RCS pressure decreased enough to cause steam formation in the reactor vessel upper head. Safety injection quickly repressurized the RCS to about 1400 psig, which caused the "B" steam generator safety valve to open. The operators were reluctant to terminate SI during this time because of the steam bubble in the reactor vessel upper head. SI was subsequently stopped, allowing RCS and "B" steam generator pressures to decrease below the safety valve setpoint.

A decision was made to restart an RCP to collapse any remaining upper head bubble and to provide pare raoid RCS cooling and depressurization.

Prior to RCP restart, one SI pump was restarted because of operator concern that the collapse of the upper head bubble would cause a large decrease in system pressure. This action caused the "B" steam generator safety valve to open again. One RCP was restarted and SI flow was again terminated.

With one RCP ranning and the vessel head bubble collapsed, the plant was cooled down using the intact "A" steam generator. The residual heat removal system was started, and cold shutdown conditions were achieved.

The maximum leak rate for the event was estimated to be about 630 gpm.

The available information for these SGTR events was examined to determine the potential applicability of the data for use in establishing design basis operator action times. A review of the data for the Point Beach, Surry and Doel events indicates that the documentation for these events is not sufficient to determine the times required to complete each of the major recovery operations. The estimated leak rates for these SGTR events, particularly for the Point Beach and Doel events, are also considerably less 7787Q:10/113084 2-14

than for a design basis SGTR. A lower leak rate can influence the operator actions since a longer time would be required for reactor trip and to initiate the recovery actions in the E-3 guideline. The estimated leak rates for the Prairie Island and Ginna SGTR events are somewhat higher, and the leak rate for the Sinna SGTR did approach that for a double-ended rupture.

In addition, the documentation for these two events is more complete such that the times to complete the major recovery operations can be determined. Thus, the data from the Prairie Island and Ginna SGTR events have been reviewed to determine the operator action times. The evaluation of the data on operator action times for these two SGTR events is presented in Section 2.3 and the resulting operator action times are compared with those obtained from the simulator data.

2.3 EVALUATION OF OPERATOR ACTION TIMES The simulator runs for SGTR transients from the validation of the Basic version and Revision 1 of the ERGS were reviewed to detenmine the applicability of the data for use in establishing design basis operator action times. Although there were a significant number of runs for SGTR events, several were in combination with other accidents and the results would not be appropriate for a design basis SGTR.

In addition,- for some of the runs which are considered to be appropriate, the data for the entire run could not be used because of transitions to other procedures or because of simulator problems. The runs which are considered to be applicabit for use in establishing the operator action times are listed below along with a description of each case.

Basic Validation

__ AL c 7787Q:10/113084 2-15

Q, C Revision 1 Validation Q, C m

i 77870:10/113084 2-16

f Q, C,

~'

6 3

7787Q:10/113004 2-17

.~

• > C The times were obtained from the validation runs where appropriate for each of the major recovery operations and for the operator actions between the major recoveryoperation,inthgE-3 procedure,asidentifiedinTable2.1-2. With theexceptionof(

] discussed above, it was not possible to distinguish any delay time between identification of the ruptured steam generator and isolation of the ruptured steam generator. Thus, only the total time between the tube rupture and isolation of the ruptured steam generator was determined.

It is noted that this time includes the time from the tube rupture to reactor trip, the time required for the action steps and diagnosis of an SGTR in E-0, and the time to perform the required steps in E-3 to isolate the ruptured steam generator. The times for each run were determined from the data recorded for each run, including observation notes, transient plots of the simulator output, and video tapes for the individual runs. Based on the accuracy of the data, the times for each item were determined only to the nearest one-half minute.

The available data for each of the major recovery operation and operator action time intervals was used to determine the average time for each interval, and the average times were rounded off to the next highest minute.

{

. gc The

., g, c.

average times and the jforeachofthemajorrecoveryoperations and the operator action time intervals are presented in Table 2.3-1. [

e, c.

The corresponding times were also determined from the data for the Prairie Island SGTR event (References 5 and 8) and the Ginna SGTR event (References 6 77870:10/121284 2-18 l

and 7), and the results are also presented in Table 2.3-1.

The data for these I

SGTR events was obtained from the sequence of events reported for each case and the analysis of plant data. A comparison of the results indicates that the total times for pressure equalization for the Prairie I: land and Ginna SGTReventsareconsiderablylongerthanthesumofthe{

.. e, c from the ERG validation runs.

1 For the Prairie Island event, the difference in times is primarily due to the longer time required to identify and isolate the ruptured steam generator and for SI termination and pressure equalization. These longer times are attributed to the relatively low primary to secondary leak rate since the rupture was significantly less than a design basis SGTR.

For instance, of the o

E lre,equired for identification and isolation, reactor trip did not J

. e, c.

occur for approximately after the rupture, and leve did not return in the ruptured steam generator until approximately afterreactor g

trip.

In addition, the time for pressure equalization after SI termination 4,c was approximately,

j due to the relatively small leak rate. The available documentation of the event is not sufficient to identify any other reasons which may have also contributed to these longer times.

For the Ginna SGTR, the increased time was primarily due to the delay between thecooldownanddepressurizationstepsandtheoperatoract{ontimeforSI termination. Itisnotedthatthetotaltimeof(

)forSItermination i

and pressure equalization represents the time from accident initiation to the time when SI was initially terminated and the RCS and ruptured steam generator pressure equalized. This was the time required to terminate the primary to secondary leakage in accordance with the SGTR recovery procedure. However, in the Ginna event, SI was subsequently reinitiated after this time which resulted in additional primary to secondary leakage that continued until final termination of SI at approximately 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after accident initiation. An SI pump was restarted because of operator concern t. bout the potential effect of upper head void collapse subsequent to RCP restart. Since the reinitiation of SI was n directedbytheSGTRprocedures,itisconsideredthatthe(

oL

] or the initial SI termination and pressure equalization is appropriate for use in comparing the operator action times from the Ginna SGTR 7787Q:10/113084 2-19

event with those determined from the ERG validation tests.

It is noted that provisions are included in Revision 1 of the ERES to accommodate potential upper head void collapse when an RCP is restarted.

~

A review of the information for the Ginna event indicates that the delay between cooldown and depressurization was due to 1) an ambiguous procedure step to close the isolation valve for the ruptured steam generator PORV which resulted in a delay in completing the step, 2) the time required to restart a charging pump, and 3) consideration over whether or not to start a 4, c RCP for use in the subsequent cooldown. The required after RCS depressurization for $1 termination and pre 3sure equalization can be attributed to a hesitation in terminating SI because of a concern about the actual versus indicated coolant inventory in the RCS. During the depressurization of the RCS, a void formed in the reactor vessel upper head region which resulted in the pressurizer level increasing to off-scale. Since s

the actual RCS coolant inventory was not readily apparert, the operator had a reluctance to terminate S1 because of the concern that core cooling might be jeopardized. The operator also may not have been fully aware of the close proximity to steam generator overfil' due to continued SI operation and the consequential primary to secondary leakage.

There have been several improvements which have been incorporated into the Revision 1 ERGS as a result of the Ginna SGTR which should eliminate the concerns which caused the longer operator action times for the Ginna event.

These improvements are summarized below:

1.

The step for isolating the PORY for the ruptured steam generator was citrified to avoid any ambiguity regarding operation of the isolation valve for the PORV.

2.

The guideline for low pressure plants was restructured to provide for restoring normal charging concurrent with the cooldown to avoid delays.

77870:10/121284 2-20

l 3.

RCP trip criteria have been developed which will reduce the chance of tripping the RCPs for a SGTR.

4.

Clarification has been provided in the background document that restart of the RCPs is not recommended until after SI termination and pressure i

equalization.

5.

A caution has been added to alert the operator of the potential effects on the pressurizer level due to a void in the reactor vessel upper head region.

4 6.

The guidelines have been restructured to emphasize the need for SI i

termination, and a caution has been provided to indicate that SI must be terminated when the specified criteria are met in order to prevent steam generator overfill.

There have also been some other changes in the guidelines since the Ginna SGTR which are expected to improve the recovery times. These changes are:

1.

The guideline step on RCS cooldown has been revised to specify that the maximum cooldown rate be used, which should reduce the time for the cooldown.

2.

The guideline steps have been standardized where possible for more efficient execution.

i 3.

The requirement for a 200 psi increase in RCS pressure for SI termination has been relaxed to only require a pressure increase.

In addition to the procedural changes, there has also been an increased emphasis on operator training for an SGTR since the Ginna SGTR event. There are background documents provided for the Revision 1 guidelines which include the knowledge requirements and the basis for the operator actions specified in the guidelines. This information will provide for an improved understanding and better execution of the SGTR guidelines. The WOG also recognized the need for additional SGTR training to assure that the plant operators are properly I

7787Q:10/113084 2-21

instructed regarding the complexities of a tube rupture event and the expected operator actions in the ERGS. Thus, the WOG sponsored an SGTR training program which was presented to utility training personnel in May,1984. The program provided both classroom text and instructor training materials to both simplify and standardize SGTR training. The SGTR training program material included 1) technical information containing text material related to an SGTR preseniad in training format, 2) guideline information containing background matter on the SGTR-related ERGS presented in' outline format intended for use by instructors in operator training, and 3) instructor information containing material for use by training instructors to assist in presentation, discussion and evaluation of training. The instructor information included a description of the use of simulators for operator training for SGTR events, and identification of potential simulator limitations which may affect the s3TR representation. It is expected that the utility training personnel will use the training materials as a basis for an SGTR training program or to supplement existing training programs.

4, c.

Basedontheaboveinformation,itisconcludedthatthe[

from the ERG validation runs represent reasonable operator action times for the design basis analysis of an SGTR. Although the times for some of the operator actions were longer for the Ginna SGTR event, the longer times are not representative for the plants which are now utilizing the ERGS and improved training materials.

It is expected that the improvements in the procedures, additional training, and general increased emphasis on SGTR recovery will result in operator action times comparable to those observed during the ERG validation runs. Therefore, the operator action times for the SGTR analysis

] o c.

s will be based on the from the ERG validation runs.

It is noted that the time for identification of the ruptured steam generator is somewhat dependent upon the method used for identification. As indicated previously, the ruptured steam generator can typically be identified by the response in narrow range level due to the primary to secondary leakage. Some plants also have instrumentation available which may provide for earlier identification of the ruptured steam generator. However, for the SGTR analysis, the identification of the ruptured steam generator will be conservatively bared on steam generator level indication.

77870:10/121284 2-22

In the guideline for SGTR recovery in the ERGS, the operator is directed to maintain the level in the ruptured steam generator between just on span and 50% on the narrow range instrument. When considering instrument uncertainty, the range is typically between approximately 16% and 50%. For the SGTR analysis for the reference plant, it will be assumed that a ruptured steam generator is identified and isolated when the narrow range level in that generator is(

r at(

narrow range level.

It is expected that the operator will actually begin to throttle the AFW flw prior to reaching this level in order to control the RCS temperature.

This would lead to earlier identification and isolation of the ruptured steam generator since the level in the ruptured steam generator would continue to increase as

- -4c.

the AFW flow is being decreased. The time to reach the narrow range level 3

intherupturedsteam1eneratorwillbecalculatedbytheLOFTTRIprogram.

If

,c thetimetoreach[

narrow range level is calculated to be longer than the

]mnutesobservedduringtheERGvalidationtests,thenthecalculatedtime will be used for identification and isolation of the ruptured steam generator. However, if the narrow range level reaches this value prior to[ ]

Einutes, a minimum of[ 3Nutes will be used for identification and isolation of the ruptured steam generator.

1 I

It is also noted tnat the times for RCS cooldown, RCS depressurization, and pressure equalization after SI terminatioa represent system response times and are dependent upon the individual plant design and parameters. The times required for RCS cooldown and for RCS depressurization are also dependent upon the methods used to perform these operations and the single failure which is l

assumed. Thus, rather than use the values observed during the ERG validation, the times required for cooldown, depressurization, and pressure equalization will be calculated using the LOFTTR1 program.

i 4

The operator action times which will be used for the design basis SGTR analysis are presented in Table 2.3-2.

i 7787Q:10/121284 2-23

TA8LE 2.3-1 SGTR OPERATOR ACTION TIMES Times (Minutes) g, c.

Action Identify and isolate ruptured SG*

Operator action time to initiate cooldown Cooldown Operator action time to initiate depressurization uepressurization Operator action time to initiate SI termination SI termination and pressure equalization L

These values represent the times from the tube rupture until completion of isolation.

Cooldown was initiated prior to completion of isolation,'and thus there was no delay between isolation and initiation of cooldown.

7787Q:10/113084 2-14

TABLE 2.3-2 OPERATOR ACTION TIMES FOR DESIGN BASIS SGTR ANALYSIS 4, C Action Identify and isolate ruptured SG Operator action time to initiate cooldown Cooldown Operator action time to initiate depressurization Depressurization Operator action time to initiate SI termination SI termination and pressure equalization These times are dependent upon the plant design and parameters and the a

equipment used to perform the operations, and therefore are calculated with the LOFTTR1 analysis program.

77870:10/113C84 2-25

_ ~.

l 3.0 Model Development 3.1 GENERAL DESCRIPTION OF LOFTRAN PROGRAM The LOFTRAN computer code is used to perform the FSAR analysis for a design basis $6TR. The NRC has performed an evaluation of the LOFTRAN program and found it to be acceptable for the SGTR analysis. A description of the LOFTRAN program and the NRC evaluation are presented in Reference (2).

LOFTRAN is a digital computer code that was developed to simulate transient behavior in a multi.-loop pressurized water reactor system. The code simulates a multi-loop system by modelling the reactor core and vessel, hot and cold leg

- piping, steam generator (tube and shell sides), pressurizer, and reactor coolant pumps, with up to four reactor coolant loops. The noding used to represent the reactor coolant system is described in Reference (2).

1 1-Th2 pressurizer model includes the of fects of pressurizer hesters, spray, and relief and safety valve operation. The reactor core model employs a lumped i

fuel heat transfor model with point neutron kinetics and includes the reactivity effects of variations in moderator density, fuel temperature j

(Doppler), boron concentration, and control rod insertion and withdrawal.

The secondary side of the steam generator is represented by a single volume model (water and steam phase). A homogeneous, saturated mixture is assumed i

for thermal-hydraulic calculations. The turbine, condenser, and feedwater heaters are not simulated; instead steam demand and feedwater flow and enthalpy are input to the code or controlled by specifying certain control a

options.

The reactor protection system is simulated.

The protection functions simulated include reactor trips on overpower and overtemperature AT, high

' neutron flux, high and low pressurizer pressure, high pressurizer level, low reactor coolant flow, low steam generator level, and safety injection actuation. The engineered safeguards features simulated are feedwater and 1

steamline isolation, auxiliary feed, and an emergency core cooling system with

~ safety injection pumps and accumulators. The control systems simulated are rod control, steam dump, and pressurizer pressure control. Reactor coolant 77870:10/121284 3-1

4 pump operation is also simulated, including the effects of pump coastdown and pumpstartupwithloopflowreversalaliowed.

3.2 LOFTRAN PROGRAM MODIFICATIONS Although the LOFTRAN program is acceptable for determining the consequences of SGTR events as previously analyzed, there are certain limitations in the program which have been identified that af fect the cal.culated plant response following a SGTR which may be significant for evaluating the margin to steam generator overfill. These include the tube rupture break flow model and the steam generator secondary side model. In addition, the LOFTRAN program does not have the capability to ef ficiently model the operator actions which must be performed to recover the plant f rom a SGTR event. Therefore, the LOFTRAN program has been modified to improve the break flow model and the secondary side representation, and to improve the capability to simulate the operator actions for SGTR recovery. The modified version of the LOFTRAN program has been designated as LOFTTRI. The LOFTTR1 program has been validated by 4

analyzing the GINNA SGTR event of January 25, 1982 and comparing the predicted results with the actual plant transient. The program modifications and the validation results are discussed in the following sections.

3.2.1 BREAK FLOW MODEL Following a steam generator tube failure, reactor coolant flows from the primary side into the secondary side of the affected steam generator through the failed tube. The primary to secondary pressure dif ferential provides the driving force for this flow. The failure site is connected to two primary fluid reservoirs, i.e., steam generator inlet and outlet plenums, via the segmented tube.

Each segment provides a substantial resistance to fluid flow including frictional losses in the tube and pressure losses at the failure site. For larger tube failures, the frictional resistance in the tube segment

{

represents a large fraction of the total. resistance between the primary and secondary systems. To provide a reasonable estimate of primary to secondary leakage, a detailed model of the failed steam generator tube has been i

developed and incorporated into LOFTTRI.

-l I

7787Q:lD/121284 3-2

In the LOFTTR1 break flow model, the failed steam generator tube is representedas[

j This leads to the following simultaneous equations for flow through the failed tube:

Q,6 m

l 4

4 z

i 7787Q:10/113084 3-3 l

WESTINGHOUSE PROPRIETARY CLASS 2

~

Q, c, Equations 1 through 4 can be solved simultaneously for unchoked fluid flow through the failed tube. However, following a steam generator tube failure event, the primary to secondary pressure differential may be sufficiently large to cause choking in the tube or at the failure site. The maximum or critical flow through the failed tube is calculated using the modified Zaloudek correlation for subcooled flow (References 9 and 10). Critical flow rates are calculated for each tube segment and at the break location as follows:

~

a,c 77870:10/121284 3-4

Mtd11NGHOUSE PROPRIETARY CLASS 2

~ G, C 1

f 1

)

i r

4

'l 77870:10/121284 3-5

Q,0 3.2.2 SECONDARY SIDE REPRESENTATION The secondaiy side of the steam generator was previously represented in the LOFTRAN program by a single volume with a saturated mixture of steam and water. With the homogeneous, saturated conditions, the model could not account for thermal stratification on the secondary side.

It is noted that accounting for thermal stratification on the secondary side was not important in the previous SGTR analyses since the SGTR recovery actions were not simulated. However, the lack of a thermal stratification model can influence

~

the secondary pressure and temperature response for the ruptured steam generator during the simulation of the SGTR recovery operations. The assumption of a homogeneous, saturated mixture on the secondary side results in an unrealistically slow temperature response for the tube bundle region when the region is being cooled due to the addition of relatively cold 4

77870:10/120384 3-6

cuxiliary feedwater and reverse heat transfer when the primary coolant temperature is lower than the secondary temperature. This also results in artificially reduced steam gent ator pressures when there is no steam flow since the pressure is assumed to be at saturation as the temperature of the water in the tube bundle region decreases. Therefore, the model for the secondary side of the steam generators has been modified to provide for a mere realistic calculation of the secondary pressure and temperature during the SGTR transient.

Q, C.

1 i

i i

7787Q:10/113084 3-7

- Q,C

~

/

4 4

i J-d

~

77874:10/120384 -

3-8

- ' Q,c t

(

t 77870:10/121284 3-9

Q,(s i

l l

In the event that the steam generator pressure exceeds the setpoint of the relief valves, the flw through the valves is modelled. When equations of the state of the node are written, the steam flw is considered to be the sum of steam f1w to the main steam header and to the relief valve. The flw through the relief valve is defined using the choked flw correlation obtained from i

Reference (12). This correlation gives a linear formula which expresses the relief valve f1w increment as a function of the nodal pressure increment.

l-77870:10/120384 3-10

]

With the equations of state, this formula allows the elimination of the relief valve flow as an unknown. After this, the general scheme described above can be followed to obtain all the nodal unknowns. Then, the relief valve flow and valve area can be evaluated using the known nodal pressure increment and linear formula mentioned above.

1 For the case in which the turbine is tripped, the sum of nodal steam flows to the main steam header is set to zero. For the case in which an individual steam ganerator is isolated, the steam flow to the main steam header for the isolated steam generator is set to zero. The general scheme described above is used with the necessary main steam header flow in the system being supplied l

by the remaining steam generators. The isolated steam generator is also described with the equations of state and relief valve equations used in the general scheme, with the only difference being that the steam flow to the main steam header (and its increment) is set to zero during the time of isolation.

i 3.2.3 CAPABILITY TO SIMULATE OPERATOR ACTIONS Following an SGTR, an operator is required to perform a series of actions to mitigate the ac'cident. These actions are performed based on the response of various plant parameters which are dependent on the plant design and accident conditions. The major operator actions specified in the E-3 guideline for recovery from a design basis tube rupture are as follows:

1.

Once the ruptured steam generator is identified, the MSIV is closed and AFW is isolated to that steam generator.

2.

The RCS is cooled down until the RCS temperature is less than the value corresponding to 20*F subcooling at the ruptured steam generator pressure f

plus an allowance for the subcooling uncertainty.

l 3.

The RCS is depressurized until any of the following conditions are met:

i RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than 0% plus an allowance for pressurizer level uncertainty, or pressurizer level is greater than 80% minus an l

allowance for pressurizer level uncertainty, or RCS subcooling is less l

than the allowance for subcooling uncertainty.

77870:10/113084 3-11 l

l

4.

SI is terminated when RCS pressure increases, a secondary heat sink is available, RCS subcooling is greater than the allowance for subcooling uncertainty, and the pressurizer level is greater than 05 plus an allowance for pressurizer level uncertainty.

The simulation of operator actions for SGTR recovery previously required a series of computer runs with the LOFTRAN program to establish the times when the actions should be initiated and to determine the effects of the actions.

Thus, the LOFTRAN program was modified to improve the capability to simulate the operator actions for SGTR recovery. With the improvements in the LOFTTR1 version, the above operator actions for recovery from a design basis SGTR can be simulated in one computer run. The improvements also permit the simulation of more complicated situations such as an SGTR plus a LOCA and the post-SGTR cooldown.

l The LOFTTR1 version is capable of simulating the(. e,e-different operator actions l

listed in Table 3.2-1.

Theseactionscanbeinitiatedbasedonanyofthe{

different plant parameters in Table 3.2-2 or on combinations of these parameters. This allows input to simulate actions such as closing of the MSIV and isolation of AFW to the ruptured steam generator based on either narrow range level or time after the rupture. The closing of the press;rizer PORY j

can also be simulated when the requirements for stopping the depressurization l

are met based on the RCS to ruptured steam generator pressure differential and pressurizer level, or on the pressurizer level alone, or on RCS subcooling.

The capability is also provided to specify a time delay prior to initiation of the major recovery actions to account for the operator action time required to '

perform the intermediate actions between the major recovery actions. The existing capability to control the AFW flow to the intact steam generators based on the narrow range level in the intact steam generators has also been retained in the LOFTTR1 model.

,. -, o, c.

The operator actgon array allows a ge{ies ofl, jactions to be performed in parallelwith[]otherseriesof[}[ actions.

Each action is performed based on its own combination of as many as[

8ntparameters. This allows the simulation of multiple parallel actions with each action being based on different parameters.

i7870:10/113084 3-12

I TABLE 3.2-1 SIMULATED OPERATOR ACTIONS 7 4,C

~

I

~

7787Q:10/113084 3-13

TABLE 3.2-2 PLANT PARAMETERS l

Q, C 77870:10/120384 3-14

E 3.3 VALIDATION OF LOFTTR1 The purpose of this section is to present the results of the validation of the LOFTTRI secondary side and break flow models. The validation was performed by using the LOFTTR1 program to simulate the Ginna SGTR event of January 25, 1982 and comparing the results with the actual plant data recorded during the The validation demonstrates that the LOFTTR1 results match the data event.

well and that the design basis model is conservative in predicting the margin to steam generator overfill.

The Ginna transient was simulated previously with the LOFTRAN program and the results were compared with the plant data in Reference (7). The base input deck used for the previous analysis was also used for the LOFTTR1 simulation and the results were compared with the Ginna plant data which was reported in Reference (7).

Break Flow Modelline lnouts The tube rupture at Ginna was a fish-mouth type four inches long and 3/4 inch wide. Calculation of the break area using the following equation for a-fish-mouth orifice results in an area of 0.016 f t.

A = v ab/4, where a = width of opening, b = length of opening The break occurred in a tube three rows in from.the outer edge of the tube bundle and three inches above the tube sheet on the hot leg side of the B steam generator. The length of this tube external to the tube sheet is 950 inches and the tube sheet is 22 inches thick, so the lengths of the two flow paths are 25 inches for the inlet side and 969 inches for the outlet side.

The inside diameter of the tube is 0.775 inches and a friction factor of 0.012 was used for drawn tubing in the flow conditions encountered in an SGTR.

Using these values to calculate the fL/D's for the two sections of tubing results in the following:

fL/Dinlet = 0.39 ft/D

= 15.0 outlet 17870:10/121284 3-15

The values used for the loss coefficients are 0.4 for the inlets to the two sections of tubing and 1.0 for the break outlet (Reference 11). The best estimate values were used for the coefficients in the Zaledek equation for

--Q C critical flow to provide a more realistic prediction

~

of the actual flow rate.

1 1

Secuence of Events 1

On January 25, 1982 the R. E. Ginna power plant was operating at 100% rated power (1,520 MWth) with the pressurizer pressure at 2235 psig and the average core temperature at 572.4*F.

A tube ruptured in the 8 steam generator at 9:25:10, as calculated in Reference (7), and the following sequence of events occurred. This sequence of events was used in the LOFTTRI. simulation of the event.

Clock time (relative time)

Event sec.

9:25:10 (0)

Tube ruptured in 8 SG 9:26:28 (78)

Plant load automatically reduced 9:26:30 (80)

Power manually reduced 9:27 (110)

Condenser steam dump opened (all 8 valves) 9:27:30 (140)

Third charging pump started 9:27:45 (155)

Four condenser steam dump closed 9:28:12 (182) a) RCS letdown secured b)

Pressurizer heaters turned off c) Reactor scramed on low pressurizer pressure 9:28:13 (183)

Turbine tripped i

9:28:20 (190)

SI actuated on low pressurizer pressure 77870:10/120384 3-16

9:28:22 (192)

Main feedwater pumps tripped 9:28:49

~ (219)

A motor driven auxiliary feedwater pump started 9:28:51 (222)

B motor driven auxiliary feedwater pump started 9:29:10 (240)

RCPs were manually tripped l

9:29:15 (245)

Turbine driven auxiliary feedwater pump started 9:30:00 (290)

Two condenser steam dump valves closed i

9:30:30 (320)

Las't two condenser steam dump valves j

closed 9:32:00 (410) a) B motor driven auxiliary feedwater pump manually stopped b) Steam supply valve from B SG to turbine driven auxiliary feedwater pump manually closed 9:38 - 9:39 (770 - 830)

Two condenser steam dump valves open and closed 9:40 (890)

B SG main steam isolation valve manually closed 9:41 (950)

Auxiliary feedwater throttled to A SG 9:43 (1070)

Two condenser steam dump valves opened and closed i

7787Q:10/113084 3-17

9:46 (1250)

Steam supply valve from A SG to turbine driven auxiliary feedwater pump manually closed 9:48 (1370) a) Two condenser steam dump valves opened b) A motor driven auxiliary feedwater pump manually stopped 9:46:50 (1420)

A third condenser steam dump valve opened 9:49 (1430)

One condenser steam dump valve closed 9:53 (1660)

Last two condenser steam dump valves closed 9:58 (1960)

Two condenser steam dump valves opened 10:03 (2260)

Two condenser steam dump valves closed 10:04 (2320)

Charging pumps manually started 10:07:30 (2530)

Pressurizer PORV opened 10:07:35 (2535)

Pressurizer PORV closed 10:07:50 (2550)

Pressurizer PORY opened 10:07:57 (2557)

Pressurizer PORV closed 10:08 (2560)

RCS letdown reestablished 10:08:44 (2604)

Pressurizer PORV opened 10:08:52 (2612)

Pressurizer PORV closed 10:09:10 (2630)

Pressurizer PORV opened 77870:10/113084 3-18

l 10:09:15 (2635)

Pressurizer PORV started to close 10:09:17 (2637)

Pressurizer PORV opened and stuck open 10:10 (2678)

Pressurizer PORV block valve closed 10:17 (3098) a) 8 SG PORY opened, but block valve was closed b) A motor driven auxiliary feedwater pump started 10:18-10:19 (3158-3218)

B SG safety valve opened The LOFTTR1 calculation indicates that the 8 steam line was completely filled withwateratapproximately{

]s5condsaftertherupture,andthe calculation was terminated at that time.

Boundary Conditions Several different sets of parameters were used for boundary conditions at different times during the simulation of the Ginna event. The parameters used forboundaryconditionswere[

] The choice of which parameters to use for boundary conditions during a particular time interval was dependent on the available plant data and plant conditions.

a, C, 77870:10/120384 3-19

Q, c i

/

Results For thg,{irst 108 seconds of the transient,[

]were the input forcing parameters in LOFTTRI. During this period of time the prediction of pressurizer pressure, pressurizer level and both cold leg temperatures are very close to the Ginna data as shown in Figures 3.3-7 to i

3.3-10.

From 100 seconds to 9 minutes.

4c

]we,reusedasforcingparameters.

During this portion of the trensient, pressurizer pressure, pressurizer level and both. cold leg temperature 7787Q:10/120384 3-20

predictions match the Ginna data well (Figures 3.3-7 to 3.3-13).

Core exit temperature and RCS pressure predictions also match the data very well as shown in Figures 3.3-14 and 3.3-15.

The calculated total steam flow values are higher than the Ginna data points during this period as shown in Figure 3.3-2, since the data points do not include the steam flow to the steam dump system.

. 4, C Between 9 and 18 minutes, the was input as

]4C w

shown in Figure 3.3-16 to forc'e the(

to match the Ginna data during this period. From9to15 minutes,{

]w%cere also input as forcing parameters. The calculated ruptured loo cold leg and core exit temperatures match the Ginna data to

,c within,.')orthecoldlegtemperatureand

}forthecoreexit temperatures as shown in Figures 3.3-13 and 3.3-14.

After 9 minutes the

. calculated RCS pressure starts to deviate from the plant data as shown in Figure 3.3-15.

Thepredictionofpressureisabout{

fian the data.

At approximately 15 minutes the MSIV for the ruptured steam generator was closed. The Ginna data indicates that the ruptured steam generator pressure continues to decrease after MSIV closure until 19 minutes when the turbine-driven AFW pump was stopped.

I

4. C i

Af ter 25 minutes, the predicted cold leg temperature in the ruptured loop cold

} 4.Las shown in Figure 3.3-13.

The legalso{

temperature data at this point starts to decrease rapidly (- 24*F/ min) until about 19 minutes when AFW was terminated to the ruptured steam generator and the temperature decreases less rapidly (~ 6*F/ min). Theprediction(

77870:10/113084 3-21

- q,c From 19 miniutes to the end of the simulation, the only forcing parameters input were[N t _

~

~~

]

o the time when the pressurizer PORY was cycled, the intact cold leg, core exit, and upper head temperatures match the Ginna data well (Figures 3.3-12, 3.3-14 and 3.3-18).

At 42 minutes, cycling of the pressurizer PORV started and continued for about 3 minutes until the block valve was closed. For these three minutes and until the time that an equilibrium pressure was reached in the RCS again, RCS conditions were very unstable. RCS pressure decreased rapidly as the PORV was opened (Figure 3.3.15) causing a void to form in the upper head and pressurizer level to rapidly increase (Figure 3.3.11).

RCS pressure decreased below the ruptured steam generator pressure causing reverse flow through the break (Figure 3.3-19) and a slight depressurization in the ruptured steam generator (Figure 3.3-17).

After the PORV was isolated, RCS pressure increased until equilibrium with the ruptured steam generator pressure was reached.

During the PORY cycling period, the predicted RCS pressure is within approximately[

]Ythedataasthepressuredecreases,butthepredicted pressure increases more rapidly than shown by the data (Figure 3.3-15).

Once an equilibrium pressure is reached, the prediction matches the data very closely again. The predicted pressurizer level response is very close to the data but the prediction does not show the pressurizer level increasing to the upper tap (Figure 3.3-11).

Both this and the more rapid RCS pressure increase prediction can be attributed at least in part to the upper head modelling in LOFTTR1 which inhibits refilling of the upper head during natural circulation conditions, and thus may underpredict the rate of void collapse. The pressurizer PORY may also not have been instantaneously isolated as it was assumed. The restricted rate of refilling the upper head also explains the 7787Q:10/120384 3-22

overprediction of upper head temperature after the PORV was cycled (Figure i'

3.3-18).

Core exit temperature predictions also deviate from the plant data 4

.ec by (ligure3.3-14).

As the RCS conditions stabilized following isolation of the pressurizer PORV, the predictions fall closer to the plant data. The plant data for intact loop cold leg temperature dips somewhat dee to an insurge of cold SI flow as RCS pressure is reduced. Themode1[

4,C

. 4, c.

Althoughthenewsecondarysidemodelling[

,the ruptured steam generator pressure after MSIV closure, it is interesting tc, note a, c.

'jThiswasnotpredictedwiththehomogeneous secondary side model in the previous analysis of the Ginna transient reported in Reference (7).

n o,c ThesimulationoftheGinnaeventendedaround(

into the transient a

when the ruptured steam generator and associated steamline was predicted to be completely filled with water. The[

]Jhichwascalculatedtofillthe steam generator is consistent with the time estimated previously in Reference (7) and also with the ruptured steam generator safety valve openings from the Ginna data.

In addition to the temperature, pressure and pressurizer level, the steam generator narrow range levels were also predicted for the transient (Figures 3.3-20 to 3.3-22).

The predicted narrow range levels follow the trends of the I

data well but they are consistently lower than the data by around[

]for both steam generators for the first 6 minutes.

After 6 minutes, the predicted narrow range level for the ruptured loop remains below the data r

4. c.

until 14 minutes when it crosses the data and remains above it for the remainder of the prediction.

77870:10/120384 3-23 l

[

Conclusions The results of the comparison of the LOFTTR1 simulation of the GINNA SGTR with actual plant data from the event can be used to draw certain conclusions concerning the new break flow and secondary modelling.

The predicted short terin pressurizer level and pressure (Figures 3.3-7 and 2.3-8) provide good indications of break flow. The predicted results match the GINNA data very well on these two plots and also on the long term plots of pressurizer level and RCS pressure (Figures 3.3-11 and 3.3-15).

From these results, it is concluded that the new break flow model calculates break flow accurately.

Calculations have also been performed using input for a double ended shear of a tube at the tube sheet on the hot leg side and also 3n the cold leg side of thesteamgenerator,andgingthemodifiedZalodekflowcoefficients

[

The short term pressurizer level and pretrip break flow from these calculations are shown on Figures,3.3-8 and 3.3-23.

Theseresultsshowa[

]p,ressurizer level and{. ] break flow than bott the simulation and the Ginna data.

Itisthereforeconcluded[

a, c,

~

_ The overall conclusion is that the proposed FSAR break flow model and input to LOFTTR1 will result in I

conservative break flow rates for a single ruptured tube.

i During the first 108 secondy of the transient, neither the(

]wasusedasaboundarycondition.

During this time the steam generator pressure predictions matched the data very well.

Therefore, for pre-trip tube rupture conditions, the steam generator pressure is accurately predicted by LOFTTRI.

-,a,L During other parts of the transients.

were used as boundary conditions except for the tinie after the MSIV was closed on the ruptured steam generator's steam line.

Predictions of the ruptured steam 7787Q:10/120384 3-24

generator pressure were,

.ns o

the data and it appears that

)'ca$sedthis i

effect. The prediction of the ruptured steam generator pressure, even though

]e,Lthan the Ginna data for some time, eventually matched the data and

( *.

showed trends better than the predictions with the homogeneous secondary model used in Reference (7).

The effects of this overprediction of ruptured steam generator pressure on the proposed design basis analysis are negligible.

~

,4., c.

J Both the stratified and the homogenous secondary models predict this rapid pressure increase.

The validation results demonstrate that the LOFTTR1 program predicts the plant response for the Ginna SGTR event well. Furthermore, with the design basis assumptions, the LOFTTR1 program will predict conservative results for determining the margin to steam generator overfill.

I l

l l

i I

77870

.'120384 3-25

A e

FIGURE 3.3-1 LETIR1 VALIMTim 9mT M CGtE P(NER Q,C I

i t

e e

G 3-26

O e

FIGURE 3.32 IIFTTR1 VALIMTIrw SHORT TERM STEAM FLOW h

1 I

4 l

l l

3-27

FIERE 3.3-3 LETTR1 VAUMTIrn SK TER INTET STEM GDEWS MESSWE

? O b

o O

3-3

1 FIGURE 3.3-4 LIFTTR1 VALIIRTION SHORT TEM RUNtED STEM GENERATE PRESSURE

~

- Q, C e

t i

4 l

3-29

FIERE 3.3-5 LIFTR1 val.REW man um surer tow ramas rw e

a o

G I

3-30

0 m

FIGURE 3.3-6 IJFTTR1 VALIMTim SHORT TEM RUPWRED 1.00P FEDRTER FUM e

- Q, C g

E

=

3-31

-. +. -.

w r --

9

~

~

FIERE 3,F7 LETTR1 VALIIRTIm 90RT TERM PRESSURIZER PRESSLRE um

_. q 3-32

g 7-y FIGURE 3.3-8 e

LIFTTR1 VALIl%TIGl

?'

SHORT TERM PRESSURIZER MYEL F

R 8

m h(

l-ens J:

=-

=.

7 2

M y

F e

K 1-R b

b t

J 4

?

3-33 E,1 "t

n-M

~

FIGURE 3.3-9 LTTTR1 VALIIMTION SHORT TEIN INTACT LOOP COLD LEG TDPERARRE W

-Q

]

Ia

. ' d : 'rs. ',j t:

- - ~.

8.? !*. '. >;

ea..,

s i

FIGURE 3.3-10

~

tanR1 VAUmng[

man Tem numano uxe can us Te,mnas m

J O

e r

r 4

3-35 l

s_

e---

u-a-u A-FIGLRE 3.3-11 LETTR1 VALIMTIrm j

m SSURI M l. EVE.

i i

e J

O e

9 W

3-36

--as--,

4

__m

--a b

FIERE 3,3-12 15TTR1 VALIMTim INTACT COG LEG TEPPERATIRE

~

o,c e

h5

FIGLRE 3.F33 LETTR1 V.timTim I

i 8

m J(*

=

i t

h l

l i

I t

l I

emas

b FIGLRE 3.3-14 LIFUR1 VAllmTI(N 1

CORE EXIT FLUID TDPERATLRE

)

I e

3-39

_h..

-as

-a-

.m_m

,a..m,a

_. - A m_~

w i

FIGURE 3.3-15

~

LIFTIRI.VALIMTim RECOR C00UWT SmW MESSURE 1

e e

l i

s I

i t

l l

l t

1 i

N

l l

FIGURE 3.F16 LIFITR1 VALIDATIrra ruracT srum seeATOR PRESSURE

~ G, C 6

3-41

. =.

FIGURE 3.3-17 LETTR1 VALIDATIGi RUmREb STEM GBGATOR PRESSURE O

M S

I I

e numa

FIGURE 3.5-18 IIFTTR1 VALITATICli LPPER W.AD FLUID TBPERATtRE Mum eum O

\\

l 3-43

,.--,e-o--

FIGURE 3,% 29-BREAK PLOW MC TUTAL SMETY IWECTION FUM h.

O mem e -

=e-e e-e.,-e..

a 4

4 a

e k

e 6

a 9

1 1

m emum 3-41

FIGURE 3.320, LETTR1 VALImTIM IH)RT TERM INTACT STEAM GENERATOR WARROW RANGE 1.EVEL

~

- %C l

l l'

3-45

9 FIGURE 3.3-21

~

i lHTM VALIMTIM N TERM RUPRRED STEAM GIMRATOR NARROW RANGE LEVEL l

a l

Jl l

l G

I h

+

W D

3-46

w e

l FIERE 3.3-22 IDTIR1 VAIRTIm i

N STDM GENERATOR NARRCM RAN(iE M W

4,C e

W

=

e 3-IV

a FIERE 3.3-3 IIF11R1 VALIIATIM PRE-TRIP TLBE RUPRRE FLDf l

8 mems

- 4, C t

a.

O G

O 0

t b

M i

r

4.0 DEVELOPMENT OF ANALYSIS METHODOLOGY The objective of this section is to present the development of the analysis methodology to be used to determine the margin to steam generator overfill for a design basis $6TR. The margin to steam generator overfill is defined as the steam space volume remaining below the steam generator outlet nozzle when the primary to secondary leakage is terminated. The margin to overfill may also be expressed in terms of the time remaining to overfill by dividing the volume to overfill by the equilibrium break flow rate.

1 An evaluation was performed to select a reference plant to be used as the basis for development of the analysis methodology. A base case analysis was performed for a assign basis SGTR for the reference plant using the LOFTTR1 4

program. The operator actions were explicitly modelled in the analysis using the operator action times presented in Table 2.3-2.

The analysis was performed assuming nominal values for the initial plant parameters and for the control and safeguards systems operating parameters.

The results of this base

. t case analysis were used as a basis for comparison of the margin to steam generator overfill obtained f rom subsequent analyses.

A series-of sensitivity studies were performed to identify the conservative assumptions with respect to overfill, including initial plant conditions, of fsite power availability, safeguards capacity, control system operation, cperator action times, etc. The results of the sensitivity studies were used to establish appropriately conservative initial conditions and assumptions for use in the SGTR analysis. An evaluation of the equipment which is used for SGTR recovery was perforwed to determine the consequences of equipment

. failures and to identify the potential single failures for the SGTR analysis.

An evaluation was performed for each of the potential single failures to

/

5

' identify the worst single failure relative to the margin to overfill. An SGTR analysis was performed for the reference plant using the proposed operator action times, the conservative initial conditions and assumptions, and the worst single failure.

The results of this analysis indicates that the primary to secondary leakage can be terminated prior to steam generator overfill.

l 1

77870:10/121284 4 -1

4.1 SELECTION OF REFERENCE PLANT A preliminary analysis was performed to estimate the relative time to steam generator overfill for several representative Westinghouse plant types. The most limiting plant type with respect to the time for overfill was determined from the plant types considered, and this plant type was selected as the reference plant for use in the subsequent studies to establish the analysis methodology.

Following an SGTR event, the primary system pressure will decrease due to the leakage of reactor coolant into the secondary side of the steam generator.

After reactor trip and SI initiation occur, the primary pressure will tend toward an equilibrium condition, as shown on Figure 4.1-1, where outgoing break flow is balanced by incoming SI flow. The break flow rate at this equilibrium pressure is defined as the equilibrium break flow rate. The equilibrium break flow rate can be estimated from curves of the SI flow rate and the calculated break flow rate as a function of RCS pressure as shown in Figure 4.1-2.

A calculation was performed to determine the relative time to overfill for each of the plant types considered, using the equilibrium break flow rate and the secondary side steam volume. The relative time to overfill is defined as the full. power steam generator secondary steam volume, including the steam bubbles in the shell region, divided by the equilibrium break flow rate. This is not the time at which steam generator overfill would be expected to occur after a SGTR since the transient system response and the operator actions are not considered. However, it does provide an indication of the relative amount of time available for the operator to perform the recovery actions for comparison between the various plant types considered.

The plants were categorized into groups according to number of loops, safety injection characteristics, and the steam generator model. The break flow rate was calculated for the double-ended rupture of one tube using the break flow model for unchoked flow which was used previously in the LOFTRAN program. The break flow rates were calculated as a function of RCS pressure for each plant type, assuming that the reactor coolant temperature and the steam generator 7787Q:10/120384 4-2

~

l secondary pressure are at no-load conditions. The use of no-load conditions is based on the assumption that of fsite power is available following the SGTR and that the steam dump system operates as designed. The equilibrium break flow rate was determined by comparing the break flow rate with the safety injection flow rate for each plant type as illustrated in Figure 4.1-2.

The equilibrium break flow rate, secondary steam volume, and the calculated relative time to overfill for each plant category are summarized in Table

~

4.1-1.

~

~~

YEerefore,thisplanttypewasselected'asthereference plant for the sensitivity studies, single failure evaluation, and the development of the licensing basis analysis methodology.

5 77870:10/121284 4-3

TABLE 4.1-1 COMPARISON OF RELATIVE TIMES TO STEAM GENERATOR OVERFILL Initial Secondary Relative Plant Eq Break Flow Steam Time to 3

Tygg*

SG Model (ft /sec)

Vol. (ft 1 Overfill (min)

- Q, C

~

412 HP SI D3 04 DS F

414 LP SI E2 312 HP SI D4 312 HP SI S1

• For plant type XYY, X = Number of loops YY = Active fuel length, ft.

7787Q:10/113084 4-4

i FIGLRE 4.1-1 RCS PRESSLRE.VTER A SGTR EM 2300 2250 TRIP.

2000 t

EQLIILIBRILM PRESSLRE 1750 5

(1500 m

$.1250 en en E '***

E 750 500 t

250 1

I I

I I

I I

O O

250 500 750 1000 1250 1500 1750 190 TIME (SEC) 4-5

FIGlRE 4,1-2 EElILIBRIIM BR'EAKiLN RATE FOR A SGTR EVENT

~

a4o0 SI FLOW RATE EQUILIBRILM BREAK FLOW RATE tooo 4

isoo i

12o0 3

BREAK FLN RATE

. E 8

a soo 4oo l

I

[

g o

0 20 4o so so 1o0

.12o 140 FLOW (fbm/s)

O O

4.2 BASE CASE SGTR TRANSIENT WITH OPERATOR ACTIONS 4.2.1 METHOD OF ANALYSIS i

An analysis was performed to determine the transient system respor.se for a SGTR event for the reference plant using the LOFTTR1 program. The margin to steam generator overfill was determined from this analysis for use as a basis for comparison with the results of the subsequent sensitivity studias.

The analysis was performed for a double-ended rupture of one steam generator tube assuming nominal plant parameters.

It was assumed that a loss of offsita power occurred at the time of reactor trip, and the worst rod was assumed to be stuck at reactor trip.

The major operator actions for S6TR recovery which are included in the E-3 guideline of the WO6 ER6s were explicitly modelled in the analysis. The operator actions modelled include identification and isolation of the ruptured steam generator, cooldown of the RCS to establish subcooling margin, depressurization of the RCS to restore inventory, and termination of Si to j

stop primary to secondary leakage. The operator action times which were developed in Section 2 and summarized in Table 2.3-2 were utilized in the analysis. The operator action time for each recovery step was input and the system response calculated with the LOFTTR1 program.

t 4.

2.2 DESCRIPTION

Of BASE CASE S6TR TRAWSIENT Automatic Actions Following initiation of the SGTR event, reactor coolant flows from the primary into the secondary side of the ruptured steam generator since the primary pressure is greater than the steam generator pressure.

In response to this loss of reactor coolant, pressurizer level decreases as shown in Figure 4. 2-1.

The RCS pressure also decreases as shown in Figure 4.2-2 as the steam bubble in the pressurizer expands. As the RCS pressure decreases due to the continued primary to secondary leakage, automatic reactor trip occurs on a low pressurizer pressure signal.

t 77870:10/120384 4-7

Af ter reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves also close and steam flow to the turbine is terminated.

The steam dump system is designed to actuate following reactor trip to limit the increase in secondary pressure, but the steam dump valves remain closed due to the loss of condenser vacuum resulting from the loss of offsite power.

Thus, the energy transfer from the primary causes the secondary side pressure to increase rapidly after reactor trip until the PORVs lift to dissipate the energy, as shown in Figure 4.2-3.

Since the intact and ruptured steam generators are connected via the main steam header, there is no significant difference in pressures before isolation of the ruptured steam generator.

4 4

The RCS pressure decreases more rapidly af ter reactor trip as energy transfer l

to the secondary shrinks the reactor coolant and the leak flow continues to deplete primary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI signal. Normal feedwater flow is automatically isolated on the SI signal which also actuates the AFW system to deliver flow to all steam generators. There is a 60.second delay assumed from the time of the SI signal until startup of the AFW system.

Pressurizer level also decreases more rapidly following reactor trip and the pressurizer eventually l

empties as shown in Figure 4.2-1.

After the pressurizer empties, the RCS pressure rapidly decreases again as shown in Figure 4.2-2.

Since offsite power is assumed lost at reactor trip, the RCPs trip and a gradual transition to natural circulation flow occurs.

Initially, the temperature rise across the core decreases following reactor trip as core power decays, and subsequently increases as natural circulation flow develops, as shown in Figure 4.2-4.

The cold leg temperatures trend toward the steam l

generator temperature as the fluid residence time in the tube region increases. The RCS temperatures continue to decrease somewhat due to the continued addition of the auxiliary feedwater until operator actions are initiated to cooldown the RCS. As noted in Figure 4.2-4, a temporary increase in the hot leg temperature occurs during the RCS depressurization.

This is due to the increased flow of the hotter water from the upper head region into the hot legs when the RCS pressure is reduced. The sequence of events for the base case SGTR is presented in Table 4.2-1.

77870:10/121784 4-8

Maior Operator Actions 1.

Identify and Isolate the Ruptured Steam Generator Once a tube rupture has been identified, recovery actions begin by isolating steam flow from the ruptured steam generator and throttling the auxiliary feedwater flow to the ruptured steam generator. As indicated in Table 2.3-2, the ruptured steam generator is assumed to be identified and e, c.

isolatedwhenthengrrowrangelevelreaches on the ruptured steam generator or at[ ] minutes af ter initiation of the SGTR, whichever is longer. The response of the narrow range level for both the ruptured and intact steam generators is presented in Figure 4.2-5.

For this narrow range level for the ruptured steam generator reaches [ ] gage, the at approximately 666 seconds indicated in Table 4.2-1, and the ruptured steam generator is assumed to be isolated at that time.

2.

Cooldown the RCS to Establish Subcooling Margin g

a,c Af ter isolation of the ruptured steam generator, there is a[]minJte operator action time imposed prior to cooldown. As noted in Table 4.2-1,

• the actual delay time used in the analysis is 4 seconds longer because of the computer program requirements for simulating the operator actions.

After this time, the RCS is cooled as rapidly as possible by dumping steam from the intact steam generators. The cooldown is continued until RCS subcooling at the ruptured steam generator pressure is 20*F plus an allowance of 30*F for subcooling uncertainty. This allowance for subcooling uncertainty is representative for Westinghouse plants. This cooldown ensures that there will be adequate subcooling in the RCS af ter the subsequent depressurization of the RCS to the ruptured steam generator pressure. Since offsite power is lost, the RCS is cooled by dumping steam to the atmosphere using the PORVs on the intact steam generators. The reduction in the intact steam generator pressures required to accomplish the cooldown is shown in Figure 4.2-3, and the effect of the cooldown on the RCS temperatures is shown in Figure 4.2-4.

The RCS pressure also decreases during this cooldown process due to shrinkage of the reactor coolant as shown in Figure 4.2-2.

7787Q:10/121284 4-9

3.

Depressurize RCS to Restore Inventory

. A C.

After the RCS cooldown, a minute operator action time is included prior l

to depressurization. The RCS is depressurized to assure adequate coolant inventory prior to terminating SI flow. With the RCPs stopped, normal pressurizer spray is not available and thus the RCS is depressurized by opening a pressurizer PORV. The depressurization is continued until any i

of the following conditions are satisfied: RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than 0%

plus an allowance of 3% for pressurizer level uncertainty, or pressurizer level is greater than 80% minus an allowance of 3% for pressurizer level uncertainty, or RCS subcooling is less than the 30*F allowance for subcooling uncertainty. These uncertainties are representative for typical Westinghouse plants. The RCS depressurization reduces the break flow as shown in Figure 4.2-6 and increases SI flow to refill the 4

pressurizer, as shown in Figure 4.2-1..

4.

Terminate SI to Stop Primary to Secondary Leakage The previous actions should have established adequate RCS subcooling, verified a secondary side heat sink, and restored the reactor coolant inventory following an SGTR to ensure that SI flow is no longer needed.

When these actions have been completed, the SI flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage. The SI flow is terminated when the RCS pressure increases, minimum AFW flow is available and at least one intact steam generator level is in the narrow range, RCS subcooling is greater than the 30*F allowance for subcooling uncertainty, and the pressurizer level is greater l

than the 3% allowance for pressurizer level uncertainty. To assure that the RCS pressure is increasing SI was not terminated until the RCS pressure increased to 50 psi above the ruptured steam generator pressure.

a,C Af ter depressurization is completed, an operator action time of] minute is imposed prior to SI terminat.Jn. However, as noted from the sequence of events in Table 4.2-1, an additional 100 seconds was required to satisfy the criteria for SI termination af ter the((m'inute delay for l

77870:10/121704 4-10

operator action. As shown in Figure 4.2-6, the primary to secondary leakage continues after the SI flow is stopped until the RCS and ruptured steam generator pressures equalize.

4.2.3 MARGIN TO OVERFILL FOR BASE CASE SGTR TRANSIENT The level response in both the intact and ruptured steam generators following the 56TR are presented in Figure 4.2-5.

The level in the intact steam generators increases to approximately 50% on the narrow range and is maintained at approximately that level by controlling the AFW flow in accordance with the SGTR recovery procedure. The fluctuations in the intact steam generator level are due to operation of the PORVs on the intact steam f

generators for temperature control. F the ruptured steam generator, the level increases rapidly until the narrow range level is reached, at which i

~

time the AFW flow to the ruptured steam generator is terminated. The ruptured steam generator continues to increase at a slower rate due to the break flow until the_ RCS and ruptured steam generator pressures are equalized and break flow is terminated. The slight reduction in the level during depressurization is due to the reversal of the break flow when the RCS pressure is reduced below the ruptured steam generator pressure.

The water volume in the secondary side of the ruptured steam generatcr is shown as a function of time in Figure 4.2-7 for the base case SGTR event. As shown in Figure 4.2-7, the water volume increases rapidly af ter reactor trip since the steam flow to the turbine is terminated before the feedwater flow to i

the steam generator is completely throttled. When the steam generator PORY opens, the water volume decreases slightly since the ste&m flow rate through 4

the PORY initially exceeds the break flow rate. However, when AFW flow is initiated, the water volume begins to increase again.

The ruptured steam generator water volume then increases due to the break flow and AFW flow.

Af ter the AFW to the ruptured steam generator is terminated, the water volume continues to increase until the break flow is terminated. The secondary water v,olume af ter termination of the primary to,sgcondary leakage is approximately

_lessthanthetotalgeconder g

side volume. Thus, the margin to steam generator overfill is L for the base case transigng. This is equivalent to a time rer.iaining to overfill 4

cf approximately

., minutes.

77870:10/120384 4-11

TABLE 4.2-1 SEQUENCE OF EVENTS FOR BASE CASE SGTR TRANSIENT Automatic Actions Event Time (Srcl Tube Failure 0

Reactor Trip 259 j

Turbine Trip 259 SI signal 285 AFW Actuation 346 Operator Actions

~

Q,C

~

Isolation of Ruptured SG

' Start Cooldown Complete Cooldown Start depressurization Complete depressurization

. Terminate SI Terminate leakage flow J

I 77870:10/113084 4-12

A

--a w

A---

A e,

e A.

a 4

..____,.,4 a

.- a

_,m

_---na

-.ee--

4 4

T FIGURE 4.2-1 4

BASE. CASE SEm DMSIstr-mssupjm m 8

e imme p

4 i

I 4

1 1

l i

}

i o

5 I'

4 M

m ll i

4-13

) '_

_. _.._.. _ -_- _. _...,.. -. ~ _ _..... _ - _ _.,.. _ _ _. _ _ _ _ - _ _ _. _ _

FIGutE 4.2-2 5dSE CASE SGTR' TRANSIENT glS PRESUtE O

l-l 4

meme e

M

+

5 O

e f

4-14

i I.

FIGURE 4.2-3 l

WE mm MMS!DE -E m g g 1

f i

i t

Q,C

~

)

I i -

3 4

I

?

i i

k i

r i

f J

f i

h f

I I#

P 1

i h

i l

l 4-15 i

[

f

FIGURE 4.2-4

.. BASE CASE SGTR TRANSIENT

-INT CT LOOP W s g g g.gg Qi Y

o I

l l

O 8 16

FIGLRE 4.2-5 BASE CASE SGTR TRANSIENT

- STEAM GDERATDR NARROW RANGE LIVELS a,C e

9 9

f e

M i

G 4.17

J e

J M*

a

.+

.mu a.

1a m

.A4J A

FIGURE 4.2-6 l

BASE CASE SGTR TRNSIBir -EREAK FUM RATE l

0> 0 4

E i

s T

1 l

7 i

J t

e 4

I J

e y

1 l

1 4

1 i

e e

4 Y

f 1

1

FIGlRE 4. 2-7 BASE CASE SGTR TRANSIENT STEAM GEERATOR SECOMWtY WATER VOUPE

_ Q,C

~

4-19

4.3 SENSITIVITY STUDIES 4.3.1 IDENTIFICATION OF CONSERVATIVE ASSUNPTIONS The analysis for the base case transient presented in Section 4.2 was performed assuming nominal plant conditions and parameters. Sensitivity studies were then performed to identify the conservative plant conditions and parameters and other conservative analysis assumptions with respect to the margin to steam generator overfill.

In some cases, the conservative values and assumptions could be identified by intuitive judgment, while other cases required a LOFTTR1 analysis to identify the conservative direction.

For the LOFTTR1 analyses, the water volume on the secondary side of the ruptured steam generator was determined after leakage termination and compared to the base case results to establish the effect on the margin to overfill.

The sensitivity studies which were performed to identify the conservative parameters and assumptions are discussed below.

1.

Initisi Conditions Power

- as a

l

~

~

RCS Pressure l

-1e

[

1944Q:10/120484 4-20

- o.. e Pressurizer Water level

-ac t

i-Steam Generator Secondary Mass a.c u

Break Location ac l

i W.

unas i

7944Q:10/120484 4-21

2.

Offsite Power Availability

-- o..c t

J 7944Q:1D/l20484 4-22

4 3.

Protection Setpoints and Errors Reactor Trio Delav qac i

t

~

Turbine Trio Delav o..e a

Steam Generator Relief Valve Pressure Setooint

..c

• emmuil Pressurizer Pressure for Reactor Trio

~

sc

~

Pressurizer Pressure for SI Initiation

4.. e w

7944Q:10/120484 4-23

I S.c J

1 1

4 4.

Safeguards Capacity SI Flow Rate

_ a.c

~

4 j

a AFW Flow

.4 i

4 1

t 4

4 7944Q:10/120484 4-24 4

= 4. C i

I i

AFW System Delav a.c a

7944Q:10/120484 4-25

AFW Temperature a..c 5.

Control Systems CVCS Operation (Charaina/t.etdown) and Pressurizer Heater Control 4.. c 4

4 Turbine Runback / Steam Duni

-. a. c

. ~ =

7944Q:10/120484 4-26

, _...~ - _ _ _. _.

t

. s. c r

4 s

i i

RCP coeration i

,i

..e l

4 i

i f

I 4

I 6.

Decay Heat 4

,a.c 1

i i

i

't 4

t i

t t

I J

i l

79440:1D/120484 -

4-27 L

i a

I~

f

. _ -. _ = _ - _ _ _... -. _.,,

7.

Operator Action Time

-- Q, c.

The results of the sensitivity studies discussed above are summarized in Table 4.3-2.

These results provide the conservative directions or conditions for each of the parameters studied relative to the margin to steam generator overfill. This informaion can then be used to select the appropriate conditions and conservative parameters, within the bounds of the normal ranges, for use in the SGTR analysis.

I 7944Q:lD/121384 4-28 I

r

\\

TABLE 4.3-1 COMPARISON OF SEQUENCE OF EVENTS FOR A SGTR WITH AND WITHOUT OFFSITE POWER Automatic Actions Ly.grLt, Time (Sec)

Without With Offsite Power Offsite Power Tube Failure 0

0 Reactor Trip

~

259 259 Loss of Offsite Power 259 Condenser Lost 259 Steam Dump Operation 260 SI Signal 286 266 AFW Actuation 346 326 Operator Actions

~

isolation of Ruptured SG Start Cooldown Complete Cooldown Start depressurization Complete depressurization Terminate SI 7944Q:10/121384 4-29

TABLE 4.3-2 MARGIN TO OVERFILL SENSITIVITY STUDY Parameters Conservative Direction Initial conditions

_ oc Power RCS Pressure Pressurizer Water Level 56 Secondary Mass i

8'reak Location Offsite Power Availability Protection Setpoints and Errors Reactor Trip Delay After Trip Signal Turbine Trip Delay after RX Trip SG Relief Valves Pressure Setpoint Pressurizer Pressure for RX Trip i

Pressurizer Pressure for SI Initiation Safeguards capacity l

SI Flow AFW Flow AFW System Delay AFW Temperature Control Systems CVCS Operation Turbine Runback / Steam Dump Pressurizer Heater Control RCP Operation L

1944Q:10/120484 4-30

TABLE 4.3-2 (Continued)

MARGIN TO OVERFILL SENSITIVITY STUDY Parameters Conservative Direction Decay Heat Operator Response Times 1

'1 79440:10/120484 4-31 y

--.-mm

---e,-v.,--

w

-r-T-1 r-W

'----m'--

ww*'e

--e--

e e'-

e--w

--e e

FlaAtE4.3-1 SENS,ITIVITY TD INITIAL RCS PRESSWtE

-sECOMWIY ETER VOL.lPE 4,t l

~

\\

=

i 4

e 9

O e

W 4

l 4-32 i

3,%,w g_;aa, w

zeus.m-ew,

.mm.w.swaar auaamJ-"-A---*----

FIGEE 4.5-2

' SGIBITIVITY 1D INITIAL FitESSIRIZER MTEt LDEL v.

M PRESSutE I

Q,C o

I-i h

t-*

h I

Ai' i

1 I.

I 4

i

+

s W

k

+

.l i

1 i

i I

t 1

t l

t

[

l I

i

.l t

i i

f i

a 6

I j

J l-t e

I -

i I

'i I

i l

f 1

FIGURE 4.3-3 SENSITIYHY TD OFFSITE POWER AVAILABILITY REETOR CDOUNT TBPERATLRES WITH OFFSITE PWER AVA!!.ABLE Ce O

GP 1

a L_.

4-34

,4

.i.4mqp,wpe-_.h s.4 mSw a -m

_-4

&L.--hhsn. A.am_.-%eJ.A 4kd--a m.i.-eA--4=.- _ _ --

-_hh._4-uL.-

-A____m_

_.as-,y1as b_m-4-n..4 us a h 4 - '.

f t

e i.

sENSmVnY,TO CPFSITE POER AV4!U3!UTY s.

1 RCS PRESSURE 2

1 9

I >C Q

6

j i

I e.

t i

f Y

,I i

4 J

k a

4 4

l N

1 f

0 1

d

}

4-1 j'

h l-8 J

i s

f 4

O O

l 3

E

+

+.-m.-+,,..%.4y-

., -. ~, -.,, _,,w

,_,,,c._,

.%-m,

.% - -,- -,-w -

.~~m...

e O

FIGURE 4.3-5 SENSITIVITY 10 0FFSITE POWER AVAILABIUTY

- semaar mm ww.

_, 4,(

i e

+

O b

9 4-36

1,a.-.sw u..

g

.u a.-m e.-.u.

FIGlRE 4.'M SENSITIVITY TD SI FLOW RATE Q, C G

9 l

t 1

3 t

I 4

,,e.-.e,,-,,

o me me - n ew-

,,.m..-.m

..,e---~e----------esw--

w--e--------m---w,

~ - - -, - - -.-. -,-

,-----,a-w~..-,-n-

3 i

FIGURE 4.F7 SENSITIVITY TO DECAY W.AT LEVEL --

i l

RCS PRESSWtE i

i' n

Q,C i

i 1

4*

i L

i 4

i.

l 1

A

?

I E

i i

e i

e 4

4 0

i i

t i

l I

6 i

4 a

1 I

I t

i V

9 9

1 I

i 1

I i

4 FIGURE 4.M i

SENSITIVIT.Y.T.D DECAY EAT LIN.EC

- SECOMWW WATER WLIM e

0,C 2

e e

e MI 4-39

4.3.2 SGTR ANALYSIS WITH CONSERVATIVE PLANT PARAMETERS An evaluation was performed to determine the effect of using conservative plant parameters on the margin to overfill for the reference plant.

The results of the sensitivity studies were used to establish the conservative conditions and parameters for the reference plant. A LOFTTR1 analysis was performed using the conservative conditions and parameters and the results were compared with the results of the nominal base case analysis. The plant parameters w'aich were used in the base case and censervative case LOFTTR1 analyses are compared in Table 4.3-3.

a,e The sequence of events for the conservative case SGTR and the base case SGTR are compared in Table 4.3-4. [

. o, c, 7944Q:10/121084 4-40

8 9 %CAs shown in Figure 4.3-9, the water volume in the ruptured steam generator is approximately.

og 3

~ -

ft for the conservative case when the primary to secondary leakage is q#c 3

terminated.

This represents a margin to overfill of apgroximately ft inthek*ginto for the conservative case, which is a reduction of ft 3

overfill compared to the base case. The margin to overfill of ft for the conservative case is equivalent to a time remaining to overfill of approximately[.] minutes.

7944Q:lD/120484 4-41

TABLE 4.3-3 COMPARISON BETWEEN BASE CASE AND CONSERVATIVE PLANT PARAMETERS Base Case Conservative

~

RCS Pressure, psia 3

Pressurizer Water Volume, ft SG Secondary Mass, Ibm Reactor Trip Delay, see Turbine Trip Delay, sec Pressurizer Pressure for SI, psia Pressurizer Pressure for Reactor Trip, psia SG Relieve Pressure, psia SIS Pump Delay, sec

.AFW Delay, sec AFW Flow Rate (gpm)

AFW Temperature (*F)

SI Flow, lb/sec, vs. RCS Pressure, psig Decay Heat 1

7944Q:10/121384 4-42

TABLE 4.3-4 COMPARISON OF THE SEQUENCE OF EVENTS FOR THE BASE CASE AND CONSERVATIVE CASE SGTR Automatic Actions

[ yin.1.

Time (sec) n Conservative Base Case Case Tube Failure 0

0 Reactor Trip 259 215 Turbine Trip 259 215 SI Signal 286 230 AFW Actuation 346 230 Operator Actions

~

Isolation of Ruptured SG Start Cooldown Complete Cooldown Start Depressurization Complete Depressurization i

Terminate SI 79440:10/121384 4-43

0 6

FIGLRE 4.3-9 I

ARIS0N OF.CONSERVAU VE CASE M ' m g m mm m O

1 4

O e

M

+

4.3.3 SGTR Analysis With Turbine Runback As indicated in the sensitivity studies, consideration of turbine runback in the SGTR analysis may result in a decrease in the margin to overfill due to the increased water mass in the ruptured steam generator at the time of reactor trip. Therefore, a LOFTTR1 analysis was performed to evaluate the effect of turbine runback on the margin to overfill.

4. C 4

.m 7944Q:10/121384' 4-45

(8 l

e J

1 7944Q:10/120484 4-46

i FIGl#tE 413-10 EFFECT OF TURBINE IUBACK ON CONSDtVATIVE CASE RENTS a, c.

m W

r 0

9 0

enum

4.3.4 Reduced Power SGTR Analysis The sensitivity studies identified that the use of lower power levels for the SGTR analysis may produce more conservative results with respect to the margin to overfill. This results from the fact that the initial water mass in the secondary side of the steam generators will be higher for lower power levels.

Since the initial secondary mass will be highest for zero power, this represents the most limiting case. Therefore, an evaluation was performed to determine the margin to overfill for an SGTR at zero power and to establish if this accident should be considered in tne design basis SGTR analysis.

~

G C.

3

~

7944Q:10/121384 4-48

4 Q,C

~

1 4

a

(

J 5

4 I

l-4 4

J 1

(

4 i

i

~4 7944Q:10/121084 4-49 w..

.n.

--.s

.c vu-,.,,.,, --,,-,,

1 t

4,C i

\\

I

\\

4 I

i C-f 5

i 7

t 1

1 i-1 J

4 f

r A

i i

'l t-l.

7944Q:10/121084 4-50

l l

4.4 EQUIPMENT FAILURE EVALUATION The objectives of the equipment failure evaluation are to identify the minimum set of equipment for which credit must be assumed in the design basis analysis in order to prevent steam generator overfill and to identify the most detrimental single failure, relative to overfill, from this list of design basis equipment. Note that equipment identified in the design basis analysis for the reference plant may not be necessary for plants with greater margin to overfill.

4.4.1 Design Basis Equipment Following an SGTR, emergency safeguards systems automatically actuate to restore coolant inventory and maintain core cooling. The operator is also called upon to control various systems and components in order to respond to the event in an optimal fashion, i.e., to minimize radiological releases and plant damage. The Westinghouse Owners Group Emergency Response Guidelines (ERGS) identify the equipment and symptom based recovery actions for SGTRs and other accidents. Revision 1 of the ERGS and associated background documents were used to construct a comprehensive list of equipment which may be utilized following a steam generator tube failure. This list of principal and backup equipment is presented in Table 4.4-1 for each of the first 23 steps of the SGTR optimal recovery guideline which 'must be completed to terminate primary to secondary leakage.

In the optimal recovery strategy presented in the ERGS, much of the equipment utilized is beneficial but not essential for recovery from the event in progress. For example, certain equipment is preferentially used to enhance reactor coolant system pressure and temperature control, such as reactor coolant pumps and condenser steam dump. Other actions, such as manual RCP trip for tube failures, provide protection for multiple failure events which are beyond the des'gn basis. Although the ERGS provide the most comprehensive list of equipment utilized, they provide no obvious guidance on which equipment is appropriate for design basis application. Hence, this list of cptimal equipment must be screened to determine which equipment failures could adversely affect the margin to steam generator overfill, 7944Q:10/120484 4-51 i

The effects.of equipment failures were evaluated relative to a conservative base case analysis. Conservative base case conditions were determined through a series of sensitivity studies (see Section 4.3) which investigated the i

effects of various parameters, such as safety ir.jection flow capacity, auxiliary feedwater flow rates, offsite power availability, and initial plant conditions. Operator actions were simulated based on the design basis operator action times presented in Table 2.3-2.

In some cases, minor differences may exist in base case conditions, such as initial pressurizer level and auxiliary feedwater capacity, for different equipment failures. -

However, the changes in base case results due to equipment failures were evaluated with consistent assumptions and parameter values. Certain equipment was assumed unavailable in the conservative base case analysis; hence, failure of this equipment had no relative impact on margin to overfill. Other equipment failures could adversely effect the margin to overfill beyond that considered in the conservative base case analysis.

These latter equipment failures must be addressed either as a revision to the conservative base case analysis, in which case no credit is assumed for operation of that equipment, or in application of the single failure criteria. Hence, the list of optimal equipment can be separated into a list which identifies equipment for which no credit is assumed in the conservative base case analysis, and a second list to which the single failure criteria is applied 1.e., the design basis equipment list. From this latter list, only the most detrimental equipment failure is assumed in the design basis analysis.

The principal equipment from the optimal equipment list in Table 4.4-1 was evaluated for failures which could adversely affect the conservative base case margin to overfill. Two key elements in determining the margin to steam generator overfill which may be affected by equipment failures are the operator action time and the system, or plant, response time. The impact on operator action time was evaluated with consideration for any additional time required to diagnose the equipment failure and implement contingency actions.

For example, failure of a PORV to close on the ruptured steam generator would require the operator to identify the valve failure and isolate the failed valve. Equipment failures can also affect the system response time.

For example, if an auxiliary feedwater pump should fail, cooldown of the reactor coolant system may take longer. Some failures which could lead to a delay in 7944Q:10/120484 4-52

i operator action, such as failure of pressurizer spray valves, may lead to reduced system response time (reactor coolant system depressurization via a pressu-izer PORV) so that the net effect on margin to overfill is.small. A general assessment of postulated equipment failures is presented below to identify the design basis equipment for the reference plant.

4, C.

J 1944Q:lD/120484 4-53

S Q, c,1 4

7944Q:10/121384 4-54

OC s

1 l

w 7944Q:10/120484 4-55

Q, 9

t 7944Q:10/120484 4-56 4

4, C.

f i

i

~

t i

1 1

i f

,1 Y,

I 4

1 3

7944Q:10/121384 4_57

_q 1

l l

i 4

4 4

i e

J 3

7944Q:lD/120484 4-58

T SC o

I t

7944Q:10/120484 4-59

i

_ gj i

5 i

The results of the general equipment evaluation are sunnarized in Table 4.4-2 which presents the design basis equipment list for the reference plant.

This i

list represents the equipment for the reference plant which could adversely impact the margin to overfill relative to the conservative base case analysis. Both the principal components and backup components are presented for each essential recovery step. As additional assurance of conservatism, the most detrimental single failure from this equipment list will be

{

considered in the design basis accident analysis. Therefore, a single failure evaluation was performed for each of the principal components in the design basis equipment list to quantify the impact on margin to steam generator overfill.

4.4.2 SINGLE FAILURE EVALUATION ^

As in the general equipment failure evaluation, the effects of design basis equipment failures were evaluated for impact on operator action time and i

system response time. The impact on operator action time was determined from a consideration of the contingency actions to be performed, the accessibility of controls for backup equipment, instrumentation available to identify i

equipment malfunctions, and instructions provided to the operator.

In general, the effect on operator action time was considered to be small if contingency actions are limited to simple manipulations which could be performed from within the control room and if explicit instructions are provided in the appropriate emergency operating procedure or in operator training. This is consistent with the operator action time data which

-7944Q:10/120484 4-60

demonstrates an average of less than 2 minutes of operator action time for each high level recovery step. Where possible, simulator or plant data was used directly. The effects of equipment failures on system response time were quantified using a combination of sensitivity studies, simplified calculations, and detailed LOFTTR1 analyses. The results of the single failure evaluation are presented below.

~~

ac 3

L 7944Q:10/121384 4-61

~

~

9, C.

f 1944Q:10/121384 4-62

Q, C l

79440:10/120484 4-63 w

rm

--r--

---

*W------nwmmw--m-w--s--w--=-e----wa-+-r-v--

---w-c w

____.__.m.

i 2-I-

l Q, C

=

I:

4

. e.

4I 1).

i f,

)

i 1-i 4

1 4

i i

1 J

i.

F 4,

I i -

t 4

1 i

d 4

1...

I:4 i

4 l,

i a

i s

-:1 t'

l 4

41 2

4.

4.

I 1

5 4

4 I

i 4

1-7

.t ai y

i L

{I e

4 i

a 1

d 6

m 1

t 7944Q:10/121384 4-64 t

i

.t

.r

4 r, ~

a, C.

t.

I L

T 4

i.

1.

1j i

4 t

4 i

J, t

i t

I i

4 i

l

..{

1 7-f 4

1 4

E

,)

1 4

4 1

i i

t I

,i i

4 4

f' 4

.it n

T f

.i m

I t

19440:10/1204s4 4-65

+

f 4

t i

- -, _,,. - - - - -, _ _.. -. _ -....... -. -,.. - -, _... _..... _ _ =... - - - _. _ - -.. _... -..

-.. - ~. -

T L

1944Q:10/121384 4-66

-9C2 I.

t, t

I, I.

t I

6 l

\\

t 7944Q:10/121384 4-67

4, 9

~

~

I d

i I

f I

l i

~

79440:10/120484 4-68

4

~ %C

~

.i I

t i

i i

1 l

l i

i l

I r

i 7944Q:1D/121384 4-69

1 I

i t

i i

t n

a 7944Q:10/121384 4-70

a, C

~

i I

l

' l, t

5 s

t i

I 7944Q:lD/120484 4-71

A a

w-e sa w-._>1_.1

-.zA s-.J g

+--e<

s e

ea.e-

.,.u--

As.

4 d

l o,%

\\

i J

f T

f d

D J

i 1

e -

=

4 4

i e

a 4

e i

9 79440:10/1204s4 4-72 4

- - - - - - - - - - -, -. +,

b J

a 4

7944Q:10/120484 4-73

\\

1 g

The results of the single failure evaluation are summarized in Table 4.4-4.

A number of single failures are identified which have nearly the same net impact on the conservative base case margin to overfill.

For most single failures, j

the largest contribution to the decrease in margin to overfill is the increase in operator action time required to implement contingency actions. However, the worst single failure for the reference plant is the failure of [

i 4.4.3 Generic Applicability The optimal equipment list was generated from the Westinghouse Owners Group ERGS. These generic guidelines are applicable to nearly all Westinghouse PWRs, although minor changes may be included in plant specific E0Ps to acconnodate design differences in the optimal recovery strategy. The design basis equipment list for the reference plant identifies sufficient principal equipment to terminate primary to secondary leakage for all Westinghouse PWRs. However, electrical power and air supplies to this equipment are plant l

7944Q:10/120484 4-74

specific. Although the contingency actions for equipment failures are also generally applicable to all Westinghouse PWRs, the location of controls and availability of power supplies for backup equipment may differ.

Theeffectsofequipmentfagluresontheplantresponsewereevaluatedbased on a reference, '

piant which was selected as described in Section

_,,e f

1 4

L t

7944Q:lD/120484 4-75

i

. -. a..

1 a

7944Q:10/120484 4-76

TABLE 4.4-1 COMPREHENSIVE EQUIPMENT LIST ERG Principal Backup Equipment /

Reference Steo Eauipment Guideline 1

Check if RCPs I

' ~

S ould be Stopped 2

Identify Ruptured SG(s)

I i

3 Isolate Flow From Ruptured SG(s) i I

i l

f 4

Check Ruptured SG Level 7944Q:10/121384 4-77 1

6 -

I TABLE 4.4-1 (Cont)

COMPREHENSIVE EQUIPMENT LIST ERG Principal Backup Equipment /

Reference SteD EauiDment Guideline j

Ed 5

Check PRZR PORVs a~.1d Block Valves 6, Check if SGs are Not Faulted 7

Check Intact SG Levels 8

Reset SI I

9 Reset Containment Isolation Phase A l'0 Establish Instru-ment Air to Con-tainment 11 Verify all AC Busses Energized by Offsite Power 12 Check if Low Head SI Pumps Should be Stopped 13 Check Ruptured SG Pressure 1944Q:10/120484 4-78

i l

TABLE 4.4-1 (Cont)

COM.'REHENSIVE EQUIPMENT LIST ERG Principal Backup Equipment /

Reference Sten Eauipment Guideline i

Gt 14 Initiate RCS T

o

}

Cooldown i

15 Check Ruptured SG Pressure Stable or Increasing 4

16 Check RCS Sub-4 cooling 17 Depressurize RCS to Minimize Break Flow and Refill PRZR 20 Check if SI Flow Should be Terminated 21 Stop SI Pumps and Place in Standby 22 Establish Charging Flow 23 Isolate BIT mum.

j 1944Q:10/120484 4-79

TABLE 4.4-2 DESIGN BASIS EQUIPMENT LIST FOR REFERENCE PLANT ERG Principal Backup Equipment /

Reference Sten Eauipment Guideline 1

Check if RCPs

""6 4

Should be Stopped 2

Identify Ruptured SG(s) 3 Isolate Flow From Ruptur2d SG(s) i 4

Check Ruptured SG Level 5

Check PRZR PORVs i

and Block Valves

~~

w-79440:10/120484 4-80

TABLE 4.4-2 (Cont)

DESIGN 8 ASIS EQUIPMENT LIST FOR REFERENCE PLANT ERG Principal Backup Equipment /

Reference Steo Eauipment Guideline

, s.c 6

Check if S6s are i

Not Faulted 7

Check Intact SG Levels 8

Reset SI 9

Reset Containment Isolation Phase A 10 Establish Instru-ment Air to Con-tainment 11 Verify all AC Busses Energized by Offsite Power 12 Check if Low Head 51 Pumps Should be Stopped 13 Check Ruptured SG Pressure 14 Initiate RCS I

Cooldown 1944Q:10/120484 4-81

6 TABLE 4.4-2 (Cont)

DESIGN BASIS EQUIPMENT LIST FOR REFERENCE PLANT ERG Principal Backup Equipment /

Reference Sten Eauipment Guideline

_. a.

15 Check Ruptured SG Pressure Stable or Increasing 16 Check RCS Sub-cooling 18 Depressurize RCS to Minimize Break Flow and Refill PRZR 19 Check RCS Pressure Increasing 20 Check if SI Flow Should be Terminated 21 Stop SI Pumps and Place In Standby 22 Establish Charging Flow 23 Isolate BIT 7944Q:1D/120484 4-82

I i

TABLE 4.4-3 SEQUENCE OF EVENTS FOR RUPTURED STEAM GENERATOR PORY FAILURE CASES WITH 20 AND 30 MINUTE ISOLATION TIMES Time (Seconds) 20 Minute 30 Minute

[ygn1 Isolation Isolation

~~

Isolated Ruptured SG

'~

SG PORY Failed Open SG PORY Isolated 4

Start Cooldown Complete Cooldown Start Depressurization Complete Depressurization Terminate SI 1

i i

i I

7944Q:1D/121384 4-83 d

TABLE 4.4-4 r

SUMMARY

OF SINGLE FAILURE EVALUATION Decrease in Marain to Overfill (Min)

Operator System Net Principal Eauipment Action

Response

Decrease AFW Flow Control Valve 7

Ruptured SG PORY MSIV Steam Supply Valve For Turbine-driven AFW Pump Main FW Flow Control Valve i

Emergency Diesel i

kntactSGPORY Pressurizer PORY SI Pump Switches 81T Isolation Valves i,

i l

7944Q:10/120484 4-84 4

\\

t i

FIGtRE 4.4-1

,FAILLRE'0F RLPTIRED SG PORV

-RLPTILRED hND INTACT SG PRESSLRES FOR.2J MINUTES ISOLATION TIT

.e 4

TIME (SEC) 0 G

Li-85

FIGURE 4.4-2

,. FAILLRE OF RLPTLRED SG PORV W SG SECONDNW SIDE WATER VOLLPES

- o.c 1

0 1INE Iltt 4-86

FIGlRE 4.4-3 FAlbRE OF RUPTURED = 0RV

= = emv sum a un = =E am n

FOR30MINUTESISOLATIONTIME 1

l

.. c.

i J

~

ting eMts O

4-87

FIGutE 4 lH FAILi#tE OF RP7UtED M W S AND RW7UtED M PRESSutES M MIMITES ISOMTION TIE

..e

\\

\\

h l

1 4

e S

4 r

t i

i muump flNC iSite I

r l

I l

e 4-88 c

i

FIERE 4.4-5 I

F.AILARE OF CE INTACT SG PORV l

-!NTACT LDOP WT LEG TDFERATLRES aac t

l 1

i t

t ting estes 4

l 4

1 e

4-89 I

FIERE 4.M FAJURE F GE INTACT M PGty N M SECOPEMf SIM MATUt VOUPE sf I

t 6

MIII 88888 w.

e muum e

l I

i.

5 1

A-90

F i

FIGURE 4.4-7 l

TOTAL STEAM FtJ0W RATE FROM WE INTACT SG PORV Ato SAFETY VALVES

>==

, 4.C 9

fleet estes bw D

4-91

h E-.a

-.m.

mum-

---wa n_---

FIGlRE 4.M toss y passamizan Passsuu comm.

1 a

i g.C 4

=

i l

l l

t e

t l

m 4

0 1

4-92

-4

-.x.a FIGutE 4.M toss or msSuntzen stESSURE N i'

• -Ile!CATED PRESSURIZER M M

d. C i

d e

1*

p a

1 11MI eft (9 4

A-93

4_.

,__.a

-2.

._.a

_a a._JL... --

a

~

FIGLRE 4.4-E t

LDSS OF PRESSLRIZER PRESSLRE CONTROL T

i e

e an %e i

1 I

O e

e e

4 9

i Il4l l',l($

~

e t

Westinghouse Proprietary Class 2 4.5 ANALYSIS OF DESIGN BASIS ACCIDENT FOR THE REFERENCE PLANT An analysis was performed for a design basis SGTR for the reference plant using nominal plant conditions and parameters and the results are presented in Section 4.2.

Additional analyses were also performed to identify conservative parameters and assumptions with respect to the margin to overfill for incorporation into the analysis methodology. An analysis was performed to determine the margin to overfill for the reference plant using the conservative parameters and assumptions and the results are presented in Section 4.3.

An analysis was also presented in Section 4.3 to determine the margin to overfill for the reference plant using the conservative conditions and also considering the effect of turbine runback.

In the single failure evaluation in Section 4.4., it was determined that the worst case single 1

failure for the reference plant is the

'/ n analysis has also been performed for A

the reference plant using the conservative conditions, considering the effect of a turbine runback, and also assuming this worst case single failure.

The LOFTTRI analysis which was performed for the case with the conservative gonditions and turbine runback was repeated, assuming that

~

~

I i

- a, c -

The transient results for this case are presented in Figures 4.5-1 to 4.5-10 and the sequence of events is presented in Table 4.5-1.

a, c The results of this analysis provides the accumulated effects of the conservative plant parameters, turbine runback and the worst single failure on the margin to overfill for the reference plant.

The cumulative effects of each of these conditions on the secondary water volume for the ruptured steam generator are shown in Figure 4.5-11 as a function of the transient time.

The 79440:10/121784 4-95

steam generator water volume when the primary to secondary leakage is terminated is also shown in Table 4.5-2 for each case, along with the corresponding margin to overfill. The margin to overfill is presented as the remaining available steam generator volume, and also as the equivalent time remaining to overfill based on the equilibrium primary to secondary leak rate.

It is noted that the margin to overfill for the design basis accident for the reference plant is approximately

~

14 l

.a.

1 7944Q:10/121784 4-96

l TABLE 4.5-1 SEQUENCE OF EVENTS FOR DESIGN BASIS SGTR Automatic Actions Event Time (Sec)

Tube Failure o

Reactor Trip 215 Condenser Lost 215 SI Signal 230 AFW Actuation 230 Operator Actions Isolation of Ruptured SG "I

")(~

~

Start Cooldown Complete Cooldown Start depressurization Complete depressurization i

Terminate SI o

i 7944Q:10/121384 4-97

TABLE 4.5-2 DESIGN BASIS MARGIN TO OVERFILL FOR THE REFERENCE PLANT Steam Generator Water Volume Marcin to Overfill 3

3 (Ft )

(Ft )

(Min) c.. c Base Case Conservative Plant Parameters Turbine Runback Worst Single Failure 7944Q:10/120484 4-98

FIGURE 4.5-1 DESIGN BASIS SGTR TR NSIENT - RCS PRESSURE g

..c a

TlHGMD I

C 4-99 w..._

FIGURE 4.5-2

,, DESIGN BASIS.SGTR TRANSIENT

• 1NTACT.IIOP <!X.D MG. AND HDT 15 TEMPERATURES

_3 TIMDMO 4-100

FIGURE 4.5-3 1

(

DESIGN BASIS hGTR '7RANSIENT

- PRESSURIZER m m EYEL 6C n

4

~

TIME (SEC)

I li-101

FIGURE 4.N DESIGN BASIS SGTR 1RANSIENT

- STEM GDERA10R PRESSURES

.. c.

~

TIMOSED 4-102

FIGURE 4.H I

,, DESIGN BASIS SGTR TRANSIENT

- RUPWRED SG STE#Fl.DW RATE

~

c.. C TIME (SEC) 9 4-103

FIGURE 4.56 DESIGN BASIS JIGTR TRANSIENT

-INTACT SG STE#FLDf PATE

,a TIME (SEC)

' 4-104

FIRRE 4.5-7

.. DESIGN BASIS SGTR TRANSIENT

-RL9TURED SG BREAK FLOW RATE

._.,. c l

l l

l 1

l t

l l

l -

i TIME (SED l

l

'4-105

FIGLRE 4.54 IESIGN BASIS SGTR TRANSIENT M MM M

- d.

s O9 e

4-106

FIGLRE 405-9 MSIGN84SISSGTRTRANSIENT v.

e

s. e l

l N

4 e

l l

4-107 L

FIGLRE 4.5-10

bESIGN BASIS SGTR. TRANSIENT-STE#1 GEERATOR NARROW RANGE LEVELS

c. c.

e e

a-M 4-108

FIGLRE 4.5-11 caMPmSON OF PWtGIN TO SG OSFIU.

emum,

p 4

1 t

l k

I I

I m

e 11-109

5.0

SUMMARY

OF SGTR DESIGN BASIS ANALYSIS METHODOLOGY The consequences of an SGTR depend largely upon the ability of the operator to complete the necessary recovery actions to terminate primary to secondary leakage.

If the leakage continues significantly beyond the 30 minutes previously assumed in FSAR analysis, liquid may enter the main steamlines and may be discharged directly to the atmosphere, increasing the radiological doses. To partially address these concerns, a generic analysis methodology has been developed to determine the margin to steam generator overfill. This development program focused on the following major tasks:

(1) analytical model development, (2) determination of operator action times for design basis

~

application, (3) sensitivity studies to identify conservative values of plant parameters relative to steam generator overfill, (4) evaluation of equipment failures to identify the worst single failure of the design basis equipment, and (5) a reference plant analysis. Each of these tasks, with the exception of the analytical model development, were necessarily performed for a reference plant design. Although plaht specific design differences could affect the results and conclusions of some of these tasks, the generic program provides a method for evaluating design differences and quantifying their effect on the margin to overfill.

The operator action times were based on recovery actions described in the WOG ERGS. These generic guidelines may be supplemented with plant specific equipment and instructions to accommodate design differences in the optimal recovery strategy. An analysis of the reference plant response was performed using the operator action times and assuming nominal plant conditions and parameters. Sensitivity studies were then performed to identify the conservative assumptions with respect to initial conditions and plant parameters. The accident examined is the double-ended rupture of a single steam generator tube

~

%C The design basis equipment list identifies sufficient principal equipment to terminate primary to secondary leakage for all Westinghouse PWRs. The single failure evaluation assessed the decrease in margin to overfill caused by postulated failures of the design basis equipment. For most single failures, the largest contribution to the decrease in margin to overfill is the increase 7944Q:10/121384 5-1

in operator response time required to implement contingency actions. The worstsinglefailurefortherg,ferenceplantisthefailureofa([

[]Thisisexpectedtobetheworstfailure,or

~

representative of the worst failure, for other Westinghouse PWRs if the operator action times are consistent with those for the reference plant.

An analysis was performed for the design basis SGTR for the reference plant using the methodology described in the previous sections. The results of this analysis demonstrates that there is margin to overfill for the reference plant.

.7944Q:10/120434 5-2 4

k

6.0 REFERENCES

1.

Westinghouse Owners Group letter to the NRC, OG-lli, " Transmittal of Revision 1 Emergency Response Guidelines, November 30, 1983.

2.

T. W. T. Burnett, et. al., 'LOFTRAN Code Description", WCAP-7907-P-A, April, 1984.

3.

C. E. Meyer, " Summary Report - Emergency Response Guidelines Validation Program", WCAP-10204, September,1982.

4.

C. E. Meyer, " Emergency Response Guidelines Validation Program Final Report", WCAP-10599, June,1984.

=

5.

L. B. Marsh, " Evaluation of Steam Generator Tube Rupture Events",

NUREG-0651, March, 1980.

,+

6.

Licensee Incident Evaluation Report'on the January 25,1982 Steam Generator Tube Rupture Incident at the R. E. Ginna Nuclear Power Plant, Docket No. 50-44, April 12,1982.

7.

Response to Long Term Commitments, Ginna Restart SER, Steam Generator Tube Rupture Incident, Attachment 8, Analysis of Plant Response During January 25, 1982 Steam Generator Tube Failure at the R. E. Ginna Nuclear Power Plant, November 22, 1982.

8.

Licensee Event Report on the October 2, 1979 Steam Generator Tube Break at the Prairie Island Nuclear Generating Plant, Docket 50-282, October 16, 1979.

9.

V. J. Esposito, K. Kesavan, and B. Maul," WFLASH - A Fortran IV Computer Program for Simulation of Transients in a Multi-Loop PWR", WCAP-8200 Revision 2 June, 1974.

10.

F. M. Bordelon, et. al., " SATAN VI Program: Comprehensive Space-Time Dependent Analysis of Loss-of-Coolant" WCAP-8302, June, 1974.

~

~;

7944Q:10/120484 6-1

l 11.

J. W. Daly and D. R. F. Harlemann, Fluid Dynamics, Addison-Wesley Publishing Company, Inc., Reading, Mass., USA, Second Printing, June, 1973.

12. ASME Steam Tables, " Thermodynamic and Transport Properties of Steam" American Society of Mechanical Engineers, 1967.

7944Q:10/120484 6-2

-