ML20202D507
| ML20202D507 | |
| Person / Time | |
|---|---|
| Site: | Haddam Neck File:Connecticut Yankee Atomic Power Co icon.png |
| Issue date: | 06/30/1986 |
| From: | NORTHEAST UTILITIES |
| To: | |
| Shared Package | |
| ML20202D493 | List: |
| References | |
| NUSCO-151, NUDOCS 8607140149 | |
| Download: ML20202D507 (228) | |
Text
. . _. . - - . .. .- . __ .
i 1
NUSCo 151 ,
4
- Haddam Neck Plant i
i NON-LOCA TRANSIENT ,
ANALYSIS i
I NOItTHEAST tmMTIES
- "'=:::=
8 l
' Ta 55:I5Edd53?i=
! P.O. Box 270, Hartford, Connecticut 8607140149 PDR 860630 ADOCK 05000213 PDR
TABLE OF CONTENTS Section Topic Page
- 1. PURPOSE 1.1
- 2. INTRODUCTION 2.1
- 3. FORMAT 3.1
- 4. DISCUSSION OF ANALYSES 4.1 4.1 UNCONTROLLED ROD WITHDRAWAL 4.8 4.1.1 Uncontrolled Rod Withdrawal from Subcritical 4.9 4.1.2 Uncontrolled Rod Withdrawal from Power 4.15 4.2 STARTUP OF AN ISOLATED OR AN IDLED LOOP 4.23 4.3 BORON DILUTION 4.28 4.4 EXCESS FEEDWATER 4.33 4.5 EXCESSIVE LOAD INCREASE 4.42 4.6 DROPPED ROD CLUSTER CONTROL ASSEMBLY 4.48 l 4.7 ROD CLUSTER CONTROL ASSEMBLY EJECTION 4.54 4.8 LOSS OF FORCED REACTOR COOLANT FLOW 4.71 4.9 STEAM LINE BREAK 4.80 4.10 STEAM GENERATOR TUBE RUPTURE 4.89 4.11 LOSS OF LOAD 4.102 4.12 LOSS OF NORMAL FEEDWATER FLOW 4.109 4.13 REACTOR COOLANT PUMP ROTOR SEIZURE AND SHAFT BREAK 4.117 4.13.1 Reactor Coolant Pump Rotor Seizure 4.117 4.13.2 Reactor Coolant Pump Shaft Break 4.126
5.0 REFERENCES
i
1.0 PURPOSE The Facility Description and Safety Analysis (FDSA), Reference 1, for the Haddam Neck Plant identifies thirteen (13) transients and accidents which collectively define the design basis for the plant.
On behalf of the Connecticut Yankee Atomic Power Company (CYAPCO),
Northeast Utilities Service Company (NUSCO) reanalyzed the design basis analyses for the Haddam Neck Plant. This effort was undertaken for several significant reasons, including:
- 1. The Haddam Neck Plant is a Westinghouse designed, 4 loop pressurized water reactor which currently utilizes fuel supplied by Babcock and Wilcox with stainless steel cladding (excluding four zircaloy cladding test assemblies). The unique features of the plant require detailed, plant-specific analyses which outside vendors are not always capable of providing on the required schedule and at reasonable cost. This reanalysis effort will demonstrate NUSCO', ability to perform in-hcuse safety analyses. Additionally, in the past these analyses have been performed by various organizations (e.g., Westinghouse, Yankee Atomic Electric Company) using differing assumptions and l
analysis methods. This effort provides a complete and consistent set of design basis analyses.
NUSCO has established an objective of developing the expertise and analytical tools necessary to perform reload analyses for our nuclear units utilizing in-house resources and without 1.1
reliance on outside vendors. This commitment includes developing the capability to perform the required nuclear core design analyses and both LOCA and non-LOCA analyses. This reanalysis report is a significant milestone in this overall effort.
- 2. 10CFR50.59 requires that planned changes to plant design and procedures and proposed tests and experiments be reviewed against the plant design basis, as described in the safety a
- analysis report, to determine whether or not they pose an unreviewed safety question. Completion of the reanalysis I
effort will provide a significantly more comprehensive and i'
readily available basis against which to evaluate proposed changes, and will provide a more detailed and documented understanding of the analyses to facilitate 50.59 reviews.
- 3. The Systematic Evaluation Program (SEP) review of the Haddam Neck Plant (Reference 2) identified several open issues i related to the existing design basis analyses. Additionally, the safety objective of one SEP topic (Topic XV-7, Reactor Coolant Pump Rotor Seizure and Reactor Coolant Pump Shaft Break) had not previously been reviewed for the Haddam Neck l Plant. The reanalysis effort thus serves to address the
> outstanding SEP issues.
The reanalysis report provided here satisfies the above objectives. This report provides a detailed understanding of f,
' 1.2
the transient response of t he liailitam Neck Plant , anil will greatly facilitate inture safety evalnations. It also proviiles a substantial amount of the information required for the FSAR update effort required by 10CFR50.71.
l I
l l
I l 1.3 I
2.0 INTRODUCTION
Chapter 10 cf the Haddam Neck Facility Description and Safety Analysis (FDSA) identifies thirteen (13) design basis events. These are grouped into three major categories:
- Reactivity incidents
- Mechanical incidents
- Hypothetical accident The first two categories encompass twelve (12) non-LOCA design basis analyses, while the third category describes the maximum credible loss of coolant accident. The twelve non-LOCA events previously analyzed plus the additional analysis required as a result of the SEP review (RCP rotor seizure / shaft break) constitute the set of non-LOCA design basis analyses for the Haddam Neck Plant. These
- analyses are
I
- 1. Uncontrolled rod withdrawal
- 2. Isolated loop startup
- 3. Boron dilution
- 4. Excess feedwater
- 5. Excessive load increase
- 6. Dropped rod 2.1 4
i
- 7. Control rod ejection
- 8. Loss of flow
- 9. Steam line rupture
- 10. Steam generator tube rupture
- 11. Loss of load
- 12. Loss of feedwater flow
- 13. RCP rotor seizure / shaft break Loss of coolant accidents are also being reanalyzed for the Haddam Neck Plant, although they are not covered by this report.
Details of this effort for a certain range of break sizes have previously been submitted to the U.S. Nuclear Regulatory Commission
! in response to TMI Action Plan requirements (NUREG-0737, Items II.K.3.30 and II.K.3.31).
Iladdam Neck is licensed to operate on 3 reactor coolant loops for power levels up to 65 percent of full power. For those events where 3 loop operation is not bounded by 4 loop operation, an analysis of the event for 3 loop conditions is included. Additionally, radiological consequence evaluations are included for the steam l
! generator tube rupture and control rod ejection events.
i 2.2
3.0 FORMAT The transients are presented in Section 4. Each transient description has the following sections:
o event description, o analysis methods, o results, and o conclusions The event description states how an event is postulated to occur and how key systems are expected to respond to the transient. The analysis methods section states the assumptions used to model the transient response. Any difference between the best estimate system j response and the analytical response are also detailed in this section. The results section summarizes the transient response and the conclusion section addresses the acceptability of the results.
The data which are generic to all of the transients are contained in Section 4.0. This section includes safety system setpoints and steady state plant operating conditions. These data have been grouped for easy referencing.
3.1
4.0 DISCUSSION OF ANALYSES The consequences of various transients are presented in the following sections. Certain parameters are common to many of the analyses. These parameters are presented in this section. The computer codes used to simulate the postulated transients are also presented in this section.
A list of system parameters and select physics data used in the analyses is given in Tables 4.0-1 through 4.0-4 and Figures 4.0-1 and 4.0-2. The setpoints and data given in these tables are used in the events described in this report.
The two computer codes employed to simulate the system response to a transient are RETRAN02 and VIPRE01. The ability of NUSCO to use j these codes is demonstrated in References 3 and 4. A brief discussion of these codes and how they are employed in this analysis follows.
The transients were analyzed for both four-loop and three-loop operation. In three-loop operation, the loop not being used can be either isolated or idled. When the loop is idled, only the cold leg loop isolation valve is closed. The reactor coolant system (RCS) mass in the idle loop is stagnant but still in communication with the rest of the RCS. When the loop is isolated, both the cold leg and hot leg isolation valves are closed. The three-loop RETRAN02 model simulates having the loop isolated. This bounds the case where the loop is idled i
I 4.1
- by not allowing the RCS mass in the idle loop to compensate for heatup or cooldown events.
The limiting axial power distribution was selected by evaluating a spectrum of distributions generated for a range of burnup and Xenon conditions. The distributions were restricted to the Technical l
l Specification limits for axial offset, rod insertion and linear heat i
generation rate. The radial peaking factors were calculated by taking into account the Technical Specification for the rod insertion limit. The radial peaking factors given in Table 4.0-1
.i have been adjusted for uncertainties. In addition, separate power distribution calculations were performed for transients that involve I
control rod movement or return to power.
t t
RETRAN02 i
j The RETRAN02 computer program models the RCS as a one dimensional 4
homogenous equilibrium mixture. The pressurizer is modeled as a nonequilibrium volume. The nodalization employed for this analysis has forty (40) primary system volumes plus four (4) steam generator i
secondary volumes, a steam header, and containment. Each of the 4
- plant's four loops is modeled separately. The nodal scheme is identical to that presented in Reference 3.
i The core is represented using point kinetics with one conductor heating up one volume. A separate volume is used to represent the core bypass region. The upper head is modeled as a single volume f 4.2 i
connected to the annulus and the upper plenum with two normal junctions representing flow paths through the upper guide structure and upper annulus.
Each steam generator is modeled using two full height U-tube volumes, two plenum volumes, one secondary side volume, and six heat conductors. The large number of heat conductors is required so that the local conditions heat transfer option can be used. The four secondary side volumes are connected with a common steam header volume from which main steam and steam bypass flow is removed.
VIPRE01 The VIPRE01 computer code performs a detailed thermal hydraulic I
analysis of the reactor core. The code is used in these analyses to calculate departure from nucleate boiling ratio (DNBR) and fuel centerline temperature. These analyses use a nineteen (19) channel,-
thirty-one (31) axial node, one-eighth (1/8) core model. This depth of modeling is detailed enough to provide accurate results as demonstrated in the NU portion of the response to question 6 of Reference 6. The W-3 CHF correlation with the L-grid factor, as contained in VIPRE01, is used to calculate DNBR.
4 4.3 ^
1 Table 4.0-1 System Parameters Parameter Value Maximum initial corepower, MWt loop 1861.5 loop 1222.75 Initial coolant inlet temperature, *F - maximum 544.1
- minimum 520.8 Minimum RCS flow rate, gpm loop 257000.
loop 203000.
Moderator temperature coefficient, pcm/*F - least neg. HFP 0.0
- most neg. HFP -29.
to HZP
- least neg. 65% +5.
to HZP Scram reactivity insertion rate Figure 4.0-1 Minimum scram reactivity insertion - HFP 4-loop 4000 worth, pcm - HFP 3-loop 3300
- HZP 4-loop 2200
- HZP 3-loop 3000 Maximum control rod drop time, see loop 2.5 loop 2.45 Doppler deficit Figure 4.0-2 Steam generator water mass, Ibm /SG - maximum HFP 42810
- minimum HFP 26140
- maximum HZP 76880
- minimum HZP 57600 Initial RCS pressure, psia - maximum 2095
- minimum 1960 Initial pressurizer level, % span - minimum 20
- maximum 55 Radial peaking factors, FAH - HFP 4-loop 1.45
- HFP 3-loop 1.49 Axial power distribution, - top peak Figure 4.0-3
- bottom peak Figure 4.0-4 4.4
t Table 4.0-2 Reactor Protection System Setpoints RPS Function Analysis Limiting Safety Delay Time Setpoint System Setting (Sec)
Core Power High 118. 107. 0.55
(% full power) Medium 82. 72. 0.55 Low 33. 23. 0.55 Pressurizer Pressure High 2350. 2295. 1.65 (psia) Low 1690. >1735.
1.65 Pressurizer Level High 94. 84. 1.65
(% span)
Low Reactor - 4 loop 83. 92. 1.45 Coolant Flow
(% full power) - 3 loop 77. 86. 1.45 Steam Flow High 118. 108. 2.15
(% full flow)
Steam / Feed Flow Mismatch 5.472/5. >4.46/>13. 2.15 Coincident with Low SG Level (AFlow 105 lbm/hr/% NR level) 4.5
Table 4.0-3 Reactor Protection System Channel Requirements I
Number of Number of Channels RPS Function Channels Required for Trip Core Power 4 2 Pressurizer Pressure
-High 3 2
-Low (on SIS) 3 2 Pressurizer Level 3 2 Low Reactor Coolant Flow
-Above P-8 4 1
-Above P-7 and 4 2 Below P-8 Steam Flow High 4 2 Steam / Feed Flow Mismatch 4 1 Coincident with Low SG Level Variable Low Pressure 3 2 4.6
Table 4.0-4 Equipment Setpoints Component Setpoint Pressurizer PORV, psia 2340 Pressurizer Safety Valves, psia 1 @ 2500 1 1%
1 @ 2550 1 1%
1 @ 2600 1%
Steam Generator Safety Valves, psia 4 @ 1000 1 3% .,
4 @ 1030 i 3%
4 @ 1040 1 3%
4 @ 1050 1 3%
e 4.7
IlGilRli 1.0 1 St.OWiiST SCI (AM L NSlillT ION 100-l
/ l 804 l l
l l
l
- l 80- ' l l
l l
l l
70 '
I 5 l C I R !
A !
M j 60f e W !
O !
R l T
H l
50-l l
l x
l l
0 l
F l
40-' l T
l l
0 l T
A l
L 30-' l l
I l
204
/
l l
l l
~
l 10- - :
l 9
02 . . . .
1.5 2.0 2.5 0.0 0.5 1.0 TIME ISEC) 3 PUMP OPERATION -- ---- 4 LOOP OPERATION LEGEND: CURVE
FIGURE 4.0-2 DOPPLER DEFICIT 5000--
\
'. i 45002 -
\.,
4000-
\.,
3500, N,
\.
0 0
P P 30002 N
L E ',
R '., '
'. 's, 0 . '
E 2500- ~
F
- I \,
C I '.',
T .
2000-- ,
\.,
p C
N.
M N.
1500-- .,
N, N.
10002- ,
N, 500f ,
02 2b) ub0 6b0 8b0 10b0 12b0 14b0 16b0 18b0 20b0 22b0 24b0 26b0 28b0 TEMPERATURE IDEG Fl LEAST NEGATIVE ----- - MOST NEGAT IVE LEGEND: CURVE
1:l GJiltli 4 . 0 - 3 TOP PEAK AXIAL POWER DISTRIBUTION
- - 3 and 4-loop operation s
E n
8 0 0.5 l'.0 1.'5 2.'O AXIAL PEAK
1 l GilRii 4. 0-4 BOTTOM l'l!AK AX 1 AI. I'0Willt 111STRIllVT10N 4
\
i .
. 3-loop operation i
\*
'4 s
4 4
6 o '.',
N y \
,, 4-loop operation g
OC '.
O '.
U '. ,
6 i
l l
,9
,0*
p O*
o 0:5 l'. o 1.'s 2 .'o AXIAL PEAK
l 4.1 UNCONTROLLED R0D WITHDRAWAL An uncontrolled rod withdrawal is defined as an uncontrolled addition of reactivity due to the withdrawal of the rod cluster control assemblies (RCCA). Such a transient could be caused by a malfunction of the reactor control system or the control rod drive system. This could occur with the reactor either suberitical or at power. These conditions are considered separately in Sections 4.1.1 and 4.1.2, respectively.
The RCCA drive mechanisms are wired into preselected bank configurations. These circuits prevent the RCCAs from being withdrawn in other than their respective banks. The reactivity insertion rates analyzed conservatively bound the maximum reactivity insertion rate when:
o the rods are withdrawn at their maximum speed (15 inches / minute),
o the rods are withdrawn either as an individual bank or in their proper sequence, and o the rods are initially inserted no farther than the maximum limit allowed by the technical specifications.
The following subsections discuss the uncontrolled rod withdrawal from suberitical and power operation.
4.8
l 4.1.1 Uncontrolled Rod Withdrawal From Subcritical The reactor can be brought to power from suberitical by means of a reactivity increase due to a RCCA withdrawal or a boron dilution event. The maximum rate of reactivity increase assumed in this analysis bounds both a RCCA withdrawal and a boron dilution event.
The reactivity insertion results in a very fast rise in neutron flux which is slowed by the reactivity feedback effect of~the negative Doppler coefficient. This self-limitation of the power excursion is important since it limits the power overshoot above the high nuclear flux trip setpoint. Once the RCCAs drop into the core the transient is terminated.
The following instrumentation provides alarm and protection against a rod withdrawal incident from suberitical:
o Source range nuclear instrumentation: High count rate is indicated and alarmed at the main control board. Also, if the source range instrumentation indicates a start-up rate in excess of approximately 2 decades per minute, an alarm and rod stop signal are automatically initiated.
4.9
o Intermediate range nuclear instrumentation: When the intermediate range nuclear instrumentation indicates a start-up rate in excess of approximately 2 decades per minute, an alarm and a rod stop signal are automatically initiated. When the start-up rate in any one of the two channels exceeds approximately 5 decades per minute, a reactor trip signal is automatically initiated.
o Power range nuclear instrumentation: When the power range nuclear instrumentation indicates a flux level in excess of approximately 105 percent of full power, an alarm and a rod stop signal are automatically initiated. When the power exceeds the setpoints given in Table 4.0-1 a reactor trip signal is generated.
While the rod stop or trip on high startup rate will terminate an uncontrolled rod withdrawal, no credit is taken for these functions in the analysis.
Method of Analysis The analysis of the uncontrolled rod withdrawal from subcritical is performed in two stages. First, the power and RCS response are calculated using RETRAN02. The system response is then input to the VIPRE01 code along 4.10
with a conservative power distribution to calculate DNBR and fuel centerline temperature as a function of time.
The system analysis is performed using limiting kinetics values, consistent with the assumed initial conditions and a spectrum of reactivity insertion rates. The system response (e.g., nuclear power, coolant temperatures and pressures) is then determined using the RETRAN02 model.
The results of the system analysis, along with the assumed power distribution, are used as input to the VIPRE01 core model. A power distribution was selected which bounds all expected RCCA patterns during the RCCA withdrawal. This limiting power distribution is assumed to be constant throughout the transient. The VIPRE01 model was used to determine the minimum DNBR and the peak fuel centerline temperature.
Plant characteristics and initial conditions are discussed in Section 4.0. In order to obtain conservative results for an uncontrolled rod withdrawal from subcritical, the following assumptions are made:
- 1. The magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler deficit. The least negative Doppler deficit 4.11
l is used in the analysis to maximize the power excursion.
2.
Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the time constant for heat transfer between the fuel and the moderator is much longer than the neutron flux response time. However, after 4
the intial neutron flux peak, the rate of power I
increase is affected by the moderator reactivity coefficient. The most positive moderator coefficient is used in the analysis to yield a bounding peak heat flux.
- 3. The RCS is assumed to be at the highest allowable temperature at the beginning of the transient. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect and thereby increasing the neutron flux peak.
4 Reactor trip is assumed to be initiated by the power range high neutron flux trip (low setting). The most 4.12
adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account.
l S. The maximum positive reactivity insertion rate of 22.5 pcm/sec assumed in the analysis is greater than that for the withdrawal of anf individual bank or the withdrawal of the two sequential control banks in controlled overlap having the greatest combined worth.
- 6. The most limiting axial and radial power shapes are assumed in the DNB analysis.
- 7. The initial power level is assumed to be below the power level expected for any shutdown condition (1.5 x 10E-12 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
- 8. Three reactor coolant pumps are assumed to be in operation. This is the minimum allowable by technical specifications and results in the greatest coolant enthalpy rise. The fourth reactor coolant loop is assumed to be unisolated, thereby decreasing the core flow rate.
4.13
Results Figures 4.1.1.-1 through 4.1.1-4 show the system response for the uncontrolled rod withdrawal from subcritical. The sequence of events is presented in Table 4.1.1-1.
The core power increases as the rod is withdrawn, as shown in Figure 4.1.1-1. Due to the rapid rise in power and conservative RPS delay times, the power overshoots the trip setpoint. The rise in reactor power is slowed by Doppler feedback. The maximum core power of 167 percent of initial power is reached at 76 seconds and is quickly reduced following reactor trip.
The thermal heat flux response, of interest for DNB considerations, is shown on Figure 4.1.1-2. The beneficial ef fect of the inherent thermal lag in the fuel is shown by the peak heat flux being much less than the full power nomimal value. The minimum DNBR calculated for the rod withdrawal from suberitical is 1.32 and the peak centerline fuel temperature is 3460*F.
The calculated DNBR and fuel centerline temperature versus time are shown in Figures 4.1.1-5 and 4.1.1-6.
4.14
Conclusions The reactor core is not adversely affected during a postulated uncontrolled rod withdrawal from subcritical transient. This is concluded because the minimum DNBR stays above the limiting value of 1.3 during the transient and the maximum fuel centerline temperature remains below the melting point of 4780'F.
4.1.2 Uncontrolled Rod Withdrawal From Power The uncontrolled RCCA bank withdrawal, while at power, results in an increase in core heat flux and reactor coolant temperature. Since the heat extraction from the steam generator lags behind core power generation, there is a net increase in reactor coolant temperature until the steam generator safety valves lift. In order to insure that the reactor protection system terminates the transient before DNB is predicted to occur, the analysis is performed assuming the minimum initial margin to DNB.
The following instrumentation is provided as protection against an uncontrolled rod withdrawal incident from power:
4.15
o Power range nuclear instrumentation: When the nuclear flux in two of the four channels exceeds the setpoints in Table 4.0-1, a reactor trip is automatically initiated.
o Variable low pressure trip: The variable low pressure trip setpoint is a function of T,y, and AT.
As the RCS heats up, the variable low pressure trip setpoint increases. A reactor trip is generated if the measured pressurizer pressure is less than this value.
o Pressurizer high level: An alarm is generated when the level increases to approximately 5 percent above its programmed setpoint. A reactor trip is generated when the level exceads the setpoint given in Table 4.0-2.
o Pressurizer high pressure: An alarm is generated when the pressure increases to approximately 2050 psig. Pressure above the setpoint in Table 4.0-2 causes a reactor trip.
The control system overpower rod stop protective circuit would normally terminate rod withdrawal before reactor trip. If the circuit receives a signal from any one of the power range flux channels which exceeds a preset 4.16
value, both automatic and manual rod withdrawal is blocked. The preset values are normally four percent below the trip setpoint. However, no credit is taken for this circuit in the analysis of the event.
Method of Analysis This transient is analyzed using the RETRAN02 computer code.
Plant characteristics and initial conditions are discussed in Section 4.0. In order to obtain conservative results for an uncontrolled rod withdrawal at power, the following assumptions 1
are made:
- 1. Initial conditions of maximum reactor coolant inlet temperature and minimum RCS pressure and flow are assumed, resulting in the minimum initial margin to DNB.
- 2. Full power 3-loop and 4-loop operation are considered. An i
uncontrolled rod withdrawal at HZP is bounded by the i results of an uncontrolled rod withdrawal from l
suberitical.
- 3. Two sets of moderator and Doppler coefficients are used.
l The first set uses the least negative Doppler and most
! positive moderator coefficients. The second set uses the l
l most negative Doppler and moderator coefficients.
4.17 l
- 4. The RCCA scram reactivity is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.
- 5. A full range of reactivity insertion rates up to a maximum of 22.5 pcm/sec is considered. The upper limit on reactivity insertion rates is determined by the maximum bank worths for any single bank in motion or any two banks moving in their preprogrammed sequence.
For each case, the core power, RCS temperature and RCS pressure at the time of reactor trip are determined using RETRAN02.
These results are then used as input to VIPRE01 to assure that the DNBR limits are not exceeded. A conservative core power distribution consistent with the assumed initial control rod position and the RETRAN02 generated core power levels were used in the VIPRE01 analysis.
Results A large number of cases were evaluated to assure that the fuel design limits are not exceeded for an uncontrolled rod withdrawal from power. The uncontrolled rod withdrawal event was analyzed for both 4-loop and 3-loop operation, at power levels of 100 percent of rated power (4-loop cases only) and at 65 percent of rated power (3- and 4-loop cases). Both positive and negative axial offsets were considered. A wide spectrum of 4.18
-ry. - - .,,--,c---w,,- - - - - - .n -
- m. , - - , - - - - -- - - - - - - - - - - , - , , .
reactivity insertion rates was used to bound all possible uncontrolled rod withdrawal events, and both maximum and minimum reactivity feedback effects were applied.
Additionally, limiting values for fuel rod gap conductivity were used. For all cases, the fuel design limits were met.
The transient response for a slow RCCA withdrawal from full power is shown on Figures 4.1.2-1 through 4.1.2-6. Coincident reactor trip signals on high power and variable low pressure occur after a longer time period and the rise in temperature and pressure is consequently larger than for rapid RCCA withdrawal. The minimum DNBR is greater than 1.30.
i Figures 4.1.2-7 through 4.1.2-12 show the transient response for a rapid RCCA withdrawal incident starting from full power.
Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in core inlet temperature result and margin to DNB is maintained.
The sequence of events for each case is presented in Table 4.1.2-1.
As a result of this analysis, it is noted that:
)
4.19
- 1. The higher the reactivity insertion rate, the more likely that the reactor will trip on high power. The lower the reactivity insertion rate, the more likely that the reactor will trip on variable low pressure.
- 2. Minimum reactivity feedback cases are more likely to result in a trip on high power. This is because with minimum feedback core power will increase faster than the heatup of the RCS. Conversely, maximum feedback cases are more likely to trip on variable low pressure.
The VIPRE01 analysis show that the fuel design limits are not exceeded for the entire range of rod withdrawals from power.
Therefore, the DNBR is always greater than 1.3 and the fuel thermal limits are not exceeded.
Conclusions The high power and variable low pressure trips provide adequate protection over the entire range of possible reactivity insertion rates. These trips ensure that the fuel design limits will not be exceeded for an uncontrolled rod withdrawal at power.
l r
l 4.20
TABLE 4.1.1-1 Sequence of Events for the .
4 Uncontrolled Rod Withdrawal From Suberitical Event Time (sec)
Rod Withdrawal Begins 0 High Start-up Rate Rod Block 43 Setpoint Reached High Start-up Rate Reactor Trip 55 Setpoint Reached High Power Reactor Trip Setpoint 74.2
- Reached High Power Reactor Trip Signal 74.7 Generated Peak Reactor Power 76.0 s
i 4.21
Table 4.1.2-1 Sequence of Events for the Uncontrolled Rod Withdrawal From Power Rapid RCCA Withdrawal Slow RCCA Withdrawal Event time (sec) time (sec)
Rod Withdrawal Begins 0 0 Reactor Trip Setpoint Reached 38.0 82.3 Reactor Trip Signal Generated 38.5 82.8 Peak Power 39.4 83.6 Peak RCS Pressure 41.2 85.2 1
4 I
L i
4.22
UNCONTROI,I.ED ROD WITilDRAWAI,1: ROM SUBCRITICAI, ,
1:!GUR1! 4.1,1 -1 i i i i g i i i
- l E
m W _
E-S l
l $
y, e , )i .
80 85 90 95 oO 65 70 75 TIMELSECOND)
FIGURE 4.1.1-2 i i i a i a a Gl
?
m g _
Eg 5 .
i dg .
a W
gg -
i e Ji e i e i M M M M M M oO 65 TIME (SECONO) l
UNCONTit01.1.1:11 110D WITilDitAWAI. I:110.\1 SUBCillTICAl.
I:l(;tlitti 4.1.1 - 3 i i i i i i g i c5 o
T }
8
- flot p -
W*
B E -
ER w
~
h! i T
Cold l ! ! ! ! !
l Je 0 55 70 75 80 85 to 35 TIMEISECOND)
FIGURE 4.1.1-4
. . i g i i i i
~
E
.a
--g _
l n
E g
-N ' ' ' ' ' '
sw' ao es 7c 75 so e5 so e5 TIMEtSECOND)
UNCONTROLLED ROD WITHDRAWAL FROM SUBCRITICAL FIGURE 4.1.1-5 5.0 4.0 E 3. 0 <
E E
E m
$ 2.0
-- N 1.0 D'BR=1.3 o
0+ 72 74 TIME (SEC) 76 78 83 FIGURE 4.1.1-6 4000-6 E
ie 3000 i E
- 2000<
, i 1000<
.m l
0~
0 M 72 7'4
~
76 78 eo
! TIME (SEC) l i
"---'r--e.47 _
9 UNCONTROLLED ROD WITilDRAWAL FROM POWER l.0W RCCA WORTil i fil G ilR l! 4 . 1 . 2 - 1 J
I i i I i i I
4 muut de .
D:
E ,
8g -
M' J
E ~
i n
w ~
~
k i
i i e i i i i g i 80 120 140 160 s
di 20 40 80 100 4 TIME (SEC)
FIGURE 4.1.2-2 i i k i i i i e
?
I t
h-l' O ,
( E r "
l bW ,
l LA. -
E' d l t
r
~
k i e i i s
g i e 120 190 160 40 60 80 100 cD 20 TlHE (SEC1 1 P
I
11NCONTROi,l.lill ROI) WITill)RAWAl,1: ROM I)OWiiR I.0W RCCS WORTil 1 IGURE 4.1. 2 -3 l i i i i i i i Eg e
~
E u) d a
s 13 -
E!
s i i i i i i 1
60 60 100 120 190 160 a 20 40 TIME (SEC) l'IGURE 4.1. 2 -4 i i i i i g i i c
- T;;g t
~
~
$0 5
E _
-T Avg -
WR T
- Cold -
g b 20 40 60 60 100 120 140 160 TIME ISEC) l
i l
UNC0!GROLLED ROD WIDIDRANAL Frat POWER IDW RCCS 110R111 FIGURE 4.1.2-5 2.2-i j 2.0 '
i a
1.8 1.6-a 1
1.4 1.2 0 20 40 6'O 8d Id0 TI!!E,SEC.
3 FIGURE 4.1.2-6 i
4500 !
t 4300 i W 4100 1
i 3900 i :
i' "
3700 ~ ~
0 20 40 60 8'O 160 TIME,SEC. .
1
i UNCONT1101.1.I!Il 1101) WITill)ltAWAI.1:110M POWi!!t .
l lilGli ItCCA W0llTil FIGURE 4.1.2-7 i
9
. i i i i i 3 -
Ei!
t-5 bg .
, g-O oc _
wg _
g.
cL E
w 8 69 cD 8 16 29 32 40 48 56 TIME (SEC)
FIGURE 4.1.2-8 4
i i i a i i i
k_
8 d
U E
~
by ~
N E
g .
5'
- i. d E -
~
W9 l
, i i i e l
g i i 24 2 40 48 56 69 cb 5 16 TIME (SEC) 1 1
l t
UNCONTROI.l.IID 110D WITilDRAWA1, FROM POWER lilGil RCCA WORTil 1:lGilitli 4.1. 2-9 l i i i i ,
i i i Eg E
E
$r w
f SE s
N -
E!
I f I t t i 1 29 32 40 98 56 69 8 16 TIME (SEC)
FIGURE 4.1.2-10 i i i i g i i i f
T C llo t 1 E3 i 3 T Avg g
w k -
- E
- }
T -
Cold i I f f 1 I 1
b 8 16 29 32 90 96 56 69 TIME (SEC)
_ -= .
UNCONTROI. LED ROD WITHDRAWAL FROM POWER llIGli RCCA MORTil FIGURE 4.1.2,-11
- 2. 6-i
- 2. 4-h ca 2.2-E 5 2.0 5
x 1.8:
1.6 0 10 2'O 3'O 4'O 5d TIME, SEC.
FIGURE 4.1.2-12 2 4800-e ui E
l h4600-E 5
t-.
$ 4400<
3 5
e U 4200-d E
4000. . . . .
0 10 20 30 40 50 TIME, SEC.
(
4.2 STARTUP OF AN_ IS01.ATED OR AN IDI.ED I.00P Event Description If a reactor coolant loop is isolated from the remainder of the reactor coolant system and subsequently brought back into the system, without first matching the boron concentration and/or the temperature of the isolated loop to the rest of the system, an increase in core reactivity and power may occur. To prevent this, and to insure safe start-up of an isolated loop, a technical specification and administrative procedures have been established.
These procedures and specification insure that the temperature and boron concentrations of the coolant in the isolated loop are at least as high as the temperature and boron concentration in the operating loops. In addition to these procedures, there are inter),cks on the cold leg loop isolation valves that prevent opening of the loop isolation valves when the temperature difference a
between the isolated loop and the hottest operating loop is greater thsn 20*F. This interlock specifies the basis for the temperature difference assumed in this analysis.
The plant procedures require the plant to be subcritical before l bringing an isolated loop into service. An idled loop (a loop with l
l only one loop isolation valve closed) is allowed to be bought into service at a maximum power level of 60 percent power. This analysis assumes that the event is initiated while at maximum permissible power l
4.23 i
i i
and the maximum allowahic temperature difference between the isolated loop and the rest of the system.
(
l The temperature interlock on the cold leg stop valve only allows the i,
valve to open if the cold leg fluid temperatures is less than 20*F below the hot leg temperature. A 10*F error is added to this setpoint to obtain the maximum expected temperature difference of 30*F.
Analysis Methods Analysis of the isolated loop start-up event is initiated from i three-loop operation. Plant procedures prohibit an isolated loop from being bought into service with the reactor critical. An isolated loop startup is bounded by an idle loop startup. Thus, the results of an idle loop startup from 60 percent power are presented.
The system response during power operation is determined using the RETRAN02 model. Effects of imperfect thermal mixing are included in the analysis by using bounding assumptions to conservatively model this effect.
The results from RETRAN02, along with the limiting power distribution, are used as input to.the VIPRE01 model to predict DNBR.
[
l l
4.24
.--- - - . - . - . = .
The RCPs are also provided with a logic which will prevent starting the pump if the cold leg isolation valve is open. However, this analysis is performed without credit for this interlock.
The technical specifications prohibit having an isolated or idle loop at a lower boron concentration than the remainder of the RCS.
Therefore, this analysis does not assume the isolated loop is at a lower boron concentration than the remainder of the RCS.
Analysis Results The idle loop startup from power results in an increase in core power to the high power trip setpoint. The minimum DNBR of 1.55 occurs at this time. The post-reactor trip portion of this event is similar to an ordinary reactor trip from full power, and does not result in an approach to DNB.
The following results have been confirmed by sensitivity studies:
- 1) Starting the RCP just after opening the cold leg isolation i
I valve results in a more rapid temperature decrease (rate of reactivity insertion) and lower minimum DNBR than opening the valve after the pump has been started.
l
- 2) An initially cold idle loop and a negative MTC results in a higher heat flux and lower minimum DNBR than an initially hot idle loop and a positive MTC.
4.25
- 3) The most negative MTC and most positive Doppler coefficient result in the highest heat flux and lowest minimum DNBR.
The sensitivity studies also determined that there are no single active failures which can impact the pre-trip event consequences.
.i The trend of the major parameters of interest are shown in Figures 4.2-1 through 4.2-4. The event sequence is given in Table 4.2-1.
Conclusions The results demonstrate that the minimum DNBR during the limiting isolated or idled loop startup event will not fall below 1.3. In addition, the pressure transient is bounded by the loss of load transient and meets the RCS pressure criteria of 110 percent of design pressure.
l l
i I
4.26
1 1
1 l
l l
TABLE 4.2-1 Sequence of Events l for the Idled Loop Startup Event Time (sec)
I Plant running in 3-loop operation, Loop #2 30*F 0.0 l cooler than remaining loops, RCP #2 off Cold leg isolation valve opened and loop 1.0 bypass valve closed by operator.
Cold leg valve fully opened. Reverse flow 5.0 exists in loop 2.
RCP #2 started by operator. 6.0 Reactor power exceeds medium trip setpoint 7.4 Reactor trip signal generated 7.95 Peak reactor power reached 8.5 Control and shutdown rods enter core 9.0 Minimum DNBR reached 9.2 Maximum heat flux reached 9.4 i
i 1
l 4.27 l
r
IDLliD LOOP STARTUP FIGURE 4.2-1 l i i i i i i i g -
2 C
E_l w
a CL -
mg -
s o
g _
I I t I f f f 4 6 8 10 12 14 16 d3 2 TIME (SECOND)
FIGURE 4.2-2 E . . . . .
i .
's _
ES s
E _
mm _
I lJ S
b YA
/
i E W _
g _
I I I I I I I
16 k 2 4 6 8 10 12 14 TIMEtSECOND) l
5 .
i IDLED LOOP STARTUP FIGURE 4.2-3
~
Um M
s b
.s .
E' 3
Ls.
J .
N 1 i t t t t 1 10 12 14 16 it 2 4 6 8 TIMEISECOND)
FIGURE 4.2-4
- , , , e s a e
m U
b -
$r=! -
he. -
l B
d _
8 -
M 1 I I I I 1 i
6 8 10 12 14 16 4 2 4 TIMEtSECOND)
Y" -' --y. m - - - - , _ _ _ _ _ . , _
IDLED LOOP STARTUP FIGURE 4.2-5 i i i i i i i g
i
~
u .
mE W
{T Hot : : : #
ww y TAvg
. g= =
g
} Cold .
= = .
E 7.-
E _
WS o
f f f I t t I b z
- s e io iz tv is TIME (SECONDI
, FIGURE 4.2-6 i i i i g i i i i
EH m
$ Ht
{ Avg j -
Y w
i
~
~
m O
_i -
- : : _ f T
t t t I Cold t i t b 2 4 6 e 10 12 19 15 TIMEtSECOND1
IDLED LOOP STARTUP FIGURE 4.2-7 l i . . i i . .
28 0
W .
$E Fn w
b s
S w -
s h.
i I I i i t 1
9 6 8 10 12 14 16 2
TIMEISECOND)
FIGURE 4.2-8 3.0<
2.5 DNBR rise due to increased flow i
E 2.0.
I 1.5.
DNBR = 1.3 1.0 5 ,g, V
6 7 8 9'
10 11 time (sec)
4.3 BORON DILUTION Reduction of the boron concentration in the reactor coolant to compensate for xenon buildup and fuel burnup is a part of normal l
l plant operation. Since alarms and procedures are provided for reactivity control, an inadvertent boron dilution is highly t
unlikely. If an inadvertent dilution of reactor coolant boron j concentration were to occur, the result would be a reactivity increase leading to either a power increase or a loss in shutdown margin. An analysis has been performed to demonstrate the following:
Adequate protection is provided to prevent core damage due to boron dilution with the reactor at power.
Sufficient time and indication exist to allow the operator to terminate a dilution and maintain an adequate shutdown margin while in a shutdown mode.
i In order to add unborated primary water to the reactor coolant i
system, at least one of the two primary water transfer pumps must be I
I running and valves must be aligned to allow flow of this water to the reactor coolant system. These pumps are supplied from both the primary water storage tank and the water treatment plant, with most of the supply coming from the tank. The maximum possible dilution rate is 180 spa.
l 4.28 i
l l
There are two potential flow paths for the primary water to enter the RCS. The first is through the boric acid blender to the VCT and charging pump. The second is directly through the charging pump suction leg.
Primary water flow through the boric acid blender which exceeds the preselected rate by 20gpm will be alarmed. If manual deboration is occurring, the operator will immediately correct an excess in primary water flow. During automatic operation the event is assumed to be terminated 15 minutes after the flow alarm by the operator.
Small excess flows (<20gpm) will be alarmed on high VCT level. The time to the flow mismat h alarm is negligible. The time to the high VCT level alarm is 37 minutes.
Method of Analysis A boron dilution during all phases of plant operation, including refueling, startup, and power operation, are considered in this analysis. Both end-of-cycle and begianing-of-cycle parameters are i
analyzed and the limiting time in life is presented.
l t
For each case, the time required to attain criticality, Atcrit, is l calculated by using the following equation:
3 _V initial crit 4n C crit i
4.29
where V = active RCS volume to be diluted (ft3 ).
This volume does not include the reactor vessel head, pressurizer, or any isolated loops.
Q = maximum charging flow (ft3 /sec)
Cg ggg,g = initial boron concentrations (ppm)
C = critical boron concentration (ppm) crit The time to when the first alarm sounds is then subtracted from the time to criticality to determine the time available for the operator to respond to the event.
Analytical Results The times to criticality from the first alarm are provided in Table 4.3-1. The results show that the operator has at least 15 minutes in modes 1 through 5 and 30 minutes in mode 6 to respond to the inadvertent dilution. The shutdown margin required to provide the times given in Table 4.3-1 are:
Mode 1 2 3 4 5 6 Shutdown Margin 1.7 1.7 2.0 2.5 2.5 5.5
(% AK/K) i 4.30
These shutdown margins are assured by the technical specifications.
The maximum possible reactivity insertion rate during a boron dilution event is well within the reactivity insertion rates of the uncontrolled RCCA withdrawal analysis. The pre-trip and immediate post-trip minimum DNBR of the RCCA withdrawal analysis will bound that of the boron dilution event initiated from full power. In addition, the system response to a boron dilution (i.e., RCS pressures and temperatures) is bounded by the uncontrolled rod withdrawal transient. Thus, the results with respect to core performance given in Section 4.1.2 bound those of a boron dilution
- event at power.
Conclusions Because of the procedures involved in the dilution process, an inadvertent dilution is considered incredible. Nevertheless, if a dilution of boron in the RCS were to occur, numerous alarms and indications are available to alert the operator to the condition.
The maxinum reactivity addition due to the dilution is slow enough to allow the operator to determine the cause of the addition and to take corrective action within 15 minutes during modes 1 through 5 and 30 minutes during mode 6. The operator has sufficient time to terminate the dilution and prevent a return to criticality. The minimum DNBR for this event remains well above 1.3.
4.31 l
Table 4.3-1 Time From First Alarm to Criticality -
Boron Dilution Event Dilution Flow Rate 180 gpm 20 gpm Time For Time For
- Loops # RHR Time to Time to Operator Time to Time to Operator Moda Isolated Loops Criticality Alarm Action Criticality Alarm Action (min) (min) (min) (min) (min) (min) 1+2 0 0 33.4 0.
- 303. 37. 266.
1 0 29.4 0. 263. 37. 226.
3 0 0 32.4 0. 292. 37. 255.
1 0 28.3 0. 254. 37. 217.
2 0 24.4 0. 319. 37. 182.
3 0 20.4 0. 183. 37. 146.
4 0 0 34.8 0. 316. 37, 279.
1 0 30.6 0. 275. 37. 238.
2 0 26.3 0. 236. 37. 199.
3 0 22.1 0. 198. 37. 161.
4 1 18.0 0. 162. 37. 125.
5 0 0 34.8 0. 316. 37. 279.
1 0 30.6 0. 275. 37. 238.
2 0 26.3 0. 236. 37. 199.
3 0 22.1 0. 198. 37. 161.
4 1 18.0 0. 162. 37. 125.
l 6 4 1 31.6 0. 336. 37. 299.
- Sime as time to criticality l
! 4.32 1
4.4 EXCESS FEEDWATER Event Description The excess feedwater event is the result of an abnormal, sustained increase in feedwater flow to one or more steam generators in excess of that needed to maintain a constant steam generator level. An excess feedwater event could be initiated by the full opening of a feedwater regulating valve as a result of a feedwater control system malfunction or an operator error.
During the event, addition of excessive feedwater will cause a decrease in reactor coolant temperature. If the moderator temperature coefficient is negative, core power will increase. The impact of the transient is reduced by the thermal lag of the secondary plant and RCS. However, if not terminated by the reactor protection system, the resulting power increase could result in fuel rod damage.
l This analysis evaluates the extent of the power increase under the most adverse combination of initial conditions and maximum feedwater flow increase. The overpower trip prevents any power increase which could lead to a DNBR less than 1.30.
l A second concern during the excess feedwater flow event involves the potential for overfilling the steam generator (s). The fastest approach to SG overfill occurs at the lowest power level at which 4.33
both SG feedwater pumps are normally operating. The low power level maximizes the power imbalance once the initiating event occurs.
Continuous addition of excessive feedwater is terminated when the operator trips the reactor and the main feedwater pumps. In this analysis operator action is assumed when the high-high steam generator water level alarm is generated.
Method of Analysis The excessive heat removal transient due to a feedwater system malfunction is analyzed by using the digital computer code RETRAriO2.
The code computes pertinent plant variables including temperatures, pressures, and power level.
Two etcess feedwater flow transients are presented. The first is a failure to the full open position of one feedwater regulating valve when at full power. The second is the failure to the full open position of one feedwater regulating valve at 40 percent power. The criteria to be addressed for the excess feedwater event are fuel damage due to the core power increase during the cooldown and steam generator overfill.
From the standpoint of steam generator overfill, the failure of the feedwater regulating valve to the full open position while at the minimum power level for two operating feedwater pumps results in the greatest steam / feed mismatch, and, hence, fastest rise in SG level.
l l
Both 4-loop and 3-loop operation have been considered for each case.
I 4.34 t
Major assumptions are as follows:
- 1. In 4-loop operation the initial power level used to determine the minimum DNBR is 102% of full power.
- 2. In 3-loop operation the initial power level used to determine the minimum DNBR is 67% of full power.
- 3. The limiting initial power level to evaluate the steam generator overfill concern is 40% of full power. This is the minimum power level at which both feedwater pumps could be operating.
- 4. The excess feedwater results in a decrease of RCS temperature; therefore, the most negative moderator temperature coefficient is used. The least negative Doppler coefficient is used in order to minimize the power reduction due to the fuel heatup.
I This results in the maximum power during the transient.
- 5. The feedwater flow resulting from a fully open regulating valve is terminated by the operator before the affected steam generator is filled. The operator trips the main feedwater pumps and the reactor following annunciation of the high-high f steam generator water level alarm from the faulted loop.
l l A conservatively low value for feedwater temperature is used.
6.
l 4.35 I
- 7. No credit is taken for the heat capacity of the RCS and steam generator metal mass to reduce the resulting plant cooldown.
- 8. The maximum initial core inlet temperature and minimum initial pressurizer pressure are assumed in order to minimize DNBR.
Plant characteristics and initial conditions are further discussed in Section 4.0.
Normal reactor control system and engineered safety systems are not required to function. The reactor protection system may function to trip the reactor due to overpower or the operator may trip the reactor at high-high steam generator water level conditions. No single active failure will prevent operation of any system required to mitigate the consequences of this event.
Results Figure 4.4-1 through 4.4-6 show the system response to the opening of one feedwater regulating valve at full power during 4-loop operation. Figure 4.4-7 through 4.4-12 show the response during i
3-loop operation. The following discussion applies to both 4- and 3-loop operation, i
i i
The full opening of one feedwater regulating valve causes the i
j feedwater flow to one SG to increase to 150 percent of its full load flow during 4-loop full power operation. During 65 percent, 3-loop 4.36
operation, the feedwater flow increases to 183 percent of its full load value. Following the increase in feedwater flow, the core coolant inlet temperature decreases and core pcwer increases slightly. The net result is a negligible change in DNBR. The power excursion predicted in the excessive load increase analysis (Section 4.5) bounds that of the increase in feedwater flow event.
Therefore, the DNBR transient of Section 4.5 will bound that of the increase in feedwater flow event.
Because feedwater flow is greater than steam flow, the SG 1evel increases. When the SG level exceeds the high-high SG level setpoint, an alarm is actuated in the control room. The operator can take manual control of the feedwater regulating valve and close it. This analysis assumes that the failure which caused the regulating valve to open also prevents the operator from closing it.
Therefore, the operator is assumed to trip the reactor and the main feedwater pumps based on receiving the high-high level alarm.
Following reactor trip and feedwater pump trip the SG level increases due to the increase in void fraction. Once the main steam trip valves close the SG level decreases.
Figures 4.4-13 through 4.4-24 show the results for the excess feedwater flow transient from 40 percent power. Figure 4.4-13 through 4.4-18 show the results for 4-loop operation and Figure 4.4-19 through 4.4-24 show the results for 3-loop operation.
4.37
l The full opening of one feedwater regulating valve during 4-loop operation at 40 percent causes feedwater flow to increase to 180 percent of full load flow. During 3-loop operation at 40 percent power the feedwater flow increases to 182 percent of full load flow. During the excess feedwater event in 4-loop operation from 40 percent power, the high-high steam generator water level alarm is actuated 23 seconds following the initiation of the event.
At 60 seconds the operator trips the main feedwater pumps and the reactor to prevent possible steam generator overfill. For 3-loop operation, the high-high steam generator water level alarm occurs at 25 seconds and the manual plant trip occurs at 70 seconds from the initiation of the event.
The primary side response due to the excess feedwater flow from 40 percent power is similar to that of the full power transient. At all times, and in particular during startup and shutdown, one of .
the operator's principal concerns is maintaining steam generator 4
water level. Thus, while there is a short period for operator action to prevent steam generator overfill, there is sufficient time to diagnose and mitigate the transient.
l l
The calculated sequence of events for the excess feedwater is shown in Table 4.4-1 and 4.4-2.
r l
[ 4.38 1
r
Conclusions The results of the analysis demonstrate that the minimum DNBR remains well above 1.3. In addition, there are alarms such as the high-high steam generator level that would alert the operators of the malfunction in the steam generator level control system. These alarms in combination with the indications of increased core power, decreased RCS inlet temperature, increased SG level, and increased feedwater flow rate will alert the operator to the excess feedwater flow transient in sufficient time to prevent SG overfill.
4.39
Table 4.4-1 Sequence of Events for the Excess Feedwater Flow from Full Power Time (Sec)
Event 4 loop 3 loog One main feedwater 0.01 0.01 regulating valve fails fully open High steam generator i water level alarms 33. 17.
High-high steam generator water level alarm 72. 36.
Main feed pumps and reactor trip by operator 170. 90.
1 i
i 4.40 l
Table 4.4-2 Squence of Events for the Excess Feedwater Flow from 40% Power Time (Sec)
Event 4 loop 3 loop One main feedwater 0.02 0.02 regulating valve fails fully open.
High steam generator 11. 12.
water level alarms High-high steam 23. 25.
generator water level alarms Main feed pumps and reactor trip by operator 60. 70.
l l
4.41 h
EXCESS FEEDWATER FROM FULL POWER 4 LOOP OPERATION .
FIGURE 4.4-1 %
l _
i i i i i e i g - -
s
.E E R.
er W -
E ~ ~
WI 8
~ ~
- I i t I f k f I f cc 40 80 120 150 200 290 250 320 TIMEtSECOND) i s
FIGURE 4.4-2 l i . . . . i i
~
5k
- E i
bl g-l Y E
e -
E9 -
t I I I I t i 40 80 120 150 200 290 200 320 l TIMEISECOND) l
EXCESS FEEDWATER FROM FULL POWER 4 LOOP OPERATION FIGURE 4.4-3
. . . . i i g
i hs E
Es -
le*
5
~
wR
~
d*
o .
E I t i I I I i b 90 80 120 150 200 290 250 320 TIMEISECOND)
FIGURE 4.4-4 i i i i g
i i i Eg E
gi _
l G5 l *
~
, Is "
l r b
as i t i I i i i b 90 80 120 160 200 290 280 320 TIMEISECOND)
EXCESS FEEDWATER FR0ff FULL POWER' 4-LOOP OPERATION FIGURE 4.4-5 5 3 i 5 I I i 1
Gl I-t-
$l h
z-s d -
ol .
W WO .
- g. .
1 i
- 1 1 i f f f c0 40 80 120 160 200 240 280 3.!D
, TIME (SECOND) i i
FIGURE 4.4-6 i
. . . i i , i
, m
\ G b
g _
Faulted SG _
OE a
W n_ -
E" : -
g Intact SG i -
=
t f I 1 I f f u0 40 80 120 150 200 290 280 320 TIME (SECOND) l l
- - , - - - m
EXCESS FI!EDWATliR FROM FULL POWER 3 LOOP OPERATION FIGURE 4.4-7 l i i i i i i i g - -
E - -
gl 8
9 C
I I t t t t I c0 20 40 60 80 100 120 190 160 TIME (SECOND)
FIGURE 4.4-8 g i i i i i i
~ ~
. 5$
! e l
- w Eg -
l g_
E Eg - -
m-5
- e -
EU l t I i t i I 20 40 60 80 100 120 190 160 TIME (SECOND)
EXCESS FEEDWATER FROM FULL POWER 3 LOOP OPERATION FIGURE 4.4-9 i i i i g i i i
~
h$
E Es -
k Ca -
.d
- g _
m f f I f i f I b 20 90 EO 80 100 120 190 150 TIME (SECOND)
FIGURE 4.4-10
. . i i g . . i Eg E
l gR w
8 _
E!
E
'gm -
i l
t t I I I f I b 20 40 60 80 100 120 190 160 TIMEtSECOND) l
EXC1!SS FlilillWATliR FRobl 1:111.1. POWlitt 3 LOOP OPl! RATION FIGURE 4.4-11 i i i i i i i i Gl 2 1 ER -
sH - -
E_-
E -
W -
a W
~
hh t i 1 i i f I 80 100 120 140 160 c0 20 40 SD TIME (SECOND)
FIGURE 4.4-12
. i i i i i i i
E P
~
S d ~ ~ ~
un E
b "
l
~
~
Intact sG i I f I t i e 80 100 120 190 160 uC 20 40 60 TIMELSECONO) s
-)
EXCESS FliEI)WATliR FR0h! 407, POWER 4 LOOP OPERATION FIGURE 4.4-13 l
. i i i i i i g -
E ER b
E gg f 8
i e i . i c0 20 40 60 80 100 120 l'60 160 TIME (SECOND)
FIGURE 4.4-14 i i i
$ i i i i 3 -
b b
s-E 5g -
ci-e -
E9-i i i i i f f 90 60 80 100 120 190 160 20 TIME (SECOND) i l
EXCESS FlillDWATER FROM 40% POWER 4 LOOP OPERATION FIGURE 4.4-15 i i .
g i i . .
N ss E
Es -
W*
5
$2 -
d*
a -
B t t i f I I I b 20 90 60 80 100 120 190 160 TIMEtSECOND)
FIGURE 4.4-16 t
5 Eg E
m . -
a:g w
'.1 8 -
gg -
i y -
i t
s - -
1 I i f f i f b 20 40 60 80 100 120 190 160 TIME (SECOND) l l
l
e EXCESS FEEDWATER FROM 40% POWER 4 LOOP OPERATION FIGURE 4.4-17 1 I I I I 4 1
(
5 _
! -a Ci s _
e 5
_J
,_ e G
k
- w. _
i ' I f f I 80 100 120 190 150 cf) 20 40 60 TIMEISECOND) j FIGURE 4.4-18 i i i i i i >
9 m
p -
S
- y _ Faulted SG _
_s h
w I
B _
7, _
E" v
~__%
g -
j .
~
c Intact SG i . .
i i i i j
80 100 120 190 150
! uO 20 40 60 TIMELSECOND)
EXCESS FEEDWATER FR0h! 40% POWER 3 LOOP OPERATION FIGURE 4.4-19 i e i
. . i g .
h_ ~
2 irg-E Y
E ~
~
gE U
~
~
5 i t i L I -
I 100 120 190 160 20 40 60 50 cf)
TIMEtSECOND)
FIGURE 4.4-20 l i i i i i i i
@l
-M
- m-E 5g -
m-e i gg -
I I I I t i t 20 40 60 50 100 120 140 160 TIME (SECOND) t
EXCESS FEEDWATER FROM 40% POWER
+ 3 1,00P OPERATION FIGURE 4.4-21 4
i i i i i g i .
ss ER E*
5 lua -
.N
- Do -
m f I I f 9 I I b 20 40 60 80 100 120 140 160 TIME (SECONDI FIGURE 4.4-22 i i i i g i i i i
k b a - -
g3 _
8 _
ER w
e
- a -
i t I f i t 1 i b 20 90 60 80 100 120 140 160 TIME (SECOND) l
. . ~ . . . . _ - . _ . - - _ , . . . - . , _ , - . .- .- _, -
. . - _ . _ _ . . _ _ _ _ _ _ - m. ..___m . _ .
EXCESS FEEDWATER FROM 40% POWER 3 LOOP OPERATION FIGURE 4.4-23 I I I I I I I N _ _
tt gl _
E_-
E ag i
hJg _
2 f I I f x i c0 20 90 60 80 100 120 140 150 TIME (SECOND)
FIGURE 4.4-24 i i . i i
, i i 7
R Faulted SG j "
d
(
i gic a
~
l ME
'~ w - -
0 Intact SG t w -
I t
I I I I i 1 i f 60 80 100 120 140 160 u0 20 90 TIME (SECOND) l
--. . - - - . - - . - . .-- _ _ . - _ = _ _ - . . _ _ - . . _ . . . _ . - . _ . - . - _ . - . _ _ . -
4.5 EXCESSIVE LOAD INCREASE An excessive load increase event is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. Such a transient could be initiated by the opening of the turbine control valves, atmospheric steam dump valves, steam generator safety valves, and/or the steam bypass to condenser valves.
The increased steam flow overcools the primary system resulting in a decrease in primary system temperature, steam generator pressure, and primary system pressure. Reactor power increases as a result of the negative moderator temperature coefficient. Protection against core damage is provided by reactor trip from overpower, variable low pressure, or high steam flow.
The reactor control system is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase without a reactor trip. The turbine load limiter is designed to j
limit the maximum load demand to 100 percent power as protection i
against excess loading by the operator or by a turbine speed control malfunction.
The operation of the steam dump to condenser system is initiated by the error signal consisting of the differences between the actual RCS temperature and the no-load temperature. It is also actuated on high steam header pressure. In addition, permissives, indicating 4.42
turbine trip and condenser availahtlity, must be satisfied betore the valves will open automatically. A false actuation signal is highly unlikely since the steam bypass to condenser control system is designed to fail closed. However, a sudden full opening of all 10 steam bypass to condenser valves constitutes the most adverse credible load increase. This failure is analyzed as the limiting excessive load increase transient.
Method of Analysis The event is analyzed using the RETRAN02 computer code. The code simulates the neutron kinetics and the RCS including the pressurizer, steam generators, steam dump and feedwater system. The code computes pertinent plant variables including temperatures, pressures, and power level.
The results of the RETRAN02 analysis along with the limiting power distribution are then used as input to the VIPRE01 computer program to determine the minimum DNBR.
In order to give conservative results for an increase in steam flow due to the sudden opening of all steam dump to condenser valves, the following assumptions are made:
- 1. The analysis is performed from the highest power level at which the opening of all bypass valves will not result in an immediate reactor trip from the high steam flow or high power i
4.43
trip signals. This corresponds to an initial power level of 83 percent of full power for 4-loop operation and 47 percent of full power for 3-loop operation.
- 2. The most negative moderator coefficient is used in order to maximize the positive reactivity insertion due to the cooldown.
The least negative Doppler coefficient is used in order to minimize the power reduction due to the fuel heatup.
- 3. The initial core inlet temperature is assumed to be at its maximum value and the initial primary pressure is assumed to be at its minimum value. This results in the minimum margin to DNB at the start of the event.
- 4. No credit is taken for pressurizer pressure control and the reactor is assumed to be in manual control.
It is assumed that the feedwater flow increases to match the l
increased steam flow.
l
- 6. The axial and radial power distributions are assumed to be l
i constant throughout the transient.
Except as discussed above, engineered safety systems are not required to function and no single active failure will prevent operation of any system where operation is required to show I
l 4.44
acceptable results. Plant characteristics and initial conditions are further discussed in Section 4.0.
Results Figures 4.5-1 through 4.5-6 show the significant plant parameters following a sudden full opening of all steam bypass to condenser valves with 4 loops in operation. Figures 4.5-7 through 4.5-12 show
- the parameters for 3-loop operation. The sequence of events for this transient is shown in Table 4.5-1. The following discussion applies to both 4-loop and 3-loop operation.
The increased steam flow causes a decrease in RCS coolant temperature. Due to the negative MTC, the core power increases.
The core power rise slows the cooldown caused by the excess steaming. The RCS temperature drop stops when core power equals the excess steaming rate. Because of the cooldown and since the RCS remains at the reduced temperature, the pressurizer pressure decreases. The calculated minimum DNBR decreases and then
, stabilizes above 1.3. The peak fuel centerline temperature remains l
below the fuel melt. limit of 4780*F.
Conclusion The results of the analyses show that for the load increase due to a sudden opening of all steam dump to condenser valves, the DNBR
- remains above 1.30 and the peak fuel centerline temperature remains 4.45
below the fuel melt limit of 4780*F. The plant reaches a stabilizeil condition rapidly following the load increase. This is the maximum credible load increase and will not cause core damage even under
, very conservative assumptions.
4 4
4 t
i i
i I.
4.46
(
i Table 4.5-1 Sequence of Events for the 2 Excessive Load Increase i
Event Time (Sec) 4 Loop 3 Loop Sudden Full opening of 0.01 0.01 i
all steam bypass to condenser valves Equilibrium 80 120
- conditions reached (approximately) j l
1
?
l 1
i i
I h
I t
4.47
,-_._r.,..____-_.m.. . , _ _ _ . _ _ . . _ _ . _ _ _ . . _ _ _ _ _ , - - _ , - . . . _ - . . . - _ . - . . _ . . . _ . . _ . - _ . , - . _ _ _ . - - _ -
EXCESSIVE 1.0AI) INCREASE FROM 4 1.00P OPERATION I:!GilRE 4. 5-1 l i i i i i e i g -
Rs EK g _
b~
g _
1 1 I i i I I i 90 00 120 ISO 200 290 280 320 TIMELSECOND)
FIGURE 4.5-2 l i i i . . i i 4
sg -
I
, m i @g -
r k
~
t g i t i t i i 2 90 so 120 160 200 290 too 320 l
TIME (SECONO) l t
l
\ .
EXCESSIVE LOAD INCREASE FROM 4 LOOP OPERATION
- FIGURE 4.5-3 i i .
g i i e i ER I
E gg -
w 0 -
a5 t t I I e i I
% 80 120 160 200 290 280 320 TIME (SECOND)
FIGURE 4.5-4 i i i i i i
g i gg -
E E
Y5 i s --
8 .
g E
h -
ns b % 80 120 150 200 240 200 320 TIMELSECOND) i
l EXCESSIVE LOAD INCREASE FROM 4 LOOP OPERATION l FIGURI! 4.5-5 5, , , , , , , ,
il
=,
E s5 -
EM sl d -
r E
u.18 .
l g -
I f f i t I f
-O 40 80 120 160 200 290 280 320 TIME (SECOND)
FIGURE 4.5-6 3.0-2.5-
)
h2.0 -
- E 1.5 l 1.0 l 0 50 100 150 200 250 300 TIME,SEC.
i
EXCESSIVE LOAD INCREASE FROM 3 LOOP OPERATION i FIGURE 4.5-7 i i i i i l i g _
~
I iEg -
E -
R W- '
8 g _
i f I f i $ f b 90 .0 120 160 200 290 200 320 TIME (SECONDI FIGURE 4.5-8 i s a : a i s
.E R-
- gg .
ta-E aig -
m-e -
EI -
l l l $ !
i $
! 5 40 so i2a iso 2o0 m Zoo 32o TIME (SECOND) l l
EXCESSIVE LOAD INCREASE FROM 3 LOOP OPERATION 1lGURii 4.5-9 i
g i i i i e i ER E
Es -
le*
5 C -
.d 5 a -
e i
f i i t t t t 90 OD 120 150 200 290 200 320 TIMEISECOND)
FIGURE 4,5-10 e i i i g i i i
gy -
E E -
Y5 e
~
hg -
r l t as i i i f I i 1 b
i 100 200 290 200 320 90 80 120 TIME (SECOND)
I!XCliSSI Vi! 1,OAll I NClil!AS!! 1 ROM 3 1.001' Ol'lillATION I:lGURii 4. 5-11 5 , , , , , ,
g .
E0 _ _
=
C e 3 _.
E_
5 d$ -
G' W
- H ' ~
$w 1 I I I i i f 40 80 120 160 200 290 290 320 TIME (SECOND)
FIGURE 4.5-12 4.0.
3.5 i
l 3.0 I a:
! E E
- 2. 5 -
2.0 .
I 1.5 0 50 100 150 200 250 300 TIME, SEC.
4.6 DROPPED ROD CLUSTER CONTROL ASSEMBLY Event Description A dropped rod cluster control assembly (RCCA) incident is defined as the unexpected release of a RCCA which would cause it to fall into the core. The immediate effect would be a decrease in reactor power followed by a decrease in coolant temperature. The power distribution would be distorted as a result of the new control rod configuration. If there were no protection, and the reactor were under automatic control, the reactor control system would restore power to match the turbine load by withdrawing control rods. The action of the control system coupled with the distorted power distribution could result in local power densities and heat fluxes in excess of design limits. An automatic turbine load runback and an automatic rod withdrawal block are provided to mitigate this situation without requiring a reactor trip, but are not required to t
operate to show acceptable results.
The RCCAs are positioned in the core by means of magnetic jack, hermetically sealed, drive mechanisms. The probability of an electrical or mechanical failure in this mechanism that would cause a RCCA to be released is remote.
! If one RCCA did drop into the core, two separate rod drop protection I
circuits would be activated. Each is independently capable of preventing core damage. The first circuit initiates a turbine load runback to approximately 70 percent of 1,825 Mwt. This runback is i
i 4.48
.- _- __ - - . - - _ - - ~ _ - . _ - _ _ . _ - _ - _ - _ . _.
accomplished by a turbine load limit rundown which overrides the governor control valve. The second circuit blocks automatic control rod withdrawal and thereby prevents the control system from restoring the initial power level.
Both of the rod drop protection circuits and a rod drop alarm will be actuated automatically by either of two independent signals. One signal is derived from the rod position instrumentation and the other from nuclear instrumentation. The former, a rod bottom signal, results from low position of the dropped RCCA. The latter results from the sudden decrease in neutron flux at one or more of j the four power range nuclear instrumentation channels, depending on the location of the dropped RCCA in the core.
The dropped RCCA incident is analyzed with and without the protective features. The limiting incident occurs when neither the turbine load runback nor the rod stop features are credited. The purpose of this analysis is to demonstrate that acceptable fuel performance is achieved for a dropped RCCA incident without credit for either protective feature.
Method of Analysis The dropped RCCA incident is simulated in two phases. In the first phase, the RETRAN02 computer code is used to generate the system response to a dropped RCCA incident. The results of the RETRAN02 simulation (core power, coolant inlet temperature, RCS pressure and 4.49
RCS flow rate) are then used as input to the VIPRE01 model in the second phase. The VIPRE01 model performs a detailed channel analysis of the core and calculates fuel temperatures and DNBR.
The assumptions made in the dropped RCCA analysis are:
- 1. The dropped RCCA worth is varied between the maximum and minimum values expected during the cycle (180 pcm to O pcm).
- 2. The turbine load runback and rod control systems are analyzed in both the manual and automatic modes of operation.
- 3. The RCS is assumed to be in steady state operation at the maximum coolant inlet temperature, and minimum pressure prior to the RCCA drop. In this way the post rod drop DNBR is minimized.
- 5. The most negative Doppler and moderator temperature coefficients are used in order to maximize the power during the 1
fuel and RCS cooldown following reactor trip. The only exception to this is the dropped RCCA event with turbine load runback in automatic and the rod control system in manual. The reactivity coefficients are minimized in this scenario since there is no trip and the coolant temperature increases due to 4.50
the primary to secondary heat transfer mismatch. Using minimum feedback will maximize the power for this case. This treatment of the reactivity feedbacks minimizes DNBR.
- 6. The penalty factor applied to the hot channel factor due to the dropped RCCA is a function of the worth of the dropped RCCA.
For conservatism, the maximum penalty factor is assumed for all rod worths.
- 7. The rod worth available for withdrawal by the reactor control system is arbitrarily set larger than the dropped RCCA worth in
> order to not restrict the control systems from causing a power overshoot.
=r Results The dropped RCCA analyses results determined the following conditions to be limiting:
1
- 1) Minimum DNBR occurs when no credit is taken for the turbine i load runback or rod stop protective features.
- 2) Initial conditions representative of full power four-loop operation results in the closest approach to DNB.
i 4.51
- 3) The largest dropped RCCA worth results in the largest reactor control system generated rod motion and resultant power i
overshoot. 1
-+
I The transient behavior of the NSSS following a dropped RCCA event from full power 4-loop operation is shown in Figures 4.6-1 through 4.6-4. Figures 4.6-5 through 4.6-7 are for 3-loop operation. The-sequence of events is given in Table 4.6-1.
The following discussion applies to both 4 and 3-loop operation.
The rapid drop in core power is quickly countered by the reactor control system. The reactor control system is able to restore the RCS at nominal conditions in approximately two minutes. The minimum DNBR predicted to occur remains well above 1.3.
Conclusions During a postulated dropped RCCA incident without automatic protection the minimum DNBR remains well above 1.3. Thus there will be no fuel failure due to a dropped RCCA incident.
i f
l l
4.52
_- .- - - -- - _ _ - ~ .
Table 4.6-1 Sequence of Events for the Dropped RCCA Incident 4
Time (sec) 4-loop 3-loop Event Operation Operation RCCA drops while at HFP conditions 0.1 0.1 Reactor control system initiates rod withdrawal 10. 10.
Minimum coolant temperature and RCS pressure 50, 45.
Maximum core power - Minimum DNBR 110. 110.
Reactor control system halts rod withdrawal -
steady state operation achieved 120. 120.
4 4.53
11ROPPl!D RCCA INCillCNT FROM llFP 4-LOOP OPERATION FIGURE 4.6-1
-y . . . i i . .
- w.
- g.
p u
i
't 25 so 7s too ars iso 17s zoo TIME (SECONO) l FIGURE 4. 6 - 2 i i i . . . .
l g
S Hot Leg
~
kI
~
~
0 - ; = ; ;
E -
f Core Average -
I : : : : :
f Cold Leg g
i i I i i g a b 25 50 75 100 its
~
iso 17s zoo TIME (SECOND) l l
l l
DROPPED RCCA INCIDENT FROM HFP 4-LOOP OPERATION FIGURE 4. 6 - 3
. . i i . .
g i
-g .
En U_
sl E \ -
5g _
u-e -
EE- -
(
, e I, i i i i
150 17s 200 b rs so 75 too TIME!SECOND) 125 FIGURE 4.6-4
- 3. 0-
- 2. 5-
, 2.0 E
9.
\
- 1. 5.
b 20 40 60 115
' TIME (SECOND)
_. -. . . _ . . . - _ _ , _ ~ . . . . _ _ . - _ _ _ _ _
11110l'I'11D 11CCA I NCi111 NT l'l(OM lif ti' 3 - 1,001' Ol'l!!i AT I ON l
1:1 G111111 1. 6 - 5 l
i I a i 9 i s s
1 -
9 C 9 5
8 0 .
w, E'
O
~
9 t t t t t 9 I 75 100 125 150 175 200 I d) 25 50 TIME (SECOND) 4 FIGURE 4.6-6 i i . . i i i
g .
~
gE 0
5
-g gHotLeg j E _
E m
g - f Core Average _
. o, _
! fColdLeg 8
o _
g i
I t t i e i i 25 50 75 100 125 150 175 200 TIMEISECOND) 1
- - . - ~ . - . . _ - = - . -. _ . _ - - - .- .- . - _ - . _- --. _ _ . .
DROPPED RCCA INCIDENT FROM llFP 3-LOOP OPERATION lilGURi! 4. 0-7 !
t l i i i i i i i l 1
iEE E
k -
mi E
SH R
0 -
E E. .
I 1 f f f I I i 25 50 75 100 125 150 175 200 i TIME (SECOND) t i
l i
l l
t
4.7 ROD CLUSTER CONTROL ASSEMBLY EJECTION f Event Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing, resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity addition which results in a core power excursion with a large localized relative power increase.
This accident is considered to be incredible for the following rerions:
o Each control rod drive mechanism and its housing is completely assembled and shop tested at 6300 psi.
o The mechanisms are hydrotested to 3,750 psig as they are installed on the reactor, and again checked during the hydrotest of the completed coolant system.
l
. o Stress levels in the mechanism are not affected by system transients at power, or by thermal movement of the coolant loops.
i 4.54
Nevertheless, the rod ejection incident is analyzed because it represents the most rapid reactivity insertion that can be postulated.
Even if a rupture of a RCCA drive mechanism housing occurs, the operation of a plant utilizing a chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the nuclear design affects the severity of the accident via the reactivity worth, location, and grouping of the control rods.
During normal full power operation only one bank of rods is located in the core and they are positioned near the top of the core. Only small RCCA insertions at power are necessary because reactivity changes caused by core depletion and xenon transients are compensated for by changes in the soluble boron concentration rather than by control rod movement.
At lower power it may be desirable to operate with the control rods further inserted. For a given reactivity addition the RCCA ejection accident is less severe at lower power. Therefore, a higher ejected l
rod worth can be tolerated at lower power. A power dependent i
insertion limit (PDIL) assures that the ejected rod worth is limited I as a function of reactor power. Therefore, the PDIL is typically i
selected to assure that adequate shutdown margin is maintained and to lessen the severity of RCCA ejection accident.
1 Reactor protection for RCCA ejection accident is provided by the high power trip setpoints (see Section 4.0).
4.55
The following criteria are applied to the RCCA ejection analysis to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves.
- 1. Average fuel pellet enthalpy at the hot spot remains below 200 cal /ga.
- 2. Average clad temperature at the hot spot remains below the temperature at which clad embrittlement may be expected (2700'F).
- 3. Peak reactor coolant pressure is less than that which could cause stresses to exceed the faulted condition stress limits.
- 4. Fuel melting will be limited to less than 10 percent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion 1 above.
For the purpose of radiological consequence analyses any rod that l
falls below the DNBR limit of 1.3 will be assumed to have failed.
I Method of Analysis The calculation of the RCCA ejection accident is performed in two stages. First, the RETRAN02 computer code is used to determine the core average system response including the nuclear power transient and the various reactivity feedback effects. The enthalpy, 4.56
i temperature, and DNBR t ransients are then determined using the VIPRE01 computer code.
I t
Avera ge Core Analysis (RETRAN02)
The main purpose of performing the average core analysis using RETRAN02 is to determine the maximum RCS pressure to assure that the l
l peak pressure is less than that which could cause stresses to exceed the faulted condition stress limits, and to calculate the core average nuclear power transient to be used in the core thermal hydraulic analysis.
In order to accomplish these objectives, the following conservative assumptions are made:
o The limiting burnup dependent nuclear parameters are combined to generate the most severe system response.
o Point neutron kinetics are used in response to the reactivity insertion with no Doppler weighting multiplier.
l l
Because the safety limits for the fuel are not exceeded, there will l
be no dispersal of fuel into the coolant. The RCS pressure surge may therefore be calculated by RETRAN02 on the basis of conventional heat transfer from the fuel rod and prompt heat generation in the coolant. RETRAN02 calculates the pressure transient by detailed modeling of the heat transfer from the fuel to the coolant and from 4.57 i __
the coolant to the secondary side of the steam generators. All the key safety parameters are conservatively chosen to maximize the peak RCS pressure. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.
1 Core Thermal Hydraulic Anslysis (VIPRE01)
In the second stage of the analysis, core thermal hydraulic analyses are performed using VIPRE01 to determine the fuel hot spot behavior and the MDNBR for the hot channel. In both the fuel hot spot and DNBR analyses, the initial nuclear power is equal to the product of the power calculated in the average core analysis and the nominal hot channel factors. During the transient, the nominal hot channel factor is linearly increased to the transient value over the time for the full ejection of the rod. This implies that the following conservative assumptions are made:
l o The hot spot before and after ejection occurs in the same l
channel.
l l o The post-ejection spatial power distribution does not change l
with time.
The post-ejection peak will occur in or adjacent to the assembly l
with the ejected rod. Prior to ejection the power in this region will necessarily be depressed by the inserted rod. Therefore, the 4.58
first assumption is very conservative. Also, because of Doppler feedback effects, the post-ejection total peak is expected to drop soon after the RCCA ejection. Therefore, the second assumption of holding the spatial power distribution constant for the duration of the transient is very conservative.
VIPRE01 uses the Thom correlation to determine the subcooled and saturated boiling heat transfer coefficient. The code uses the Groneveld-Bengtson correlation to determine the film boiling heat transfer coefficient after DNB. The criterion for switching between 4
correlations was selected to maximize the consequences of the rod ejection. Similarly, the gap heat transfer coefficient has been selected to maximize the consequences. A conservatively high_value has been used for the DNBR calculation and a conservatively low value has been used for the calculation of fuel enthalpy.
Calculation of Input Parameters i
l The input parameters for the RCCA ejection analysis are conservatively selected on the basis of the values calculated for
- the Haddam Neck core. The worst burnup dependent parameters are combined together to create a " worst" case. The more important parameters are discussed below.
- 1. The values for ejected rod worths and hot channel factors are calculated with no credit for the flux flattening effects of reactivity feedback. The calculation is performed for the 4.59
maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Because the rod insertion limits for 3-loop operation at hot zero power is much more restrictive, a rod ejection in 3-loop operation at HZP is clearly bounded by 4-loop operation at HZP. Thus, no analysis is presented for 3-loop operation at HZP. Adverse xenon distributions are considered in the calculation to provide worst case results.
Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties.
- 2. The larger fuel temperature rises, and hence the largest Doppler feedback, occur in channels where the power increase is higher than the average. This means that the Doppler feedback in the hot channel is much larger than that calculated by the one point neutron kinetics models, since these models distribute this localized effect over the entire core. This effect is usually modelled by application of a Doppler weighting factor (a multiplier which is greater than one) to the Doppler reactivity deficit curve of the point kinetics l
models. For conservatism, no Doppler weighting factor is used in the RCCA ejection analysis.
- 3. Since the Doppler effect terminates the power increase, fuel temperature reactivity feedback is very important. For 4.60
conservatism, the fuel temperature feedback is assumed to be at its minimum absolute value over the entire burnup range.
- 4. The moderator temperature reactivity feedback contributes a much smaller amount of reactivity than the fuel temperature feedback. However, for conservatism the analysis uses the most positive MTC over the entire burnup range.
- 5. The RCCA ejection analysis is very sensitive to the effective delayed neutron fraction since prompt criticality is attained when reactivity insertion becomes greater than or equal to the effective delayed neutron fraction. Therefore, the value used is the minimum expected value over the entire burnup range.
- 6. Control rod reactivity as a function of rod position is minimized for conservatism. This is done by computing the scram insertion worth with a highly bottom peaked axial power distribution. Furthermore, it is assumed that the highest worth rod is stuck at its fully withdrawn position. In addition, the ejected rod worth is not used in calculation of l
trip reactivity. The start of rod motion occurs approximately 0.55 seconds after the high neutron flux trip setpoint is reached. This includes 0.35 second trip delay and 0.2 second trip response time.
The minimum design shutdown margin available for the Haddam Neck Plant at hot zero power (HZP) may be reached only at i
I l
4.61
end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, and adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculation undertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown margin by no more than 500 pcm. Therefore, 1
following a reactor trip resulting from RCCA ejection accident, the reactor will be subcritical as long as the shutdown margin in the technical specifications are met.
Depressurization calculations have been performed using the NULAPS computer code (Reference 5), for demonstration of the availability of shutdown margin, assuming the maximum possible size break of 2.75-inch diameter located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The safety injection system is activated on low pressurizer pressure within half a minute after the break. The RCS pressure continues to drop and reaches saturation of 1380 psia l in about 1 minute. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the RCS temperature below no-load by this time, and the depressurization itself causes an increase in the shutdown margin due to the density coefficient of reactivity. The addition of borated safety injection flow starting 60 seconds 4.62
after the break is sufficient to ensure that the core remains subcritical during the cooldown.
- 7. As discussed earlier, reactor protection for a RCCA ejection is provided by high neutron flux trip. This protection function is part of the reactor protection system (RPS). No single failure of the RPS will negate the protection functions required for the rod ejection accident, or adversely affect the consequence of the accident.
Results Results are presented in Table 4.7-1 for hot full power (HFP) 4-loop operation, full power 3-loop operation, and hot zero power (HZP) 4-loop operation. No results are presented for hot zero power 3-loop operation since it is bounded by the 4-loop results.
4 A summary of the parameters used for the above analysis is also given in Table 4.7-1. The nuclear power, pressurizer pressure, core average heat flux, and hot spot fuel and cladding temperature transients are presented in Figures 4.7-1 through 4.7-12.
l l
The calculated sequence of events for the limiting case RCCA l
ejection accidents are presented in Table 4.7-2. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated. As discussed previously, the reactor will remain subcritical following reactor trip.
4.63
It is assumed that all rods predicted to have a DNBR of less than !
1.3 have failed. In all cases considered, less than 18 percent of the rods had a calculated DNBR of less than 1.3 based on the detailed three dimensional VIPRE01 analysis. No centerline melting was calculated for any of the cases analyzed.
A detailed calculation of the RCS pressure transient for the cases analyzed indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits.
Figures 4.7-2, 4.7-6, and 4.7-10 present the transient pressure response for the cases analyzed.
The RCS integrated break flow to containment following a rod ejection accident is shown on Figure 4.7-13.
Conclusions The analyses indicate that the fuel and cladding criteria are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further l
consequential damage to the RCS. The analyses have demonstrated that no more than 18 percent of the fuel rods have a DNBR of less than 1.3.
l 4.64 i _. _ _ . _ .
Radiological Consequences To evaluate the radiological consequences of a control rod ejection accident, the fuel rods which were calculated to have a DNBR below 1.3 are assumed to release their respective gap activities to the reactor coolant. The gap activity is assumed to be released into the containment atmosphere via the break in the reactor vessel head. The releases to the environment are assumed to take place from the containment building at a leakage rate equal to the technical specification limit for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 50 percent of the limit thereafter. Internal cleanup via the air recirculation filters is assumed. Activity released from the secondary system is derived from the technical specification primary to secondary leakage of reactor coolant containing activity associated with technical specification fuel defects and releases from fuel with clad damage. Primary to secondary leakage is assumed to occur until the pressures equalize.
This occurs at approximately 1100 seconds. Releases from the secondary side are evaluated assuming coincident loss of offsite power. Pertinent parameters used to describe the primary and secondary side releases are presented in Table 4.7-3.
The radiological consequences of the postulated rod ejection accident are presented in Table,4.7-4 and are within the requirements of 10CFR100.
I L l
4.65
Table 4.7-1 Parameters and Results for the RCCA Ejection Accident Analysis Case HFP HFP HZP Analyzed 4-Loop 3-Loop 4-Loop Power level 102 67 0 (percent)
Ejected rod 150 300 400 worth (pcm)
. Delayed neutron 0.48 0.48 0.48 fraction (percent)
Feedback reactivity 1.0 1.0 1.0 weighting Trip reactivity 3,500 2,800 1,700 (pcm)
Fq before 2.9 2.78 --
RCCA ejection Fq aft-r 3.63 5.28 14.2 RCCA ejection Number of 4 3 4 operating reactor coolant pumps Max. fuel 4,751.0 4,129.3 2,628.0 centerline temperature (F*)
! Max. clad 679.5 676.0 664.0 average temperature (F*)
Max. fuel stored 138.0 120.0 72.0 energy (cal./gm.)
Failed fuel as 0.0 18.0 0.0 a result of the accident (%)
i 4.66
Table 4.7-2 Sequence of Events for the RCCA Ejection Accident Analysis TIME (sec)
HFP HFP HZP EVENT 4-Loop 3-Loop 4-Loop Initiation'of rod ejection 2.0 2.0 2.0 Power range high neutron flux 2.19 2.12 3.9 setpoint reached Peak nuclear power occurs 2.24 2.16 6.0 Rods begin to fall into core 2.54 2.47 4.25 Peak heat flux occurs (RETRAN02) 3.7 3.8 6.0 Peak fuel centerline temperature occurs (VIPRE01) 3.9 4.6 6.4 l
4.67
Table 4.7-3 Parameters for the Radiological Analysis of the RCCA Ejection
- 1. Power level, NWt 1861.5
- 2. Offsite power Not available
- 3. Fuel cladding failure resulting from accident, % 18
- 4. Fuel melt resulting from accident, % 0
- 5. Release per pin, percentage of inventory
- a. Fuel cladding gap 10% noble gas, 10% iodine
- 6. Pre-accident coolant concentrations, pCi/gm
- b. Primary coolant, noble gases 100/E 0
- 7. Containment free air volume, ft3 2.23E06
- 8. Containment leak rate, percentage per day
- a. 0-24 hrs 0.18
- b. >24 hrs 0.09
- 9. Containment air recirculation fan (I)
- a. Initiation time, minutes 1.0
- b. Capacity, cfm 50,000
- a. elemental 99
- b. particulate 90
- c. organic 30 (1)One fan initiates during this incident.
4.68
Table 4.7-3 (Cont'd)
- 11. Primary to secondary leak rate, gpm 0.4
- 12. Duration of primary to secondary leak, see 1100
- 13. Steam generator partition factor 100
- 14. Breathing rates, cubic meters /see
- a. 0-8 hrs 3.47 E-4
- b. 8-24 hrs 1.75 E-4
- c. >24 hrs 2.32 E-4
- 15. Dose conversion factors Reg. Guide 1.109
- 16. Ground level Chi /Q's, sec./ cubic meter EAB LPZ
- a. 0-2 hrs 1.08E-3 ---
- b. 0-8 hrs -
2.91 E-5
- c. 8-24 hrs -
9.70 E-6
- d. 24 hrs-30 days - 2.85 E-6 l
4.69
Table 4.7-4 Radiological Consequences for the RCCA Ejection Doses (Rem)
EAB 0-2 hrs LPZ 0-8 hrs LPZ 0-30 days
- 1. Containment release Whole body 0.3 <0.1 <0.1 Thyroid 39 1.2 1.2
- 2. Secondary release Whole body 0.4 <0.1 <0.1 Thyroid 1.8 0.1 0.1 i
a i
4.70 ,
l i
RCCA !!JI!CTION I:110M 111:l' 4 -1.001' Ol'lillATION I:lGURE 4.7-1 f i i e i i i g _ -
1 C
E g
b in g _ -
I l l l i t i cc.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIMElSECONDI FIGURE 4.7-2 i i i i i i i EH e
$8 u
e m
~ ~
Q.
g , , , , , , ,
! m.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIMEISECONO) l
RCCA EJECTION FR0h! IIFP 4-1,00P OPERATION l'IGURI! 4.7-3
, , i i i ' '
58 Eg - _
$~
s El _ -
s' if ag _ -
Es a
El - _
W 8
I f I f I I I cD.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIME (SECOND)
J FIGURE 4.7-4 5000- fuel temperature limit
~
f fuel centerline 4000-C 3000 -
N-W t=
fuel average g
I M
g; 2000 -
e,
! F l
f 1000' I fcladoutside 0- ~
~
1.0 2.0 3'. 0 4.0 5.0 6.0 TIME (SECOND) l . __.
RCCA EJECTION FROM IIFP 3-LOOP OPERATION FIGURE 4.7-5 l i i i i i e i l -
2 E -
hl E
g _
$5 g _
I I I I I i i cD.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIME (SECOND)
FIGURE 4.7-6 4
I I i i 4 4 8
~
e a!
l
, m cL J
M e
E! ce f I f I t i I w.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIME!SECOND) l l
P -e-- -
.w-.+ - ey y y , +p rw w - - - -
RCCA EJECTION FROM llFP 3-LOOP OPERATION
. FIGURE 4.7-7 i i i e i i i E -
+-
s bh -
E-d es _
Ell E '
~
Wl 8
i t t i f I f i
2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 cD.0 TIMEtSECOND)
FIGURE 4.7-8 5000-fuel temperature limit o'
fuel cente i
I b 3000i/'-
P '
l f fuel average 2000 ,
1000 clad outside
. O l 6 l'. 0 2 .'O 3'. 0 4.0 5.0 6'. 0 TIME (SECOND)
. - _ = _ .. . . - - . - ._.- .
RCCA EJECTION FROM IIZP 4-LOOP OPERATION FIGURE 4.7-9 i
^
i i i s i 8 3 a
E, tr M g!
"i O
k j -
g _
, g i f f I
-cD.0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIME (SECOND)
FIGURE 4.7-10
[ s i i i i i i ER i e_
~
S -
c E
s 12
~
El g i I f 1 I I l 11 0 . 0 2.5 5.0 7.5 10.0 12.5 15.0 17.5 20.0 TIME (SECOND)
. _ . . ..- - - - ,~. - ~ . - -_
i RCCA EJECTION FROM liZP 4-LOOP OPERATION FIGURE 4.7-11 i
i I I I I I i 5 -
- l -
. m 3
5 d
eg
$2 ,
d El g
8 I I I f 1 e i 10.0 12.5 15.0 17.5 e 20.0 cD.0 2.5 5.0 7.5 '
4 TIME (SECOND) i FIGURE 4.7-12
< 3000-a
,2500; i
L u.
/
lT fuel centerline
! E 2000-
- ?
? 1500.' , /
/- t N
= ' fuel average
'/
H /
/
1000- ,
clad outside I
500 O l' . 0 2' . 0 3.0 4.0 5.0 6.0 TIME (SECOND)
, - , . , , ,-,,-..._.a.,_-,,g._., , , , __ - . _ . . - , , _ . . , _ , _ _ . , . , , , _ , - , , . . _ _ , --_ n - - _ _ . -
RCCA IUECTION FIGUlm 4.7-13 3500 s uu%
%3000:
o 32500 6
E 2000 M
e j1500 a
h g 1000 4 !E 500.
0 8000 10'000 2000 4000 6000 0
TDfE (SECONDS)
I i
- , . - _ - _ . m. - --_ ._~_--...,o _.__ y., ,, , - _ _ . - , .-- --, --
4.8 LOSS OF FORCED REACTOR COOLANT FLOW Event Description The partial and complete loss of coolant flow accidents are discussed in this section. These events are analyzed for both 4-loop and 3-loop operation.
A partial loss of coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump (RCP), or from a fault in the power supply to the RCP(s) supplied by a RCP bus.
(Each RCP bus supplies power to two RCPs.) A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all RCPs. If the reactor is at power at the time of the accident, the immediate effect of a loss of coolant flow is an increase in the average coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.
Normal power for the RCPs is supplied t. rough two buses connected to the generator. When a turbine ar grne- :or trip occurs, the buses
[
l are automatically transferred to a transformer supplied from external power lines such that two RCPs will continue to supply l
coolant flow to the core.
Reactor trip signals for the loss of flow event are provided by any one of the following: 1) low voltage on the bus supplying the RCP, 4.71 I __
- 2) opening of the RCP breaker or 3) low reactor coolant loop flow as indicated by a steam generator AP measurement.
Above Permissive 8 (74 percent power), the opening of an RCP breaker or one low loop flow signal causes a reactor trip. Between Permissive 7 (10 percent power) and Permissive 8, two open RCP breakers or two low loop flow signals cause a reactor trip. Since two RCPs are connected to each bus, low voltage to one bus causes a reactor trip for powers above Permissive 7. All three trip functions are blocked during operation below the Permissive 7 power level. During 3-loop operation, the low flow protection in the isolated loop is in the tripped mode. Therefore, the loss of one RCP during 3-loop operation results in a reactor trip signal at power levels above Permissive 7.
The complete loss of flow event from full power 4-loop operation is the most limiting loss of flow event. Because of a larger power-to-core flow ratio this event results in a lower DNBR than the complete loss of flow in three loop operation. Also, because of a
( more rapid decrease in core flow, this event is more severe than the partial loss of flow events.
l Because of the permissives described above, a loss of forced circulation in one loop at 74 percent power (4-loop operation), and a complete loss of flow at 10 percent power (3- or 4-loop operation) will not cause a reactor trip. However, these events are less 4.72
limiting with respect to DNB than the complete loss of flow from full power, 4-loop operation.
1 Method of Analysis The loss of coolant flow transient is analyzed using two computer codes. First, the RETRAN02 code is used to perform a detailed plant transient analysis. The transient calculation with RETRAN02 includes the modeling of the reactor coolant system, the steam generators, the main steam and feedwater systems, and reactor core kinetics including fuel and moderator temperature feedback. The results calculated by RETRAN02 during the loss of flow transient include core inlet flow, nuclear power, core inlet temperature and RCS pressure. Using the RETRAN02 results as input, the VIPRE01 code is then used to calculate the DNBR during the transient.
- The assumptions made in the analyses are as follows
- 1. The plant is initially at 102 percent power for 4-loop operation and 67 percent power for 3-loop operation.
4
- 2. Reactor trip occurs due to low loop flow. Instrument response time and trip delay time are also included. The reactor trip signals due to bus undervoltage and RCP breaker position are not credited in this analysis so that the adequacy of the loop l AP setpoint can be assessed.
( 4.73 l
- 4. The least negative Doppler deficit is used to minimize the core power decrease due to fuel heatup.
- 5. The most po itive moderator temperature coefficient is used in order to maximize core power due to the RCS heat up.
- 6. The plant is assumed to be at the minimum initial RCS pressure and flow in order to minimize DNER.
- 7. The plant ir assumed to be at the maximum initial core inlet temperature.
- 8. A loss of AC power occurs coincident with the low flow reactor trip signal.
- 9. The following assumptions are made so as to minimize the RCS j
pressure rise and/or to maximize the core power. These assump-tions result in conservative DNBR predictions.
l
[
i r
- Minimum initial pressurizer level Maximum initial SG Icvel
- Maximum turbine stop valve closure time l
- Maximum pressurizer spray 4.74
\
\
Pressurizer heaters off l
Charging isolated, letdown available I
l Assumptions regarding main feedwater, auxiliary feedwater, SG safety i
valves and pressurizer PORV operation have a negligible effect on i the DNBR results for these transients. Plant characteristics and initial conditions are further discussed in Section 4.0.
l The loss of flow analysis is performed to demonstrate the adequacy of the low flow reactor trip in preventing the minimum DNBR from decreasing below 1.3. By meeting this criterion, the fuel rod integrity is maintained.
RESULTS The results of the parametric studies performed indicate that the total loss of forced circulation is more limiting than the loss of ,
forced circulation in one loop with respect to DNBR. This applies during 4-loop and 3-loop operation. In addition, the total loss of flow from 10 percent power, which does not result in a reactor trip signal on low reactor coolant loop flow, is less limiting than that from full power with respect to DNBR. Finally, the loss of forced reactor coolant flow in one loop during 4-loop operation at 74 percent power, which also does not result in a reactor trip
(
signal on low reactor coolant loop flow, is less limiting than the total loss of forced circulation during 4-loop operation at full l power. The limiting transient is the total loss of forced l
I l 4.75 t
circulation from full power. The results for this event are presented for both 4-loop and 3-loop operation.
Figures 4.8-1 to 4.8-6 show the significant plant parameters during the complete loss of flow transient from full power 4-loop operation. Figures 4.8-7 to 4.8-12 show these parameters for the complete loss of flow from full power 3-loop operation. A time sequence of events is listed for both transients in Table 4.8-1.
In the complete loss of flow analysis from full power 4-loop operation the low flow reactor trip signal is reached about 2.5 seconds after the loss of power to all RCPs occurs. Due to
, delay and response times the control rods begin to drop about 1.5 seconds after the trip signal. Nuclear power and core heat flux decrease slightly prior to control rod insertion due to fuel heatup and Doppler reactivity feedback.
The maximum pressurizer pressure occurs at 6.5 seconds. This pressure increase is minimized due to the assumptions mentioned earlier in order to minimize DNBR.
t l The minimum DNBR of 1.40 occurs at 5.40 seconds. At this time the l
core flow rate has decreased to about 67 percent of its initial value. Since the minimum DNBR remains above 1.3 during the complete loss of flow transient from full power 4-loop operation, no fuel failures are expected. This transient was also analyzed to maximize RCS pressure and the peak pressure was found to be bounded by that of the 4.76
locked rotor transient. This is due to the fact that the locked rotor transient results in a more rapid flow coastdown and lower asymptotic core flow rate. The peak RCS pressure during a locked rotor transient is below 110 percent of design pressure. Therefore, the peak RCS pressure during a loss of flow transient is also below 110 percent of design pressure.
In the complete loss of flow analysis from full power 3-loop operation the low flow trip signal is generated at 3.6 seconds. The control rods begin to drop about 1.5 seconds after the trip signal as in the previous case. Due to the positive moderator temperature coefficient, nuclear power and core heat flux increase prior to reactor trip.
Pressurizer pressure decreases slightly during this loss of flow transient. This decrease is due to conservative assumptions for the
, operation of the pressurizer heaters and spray which minimize the predicted DNBR.
For the complete loss of flow from full power 3-loop operation the minimum DNBR of 1.93 occurs at 6.4 seconds. At this time the core flow rate has decreased to about 64 percent of its initial value.
No fuel failure is expected during this transient since the minimum DNBR remains above 1.3.
l 4.77
. .__ ~ - .__ ._ _ __ _ _ _
i Conclusions The results of the analyses show that the DNBR will not decrease below the limiting value of 1.3 at any time during the loss of flow transients. Thus, no fuel or cladding damage is predicted. In addition the peak RCS pressure is bounded by that of the locked rotor transients and remains below 110 percent of design pressure.
l t
4.78
t Table 4.8-1 Settuence of Events for the Complete Loss of Flow 4-Loop 3 Loop Time Time Event (Sec) (Sec)
Loss of power to all RCPs 0.02 0.02 flow coastdown begins Low flow reactor trip 2.5 3.6 Rods begin to drop 4.0 5.1 Minimum DNBR occurs 5.4 6.4 Peak pressure occurs 6.5 -
l I
i 4.79
h TOTAL LOSS OF FORCED REACTOR COOLANT FLOW FROM IIFP 4-LOOP OPERATION FIGURE 4.8-1 i i i y , i i i w
c-E b -
r' s -
x m
E -
% h TIME (SEC)
FIGURE 4.8-2 i i i
y , , i i
[ m g.g
==___
M l
d E
s
~
J 5
m Wy
,; 3; i; is s, ,' , , ,
TIME (SEC)
i TOTAL LOSS OF FORCED REACTOR COOLANT FLOW FROM llFP 4-LOOP OPERATION FIGURE 4.8-3 g , , i i i ' '
eu
=
E
=
c; E
S - -
S B-d
~
$c.
U 8
6 e 10 1 1 16 TIME (SEC)
FIGURE 4.8-4
, , s a ' ' '
f -
T
- u. Hot p
t
$ T gyg d
9 = =
$ T Cold 9 6 8 10 gg .19 16 l
TIME (SEC)
L
TOTAL LOSS OF FORCED REACTOR COOLANT FLOW FROM IIFP 4-LOOP OPERATION FIGURE 4.8-5 8 i i i i i i i E - -
r_g k ~ ~
W-e ct N-b W
M8 - -
- a. _
1 1 1 I i i t a 2 9 6 8 10 12 14 16 TIME (SEC)
FIGURE 4.8-6 i , i i i i i er m
4 4
O -
4 q -
l e i e e t i t
.D 2 4 6 6 10 12 19 15 TIME (SEC) i r
l
4 TOTAI. LOSS OF FORCIII) Rl! ACTOR COOLANT FLOW
, FROM lil:P'3-LOOP OPERATION FIGURE 4.8-7 4
I. N. i i i i i a i k .s j' 3
$8 -
5 2.
b n
8-a:
b O'
k -
n k
w dW ~
s' a ___
j 8 ' t t i e i i d 2 9 6 8 10 12 19 16
, TIME (SEC) 5 FIGURE 4.8-8 i e 4 ". a i i i i i i i
[-
I
! ~]8 ~-
g .:
C l
. b e.
sg -
- n'
- e >
- E ~
l WC -
8 ' ' ' ' ' ' '
& 2 4 6 8 10 12 19 15 TIME (SEC)
s TOTAL LOSS Ol: 1:0RCl!D Rl! ACTOR COOLANT FLOW FROM llFP 3-LOOP OPERATION FIGURE 4.8-9 I I 4 3 8 I I Q 8,
=
E m
J E
eg - _
E-d b.)
~
(Jh g i l i t I t I cb 2 4 5 5 10 12 19 15 TIME (SEC1 FIGURE 4.8-10 I I I i 8 I I l -
E T t
- Hot
~
~
WR e
E E -
T t
Wg Avg
, : : ~
~
= -
l - -
6 - -
I & T '
Cold l
t t I t I t i i b 2 9 5 8 10 12 14 16 l TIME (SEC) 1
i TOTAL LOSS OF FORCED REACTOR COOLANT FLOW FROM HFP 3-LOOP OPERATION FIGURE 4.8-11
! i i i i e i i w
~ ~
sn uJ
$$ ~ ~
E-Y 53 - -
m-E E
Ws et I i i i t i f a 2 9 6 8 10 12 19 15 TIME ISEC)
FIGURE 4.8-12
- i i i i i i l
l I
l *. ~ ~
! N .
m l 8 .
O -
l e4 q - -
I I t t 1 i i
! % 2 9 6 6 10 12 19 15 TIME (SEC) l
4.9 STEAM LINE BREAK EVENT Event Description A steam line break is defined as a rupture of a main steam line which results in a rapid increase in main steam flow and an increase in heat removal. The increased energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the RCS cooldown results in the insertion of positive reactivity. A reactor trip will occur on high power or low RCS pressure. However, the continued cooldown will result in a reduction in shutdown margin. If the positive reactivity inserted exceeds the shutdown margin, it is possible that the core will become critical and return to power. If this were to occur, the core would be ultimately shut down by the decrease in steam flow and cooldown as the steam generator (SG) inventory is depleted and by the boron addition delivered by the safety injection system.
The analysis of a main steam line rupture is performed to
- demonstrate that the following criterion is satisfied:
- 1) Assuming the most reactive control rod stuck in its fully withdrawn position, with or without offsite power, and l
assuming the most limiting single failure, the i
radiological consequences do not exceed the requirements of 10CFR100.
l 4.80 l
The following functions provide the protection for a steam line rupture.
- 1. Safety injection system actuation from either of the following:
- a. low pressurizer pressure
- b. high containment pressure
- 2. Reactor trip may occur due to the over power reactor trip or on receipt of the Safety Injection Signal (SIS).
- 3. Isolation of the main feedwater lines will occur on safety injection actuation, via closure of the redundant main feedwater isolation valves. In addition, the feedwater control system will isolate feedwater by closing the feedwater regulating valves as the RCS average temperature (Tavg) decreases to 535*F.
- 4. Trip of the fast acting steam line trip valves (designed to close in less than 10 seconds) on high steam flow in 2 out of 4 steam lines.
. Additional protection is provided by the nonreturn (check) valves in the steam lines. The nonreturn valves in the main l
l steam lines prevent steam flow from the intact steam generators l
t i 4.81 l
L
i from discharging through a break located upstream of a nonreturn valve.
Method of Analysis The steam line break transient is analyzed using two computer codes. First, the RETRAN02 code is used to perform a detailed plant transient analysis. The transient calculation with RETRAN02 includes the modeling of the reactor coolant system, the steam generators, the main steam and feedwater systems, and reactor core kinetics including fuel and moderator temperature feedback. The results calculated by RETRAN02 include core inlet flow, nuclear power, core inlet temperature and RCS pressure. Using the RETRAN02 results as inputs, the VIPRE01 code is then used to calculate the fuel rod heat flux and temperature distributions and the minimum l
The MacBeth Critical Heat flux correlation is used to calculate DNBR in VIPRE01 because the thermohydraulic conditions are outside the range of the W-3L correlation. The axial and radial peaking factors
! used in the analysis are calculated for the specific conditions during the steam line rupture. These peaking factors take into
/
account the effect of the most reactive control rod stuck in its l fully withdrawn position.
l i
I l
4.82 i
L.
Analyses were performed for both 3-loop and 4-loop operation at full power and hot zero power. Cases with and without offsite power available were evaluated.
The assumptions made in the analysis are as follows:
- 1. The steam line break analysis is performed with end of life shutdown margin, zero ppm boron concentration, and the most reactive control rod stuck in its fully withdrawn position.
- 2. For full power cases, the plant is initially at 102 percent power for 4-loop operation and 67 percent power for 3-loop operation. For the hot zero power cases, the plant is assumed to be initially at 1 percent power.
- 3. The most negative moderator temperature deficit is used to maximize the positive reactivity insertion due to the cooldown.
The moderator density feedback coefficient is varied with temperature and pressure.
- 4. The least negative Doppler deficit is used to minimize the core power decrease due to fuel heatup.
- 5. The break is assumed to be located outside the containment upstream of the nonreturn valve. This break location delays the initiation of SIS, which is generated by low pressurizer l
pressure. If the break location were to be postulated inside 4.83
the containment, the SIS would occur earlier on high containment pressure. Break flow is maximized by ignoring line losses. A double ended break is postulated.
- 7. The single failure assumed is the failure of all feedwater regulating valves to close when the RCS average temperature (Tavg) drops to 535 F. Feedwater is isolated by the feedwater isolation valves, which receive a closure signal on actuation of the SIS. Since Tavg drops to 535*F well before the SIS is generated, this assumption maximizes the feedwater supply and thus maximizes the RCS cooldown.
- 8. Perfect moisture separation in the steam generator is assumed.
The assumption leads to conservative results since, in fact, considerable amount of water would be discharged. Water carryover would reduce the magnitude of the temperature i
decrease in the core.
Results l
The HZP cases with offsite power available provide the most limiting results. This is because at HZP, the primary side has the least stored energy and the SG secondary side contains the maximum inventory. Also, at HZP the feedwater temperature is at a minimum.
4.84
All these factors maximize the cooldown, which maximizes the return to power. ,
The loss of offsite power cases are less severe than the cases with offsite power available. A loss of offsite power affects the transient in three ways. First, the main feedwater pumps trip on loss of offsite power, reducing the amount of water available for overcooling. Second, the coastdown of the reactor coolant pumps (RCPs) reduces the RCS flow rate, which in turn, reduces heat transfer both in the steam generator and in the core. Third, the delay in starting the safety injection pumps is increased by 10 seconds due to the startup of the emergency diesel generators.
The transient results show that termination of main feedwater flow to the faulted steam generator and the reduction in heat transfer due to RCP trip more than compensate for the delay in safety injection.
A sensitivity study was performed to determine the limiting assumption with respect to the time of reactor trip. The time of reactor trip affects the transient in two ways. An earlier trip minimizes the heat input to the RCS, which maximizes the cooldown.
However, a later trip time slows down the depressurization and thus delays high pressure injection of horated water. For the 3-loop case, reactor trip at the initiation of the break gave a higher core power. However, for the 4-loop case, reactor trip on high power yielded the highest return to power.
4.85
As discussed in Section 4.8, two reactor coolant pumps (RCPs) will coastdown upon reactor trip. This will result in two RCPs remaining running in the 4-loop simulation, and one RCP in the 3-loop simulation. To maximize the cooldown, the RCP in the faulted loop is assumed to be running throughout the transient. No credit is taken for operator action to trip the RCP in the faulted steam generator.
Because of the reduced pressure in the faulted steam generator, most of the feedwater flow is diverted to the faulted generator. On actuation of the SIS, the feedwater isolation valves will begin to close. The valves will ramp closed in 70 seconds. No credit is taken for the reduction in feedwater flow until 70 seconds have elapsed. After main feedwater flow is terminated, the SG level begins to decrease since the auxiliary feedwater (AFW) flow is unable to keep up with loss of inventory through the break. The operator is assumed to terminate AFW flow to the faulted generator at 10 minutes.
Following a double-ended rupture of the main steam line, only one steam generator blows down completely. Thus, the remaining steam generators in operation are still available for removal of decay heat after the initial blowdown is over.
Table 4.9-1 provides the sequence of events for the steam line break events initiated from 4-loop and 3-loop operation at HZP. The system response during 4-loop operation is shown in Figures 4.9-1 4.86
through 4.9-12. The nyatem response iluring 3-loop operation is shown in Figures 4.9-13 through 4.9-24.
i A DNB analysis is performed utilizing the power distribution calculated for the maximum return to power conditions. A large margin to DNB is predicted. The maximum fuel centerline temperature is less than the fuel melt limit of 4,780 F.
Conclusion Results show that for the limiting steam line break case, no fuel rods exceed the DNB limit or experience fuel melt. The analyses show that no DNB or cladding perforation occurs for a steam line rupture. Therefore, the radiological consequences of this event are within the requirements of 10CFR100.
I I
l 4.87
[
Table 4.9-1 Sequence of Events for the Steam Line Break from Hot Zero Power and Offsite Power Available Event Time (Secs.)
4-loop 3-loop Operation Operation Break Initiated 0.1 0.1 Reactor Trip Initiated 13.7 0.01 2 RCP Tripped 13.7 0.01 SIS Actuation 32.1 34.
Return to Criticality 42.0 22.
Pressurizer Empties 36.0 40.0 HPSI Pump Starts Injection 59.0 54.
Time of Peak Core Power 71.0 85.
AFW Flow Initiated 103.0 95 Main Feedwater Flow Terminated 102.0 101 AFW Flow Terminated (Operator Action) 600.0 600 4.88
STEAM LINE BREAK FROM IIZP 4-LOOP OPERATION FIGURE 4.9- I 8 i i . . i i i 55
~
z J , , , , , , ,
cc 00 160 240 320 900 460 560 640 TIME (SECOND)
' FIGURE 4.19- 2 1
4 g i i e i i e i
, .\ lode ra t o r -
Dopplerg
- t. 4 C*
E C [
) -
Total -
Rods and Boron a -
f -
W 80 160 240 320 400 480 560 640 TIME (SECON01 l
l t
STEAM I,INE BREAK FROM IlZP 4-1,00P OPERATION FIGURE 4.9- 3 l n , , . , , .
El
_e Nl-E wg _ _
5-85 8
w Eg I f I i t i I c0 50 160 240 320 900 900 560 690 TIME (SECON01 FIGURE 4.9- 4 I
I I I i 1 5 i c
i E l hy - -
. W O
- 5 4
g, _ _
- E g
l l
s i i i e i i b 80 160 290 320 900 900 560 640 TIME (SECON01 l
l I
l-j STEAM LINE BREAK FROM llIP 4-LOOP OPERATION FIGURE 4.9- 5 I
r.
l . i i i i e i I
U d
s -
$_l E
! Eg _
!6 E~
~
j_ i i i i e i i i co 80 160 240 320 400 900 560 640 l TIME (SECON01 FIGURE 4.9- 6 i
I
, g i i e i e i i l
}
R 3
. w*
x N
l M,s i ai , ,
l . ,
- co ao too 2*o 320 900 *eo sea evo i
TIME (SECON01
STEAM LINE BREAK FROM llZP 4-LOOP OPERATION FIGURE 4.9- 7 l i i i i i e i g .
a-M s
dl . -
B~
d
~
hl
~
E N
w t t I t 1 l l co 80 ISO 290 320 400 900 560 690 TIMEtSECOND)
FIGURE 4.9- 8 g i i i i i i i a8 M
i sJ l 5g - -
S-u.
E8
, 3
- E 8 - .
v t t t t l t t cc 00 ISO 240 320 H)0 980 560 690 TIME (SECOND)
STEAM LINE BREAK FROM HZP 4-LOOP OPERATION FIGURE 4.9- 9 I i . . i i g a
Wh -
s b
12 .
g5 s
a
=g -
W d
E WM -
w
- I I f f f g g d 80 160 240 320 400 980 560 690 TIME (SECOND)
FIGURE 4.9- 10 g i e i i . . .
l
~
Og -
E i
i m .
"a -
(- E E
5 z -
d.
~
E W
m -
a f f f f f f l
@ 80 160 290 320 400 900 560 640 TIME (SECON01
STEAM LINE BREAK FROM HZP 4-LOOP OPERATION FIGURE 4.9- 11 l i i . . . , ,
R U
tM h5 a
d -
g_R w
g- .
4 c0 80 160 290 320 400 400 560 690 TIMEISECOND)
FIGURE 4.9- 12 a a . . . . .
~
j 9 l
t N - -
M ~
f i
l.
/ _
9 8 f I I I I I O
d 80 160 240 320 400 480 560 640 TIMEtSECOND) l I _ _ . _ -
STEAh! I,1Nii Ittti!AK liit0M ll2P 3-1.00P OPEllATION 1:1(;tiltli 4.9- 13 E i i i i i i i g _
C .
3_5 oc El N
J. , , , , , ,
cs 50 160 240 320 400 960 560 640 TIMELSECOND)
FIGURE 4.9- 14 g i i i i i i i
% Moderator l -
l l
E q -
/ Doppler
- =
h ,
Total / _
t it!'?
i
?
/ Rods and Boron
, i 1 e ;
T 80 160 240 320 400 460 560 640 TIME (SECONO)
l STEAM LINE IIREAK FROM ll2P 3-LOOP OPERATION FIGURE 4.9-15 l i i i i . . .
ER e_
$g -
s-w E
Eg - _
ct -
e Eg 0 I I t I f I cc 80 160 240 320 400 400 560 640 TIME (SECOND)
FIGURE 4.9- 16 g . i i e i i .
g _
c E
Ws -
w O
5 ag -
w E
o g _
f f 1 I t i 80 160 240 320 400 480 560 640 TIMEISECOND)
l STEAM LINE lillEAK Fit 0M llZP 3-LOOP OPERATION 1:IGUlti! 4. 9 - 17
' ' i e i . .
U
$8 s -
3_g E
d -
WI 8 -
I I I f f g ,
d 80 160 240 320 900 980 560 690 TIME!SECOND)
FIGURE 4.9- 18 g ' 8 e a a i ,
g .
G b .
! d de a
b
~
$2 m
wi I I f f f g W 160 290 320 400 480 560 640 l TIME (SECONO) l I
STEAh!LINEBREAKFR0!tilIP3-LOOPOPERATION FIGURE 4.9-19 l . . . i i i i g -
s-N 2
eg -
B-d hl a
b w
t i f f I I l d 80 150 2+0 320 400 480 560 640 TIME (SECONDI FIGURE 4.9-20 g i . i i . . i as E
s e -
un -
3-W 6
gs -
1 5
E -
9 -
I fr i f f f 1 d 80 150 290 320 400 480 560 640 TIME (SECOND)
I STEAM LINE BREAK FROM IIZP 3-LOOP UPERATION l
FIGURE 4.9- 21 I i i i i ,
i i L
i
! tc El
~
s
~
l EE s
=g .
Y 8
E WR -
m w
f f f f f f I d 80 160 240 320 900 900 560 690 TIME (SECOND)
FIGURE 4.9- 22 g i i e i e i i i
C g d
E -
ag -
i E E
Y ,, -
8-E W
m -
1 e i i e i i i i j co so ISO 250 sz0 *00 *eo 560 s*0 l TIME (SECOND) i l
STEAM LINE BREAK FROM ll2P 3-LOOP OPERATION FIGURE 4.9- 23 g i i i i i i i
~
8 - -
M L
~
$)
aJ J -
M-E
, ~
f f f f f I i cs 80 ISO 240 320 900 980 560 640 TIME (SECOND)
FIGURE 4.9- 24 o i i i i i i i
~
D a
gs
~
~
i ,
O cb 80 160 240 320 900 480 560 640 TIME (SECOND)
4.10 STEAM GENERATOR TUBE RUPTURE Event Description The accident examined is the complete severance of a single steam generator tube. The accident is assumed to take place at full power with the reactor coolant fission product activity corresponding to the technical specification limits. The accident leads to an increase in the activity of the secondary system due to leakage of coolant from the RCS.
Complete severance of the steam generator tube is considered a conservative assumption since the Inconel-600 tube material is highly ductile. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance and an accumulation of minor leaks which exceed the limits established in the Technical Specifications is not permitted during normal operation. Therefore, operation would be terminated before the tube l
defect could significantly increase in size.
l The operator is expected to determine that a steam generator tube rupture has occurred, and to identify and isolate the faulty steam generator to minimize the contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the faulty steam generator. The recovery procedure can be carried out on a time scale which ensures that break flow to the secondary 4.89
l system is terminated before water level in the affected steam generator rises into the main steam line. Suliicient indications and controls are provided to enable the operator to carry out these functions satisfactorily.
Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the accident diagnostics and isolation procedure can be completed within 30 minutes of initiation for the design basis event.
If normal operation of the various plant control systems is assumed, the following sequence of events is initiated by a tube rupture.
- 1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, steam flow /feedwater flow mismatch occurs as feedwater flow to the affected steam generator is reduced as a result of l primary coolant break flow to that loop.
l l
l
- 2. The decrease in RCS pressure due to continued loss of i
reactor coolant inventory leads to a reactor trip signal l
on low pressurizer pressure or variable low pressure, or the reactor may be manually tripped by the operator. The resultant plant cooldown following reactor trip leads to a decrease in pressurizer level.
4.90
- 3. The reactor trip automatically trips the turbine and the steam dump valves open, permitting steam dump to the condenser. In the event that steam dump to condenser is unavailable, the steam generator pressure rapidly increases, resulting in steam discharge to the atmosphere through the steam generator safety valves.
- 4. Following the reactor trip, the auxiliary feedwater supply and the borated charging injection flow provide a heat sink which absorbs the decay heat and maintains sufficient primary inventory.
- 5. Charging injection flow is sufficient to keep up with the break flow and results in a slightly increasing pressurizer water volume.
- 6. The condenser air ejector monitor and the steam generator blowdown liquid monitor may alarm, indicating a sharp increase in radioactivity in the secondary system. At this point, steam generator blowdown is manually isolated.
Method of Analysis RETRAN02 is used to conservatively determine the primary to secondary mass release and to conservatively determine the amount of steam vented from each of the steam generators.
4.91
In estimating the mass transfer from the RCS through the broken tube, the following assumptions are made:
- 1. Reactor trip occurs manually at event initiation in order to maximize the radiological consequences. Loss of offsite power is assumed to occur coincident with reactor trip.
- 2. Following the reactor trip, two charging pumps are actuated and are assumed in the analyses to continue tc deliver flow until 30 minutes af ter accident initiation.
- 3. After reactor trip, the break flow approaches equilibrium where incoming charging injection flow is balanced by outgoing break flow as shown on Figure 15.6-3. Break flow is assumed to persist for 30 minutes beyond initiation of the accident.
- 4. Steam generator pressure is controlled by the steam generator safety valves during the initial 30 minutes of the transient.
l l Safety valve blowdown is assumed to maximize the steam releases. The effect of the blowdown is seen in the oscillatory system response.
l l
- 5. The operator is assumed to terminate the auxiliary feedwater flow to the faulted steam generator at ten minutes.
- 6. The operator identifies the accident type and terminates break flow to the faulted steam generator within 30 minutes of 4.92
k accident initiation by closing the loop stop valves in the faulted loop.
The above assumptions, suitably conservative for the design basis tube rupture, are made to maximize radiological consequences and do l
not explicitly model operator actions for recovery.
Prior to reactor trip, both the faulted and nonfaulted generators steam to the turbine. Following reactor trip and due to the assumed loss of offsite power, steam dump to the condenser is lost and steam from all of the generators is released to the atmosphere.
Following isolation of the faulted steam generator, it is assumed the nonfaulted steam generators are used to reduce the RCS temperature to 50 F below no-load T,y within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. From 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, it is assumed the nonfaulted steam generators are used to reduce the RCS temperature and pressure to residual heat removal systems (RHRS) entry conditions. After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, further plant cooldown is carried out with the RHRS.
The recovery sequence to be followed consists of the following major operator actions:
i l
- 1. identification of the faulted steam generator;
- 2. isolation of the faulted steam generator; 4.93 L
- 3. subsequent termination of safety injection flow;
- 4. closure of the loop isolation valves in the faulted loop;
- 5. cooldown of the RCS fluid to approximately 50*F below no load temperature; and i
- 6. subsequent controlled cooldown of the RCS to RHRS entry conditions.
Results The behavior of pertinent time-dependent parameters is shown on Figure 4.10-1 through 4.10-7. The sequence of events for the steam generator tube rupture is presented in Table 4.10-1.
The previously discussed assumptions lead to an estimate of 106,500 pounds for the total amount of reactor coolant transferred to the secondary side of the faulted steam generator as a result of a tube f
i rupture accident. The steam releases to the atmosphere from both
! the faulted and nonfaulted steam generators are given in Table 4.10-2.
Radiological Consequences I
If a steam generator tube rupture were to occur, a fraction of reactor coolant system activity is assumed to be released to the l
4.94 i
f secondary side of the steam generator. The release to the environment from the faulted steam generator continues until this steam generator is isolated 30 minutes after the rupture occurs.
The intact steam generators continue to release activity until the plant is brought to cold shutdown. The activities released to the intact steam generators are based on technical specification primary to secondary leak rate of 0.4 gpm. It is also assumed the reactor ,
coolant and secondary coolant are at equilibrium technical specification activity concentrations. A partition factor of 0.01 is assumed for iodines passing between the water and steam phases in both the faulted and intact steam generators.
The assumptions used to calculate the doses to the exclusion area boundary (EAB) and the low population zone (LPZ) from a steam generator tube rupture are summarized in Table 4.10-3. Two cases are analyzed to ascertain the results of increased reactor coolant iodine concentration resulting from operating transients:
, 1. the iodine activity in the primary coolant is increased due to preaccident iodine spike, and I
l
- 2. an iodine spike occurs concurrently with the steam generator tube rupture.
The radiological consequences from the steam generator tube rupture are summarized in Table 4.10-4. The whole body and thyroid doses calculated for the postulated accident assuming a preaccident iodine 4.95
}
spike in the reactor coolant are less than the requirements of 10CFR100, i.e., 300 Rem to the thyroid and 25 Rem to the whole body.
For the assumed condition of a concurrent iodine spike in i
combination with equilibrium iodine concentrations at full power, the analysis of the postulated accident resulted in dose values less than a small fraction of 10CFR100; i.e., less than 30 Rem to the thyroid and 2.5 Rem whole body.
.i 4.96
Table 4.10-1 Sequence of Events for the Steam Generator Tube Rupture Event Time (Sec)
Tube Rupture Occurs 0.0 Reactor Trip 10.0 Steam Generator - Safety Valve Opened 15.0 Auxiliary Feedwater Injection 301.7 Faulted Steam Generator Isolated 1800.0 l
6 r a 4.97
Table 4.10-2 Steam Releases for the Steam Generator Tube Rupture Time Period Flow Path (hr) 0-0.5 0-2 2-8 Steam from ruptured SG (lba) 121,700 121,700 0 Steam from intact SG (lba) 25,100 265,000 730,000 Tube rupture flow (1bm) 106,600 106,600 0 9
l l
l 4.98
Table 4.10-3 Parameters for the Radiological Analysis of the Steam Generator Tube Rupture
- 1. Power level, NWt 1861.5
- 2. Offsite power Not Available
- 3. Fuel cladding failure resulting from accident, % 0
- 4. Primary to secondary leak rate, gpm 0.4
- 5. Time to isolate faulted steam generator, see 1800
- 6. Pre-accident coolant concentrations pCi/gm
- b. Primary coolant, noble gases 100/5 0
- 7. Iodine spiking
- b. Accident initiated spike 500 times release rate for Tech Spec limit
- c. Duration of accident initiated spike, hrs 4
- 8. Iodine partition factors
- a. Condenser 100
- b. Steam generators 100 j
\
- 9. Dose Conversion Factors Reg. Guide 1.109 l
- 10. Breathing rates, m 3/sec
- a. 0-2 hrs 3.47E-04
- b. 2-8 hrs 3.47E-04 l
l 4.99
l Table 4.10-3 (Cont'd) i 11.
I) , sec/m 3 EAB LPZ 95% Chi /Q's
-a. 0-2 hrs 1.08E-3 ---
- b. 0-8 hrs N/A 2.91E-5 i
l i
i (2)The values for the release paths considered here are taken to be ground level Chi /Q's.
P 4.100
)
i Table 4.10-4 l
l l
Calculated Doses for the l
Steam Generator Tube Rupture Doses (Rem)
EAB 0-2 hrs LPZ 0-8 hrs l
l Whole body 1.3 0.1 l
Thyroid: pre-accident spike 62 4.8 Thyroid: accident initiated spike 18 1.5 I
l l
l 4.101
STEAM GENERATOR TUBE RUPTURE FROM HFP FIGURE 4.10-1 i i i i i 8
i i U
g ss E
- d l TOTAL a
g8 c
mwumwwmanuauu.wx -
M y l gytyntym%^AM N!NJJJ ' JJ JJJ,^- .
[g sn COLDSIDE{
S
- ~
- e - w y ~ s.~ e s .s v % w .s g -
HOTSIDEf t i I t I 1 I 500 753 ID's3 1253 1532 1750 2:~.
c0 253 TIME ISECO:05)
FIGURE 4.10-2 l i i i i i i i a -
- D -
l-~ .
G E
d{
E /
- = ~
~
gE _ - -
=
5 m -
08 -
U t t I t i I I c0 250 503 750 1000 1253 1533 1753 2002 TIME (SECONDS)
STEAM. GENERATOR TUBE RUPTURE FROM HFP FIGURE 4.10-3
.l i e i i i , ,
C]rf e
E - .
e E
i k -
- 'A W ^W ^" N v/A W//f/w%,aff,,j N
CL -1 -
4 Y
I i l i t t t j .
250 500 750 103G 1253 15 3 1753 I:::
TIME (SECC'C51
< FIGURE 4.10-4 i.
E E -
h I thI ek II V it iksi .5 I (f{kIkn(i -
08 i
! Es ce
? -
Es 4
W'
.: O E _
~
l WR l
f f I I t t I c.D 250 500 753 10D 12!3 15;] 1759 ;c?;
TIME (SECONJ51
i STEAM GENERATOR TURE RUPTURE FROM HFP 1:IGURE 4.10-5 m
p- - .
- ~ -- ... .
R x:
! to I
d ~ -
4 S
u_
gg
=
if '
- Eg -
! c
- O .
I ll l ; a l '! l ,l ; ,
m n ol!
4 j di i n i j -
[e ,
l l..
.I !
{ lql}nill. l j ,
nml .
i ,i}
- 11 l
l i
l I
I'
'l. ll ..i l
46 i ll I i .j f
- i. l i !ll 'hb I l)!fi.l ! l . f jI i c0 250 500 750 1003 1233 1503 1753 2333 TIME (SECJtC51 t-4 FIGURE 4.10-6 i i i i i i e g
- i C
M -
se S
eu
- g \WfN#
- e .
O co ,
o
- d ~
a -
d' u.
t t I I I ' '
f 750 1230 1233 15C3 1750 2333 d 25# .
TIME (SECGTSI I
STEM 4 GENERATOR TUBE RUPTURE FROM HFP FIGURE 4.10-7 h i i i e i i i h
m Intact SGs
$h
\ -
=
E Wl 8
E w e El-
% Faulted SG -
f f I t p g g c0 250 500 750 1000 1250 1500 1750 2000 TIME (SECONDS)-
f i
i
l 4.11 LOSS OF LOAD Event Description A loss of load event occurs when the demand for steam from the turbine is reduced. The plant is designed to accept a small step
- reduction in load. A large reduction in load will cause the steam generator pressure and temperature to increase significantly. This will cause the reactor coolant system temperature and pressure to
. increase above normal operating limits.
A large loss of load will cause a turbine trip either by a signal from the generator switchgear or from the turbine overspeed trip signal. Termination of steam flow to the turbine can occur either due to automatic fast closure of the turbine control valves or closure of the turbine stop valves. Because of the more rapid closure time of the turbine stop valves, compared to the turbine control valves, closure of both turbine stop valves will result in a more severe transient.
Upon completion of stop valve closure, sensors on the stop valves initiate steam dump to the condenser and, if above 10 percent power, a reactor trip. The reduction in steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient.
t 4.102
l The automatic steam dump system will accommodate the post trip steam generation. Reactor coolant temperatures and pressure do not increase significantly if the steam dump to condenser and pressurizer pressure control system are functioning properly. If the condenser were not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost l causing the steam generator water level to fall. For this situation, feedwater flow would be maintained by the auxiliary feedwater system to ensure adequate decay heat removal capability.
If the atmospheric dump valve were to fail to operate or if the pressure rise is too fast for the capacity of the dump valve, the steam generator safety valves would lift to limit the pressure l excursion.
In the analysis, a complete loss of steam load is evaluated from full power, 4-loop and 3-loop operation. Reactor trip on turbine trip is not credited in order to show the adequacy of the pressure relieving devices and also to demonstrate margin to DNB. This assumption delays reactor trip until conditions result in a trip due to other signals. In addition, no credit is taken for steam dump to j condenser. Main feedwater flow is terminated at the time of loss of L
load, with no credit taken for manual initiation of auxiliary feedwater to mitigate the consequences of the transient. Auxiliary feedwater is automatically initiated on low-low level in the steam generator.
l 4.103
Method of Analysis The loss of load transient is analyzed by employing the RETRAN02 computer program to determine the system response.
The results of the RETRAN02 analysis, along with the limiting power distribution, are then used as input to the VIPRE01 computer program to determine the minimum DNBR. Plant characteristics and initial conditions are discussed in Section 4.0. Both 4-loop and 3-loop operation are considered.
The major assumptions is the analysis are as follows:
- 1) The initial reactor power and RCS temperature are assumed at their maximum values consistent with steady state full power operation including allowances for calibration and instrument errors. The initial RCS pressure is assumed at a minimum value consistent with steady state full power operation including allowances for calibration and instrument errors. This results in the minimum margin to DNB at the initiation of the f
- 2) The least negative Doppler and most positive moderator temperature coefficients are used, minimizing the pre-trip negative reactivity insertion. This maximizes the core power and RCS pressure excursion prior to reactor trip.
4.104
- 3) No credit is taken for automatic reactor control. In automatic reactor control, the control banks would insert reactivity prior to trip and reduce the severity of the transient.
- 4) No credit is taken for the operation of the atmospheric dump valve. The steam generator pressure rises to the safety valve setpoint where steam release through the safety valves limits secondary steam pressure.
- 5) Main feedwater flow to the steam generators is lost at the time of turbine trip. No credit is taken for manual initiation of auxiliary feedwater flow. Automatic auxiliary feedwater, initiated on low-low steam generator water level, removes core decay heat following plant stabilization.
- 6) Primary and secondary safety valves are modeled with minimum ,
flow capacities and with the opening setpoints increased from the nominal values by the setpoint uncertainties. This minimizes and delays heat removal and maximizes peak pressure.
- 7) Reactor trip is actuated by the first reactor protection system trip setpoint reached with no credit taken for direct reactor trip on turbine trip. Trip signals are expected due to high pressurizer pressure, high pressurizer water level, or high power level. The time rate of change of pressure at the time of reactor trip is maximized by incorporating reactor trip l
4.105
l delay times. This allows more time for heat to be stored in the primary system prior to reactor trip.
- 8) No credit is taken for pressurizer sprays or PORVs to reduce or limit pressurizer pressure during the peak pressure transient.
In order to minimize DNBR, the PORVs are assumed to be operable.
Except as discussed above, normal reactor control systems and engineered safety systems are not required to function to show acceptable results. No single active failure will prevent operation of any system whose operation is required to show acceptable results.
Analysis Results The system response to a total loss of steam load from full power 4-loop operation and full power 3-loop operation are provided. The sequence of events and plots of important parameters are provided in Tables 4.11-1 and 4.11-2 and Figures 4.11-1 through 4.11-20.
Figures 4.11-1 through 4.11-10 show the transient responses for the 4-loop case. No credit is taken for steam dump to condenser. The reactor trip signal is generated on high pressurizer pressure at 6.8 seconds. Due to the use of the most positive moderator temperature coefficient (MTC) and Doppler feedbacks, the nuclear power remains fairly constant until the reactor is tripped. The minimum DNBR remains well above 1.3. The pressurizer safety valves are actuated, and maintain l
4.106
primary system pressure below 110 percent of the design value. Three of the four steam generator safety valves on each SG lif t to provide pressure relief and limit the secondary side pressure excursion.
The complete loss of steam load accident during full power 3-loop i operation will be less severe than that during full power 4-loop 1
operation. This is due to the fact that the 3-loop reactor coolant volume is 88 percent of the 4-loop volume while the maximum initial power is limited to 65 percent of full power. Therefore, the reactor coolant volume to power ratio will be greater for full power 4-loop operation and the overpressurization and temperature increase effect is lower and less severe for full power 3-loop operation.
The parameters of interest are shown in Figures 4.11-11 through 4.11-20 for the loss af load event initiated from 3-loop operation.
An initial rise in core power is predicted during 3-loop operation.
This is due to the positive MTC present during 3-loop operation.
t
{ Conclusions The results of the analyses show that the plant design is such that
! during a complete loss of load, the RCS and the main steam system i
l Integrity is maintained. Pressure relieving devices incorporated in l
the primary and secondary systems are adequate to limit the maximum pressures to within 110 percent of the design limits. In addition, 1
j the minimum DNBR is maintained above 1.3.
t 4.107
1 TABI.E 4.11-1 Sequence of Events for the Loss of Load Time (sec)
Event 4-Loop 3-Loop Turbine stop valves closure, 0.01 0.01 loss of main feed flow High pressurizer pressure reactor 6.8 8.8 trip setpoint reached SG safety valves open 7.0 9.0 Control rods begin to drop 8.7 10.6 Pressurizer safety valve #1 actuated 9.0 11.0 Pressurizer safety valve #2 actuated 9.5 11.5 Pressurizer safety valve #3 actuated 10.5 -
Peak pressurizer pressure occurs 11.0 13.0 Peak pressurizer water volume occurs 15.5 17.5 Peak inlet temperature occurs 19.5 24.5 I
4.108
LOSS OF LOAD FROM FULL POWER 4 LOOP OPERATION FIGURE 4.11-1 W i . i i i i .
. s -
m l $.
l wp - .
i e N
I g.
l l l I l l $
e 20 90 s0 a0 100 120 190 iso TIME (SECONDI FIGURE 4.11-2 a ,
g . . . , , ,
-g y- - -
a~
t i
Ea_
s - _
E E
dE - -
s E
wE_
UT f I I 1 e i i
! 20 90 60 80 100 120 190 160 TIMEISECOND)
LOSS OF LOAD FROM FULL POWER 4 LOOP OPERATION FIGURE 4.11-3 i i i g i i i i e
$g _
E E
BR R
!EE i I f f I 1 1 20 40 60 50 100 120 190 160 TIME (SECOND)
FIGURE 4.11-4 i i 8 i i i i i s
M -
28 5
g afety Valve #1 W
d
>. 9 Safety Vdive #2 g .
E
~
~
Rig IE
\
,,, Safety Valve #3 l l L! ! ! ! ! ! !
c0 20 90 60 80 100 120 140 160 TIME (SECOND)
LOSS OF LOAD FROM FULL POWER 4 LOOP OPERATION FIGURE 4.11-5 R i i i i i i i n -
T-"
i b
s -
w:
5
, 8 bg - -
e-
- s N
E _ -
g
, , , f . I b 20 90 60 80 100 120 140 160 TIMEISECONDI FIGURE 4.11- 6 i i i g i i i e
- w l 5
~
i kR
- e W
g _ , -
.d g em og b 20 40 60 80 100 120 190 ISO l TIME (SECOND) l
l.0SS 01: 1.0AI) 1:lt051 lilli l. l'0Wi!R 4.1,0018 Ol'UllAT10N FIGURE 4.11-7 8
i i i i i i i L
g-i r
l
@g -
p, 10 i 5 %.
58 g-Z 8
M _
g l
I t i I I f f b 20 90 60 80 100 120 190 150 TIME (SECOND) 1 i FIGURE 4.11-8 i
ss , , , , i i E
C -
8g
- e
- E e -
~
( gl u.
Y ~
~
i C .
I
\ v>
40 60 80 100 120 140 160 cf) 20 TIME (SECONDI L
LOSS OF LOAD FRO >l Fill L POWER 4 LOOP OPERATION FIGURE 4.11-9 I 5 I i I I I EH E
E _
.gf w
W -
~
ER w
a
@a t f I f f f I b 20 40 60 80 TIME (SECOND) 100 120 190 160 FIGURE 4.11-10 5.0 4.0 l
r a x
3.0 2.0 _.
1.0 20 0 5 10 15 time (second)
LOSS OF LOAD FROM FULL POWER 3 LOOP OPERATION FIGURE 4.11- 11 y i . . i i i i t a i
E _
wg -
B' O
h -
t I t
g i t t i
w so so toO 12o IH iso ce to TIMEtSECONDI FIGURE 4.11- 12 a~ l 8 4 . I i .
l I
U! - -
l
- =
t lr E @ -
es e
5 -
d% -
3 LLS z
eg _
l 87 t t I r 1 t
80 100 120 140 150 20 90 60 TIME (SECOND1
LOSS OF LOAD FROM FULL POWER 3 LOOP OPERATION FIGURE 4.11-13 i
g e i i i e i
~
ER r_
3 -
$e E
EH E
O -
EE- ,
f I I I I I f 80 100 120 140 160 ,
20 90 00 TIME (SECOND)
FIGURE 4.11-14 g i i i i i i i S -
Rg E
d 8 -
] -
d8 W Safety Valve #1 Y. .
>- 9 Ei I m Safety Valve #2 -
l gg -
l E 4 i A! ! ! ! ! ! !
c0 20 90 60 80 100 120 140 150 TIME (SECOND)
LOSS OF LOAD FROM FULL POWER 3 LOOP OPERATION FIGURE 4.11- 15 8, i i i i i i i
_g - -
T-"
15 wg - -
l 5-8 5g - -
5-2 N
te cL - -
t I I I I I i b 20 40 63 80 100 120 190 160 TIME (SECOND)
FIGURE 4.11- 16 4 5 5 4 8 3 4
~
s;5
! !s, -
Y w
t .ig W
~~
\
1 t t t t t I l
b 20 40 60 80 100 120 190 160 TIME (SECONDI
LOSS 01: 1.0AD 1: ROM I:UI.L POWi!R 3 1.00P OPliRATION FIGURE 4.11-17
$ i i i i . . i
_R m
Ws -
in: x 0
E EM i 8 s
m -
e i f f f I f f b 20 90 60 80 100 120 140 150 TIME (SECOND)
FIGURE 4.11-18 i i i i i i g i 4
3m k
e E
cf -
gE n d l w -
l $8 N Jl s
, , , J , u I1, t ,
, , l c0 20 40 60 80 100 120 190 160 i TIME (SECON01
LOSS OF LOAD FROM FULL POWER 3 LOOP OPERATION FIGURE 4.11-19 i i i i i g i i gg _
E E _
i EI W
~
R e
a a _
I I i f f I f b 20 40 50 80 100 120 190 150 TIME (SECOND)
FIGURE 4.11-20 4
5.0-4.0-oc E 3.0-
? -
2.0<
1 l
- 1. 0, 0 5' l'0 l'5 2'O Time (second)
4.12 LOSS OF NORMAL FEEDWATER FLOW i
Event Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in the i
l capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.
Following reactor trip with offsite AC power available, two reactor coolant pumps (RCPs) are tripped and two RCPs remain running.
- Following RCP coastdown in two of the four reactor coolant loops,
( reverse flow occurs in those reactor coolant loops, and consequently heat removal capability may be limited to two steam generators in l
4-loop operation and one steam generator in 3-loop operation. If a l
loss of offsite power occurs and all four RCPs coastdown, natural circulation is established in all steam generators and all steam generators are available for heat removal. Since fewer steam generators are available with offsite AC power available, single failures in the auxiliary feedwater system have a greater impact.
Thus, the limiting loss of normal feedwater event is one initiated 4.109
_ _ _ _ _ _ _ - _ _ _ _ _ ~ _ . . , . _ .
with offsite AC power available and with the limiting single failure.
The following events would occur upon a total loss of normal feedwater with offsite AC power available.
- 1. A reactor trip will occur due to low steam generator level i
coincident with steam / feed flow mismatch.
t
- 2. As the steam pressure rises following the trip, the steam dump to the condenser valves would automatically open. If the steam dump to the condenser were unavailable, the steam generator safety valves would lift to remove the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
- 3. As the no-load temperature is approached, the steam dump to condenser valves (or the self-actuated safety valves, if the steam dump to condenser valves are not available) are used to remove the residual decay heat and to maintain the plant at the I hot shutdown condition.
The auxiliary feedwater system is started automatically as follows:
Two steam-driven auxiliary feedwater pumps are started on any of the following:
j
- 4.110 l
i l
- 1. low level in any two steam generators,
- 2. both main feedwater pump motor breakers open; or
- 3. manual actuation.
An analysis of the system response to a total loss of normal feedwater is presented below to show that the auxiliary feedwater system is capable of removing the stored and residual heat, preventing either overpressurization of the RCS or loss of water from the reactor core, and thus maintaining the plant in a safe condition.
Methods of Analysis A detailed analysis using the RETRAN02 computer code is performed in order to obtain the system response following a total loss of normal feedwater. The simulation describes the plant thermal kinetics and RCS including the pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature. The results of the RETRAN02 analysis, along with the limiting power distribution, are then used to generate input to the VIPRE01 computer code to determine the minimum DNBR.
I l
4.111 l- _ .- .. , _ _ . __ _ _ --- -- _ _ _ ._. _ - - .
The assumptions made in the analysis are as follows:
- 1. The plant is initially operating at full power for both 4-loop and 3-loop operation.
- 2. A conservative core residual heat generation rate is used based upon long term operation at the initial power level preceding the trip.
- 3. Secondary system steam relief is achieved through the safety valves. Steam relief will, in fact be through the steam dump to condenser valves for most cases of loss of normal feedwater.
However, no credit for steam dump to condenser is taken in the j analysis.
- 4. The initial reactor coolant inlet temperature is conservatively lower than the nominal value since this results in a greater expansion of the RCS water during the transient and, thus, in a higher water level in the pressurizer.
The total loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and the auxiliary feedwater system in removing decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water. As such, the assumptions used in this analysis
- are designed to minimize the energy removal capability of the system l
l 4.112
I and to maximize the possibility of water relief from the coolant i system by maximizing the coolant system expansion.
s Plant characteristics and initial conditions are further discussed in Section 4.0. Normal reactor control systems are not assumed to function during this transient. The reactor protection system is
( required to trip the reactor following a loss of normal feedwater.
The auxiliary feedwater system is required to deliver the minimum auxiliary feedwater flow rate assumed in this analysis. No single f
active failure will prevent operation of any system required to function.
i Results Figures 4.12-1 through 4.12-7 show the significant plant parameters following a total loss of normal feedwater from 4-loop operation.
i Figures 4.12-8 through 4.12-13 are for 3-loop operation. The following discussion applies to both 4- and 3-loop operation.
I The reactor coolant pumps in loops one and three trip approximately one minute after the generator trips. This results in reverse flow i
in those two loops. The limiting active single failure for 4-loop operation is failure of one of the two steam-driven auxiliary t
feedwater pumps to start. For 3-loop operation the limiting initial plant configuration is for loop two to be out of service. This results in only one RCP running following generator trip. The limitinc single active failure for 3-loop operation is failure of 4.113
the auxiliary feedwater injection valve to steam generator four to open since this is the only RCS loop with a running RCP.
4 Sensitivity studies have been performed to identify these failures as the limiting single failures.
Following the reactor and turbine trip from full load, the water level in the steam generators will decrease due to the reduction of steam generator void fraction and because of the mass depletion caused by steam flow through the safety valves as the steam 1
generators continue to remove the stored and generated heat. Two minutes following reaching of the low level auxiliary feedwater initiation setpoint, at least one auxiliary feedwater pump is automatically started, reducing the rate of water level decrease.
The capacity of the auxiliary feedwater pumps is such that the water level in the steam generator being fed does not recede below the lowest level at which sufficient heat transfer area is available to remove the core residual heat and prevents water relief from the RCS relief or safety valves. From Figure 4.12-7 it can be seen that at no time is the tubesheet uncovered in the steam generators receiving l auxiliary feedwater flow. From Figure 4.12-2 it can be seen that at i no time is there water relief from the pressurizer.
I The minimum DNBR for the loss of feedwater from 4-loop operation is 1.75. The minimum DNBR for the loss of feedwater from 3-loop l operation is 2.52.
l 4.114
The calculated sequence of events for this accident is listed in Table 4.12-1. As shown on Figures 4.12-1 through 4.12-13, the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation. Standard plant shutdown procedures would be followed to further cool down the plant.
Conclusions T
The peak RCS pressure resulting from a total loss of normal feedwater does not exceed 110 percent of design pressure. In addition, liquid discharge from the pressurizer safety valves is not predicted to occur. The minimum DNBR remains above 1.3.
0 4.115
TABLE 4.12 SEQUENCE OF EVENTS FOR THE TOTAL LOSS OF MAIN FEEDWATER 4-Loop 3-Loop Time Time Event (Sec) (Sec)
Total Loss of Main Feedwater .01 .01 Reactor Trip on Low SG 7.2 8.1 Level Coincident With Steam / Feed Flow Mismatch Reactor Coolant Pumps in 67.2 68.1 Loops One and Three Begin to Coastdown RCS Pressure Reaches Safety 91. 81.
Valve Setpoint Auxiliary Feedwater Flow 235. 690.
Begins to Reach the Steam Generators Core Decay Heat Reduces ~2470. ~1825.
to Auxiliary Feedwater Heat Removal Capability Peak Pressurizer Water Level ~2470. ~1825.
/
4.116
LOSS OF NORMAL FEEDWATER FLOW FROM 4-LOOP OPERATION FIGURE 4.12-1 I I i i a i i 28 -
W S r E8 -
B r.
0 E
yl -
w -
Ef -
! I i i e i i 500 1000 1500 2000 2500 3000 3500 4000 TIME (SECONDS)
FIGURE 4.12-2 i i i i i i i
_g __.__ .___ ___ __ E r e.s.s uriz c.r__V cl.um c__
7" b -
Sm$
m NH u
a_ g -
r-I i i i t i i
3500 4000 k 500 1000 1500 2000 TIME (SECONOS) 2500 3000
LOSS OF NOIBIAL FEEDWATER FLOW FRG1 4-LOOP OPERATION FIGURE 4.12-3 i i i i i g i i
~
Sat h
E a ~
~
~
I
- jTcold
~
5_ 2
~
hot
~
g I I t 1 i t i 500 1000 1500 2000 2500 3000 3500 4000 TIME (SECONDS)
FIGURE 4.12-4 i i i i i .
g i
~
C@ T
- Sat n
E g -
s ~
Sg T : :
N g ilot -
T -
"3 cold I I t i i
' I t b 500 1000 1500 2000 2500 3000 3500 4000 TIME (SECONDS) 1
LOSS OF NORMAL FEEDWATER FLOW FRG14-LOOP OPERATION FIGURE 4.12-5 i i i i i I i g
g Sat R>- -
b s ~
S$ hTcold _
m : _
k
~
g 5 :
T Hot k a -
g i e i e i e i b 500 1000 1500 2000 2500 3003 3500 4000 TIME (SECONDS)
FIGURE 4.12-6 g i i i i i i i h Sat -
E b
s
~Tllot
~
Nb :
~
.r _
h U_ cold _
a$
i i e i i e i b 500 1000 1500 2000 2500 3000 3500 4000 TIME (SECONOSI l
i i
1 IDSS OF NOIM\L FELDWATER FLOW FRG14-LOOP OPFA\ TION FIGURE 4.12-7 l . . . . . . .
E d ~ ~
- =
e Nk - -
a- RCPs TRIPPED e
s i -
3 f RCPs RUNNING 1 1 I f I I i c0 500 1000 1500 2000 2500 3000 3500 m TIME (SECONDS) 3 I
i I
.k i
i 5
l
. . - , . - - , . . - - - - , - - . . . . . . - - ~ - . - . . , . .. . _ - - , - , - . . - . - . . - . - - . - - - - , , - - - - - , n--- - , - . . - . . . . , ,
l IDSS OF NOR\fAL FEEIMATER FIM FIDI 3-LOOP OPERATION 1
FIGURE 4.12-8 l i i i i . . i El- ,
e_ ,
si.
E oc ~
i s m
l 2
w ~
$h ~
j 4-
) t i e j g I t t 2000 t
2500 3000 3500 9000
' W 500 1000 1500 TIME ISECONDS) i 4
t FIGURE 4.12-9 4
i i i i
. i i Pressurizer Volume i
L i .
g .
. =
l $
t
- tr h
E. -
i i i f 1 I t i k 500 1000 1500 2000 TIME (SECONDS) 2500 3000 3500 4000 i
I ir
LOSS OF NORMAL FEEDWATER FLOW FROM 3-LOOP OPERATION FIGURE 4.12-10 i i i i i . i g
T g sat E
+
k 5 .
sg - -
~ cold g : :
a e 3 4 5 Hot l i i t t l t
3500 m k 300 1000 1500 2000 TIME (SECONDS) 2500 3000 FIGURE 4.12-11 i i i i i i i
g CE T
- sat n
+ _
5 ~
sg - _ _ _
" cold : : :
g : :
5 T ilot l
. i i rmo zs= =0 nm =
& 300 im is00 l TIME (SECONDS) l i
LOSS OF NORMAL FEEDWATER FLOW FROM 3-LOOP OPERATION FIGURE 4.12-12 i i i i g i i i b sat s
e-- -
g5 a
Sg =
r THotk b
s }T cold -
o -
5 I t t t t 8 I b 500 1000 1500 2000 2500 3000 32 W TIME (SECONDS)
FIGURE 4.12-13
, , i i i i i E
-s -
mg .. . .
f'
~
E f~
[ RCPs TRIPPED
~
N$.
a .
Pn lb RCP RUNNING f
t t t t i I d n IM 1500 m 22 M M 4M TIME (SECONDS)
4.13 REACTOR COOLANT PUMP ROTOR SEIZURE AND SHAFT BREAK In the following two sections the reactor coolant pump (RCP) rotor seizure and shaft break accident analyses are presented. These accidents were analyzed to determine both the MDNBR and peak RCS pressure for 4-loop and 3-loop operation. The RCP rotor seizure ,
accident produces the more limiting DNBR and RCS pressure results and therefore, only the rotor seizure results are presented.
4.13.1 Reactor Coolant Pump Rotor Seizure Event Description The RCP rotor seizure accident is analyzed as an instantaneous seizure of an RCP rotor. Flow through the affected reactor coolant loop is rapidly reduced. For 4-loop and 3-loop full power operation, the rotor seizure will cause a reactor trip signal due to low loop flow.
Following reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand.
At the same time, heat transfer to the secondary side of the steam generators is reduced, first because of reduced flow and then because of the increased secondary side temperature due to turbine trip. The rapid expansion of the coolant in the reactor core combined with reduced heat transfer in the steam 4.117
generators, causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system.
Method of Analysis The RCP rotor seizure transient is analyzed using two computer codes. First, the RETRAN02 code is used to perform a detailed plant transient analysis. The transient calculation with RETRAN02 includes the modeling of the Reactor Coolant System (RCS), the steam generators (SGs), the main steam and feedwater systems, and reactor core kinetics including fuel and moderator temperature feedback. The results calculated by RETRAN02 during the RCP rotor seizure transient include core inlet flow, nuclear power, core inlet temperature and RCS pressure.
One RETRAN02 analysis is performed to predict the peak RCS pressure during the RCP rotor seizure transient. A second RETRAN02 analysis is performed with assumptions which minimize the RCS pressure increase and create the most limiting DNBR conditions. The assumptions used in each RETRAN02 analysis are outlined later in the section.
Using the RETRAN02 results for the DNBR analysis, the VIPRE01 code is then used to determine the minimum DNBR during the transient.
4.118
l l
I Two separate analyses were performed for the RCP rotor seizure accident. One analysis used assumptions which resulted in the most limiting DNBR. The second analysis used assumptions to maximize the RCS pressure response. For each analysis, the RCP rotor seizure from full power 4-loop operation produced more limiting results than that from full power 3-loop operation.
An additional RCP rotor seizure analysis was performed for 74 percent power, 4-loop operation. For these conditions, one low loop flow signal will not cause a reactor trip (see Section 4.8 for a discussion of the low loop flow reactor trip). However, results indicate that this event is less severe than the rotor seizure at 100 percent power with respect to both MDNBR and peak pressure.
The following discussions of assumptions and results addresses the RCP rotor seizure transients from 4 and 3-loop full power operation. The analysis of those two transients is presented to show that following an RCP rotor seizure, the RCS pressure does not increase above 2750 psia (110 percent of design pressure) and the MDNBR does not decrease below 1.3.
The assumptions made in the analyses are as follows:
- 1. The plant is initially at 4-loop or 3-loop full power operation.
4.119
- 2. Reactor trip occurs due to low loop flow. The maximum instrument response time and trip delay time are also included.
- 3. A least negative Doppler deficit is used to minimize the core power decrease due to fuel heatup.
- 4. A most positive moderator temperature coefficient is used to maximize the core power increase due to the pre-trip coolant heatup.
- 5. Initial RCS pressure is minimized in the DNB analysis and maximized in the peak pressure analysis.
- 6. Initial core inlet temperature is maximized in the DNB analysis and minimized in the peak pressure analysis.
- 7. A minimum initial RCS flow rate is used.
- 8. A loss of AC power occurs coincident with the low flow reactor trip signal.
9a. The following assumptions are made in the analysis performed to support the DNBR calculations to minimize the RCS pressure rise and/or maximize the core power:
4.120
Minimum initial pressurizer level Maximum initial SG level Maximum turbine stop valve closure time Maximum pressurizer spray Pressurizer heaters off Charging isolated, letdown available Assumptions regarding post-trip main feedwater, auxiliary feedwater, SG safety valve and pressurizer PORV operation have no effect on the DNBR results for these transients.
9b. The following assumptions are made to maximize the peak RCS pressure:
Maximum initial pressurizer level Minimum initial SG level Minimum turbine stop valve closure time Pressurizer spray isolated Pressurizer heaters available Charging available, letdown isolated Pressurizer PORVs not available Assumptions regarding post trip main feedwater, auxiliary feedwater and SG safety valve operation have no effect on the peak RCS pressure for these transients.
s 4.121
Plant characteristics and initial conditions are further discussed in Section 4.0.
DNBR Analysis Results Figures 4.13-1 to 4.13-6 show the significant plant parameters during the RCP rotor seizure transient from full power 4-loop operation. Figures 4.13-7 to 4.13-12 show these parameters for the RCP rotor seizure from full power 3-loop operation. A time sequence of events is listed for both transients in Table 4.13-1.
In the 4-loop RCP rotor seizure analysis the low flow reactor trip signal is generated approximately 0.2 seconds after the RCP rotor seizure occurs. Due to delay and response times, the control rods begin to drop about 1.1 seconds after the trip signal. Nuclear power and core heat flux decrease slightly prior to control rod insertion due to fuel heatup and Doppler reactivity feedback.
Pressurizer pressure increases to a maximim of 2002 psia at 4.0 seconds. This pressure increase is minimized due to the assumptions mentioned earlier in order to minimize DNBR.
The minimum DNBR of 1.37 occurs at 2.7 seconds. At this time the core flow rate has decreased to about 65 percent 4.122
of its initial value. Since the minimum DNBR remains above 1.3 during the RCP rotor seizure transient at 100 percent power no fuel failures are predicted to occur.
In the RCP rotor seizure analysis from 3-loop operation the low flow trip signal is generated at C.2 seconds. The l
control rods begin to drop about 1.1 seconds after the trip signal as in the previous case. Due to the positive moderator temperature coefficient the nuclear power and core heat flux increase prior to reactor trip.
Pressurizer pressure increases very slightly during this RCP rotor seizure transient. This response is due to conservative operating assumptions for the pressurizer heaters and spray and serves to minimize the DNBR.
For the RCP rotor seizure at full power 3-loop operation the minimum DNBR of 2.0 occurs at 2.8 seconds. At this time the core flow rate has decreased to about 56 percent of its initial value. No fuel failure is expected during this transient since the minimum DNBR remains above 1.3.
For Haddam Neck, DNB is not predicted to occur during RCP rotor seizure transients. The results of the rotor seizure are similar to, but slightly more severe than the results of the loss of flow transients (see Section 4.8).
4.123
Peak Pressure Analysis Results l
l As noted earlier, a conservatively long delay is assumed between the time of the low flow reactor trip signal and control rod motion. Also, no credit is taken for the pressure reducing effect of the pressurizer PORVs, pressurizer spray, steam dump and controlled feedwater flow after plant trip.
The highest RCS pressure as found to occur for the RCP rotor seizure from full power 4-loop operation. The RCS pressure response during this transient is shown in Figure 4.13-13. The peak pressure in this analysis is well below 110 percent of design pressure (2750 psia).
Therefore, the integrity of the RCS is not endangered.
Peak Clad Temperature Results The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on sensitivity studies on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient was assumed to increase from a steady state value consistent with initial fuel temperature to 4.124
10,000 Btu /hr-ft 2 *F at the time of reactor trip. The low initial value maximizes the initial stored energy.
Increasing the coefficient during the transient maximizes the heat transfer to the cladding at the time of reactor trip.
The peak clad temperature in all RCP rotor seizure transients remains below the clad temperature design limit. Therefore, the core integrity is assured with no loss of core cooling capability.
Conclusions The results of the analyses show that the DNBR will not decrease below the limiting value of 1.3 at any time during the assumed RCP rotor seizure transients.
Additionally, the RCS pressure limit and clad temperature design limit are not exceeded. Thus, for all postulated RCP rotor seizure transients, no fuel or clad damage is predicted and the integrity of the RCS is not endangered.
4.125
4.13.2 Reactor Coolant Pump Shaft Break Event Description The RCP shaft break assumes an instantaneous separation of the RCP impeller and shaft from the RCP motor / flywheel assembly.
Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the RCP rotor seizure event. As in the RCP rotor seizure event, the shaft break event at full power 4-loop operation and full power 3-loop operation will c ause a reactor trip due to low loop flow.
Conclusions The shaft break analyses performed show that the minimum DNBR and peak clad temperature calculated for the RCP shaft break are bounded by those calculated for the locked rotor incident (Section 4.13.1). With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position, as assumed in the locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady state) core flow. For the shaft break incident, reactor trip occurs very early in the transient as in the locked rotor event.
4.126
Table 4.13-1 Sequence of Events for the RCP Rotor Seizure 4-Loop 3-Loop Time Time EVENT (Sec) (Sec)
Rotor seizure occurs 0.02 0.02 Flow coastdown begins Low flow reactor trip setpoint 0.2 0.2 Control rods begin to drop 1.3 1.3 Minimum DNBR occurs 2.7 2.8 Peak pressure occurs 4.0 2.1 4.127
REACTOR COOLANT PUMP ROTOR SEIZURE FROM HFP 4-LOOP OPERATION FIGURE 4.13.1-1
, i i i s i s a -
58
}
E b ~
ok E
b
~
8 ct E
w -
ag -
M- <
8 8 10 12 14 15 cD 2 4 6 TIME (SEC)
FIGURE 4.13.1-2 i i i i i i i 1
h.k C
E by -
O E -
s -
E' d
E -
W9
' ' ' i e i i 8
O 2 9 6 8 10 -
12 14 16 TIME ISEC)
REACTOR COOLANT pub 1P ROTOR SEIZURE FROM liFP 4 -LOOP OPERATION F I GtIRii 4 .13.1 - 3 i i i s a i a 38 -
E' C
E eq - -
o 5
o _ -
E' d
u - -
Bri 8
cb 2 'e 6 8 10 12 19 16 TIME (SEC)
FIGURE 4.13.1-4 g i i i i i i i e
g - f -
C Ilo t cr e W
e 5 ss*
T Avg 8
e ; ; ;
= ; ; ;
7 T
Cold i I I I I I I b 2 9 6 8 10 12 19 16 TIME (SEC)
REACTOR C001. ANT PilMP ROTOR SEIZURE 1: ROM lil:P 4-1.00P OPlillAT10N I:l Gilitli 4 .13.1 - 5
@ i i i i i i i N
~ ~
r Eo - -
5?E lC E
58 - -
m-i
!3 E!
t i l 1 1 I i 2 9 6 8 10 12 14 16 TIME ISEC)
FIGURE 4.13.1-6 y i i i i i i i e -
u 7, -
M a
o -
c.
3 g i ! I i t i g
-b 1 2 3 4 5 6 7 e TIME (SEC)
Rl! ACTOR C001. ANT PilblP 110Tolt SEIZ11111!
1R051IIFP 3-1.00P OPERATION FIGURE 4.13.1-7 iC i i i i i i i
esa
~
- b. -
k_
B-1 E
b -
?
$ 2
- s e ib i i 5 TIME (SEC)
FIGURE 4.13.1-8 q i i i i i i i t
5 ~
e r, d
w_ o -
D d
E -
W9 i$ is 1 2 s s e i i TIME (SEC1
REACTOR COOLANT PUMP ROTOR SEIZURE FROM HFP 3-LOOP OPERATION FIGURE 4.13.1-9 k-i i i i i i i
=
z
~
ok 0
E S
g 8-d W -
~
89 g , ,
cD 2 9 6 8 10 12 14 16 TIME (SEC)
FIGURE 4.13.1-10 i i g i i i i e e
o _
Ilo t wg -
E 5
ko
~
Wg T gyg 8
Cr : : : : :
7
- T
, Cold I I I '
t 1 1 b 2 9 6 0 10 12 14 16 TIME (SEC)
REACTOR COOLANT PUMP ROTOR SEIZURE FROM HFP 3-LOOP OPERATION FIGURE 4.13.1-11
@ i i i i i i i n
e -
Ng -
a-t0 E
58 m-E 8
Ng -
m_
i I i t i 1 I 2 4 6 8 10 12 14 15 TIME (SEC)
FIGURE 4.13.1-12 i i i i e i i c:
m A
A
~
a -
d I t ! I I I f
A 1 2 3 4 5 6 7 8 TIME (SEC)
REACTOR COOLANT PUMP ROTOR SEIZURE FROM llFP 4-LOOP OPERATION FIGURE 4.13.1-13 l i i i e i i i Eg p
=
a.
s 8
El f I f f I I f 10 20 30 40 50 60 70 60 TIME (SEC)
5.0 REFERENCES
- 1. Connecticut Yankee Atomic Power Company, Haddam Neck Plant, Facility Description and Safety Analysis, Docket No. 50-213.
- 2. United States Nuclear Regulatory Commission, Integrated Plant Safety Assessment Report, Systematic Evaluation Program, Haddam Neck Plant, NUREG-0826, dated June, 1983.
- 3. NUSCO Thermal Hydraulic Model Qualification Volume I (RETRAN),
NUSCO 140-1, dated August 1, 1984.
- 4. NUSCO Thermal Hydraulic Model Qualification Volume II (VIPRE),
NUSCO 140-2, dated August 1, 1984.
- 5. Calculative Methods for the Northeast Utilities Small Break LOCA ECCS Evaluation Model, Dated July 1984, Docket No. 50-213.
- 6. J. A. Blaisdell (Chairman UGRA Executive Committee, NU) letter to H. R. Denton (NRC), NE-85-SAB-285 dated October 10, 1985.
5.1
_ .__ ____