ML20209A392
Text
Millstone Power Station Unit 3 Safety Analysis Report Chapter 15: Accident Analyses
Revision 3306/30/20 MPS-3 FSAR 15-i CHAPTER 15ACCIDENT ANALYSES Table of Contents Section Title Page
15.0 INTRODUCTION
.................................................................................... 15.0-1 15.0.1 Classification of Plant Conditions ............................................................ 15.0-1 15.0.1.1 Condition I - Normal Operation and Operational Transients ................... 15.0-2 15.0.1.2 Condition II - Faults of Moderate Frequency ........................................... 15.0-3 15.0.1.3 Condition III - Infrequent Faults............................................................... 15.0-4 15.0.1.4 Condition IV - Limiting Faults ................................................................. 15.0-5 15.0.2 Optimization of Control Systems ............................................................. 15.0-6 15.0.3 Plant Characteristics and Initial Conditions Assumed in the Accident Analyses .................................................................................... 15.0-6 15.0.3.1 Design Plant Conditions ........................................................................... 15.0-6 15.0.3.2 Initial Conditions ...................................................................................... 15.0-6 15.0.3.3 Power Distribution .................................................................................... 15.0-7 15.0.4 Reactivity Coefficients Assumed in the Accident Analyses .................... 15.0-8 15.0.5 Rod Cluster Control Assembly Insertion Characteristics ......................... 15.0-8 15.0.6 Trip Points and Time Delays to Trip Assumed in Accident Analyses ..... 15.0-9 15.0.7 Plant Systems and Components Available for Mitigation of Accident Effects...................................................................................... 15.0-10 15.0.8 Fission Product Inventories .................................................................... 15.0-10 15.0.8.1 Inventory in the Core .............................................................................. 15.0-10 15.0.8.2 Inventory in the Fuel Clad Gap............................................................... 15.0-11 15.0.8.3 Reactor Coolant Activity ........................................................................ 15.0-11 15.0.9 Residual Decay Heat............................................................................... 15.0-11 15.0.9.1 Total Residual Heat ................................................................................ 15.0-11 15.0.9.2 Decay Heat Modeling for Small Break Loss-of-Coolant Accident ........ 15.0-11 15.0.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident .................................................................................................. 15.0-11 15.0.10 Computer Codes Utilized........................................................................ 15.0-12 15.0.10.1 FACTRAN.............................................................................................. 15.0-12 15.0.10.2 LOFTRAN .............................................................................................. 15.0-12 15.0.10.3 Casmo5 ................................................................................................... 15.0-13
Revision 3306/30/20 MPS-3 FSAR 15-ii CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.0.10.4 Simulate5 ................................................................................................ 15.0-13 15.0.10.5 TWINKLE .............................................................................................. 15.0-13 15.0.10.6 VIPRE ..................................................................................................... 15.0-13 15.0.10.7 RETRAN ................................................................................................ 15.0-14 15.0.11 References for Section 15.0 .................................................................... 15.0-14 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.1-1 15.1.1 Feedwater System Malfunctions that Result in a Decrease in Feedwater Tem-perature ..................................................................................................... 15.1-1 15.1.1.1 Identification of Causes and Accident Description .................................. 15.1-1 15.1.1.2 Analysis of Effects and Consequences ..................................................... 15.1-2 15.1.1.3 Conclusions............................................................................................... 15.1-3 15.1.1.4 Radiological Consequences ...................................................................... 15.1-3 15.1.2 Feedwater System Malfunctions that Result in an Increase in Feedwater Flow......................................................................................... 15.1-3 15.1.2.1 Identification of Causes and Accident Description .................................. 15.1-3 15.1.2.2 Analysis of Effects and Consequences ..................................................... 15.1-3 15.1.2.3 Conclusions............................................................................................... 15.1-6 15.1.2.4 Radiological Consequences ...................................................................... 15.1-6 15.1.3 Excessive Increase In Secondary Steam Flow.......................................... 15.1-6 15.1.3.1 Identification of Causes and Accident Description .................................. 15.1-6 15.1.3.2 Analysis of Effects and Consequences ..................................................... 15.1-7 15.1.3.3 Results and Conclusions ........................................................................... 15.1-7 15.1.3.4 Radiological Consequences ...................................................................... 15.1-7 15.1.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a De-pressurization of the Main Steam System................................................. 15.1-7 15.1.4.1 Identification of Causes and Accident Description .................................. 15.1-7 15.1.4.2 Analysis of Effects and Consequences ..................................................... 15.1-9 15.1.4.3 Radiological Consequences ...................................................................... 15.1-9 15.1.5 Steam System Piping Failure .................................................................... 15.1-9 15.1.5.1 Identification of Causes and Accident Description .................................. 15.1-9
Revision 3306/30/20 MPS-3 FSAR 15-iii CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.1.5.2 Analysis of Effects and Consequences ................................................... 15.1-11 15.1.5.3 Conclusions............................................................................................. 15.1-15 15.1.5.4 Radiological Consequences .................................................................... 15.1-15 15.1.6 References for Section 15.1 .................................................................... 15.1-16 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.2-1 15.2.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow ............................................................................................... 15.2-1 15.2.2 Loss of External Electrical Load .............................................................. 15.2-1 15.2.2.1 Identification of Causes and Accident Description .................................. 15.2-1 15.2.2.2 Analysis of Effects and Consequences ..................................................... 15.2-3 15.2.2.3 Conclusions............................................................................................... 15.2-3 15.2.2.4 Radiological Consequences ...................................................................... 15.2-3 15.2.3 Turbine Trip .............................................................................................. 15.2-4 15.2.3.1 Identification of Causes and Accident Description .................................. 15.2-4 15.2.3.2 Analysis of Effects and Consequences ..................................................... 15.2-5 15.2.3.3 Conclusions............................................................................................... 15.2-7 15.2.3.4 Radiological Consequences ...................................................................... 15.2-8 15.2.4 Inadvertent Closure of Main Steam Isolation Valves ............................... 15.2-8 15.2.5 Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip 15.2-8 15.2.6 Loss of Nonemergency AC Power to the Station Auxiliaries .................. 15.2-8 15.2.6.1 Identification of Causes and Accident Description .................................. 15.2-8 15.2.6.2 Analysis of Effects and Consequences ................................................... 15.2-10 15.2.6.3 Conclusions............................................................................................. 15.2-11 15.2.6.4 Radiological Consequences .................................................................... 15.2-11 15.2.7 Loss of Normal Feedwater Flow ............................................................ 15.2-12 15.2.7.1 Identification of Causes and Accident Description ................................ 15.2-12 15.2.7.2 Analysis of Effects and Consequences ................................................... 15.2-13 15.2.7.3 Conclusions............................................................................................. 15.2-15 15.2.7.4 Radiological Consequences .................................................................... 15.2-15
Revision 3306/30/20 MPS-3 FSAR 15-iv CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.2.8 Feedwater System Pipe Break ................................................................ 15.2-16 15.2.8.1 Identification of Causes and Accident Description ................................ 15.2-16 15.2.8.2 Analysis of Effects and Consequences ................................................... 15.2-17 15.2.8.3 Conclusions............................................................................................. 15.2-21 15.2.8.4 Radiological Consequences .................................................................... 15.2-21 15.2.9 References for Section 15.2 .................................................................... 15.2-21 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ........................................................................................................ 15.3-1 15.3.1 Partial Loss of Forced Reactor Coolant Flow........................................... 15.3-1 15.3.1.1 Identification of Causes and Accident Description .................................. 15.3-1 15.3.1.2 Analysis of Effects and Consequences ..................................................... 15.3-2 15.3.1.3 Conclusions............................................................................................... 15.3-3 15.3.1.4 Radiological Consequences ...................................................................... 15.3-3 15.3.2 Complete Loss of Forced Reactor Coolant Flow...................................... 15.3-3 15.3.2.1 Identification of Causes and Accident Description .................................. 15.3-3 15.3.2.2 Analysis of Effects and Consequences ..................................................... 15.3-4 15.3.2.3 Underfrequency ........................................................................................ 15.3-5 15.3.2.4 Conclusions............................................................................................... 15.3-5 15.3.2.5 Radiological Consequences ...................................................................... 15.3-5 15.3.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor).............................. 15.3-6 15.3.3.1 Identification of Causes and Accident Description .................................. 15.3-6 15.3.3.2 Analysis of Effects and Consequences ..................................................... 15.3-6 15.3.3.3 Conclusions............................................................................................... 15.3-9 15.3.3.4 Radiological Consequences ...................................................................... 15.3-9 15.3.4 Reactor Coolant Pump Shaft Break ........................................................ 15.3-10 15.3.4.1 Identification of Causes and Accident Description ................................ 15.3-10 15.3.4.2 Conclusions............................................................................................. 15.3-10 15.3.5 References for Section 15.3 .................................................................... 15.3-10
Revision 3306/30/20 MPS-3 FSAR 15-v CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES ............ 15.4-1 15.4.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcrit-ical or Low Power Startup Condition ....................................................... 15.4-1 15.4.1.1 Identification of Causes and Accident Description .................................. 15.4-1 15.4.1.2 Analysis of Effects and Consequences ..................................................... 15.4-3 15.4.1.3 Conclusions............................................................................................... 15.4-5 15.4.1.4 Radiological Consequences ...................................................................... 15.4-5 15.4.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power .................................................................................................... 15.4-5 15.4.2.1 Identification of Causes and Accident Description .................................. 15.4-5 15.4.2.2 Analysis of Effects and Consequences ..................................................... 15.4-7 15.4.2.3 Conclusions............................................................................................. 15.4-10 15.4.2.4 Radiological Consequences .................................................................... 15.4-10 15.4.3 Rod Cluster Control Assembly Misalignment........................................ 15.4-10 15.4.3.1 Identification of Causes and Accident Description ................................ 15.4-10 15.4.3.2 Analysis of Effects and Consequences ................................................... 15.4-12 15.4.3.3 Conclusions............................................................................................. 15.4-16 15.4.3.4 Radiological Consequences .................................................................... 15.4-16 15.4.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature and Boron Concentration................................................... 15.4-17 15.4.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate................................................ 15.4-17 15.4.6 Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant................................ 15.4-17 15.4.6.1 Identification of Causes and Accident Description ................................ 15.4-17 15.4.6.2 Analysis of Effects and Consequences ................................................... 15.4-20 15.4.6.3 Conclusions............................................................................................. 15.4-25 15.4.6.4 Radiological Consequences .................................................................... 15.4-25 15.4.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position ................................................................................... 15.4-25 15.4.7.1 Identification of Causes and Accident Description ................................ 15.4-25 15.4.7.2 Analysis of Effects and Consequences ................................................... 15.4-26
Revision 3306/30/20 MPS-3 FSAR 15-vi CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.4.7.3 Conclusions............................................................................................. 15.4-27 15.4.7.4 Radiological Consequences .................................................................... 15.4-27 15.4.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents ........... 15.4-27 15.4.8.1 Identification of Causes and Accident Description ................................ 15.4-27 15.4.8.1.1 Design Precautions and Protection ......................................................... 15.4-27 15.4.8.1.2 Limiting Criteria ..................................................................................... 15.4-30 15.4.8.2 Analysis of Effects and Consequences ................................................... 15.4-31 15.4.8.2.1 Calculation of Basic Parameters ............................................................. 15.4-32 15.4.8.3 Conclusions............................................................................................. 15.4-36 15.4.8.4 Radiological Consequences .................................................................... 15.4-37 15.4.9 References for Section 15.4 .................................................................... 15.4-38 15.5 INCREASE IN REACTOR COOLANT INVENTORY.......................... 15.5-1 15.5.1 Inadvertent Operation of the Emergency Core Cooling System During Power Operation .................................................................................................. 15.5-1 15.5.1.1 Identification of Causes and Accident Description .................................. 15.5-1 15.5.1.2 Analysis of Effects and Consequences ..................................................... 15.5-2 15.5.1.3 Conclusions............................................................................................... 15.5-5 15.5.1.4 Radiological Consequences ...................................................................... 15.5-6 15.5.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory ..................................................................................... 15.5-6 15.5.2.1 Identification of Causes and Accident Description .................................. 15.5-6 15.5.2.2 Analysis of Effects and Consequences ..................................................... 15.5-7 15.5.2.3 Results....................................................................................................... 15.5-8 15.5.2.4 Conclusions............................................................................................... 15.5-9 15.5.3 A Number of BWR Transients ................................................................. 15.5-9 15.5.4 References for Section 15.5 ...................................................................... 15.5-9 15.6 DECREASE IN REACTOR COOLANT INVENTORY ........................ 15.6-1 15.6.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve................... 15.6-1 15.6.1.1 Identification of Causes and Accident Description .................................. 15.6-1 15.6.1.2 Analysis of Effects and Consequences ..................................................... 15.6-2
Revision 3306/30/20 MPS-3 FSAR 15-vii CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.6.1.3 Conclusions............................................................................................... 15.6-3 15.6.1.4 Radiological Consequences ...................................................................... 15.6-3 15.6.2 Failure of Small Lines Carrying Primary Coolant Outside Containment. 15.6-3 15.6.3 Steam Generator Tube Failure .................................................................. 15.6-4 15.6.3.1 Identification of Causes and Accident Description .................................. 15.6-5 15.6.3.2 Analysis of Effects and Consequences ..................................................... 15.6-8 15.6.3.2.1 Margin to Steam Generator Overfill ......................................................... 15.6-8 15.6.3.2.2 Radiological Consequences ...................................................................... 15.6-9 15.6.3.2.2.1 Thermal and Hydraulic Analysis .............................................................. 15.6-9 15.6.3.2.2.2 Radiation Dose Analysis......................................................................... 15.6-14 15.6.4 Spectrum of BWR Steam System Piping Failures Outside of Containment (Not Applicable to Millstone 3).............................................................. 15.6-17 15.6.5 Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.......................... 15.6-17 15.6.5.1 Identification of Causes and Frequency Classification........................... 15.6-17 15.6.5.2 Best Estimate Large Break Loss of Coolant Analysis (BE-LBLOCA).. 15.6-18 15.6.5.2.1 General.................................................................................................... 15.6-18 15.6.5.2.2 Method of Analysis................................................................................. 15.6-20 15.6.5.2.3 Analysis Assumptions............................................................................. 15.6-22 15.6.5.2.4 Design Basis Accident ............................................................................ 15.6-22 15.6.5.2.5 Post Analysis of Record Evaluations...................................................... 15.6-24 15.6.5.2.6 Conclusions............................................................................................. 15.6-25 15.6.5.3 Small Break LOCA................................................................................. 15.6-26 15.6.5.3.1 Description of Small Break LOCA Transient......................................... 15.6-26 15.6.5.3.2 Small Break LOCA Evaluation Model ................................................... 15.6-27 15.6.5.3.3 Input Parameters and Initial Conditions ................................................. 15.6-28 15.6.5.3.4 Small Break Results................................................................................ 15.6-28 15.6.5.4 Radiological Consequences .................................................................... 15.6-29 15.6.5.5 Conclusions............................................................................................. 15.6-32 15.6.6 BWR Transients...................................................................................... 15.6-32 15.6.7 References for Section 15.6 .................................................................... 15.6-32
Revision 3306/30/20 MPS-3 FSAR 15-viii CHAPTER 15ACCIDENT ANALYSES Table of Contents (Continued)
Section Title Page 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT.......................................................................................... 15.7-1 15.7.1 Radioactive Gaseous Waste System Failure............................................. 15.7-1 15.7.2 Radioactive Liquid Waste System Leak or Failure (Atmospheric Release).............................................................................. 15.7-1 15.7.3 Liquid Containing Tank Failure ............................................................... 15.7-1 15.7.4 Design Basis Fuel Handling Accidents .................................................... 15.7-1 15.7.4.1 Identification of Causes and Accident Description .................................. 15.7-1 15.7.4.2 Sequence of Events and Systems Operation............................................. 15.7-1 15.7.4.2.1 Fuel Handling Accident in the Fuel Building ........................................... 15.7-2 15.7.4.2.2 Fuel Handling Accident in Containment .................................................. 15.7-2 15.7.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool ........................................................... 15.7-3 15.7.4.3 Radiological Consequences ...................................................................... 15.7-3 15.7.5 Spent Fuel Cask Drop Accidents .............................................................. 15.7-3 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM ............................ 15.8-1 15.8.1 References for Section 15.8 ...................................................................... 15.8-1 Appendix 15A Dose Methodology............................................................................. 15.A-1 15.A.1 References for Appendix 15A ................................................................. 15.A-5 Appendix 15B Deleted by FSARCR 02-MP3-017 .....................................................15.B-1
Revision 3306/30/20 MPS-3 FSAR 15-ix CHAPTER 15-ACCIDENT ANALYSES List of Tables Number Title 15.0-1 Nuclear Steam Supply System Power Ratings 15.0-2 Summary of Initial Conditions and Computer Codes Used 15.0-3 Nominal Values of Pertinent Plant Parameters Utilized in the Accident Analysis 15.0-4 Trip Point and Time Delays to Trip Assumed in Accident Analyses 15.0-5 Deleted by PKG FSC 07-MP3-049 15.0-6 Plant Systems and Equipment Required for the Mitigation of Transient and Accident Conditions 15.0-7 Fission Product Inventory in Reactor Core 15.0-8 Potential Dose Due to Accidents 15.0-9 Typical Power-Temperature Distribution for Full Core 15.0-10 Technical Specification Coolant Concentrations 15.0-11 Atmospheric Dispersion Data Used for Design Basis Accident Analysis 15.0-12 Reactor Coolant Iodine Concentrations Assuming Pre-Accident Iodine Spike 15.0-13 Iodine Release Rates into Reactor Coolant Due to Concurrent Iodine Spike 15.1-1 Time Sequence of Events for Incidents Which Cause an Increase in Heat Removal by the Secondary System 15.1-2 Equipment Required Following a Rupture of a Main Steam Line 15.1-3 Assumptions Used in Main Steam Line Break Analysis 15.1-4 Deleted by FSARCR PKG FSC 04-MP3-017 15.2-1 Time Sequence for Events for Incidents Which Cause a Decrease in Heat Removal by the Secondary System 15.2-2 Natural Circulation Flow 15.3-1 Time Sequence of Events for Incidents Which Result in a Decrease in Reactor Coolant System Flow 15.3-2 Summary of Results for Locked Rotor Transients 15.3-3 Assumptions Used in Locked Rotor Analysis 15.4-1 Time Sequence of Events for Incidents Which Cause Reactivity and Power Distribution Anomalies
Revision 3306/30/20 MPS-3 FSAR 15-x CHAPTER 15-ACCIDENT ANALYSES List of Tables (Continued)
Number Title 15.4-2 deleted by fsarcr ucr-m3-2019-003 15.4-3 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident 15.4-4 Parameters Used in Rod Ejection Accident Analysis 15.4-5 Integrated Break Flow (lbm) in Containment 15.4-6 Deleted by FSARCR PKG FSC 04-MP3-017 15.5-1 Time Sequence of Events - inadvertent operation of eccs 15.5-2 Time Sequence of Events - CVCS Malfunction that Increases Reactor Coolant Inventory 15.6-1 Time Sequence of Events for Inadvertent Opening of a Pressurizer Safety Valve 15.6-2 Assumptions Used in Analysis of Failure of Small Lines Carrying Primary Coolant Outside Containment 15.6-3 Plant Operating Range Allowed by the Best Estimate Large Break LOCA Analysis 15.6-4 Large Break LOCA Containment Data Used for Calculation of Containment Pressure 15.6-5 Analysis of Record Best Estimate Large Break LOCA Results 15.6-6 Total Minimum Injected Safety Injection Flow Used in Best Estimate large Break LOCA Analysis 15.6-7 Large Break LOCA Containment Data Used for Calculation of Containment Pressure 15.6-8 Peak Clad Temperature including All Penalties and benefits, Best Estimate large Break LOCA (BE LBLOCA) 15.6-9 Assumptions Used for the Radiological Consequences of a LOCA Analysis 15.6-10 Deleted by FSARCR PKG FSC 04-MP3-017 15.6-11 Deleted by Change PKG FSC 07-MP3-054 15.6-12 Assumptions Used for the Control Room Habitability Analysis 15.6-13 Deleted by FSARCR PKG FSC 04-MP3-017 15.6-14 Time Sequence of Events for Incidents Which Cause a Decrease in Reactor Coolant Inventory (Small Break) 15.6-15 Input Parameters Used in the ECCS Analysis (small Break)
Revision 3306/30/20 MPS-3 FSAR 15-xi CHAPTER 15-ACCIDENT ANALYSES List of Tables (Continued)
Number Title 15.6-16 Small Break LOCA Results Fuel Cladding Data 15.6-17 Small Break LOCA Safety Injection Flow Rate for 1.5 inch to 6 inch Breaks 15.6-18 Small Break LOCA Safety Injection Flow Rate for 8.75 inch Break Before Switchover 15.6-19 Omitted 15.6-20 Omitted 15.6-21 DELETED BY FSARCR 03-MP3-022 15.6-22 DELETED BY FSARCR 03-MP3-022 15.6.3-1 Operator Action Times for Design Basis Steam Generator Tube Rupture Analysis 15.6.3-2 Steam Generator Tube Rupture Analysis Sequence of Events 15.6.3-3 Steam Generator Tube R Mass Releases Total Mass Flow (Pounds) 15.6.3-4 Steam Generator Tube Rupture Analysis Parameters Used in Evaluating Radiological Consequences 15.6.3-5 Deleted by Change PKG FSC 07-MP3-054 15.6.3-6 Steam Generator Tube Rupture Analysis Iodine Spike Appearance Rates 15.6.3-7 Deleted by FSARCR PKG FSC 04-MP3-017 15.6.3-8 Deleted by FSARCR PKG FSC 04-MP3-017 15.6.3-9 Deleted by FSARCR PKG FSC 04-MP3-017 15.6.3-10 Deleted by FSARCR PKG FSC 04-MP3-017 15.7-1 Omitted 15.7-2 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017 15.7-3 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017 15.7-4 Table Relocated to Table 11.2-12 by FSARCR 04-MP3-017 15.7-5 Table Relocated to Table 11.2-11 by FSARCR 04-MP3-017 15.7-6 Table Relocated to Table 11.2-13 by FSARCR 04-MP3-017 15.7-7 Table Relocated to Table 11.2-14 by FSARCR 04-MP3-017 15.7-8 Parameters for Postulated Fuel Handling Accident 15.7-9 Deleted by FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15-xii CHAPTER 15-ACCIDENT ANALYSES List of Tables (Continued)
Number Title 15.7-10 Deleted by PKG FSC 07-MP3-056 15.7-11 Deleted by FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15-xiii NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures Number Title 15.0-1 Illustration of Overtemperature and Overpower T Protection 15.0-1 A Deleted by FSARCR PKG FSC 02-MP3-017 15.0-2 Doppler Power Coefficient Used in Accident Analysis 15.0-3 RCCA Position Versus Time to Dashpot 15.0-4 Normalized Rod Worth Versus Percent Inserted 15.0-5 Normalized RCCA Bank Reactivity Worth Versus Drop Time 15.0-6 Deleted by FSARCR PKG FSC 07-MP3-049 15.0-7 Abbreviations 15.0-8 Excessive Heat Removal Due to Feedwater Systems Malfunction 15.0-9 Excessive Load Increase 15.0-10 Depressurization of Main Steam System 15.0-11 Loss of External Load/Turbine Trip 15.0-12 Loss of Offsite Power to Station Auxiliaries 15.0-13 Loss of Normal Feedwater 15.0-14 Major Rupture of a Main Feedwater Line 15.0-15 Loss of Forced Reactor Coolant Flow 15.0-16 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal 15.0-17 Dropped Rod Cluster Control Assembly 15.0-18 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.0-19 Not Used 15.0-20 Not Used 15.0-21 Rupture of Control Rod Drive Mechanism Housing (Rod Ejection) 15.0-22 Inadvertent ECCS Operation at Power 15.0-23 Accidental Depressurization of Reactor Coolant System 15.0-24 Steam Generator Tube Rupture 15.0-25 Loss of Coolant Accident
Revision 3306/30/20 MPS-3 FSAR 15-xiv NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.0-26 CVCS Letdown Line Rupture 15.0-27 GWPS Gas Decay Tank Rupture 15.0-28 Floor Drain Tank Failure 15.0-29 Fuel Handling Accident in Fuel Building 15.0-30 Fuel Handling Accident Inside Containment 15.0-31 Spent Fuel Cask Drop Accident 15.1-1 Feedwater Control Valve Malfunction 15.1-1 A Deleted by FSARCR PKG FSC 02-MP3-017 15.1-2 Feedwater Control Valve Malfunction 15.1-2 A Deleted by FSARCR PKG FSC 02-MP3-017 15.1-3 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-4 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-5 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-6 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-7 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-8 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-9 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-10 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-11 Typical(1)Keffective Versus Temperature 15.1-12 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-12 A Deleted by FSARCR PKG FSC 02-MP3-017 15.1-13 Deleted by FSARCR PKG FSC 07-MP3-050 15.1-13 A Deleted by FSARCR PKG FSC 02-MP3-017 15.1-14 TYPICAL(1)Doppler Power Feedback 15.1-15 1.4 SQ. FT. Steamline Rupture Offsite Power Available 15.1-15 A 1.4 SQ. FT STEAMLINE RUPTURE OFFSITE POWER AVAILABLE 15.1-16 1.4 SQ. FT. Steamline Rupture Offsite Power Available
Revision 3306/30/20 MPS-3 FSAR 15-xv NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.1-16 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE 15.1-17 1.4 SQ. FT. Steamline Rupture Offsite Power Available 15.1-17 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE 15.2-1 Turbine Trip - RCS Overpressurization Case 15.2-1A Deleted by FSARCR 02-MP3-017 15.2-2 Turbine Trip - RCS Overpressurization Case 15.2-2A Deleted by FSARCR 02-MP3-017 15.2-3 Turbine Trip-DNBR Case 15.2-3A Deleted by FSARCR 02-MP3-017 15.2-4 Turbine Trip-DNBR Case 15.2-4A Deleted by FSARCR 02-MP3-017 15.2-5 Turbine Trip-MSS Over pressurization Case 15.2-5A Deleted by FSARCR 02-MP3-017 15.2-6 Turbine Trip-MSS Over pressurization Case 15.2-6A Deleted by FSARCR 02-MP3-017 15.2-7 Deleted by FSARCR PKG FSC 07-MP3-051 15.2-7A Deleted by FSARCR 02-MP3-017 15.2-8 Deleted by FSARCR PKG FSC 07-MP3-051 15.2-8A Deleted by FSARCR 02-MP3-017 15.2-9 Loss of Normal Feedwater with Offsite Power Available 15.2-9A Loss of Normal Feedwater without Offsite Power Available 15.2-10 Loss of Normal Feedwater with Offsite Power Available 15.2-10A Loss of Normal Feedwater without Offsite Power Available 15.2-11 Loss of Normal Feedwater with Offsite Power Available 15.2-11A Loss of Normal Feedwater without Offsite Power Available 15.2-12 Loss of Normal Feedwater with Offsite Power Available
Revision 3306/30/20 MPS-3 FSAR 15-xvi NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.2-12A Loss of Normal Feedwater without Offsite Power Available 15.2-13 Main Feedline Rupture with Offsite Power Available 15.2-13A Deleted by FSARCR 02-MP3-017 15.2-14 Main Feedline Rupture with Offsite Power Available 15.2-14A Deleted by FSARCR 02-MP3-017 15.2-15 Main Feedline Rupture with Offsite Power Available 15.2-15A Deleted by FSARCR 02-MP3-017 15.2-16 Main Feedline Rupture with Offsite Power Available 15.2-16A Deleted by FSARCR 02-MP3-017 15.2-17 Main Feedline Rupture with Offsite Power Available 15.2-17A Deleted by FSARCR 02-MP3-017 15.2-18 Main Feedline Rupture with Offsite Power Available 15.2-18A Deleted by FSARCR 02-MP3-017 15.2-19 Main Feedline Rupture without Offsite Power Available 15.2-19A Deleted by FSARCR 02-MP3-017 15.2-20 Main Feedline Rupture without Offsite Power Available 15.2-20A Deleted by FSARCR 02-MP3-017 15.2-21 Main Feedline Rupture without Offsite Power Available 15.2-21A Deleted by FSARCR 02-MP3-017 15.2-22 Main Feedline Rupture without Offsite Power Available 15.2-22A Deleted by FSARCR 02-MP3-017 15.2-23 Main Feedline Rupture without Offsite Power Available 15.2-23A Deleted by FSARCR 02-MP3-017 15.2-24 Main Feedline Rupture without Offsite Power Available 15.2-24A Deleted by FSARCR 02-MP3-017 15.3-1 Flow Transients, One Pump Coasting Down 15.3-2 Nuclear Power and Pressurizer Pressure Transients, One Pump Coasting Down 15.3-3 Average and Hot Channel Heat Flux Transient, One Pump Coasting Down
Revision 3306/30/20 MPS-3 FSAR 15-xvii NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.3-4 DNBR Versus Time, One Pump Coasting Down 15.3-5 Core Flow Coastdown, Four Pumps Coasting Down 15.3-6 Nuclear Power & Pressurizer Pressure Transients, Four Pumps Coasting Down 15.3-7 Average & Hot Channel Transients, Four Pumps Coasting Down 15.3-8 DNBR versus Time, Four Pumps Coasting Down 15.3-9 Flow Transients, One Locked Rotor 15.3-9 A Deleted by FSARCR 02-MP3-017 15.3-10 RCS Pressure, One Locked Rotor 15.3-10 A Deleted by FSARCR 02-MP3-017 15.3-11 Nuclear Power, Average and Core Average Heat Flux Transients, One Locked Rotor 15.3-11 A Deleted by FSARCR 02-MP3-017 15.3-12 Maximum Clad Temperature at Hot Spot, One Locked Rotor 15.3-12 A Deleted by FSARCR 02-MP3-017 15.3-13 Core Flow Transient, Four Pumps Experiencing Frequency Decay 15.3-14 Nuclear Power and Pressurizer Pressure Transients, Four Pumps Experiencing Frequency Decay 15.3-15 Average and Hot Channel Heat Flux Transients, Four Pumps Experiencing Frequency Decay 15.3-16 DNBR versus Time, Four Pumps Experiencing Frequency Decay 15.4-1 Neutron and Thermal Flux Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition 15.4-2 Omitted 15.4-3 Fuel and Clad Temperature Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition 15.4-4 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate) 15.4-4 A Deleted by FSARCR 02-MP3-017 15.4-5 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
Revision 3306/30/20 MPS-3 FSAR 15-xviii NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.4-5 A Deleted by FSARCR 02-MP3-017 15.4-6 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate) 15.4-6 A Deleted by FSARCR 02-MP3-017 15.4-7 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate) 15.4-7 A Deleted by FSARCR 02-MP3-017 15.4-8 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate) 15.4-8 A Deleted by FSARCR 02-MP3-017 15.4-9 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate) 15.4-9 A Deleted by FSARCR 02-MP3-017 15.4-10 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 100%
RTP 15.4-10 A Deleted by FSARCR 02-MP3-017 15.4-11 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 60% RTP 15.4-11 A Deleted by FSARCR 02-MP3-017 15.4-12 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 10% RTP 15.4-13 Dropped Rod Cluster Control Assembly, Manual Control 15.4-14 Dropped Rod Cluster Control Assembly, Manual Control 15.4-15 Not Used 15.4-16 Not Used 15.4-17 Not Used 15.4-18 Not Used 15.4-19 Not Used 15.4-20 Not Used 15.4-21 Interchange Between Region 1 and Region 3 Assembly 15.4-22 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly
Revision 3306/30/20 MPS-3 FSAR 15-xix NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.4-23 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 1 Assembly 15.4-24 Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position 15.4-25 Loading a Region 2 Assembly into a Region 1 Position Near Core Periphery 15.4-26 Nuclear Power Transient BOL HFP RCCA Ejection 15.4-26 A Deleted by FSARCR 02-MP3-017 15.4-27 Hot Spot Fuel and Clad Temperature versus Time - BOL HFP RCCA Ejection 15.4-27 A Deleted by FSARCR 02-MP3-017 15.4-28 Nuclear Power Transient EOL HZP RCCA Ejection (Two RCPs Running) 15.4-29 Hot Spot Fuel and Clad Temperature versus Time - EOL HZP RCCA Ejection (Two RCPs Running) 15.4-30 Reactor Coolant System Integrated Break Flow Following a Rod Ejection Accident 15.5-1 CVCS Malfunction that increases Reactor Coolant Inventory, Nuclear Power and Vessel Average Temperature versus Time 15.5-2 CVCS Malfunction that increases Reactor Coolant Inventory, Pressurizer Pressure and Pressurizer Water Volume versus Time 15.5-3 CVCS malfunction that increases reactor coolant inventory, nuclear power and vessel average temperature versus time 15.5-4 cvcs malfunction that increases reactor coolant inventory, pressurizer pressure and pressurizer water volume versus time 15.6-1 Inadvertent Opening of a Pressurizer Safety Valve 15.6-1 A Deleted by FSARCR 02-MP3-017 15.6-2 Inadvertent Opening of a Pressurizer Safety Valve 15.6-2 A Deleted by FSARCR 02-MP3-017 15.6-3 Deleted by FSARCR 02-MP3-017 15.6.3-1 Pressurizer Level 15.6.3-2 Reactor Coolant System Pressure 15.6.3-3 Secondary Pressure 15.6.3-4 Ruptured Loop Hot and Cold Leg RCS Temperatures 15.6.3-5 Intact Loop Hot and Cold Leg RCS Temperatures
Revision 3306/30/20 MPS-3 FSAR 15-xx NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.6.3-6 Primary to Secondary Break Flow Rate 15.6.3-7 Differential Pressure Between Reactor Coolant System and Ruptured Steam Generator 15.6.3-8 Ruptured Steam Generator Water Volume 15.6.3-9 Ruptured Steam Generator Water Mass 15.6.3-10 Ruptured Steam Generator Mass Release Rate to the Atmosphere 15.6.3-11 Intact Steam Generators Mass Release Rate to the Atmosphere 15.6.3-12 Flashed Break Flow 15.6-4 Sequence of Events for Large Break LOCA Analysis 15.6-5 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-6 Code Interface Description for Small Break LOCA Model 15.6-7 Small Break Power Shape 15.6-8 Limiting PCT Case PCT and PCT Location 15.6-8 A Deleted by FSARCR PKG FSC 07-MP3-054 15.6-9 Limiting PCT Case Vessel Side Break Flow 15.6-10 Limiting PCT Case Loop Side Break Flow 15.6-11 Limiting PCT Case Broken and Intact Loop Void Fraction 15.6-12 Limiting PCT Case Hot Assembly Top Third of Core Vapor Flow 15.6-13 Limiting PCT Case Pressurizer Pressure 15.6-14 Limiting PCT Case Lower Plenum Collapsed Liquid Level 15.6-15 Limiting PCT Case Vessel Fluid Mass 15.6-16 Limiting PCT Case Loop 2 Accumulator Flow 15.6-17 Limiting PCT Case Loop 2 Safety Injection Flow 15.6-18 Limiting PCT Case Core Average Channel Collapsed Liquid Level 15.6-19 Limiting PCT Case Loop 2 Downcomer Collapsed Liquid Level 15.6-20 BELOCA Analysis Axial Power Shape Operating Space Envelope 15.6-21 Lower Bound Containment Pressure 15.6-22 Deleted by FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15-xxi NOTE: REFER TO THE CONTROLLED PLANT DRAWING FOR THE LATEST REVISION.
CHAPTER 15-ACCIDENT ANALYSES List of Figures (Continued)
Number Title 15.6-23 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-24 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-25 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-26 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-27 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-28 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-29 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-30 Deleted by FSARCR PKG FSC 07-MP3-054 15.6-31 Reactor Coolant System Pressure (4 inch Break) 15.6-32 Core Mixture Level (4 inch Break) 15.6-33 Clad Temperature Transient at Peak Temperature Elevation (4 inch Break) 15.6-34 Core Exit Steam Flow Rate (4 inch Break) 15.6-35 Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation (4 inch Break) 15.6-36 Fluid Temperature at Peak Clad Temperature Elevation (4 inch Break) 15.6-37 Reactor Coolant System Pressure (1.5 inch Break) 15.6-38 Reactor Coolant System Pressure (2 inch Break) 15.6-39 Reactor Coolant System Pressure (3 inch Break) 15.6-40 Reactor Coolant System Pressure (6 inch Break) 15.6-41 Reactor Coolant System Pressure (8.75 inch Break) 15.6-42 Core Mixture Level (1.5 inch Break) 15.6-43 Core Mixture Level (2 inch Break) 15.6-44 Figures 15.6-44 through 62 Deleted by FSARCR PKG FSC 02-MP3-017 15.B-1 Figures Deleted by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.0-1 CHAPTER 15 - ACCIDENT ANALYSES
15.0 INTRODUCTION
This chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 of Regulatory Guide 1.70, Revision 3, as they apply to Millstone 3.
Certain items in the guide warrant comment, as follows:
Items 1.3 and 2.1 - There are no pressure regulators in the nuclear steam supply system (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.
Item 6.2 - No instrument lines from the reactor coolant system boundary in the NSSS PWR design penetrate the containment. (For the definition of the reactor coolant system boundary, refer to ANSI-N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, Section 5, 1973.)
Items 7.1 (radioactive gas waste system leak or failure), 7.2 (radioactive liquid waste system leak or failure) and 7.3 (postulated radioactive releases due to liquid tank failures) from Table 15-1 of Regulatory Guide 1.70 have been transferred to Chapter 11.
15.0.1 CLASSIFICATION OF PLANT CONDITIONS Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:
- 1. Condition I: Normal Operation and Operational Transients
- 2. Condition II: Faults of Moderate Frequency
- 3. Condition III: Infrequent Faults
- 4. Condition IV: Limiting Faults The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public, and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur.
Where applicable, reactor trip system and engineered safeguards functioning is assumed to the extent allowed by considerations such as the single failure criterion, in fulfilling this principle.
Thereby, only Seismic Category I, Class IE and IEEE qualified equipment, instrumentation, and components, are used in the ultimate mitigation of the consequences of faulted conditions (Condition II, III, and IV events).
Revision 3306/30/20 MPS-3 FSAR 15.0-2 Step-by-step sequence-of-events diagrams are provided for each transient on Figures 15.0-8 through 15.0-18 and Figures 15.0-21 through 15.0-31. Figure 15.0-7 provides the legend used in these diagrams.
Postulated accidents with respective potential offsite rem doses are shown in Table 15.0-8.
15.0.1.1 Condition I - Normal Operation and Operational Transients Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. Inasmuch as Condition I occurrences occur frequently or regularly, they must be considered from the point of view of affecting the consequences of fault conditions (Conditions II, III, and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to adverse conditions which can occur during Condition I operation.
A typical list of Condition I events is listed below:
- 1. Steady state and shutdown operations
- a. Power operation (>5 to 100 percent of rated thermal power)
- b. Startup (K 0.99, 5 percent of rated thermal power)
- c. Hot standby (subcritical, residual heat removal system isolated)
- d. Hot shutdown (subcritical, residual heat removal system in operation)
- e. Refueling
- 2. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes. These include:
- a. Operation with components or systems out of service
- b. Leakage from fuel with clad defects
- c. Radioactivity in the reactor coolant
- 1. Fission products
- 2. Corrosion products
Revision 3306/30/20 MPS-3 FSAR 15.0-3
- 3. Tritium
- d. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications
- e. Testing as allowed by the Technical Specifications
- 3. Operational transients
- a. Plant heatup and cooldown (up to 100°F/hour for the reactor coolant system; 200°F/hour for the pressurizer during cooldown and 100°F/hour for the pressurizer during heatup)
- b. Step load changes (+/-10 percent)
- c. Ramp load changes (up to 5 percent/minute)
- d. Load rejection up to and including design full load rejection transient 15.0.1.2 Condition II - Faults of Moderate Frequency These faults, at worst, result in the reactor trip with the plant being capable of returning to operation. By definition (ANSI N18.2), these faults (or events) do not propagate to cause a more serious fault, i.e. Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or reactor coolant system or secondary system overpressurization.
For the purposes of this report, the following faults are included in this category:
- 1. Feedwater System Malfunctions that Result in a Decrease in Feedwater Temperature (Section 15.1.1)
- 3. Excessive Increase In Secondary Steam Flow (Section 15.1.3)
- 4. Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a Depressurization of the Main Steam System (Section 15.1.4)
- 5. Loss of External Electrical Load (Section 15.2.2)
- 6. Turbine Trip (Section 15.2.3)
- 7. Inadvertent Closure of Main Steam Isolation Valves (Section 15.2.4)
Revision 3306/30/20 MPS-3 FSAR 15.0-4
- 8. Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip (Section 15.2.5)
- 9. Loss of Nonemergency AC Power to the Station Auxiliaries (Section 15.2.6)
- 10. Loss of Normal Feedwater Flow (Section 15.2.7)
- 11. Partial Loss of Forced Reactor Coolant Flow (Section 15.3.1)
- 12. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition (Section 15.4.1)
- 13. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power (Section 15.4.2)
- 14. Rod Cluster Control Assembly Misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full or part length assembly) (Section 15.4.3)
- 15. Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant (Section 15.4.6)
- 16. Inadvertent Operation of the Emergency Core Cooling System During Power Operation (Section 15.5.1)
- 17. Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory (Section 15.5.2)
- 18. Inadvertent Opening of a Pressurizer Safety or Relief Valve (Section 15.6.1)
- 19. Failure of Small Lines Carrying Primary Coolant Outside Containment (Section 15.6.2) 15.0.1.3 Condition III - Infrequent Faults By definition, Condition III events are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods although sufficient fuel damage might occur to preclude resumption of the operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the reactor coolant system or containment barriers. For the purposes of this report, the following faults are included in this category and are shown on Figures 15.0 15.0-31:
- 1. Steam System Piping Failure (minor) (Section 15.1.5)
Revision 3306/30/20 MPS-3 FSAR 15.0-5
- 2. Complete Loss of Forced Reactor Coolant Flow (Section 15.3.2)
- 3. Rod Cluster Control Assembly Misalignment (single rod cluster control assembly withdrawal at full power) (Section 15.4.3)
- 4. Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (Section 15.4.7)
- 5. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (Section 15.6.5)
- 6. Radioactive Gas Waste System Leak or Failure (Section 11.3.3)
- 7. Radioactive Liquid Waste System Leak or Failure (Section 11.2.3)
- 8. Postulated Radioactive Releases Due to Liquid Tank Failures (Section 11.2.3)
- 9. Spent Fuel Cask Drop Accidents (Section 15.7.5) 15.0.1.4 Condition IV - Limiting Faults Condition IV events are faults which are not expected to take place, but are postulated because their consequences would include the potential of the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10 CFR 50.67. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the emergency core cooling system and the containment.
For the purposes of this report, the following faults have been classified in this category:
- 1. Steam System Piping Failure (major) (Section 15.1.5)
- 2. Feedwater System Pipe Break (Section 15.2.8)
- 3. Reactor Coolant Pump Shaft Seizure (Locked Rotor) (Section 15.3.3)
- 4. Reactor Coolant Pump Shaft Break (Section 15.3.4)
- 5. Spectrum of Rod Cluster Control Assembly Ejection Accidents (Section 15.4.8)
- 6. Steam Generator Tube Failure (Section 15.6.3)
- 7. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (large break)
(Section 15.6.5)
Revision 3306/30/20 MPS-3 FSAR 15.0-6
- 8. Design Basis Fuel Handling Accidents (Section 15.7.4) 15.0.2 OPTIMIZATION OF CONTROL SYSTEMS A control system setpoint study (refer to Section 7.7.2) was performed in order to simulate performance of the reactor control and protection systems. In this study, emphasis was placed on the development of a control system which automatically maintains prescribed conditions in the plant even under a conservative set of reactivity parameters with respect to both system stability and transient performance.
For each mode of plant operation, a group of optimum controller setpoints is determined. In areas where the resultant setpoints are different, compromises based on the optimum overall performance are made and verified. A consistent set of control system parameters is derived satisfying plant operational requirements throughout the core life and for various levels of power operation.
The study comprised of an analysis of the following control systems: rod cluster control assembly, steam dump, steam generator level, pressurizer pressure and pressurizer level.
15.0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES 15.0.3.1 Design Plant Conditions Table 15.0-1 lists the principal power rating values which are assumed in analyses performed in this report.
The thermal power values used for each transient analyzed are given in Table 15.0-2.
The values of other pertinent plant parameters utilized in the accident analyses are given in Table 15.0-3. As part of the transition to Dominion Energy Methods, the DNBR analysis basis was revised using the VIRE-D thermal-hydraulic code and the CHF correlations identified in Section 4.4. In Reference 15.0-17, the NRC approved the use of Dominion Energy Methods for Millstone Unit 3. VIPRE-D along with the Statistical DNBR Evaluation Methodology (VEP-NE-2-A) has been applied to all Condition I and II statistical DNB events as well as the Loss of Flow accident (Section 15.3.4). VIPRD-D has also been used for all deterministic DNB events (e.g.,
rod withdrawal from subcritical in Section 15.4.1). Statepoints for applicable DNB events were analyzed with VIPRE-D at core power of 3712 MWt for full-power, statistically-treated events.
All DNBR calculations were performed using the CHF correlations identified in Section 4.4, as applicable. Some DNB events are bounded by other events and were not explicitly analyzed. All DNB events show acceptable DNB performance for the RFA-2 fuel.
15.0.3.2 Initial Conditions For most accidents analyzed to demonstrate that the DNB design is met, statistical methods are employed in defining the initial conditions (see Section 4.4). The other accidents obtain initial
Revision 3306/30/20 MPS-3 FSAR 15.0-7 conditions by adding the maximum steady state errors to rated values. The following steady state errors are considered:
- 1. Core power +/- 2.0 percent allowance for calorimetric error.
- 2. Average reactor coolant temperature +/- 4.0°F allowance. The calculated uncertainties for Tavg rod control include instrument allowance, rod control deadband, and cold leg streaming. The calculated values are +/- 3.0°F random, +/- 1.0 °F bias. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty (+0.1°F) as a result of an error in the Hysteresis of Weed Resistance Temperature Detectors.
- 3. Pressurizer pressure +/- 50 psi allowance. The calculated uncertainties for pressurizer pressure control include instrumentation allowance, control system overshoot and transmitter bias. The calculated values are +/- 31.8 psi random, +/- 15 psi bias.
Table 15.0-2 summarizes the initial conditions and computer codes used in the accident analyses.
15.0.3.3 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distribution through the placement of control rods and operating instructions. Power distribution may be characterized by the radial factor (FH) and the total peaking factor (Fq). The peaking factor limits are given in the Technical Specifications.
For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated on Figure 15.0-1. All transients that may be DNB limited are assumed to begin with a FH consistent with the initial power level defined in the Technical Specifications.
The axial power shape used in the DNB calculation is the 1.78 chopped cosine as discussed in Section 4.4. The radial and axial power distributions described above are input to the VIPRE-D Code as described in Section 4.4.
For transients which may be overpower limited, the total peaking factor (Fq) is of importance. All transients that may be overpower limited are assumed to begin with plant conditions including
Revision 3306/30/20 MPS-3 FSAR 15.0-8 power distributions which are consistent with reactor operation as defined in the Technical Specifications.
For overpower transients which are slow with respect to the fuel rod thermal time constant, for example the chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant incident which lasts many minutes, and the excessive increase in secondary steam flow incident which may reach equilibrium without causing a reactor trip, the fuel rod thermal evaluations are performed as discussed in Section 4.4. For overpower transients which are fast with respect to the fuel rod thermal time constant, e.g., the uncontrolled rod cluster control assembly bank withdrawal from subcritical or low power startup and rod cluster control assembly ejection incidents which result in a large power rise over a few seconds, a detailed fuel heat transfer calculation must be performed. Although the fuel rod thermal time constant is a function of system conditions, fuel burnup and rod power, a typical value at beginning-of-life for high power rods is approximately 5 seconds.
15.0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Chapter 4.
In the analysis of certain events, conservatism requires the use of large reactivity coefficient values whereas in the analysis of other events, conservatism requires the use of small reactivity coefficient values. Some analyses such as loss of reactor coolant from cracks or ruptures in the reactor coolant system do not depend on reactivity feedback effects. The values used are given in Table 15.0-2. Reference is made in that table to Figure 15.0-2, which shows the upper and lower bound Doppler power coefficients as a function of power, used in the transient analysis. The justification for use of conservatively large versus small reactivity coefficient values are treated on an event-by-event basis. In some cases, conservative combinations of parameters are used to bound the effects of core life. For example, in a load increase transient, it is conservative to use a small Doppler defect and a small moderator coefficient.
15.0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS The negative reactivity insertion following a reactor trip is a function of the acceleration of the rod cluster control assemblies and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry or approximately 85 percent of the rod cluster travel. The rod cluster control assembly position versus time assumed in accident analyses is shown on Figure 15.0-3. The rod cluster control assembly insertion time to dashpot entry is taken as 2.7 seconds, unless otherwise noted in the discussion. The use of such a long insertion time provides the most conservative results for all accidents and is intended to be applicable to all types of rod cluster control assemblies which may be used throughout plant life. Drop time testing requirements are specified in the plant Technical Specifications.
Revision 3306/30/20 MPS-3 FSAR 15.0-9 Figure 15.0-4 shows the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve is used to compute the negative reactivity insertion versus time following a reactor trip which is input to all point kinetics core models used in transient analyses. The bottom skewed power distribution itself is not an input into the point kinetics core model.
There is inherent conservatism in the use of Figure 15.0-4 in that it is based on skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.
The normalized rod cluster control assembly negative reactivity insertion versus time is shown on Figure 15.0-5. The curve shown on this figure was obtained from Figures 15.0-3 and 15.0-4. A total negative reactivity insertion of 4 percent following a trip is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available as shown in Table 4.3-3. For Figures 15.0-3 and 15.0-4, the rod cluster control assembly drop time is normalized to 2.7 seconds, unless otherwise noted for a particular event, in order to provide a bounding analysis for all rod cluster control assemblies to be used in the Millstone 3 cores, as previously stated.
15.0.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the rod cluster control assemblies which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0-4.
The overtemperature and overpower trip functions referred to in Table 15.0-4 are graphically illustrated in Figure 15.0-1. This figure presents the allowable reactor coolant loops average temperature and T for the flow and power distribution, as described in Section 4.4, as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and set point errors so that, under nominal conditions, trip would occur well within the area bounded by these lines. The utility of this diagram is that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.
Revision 3306/30/20 MPS-3 FSAR 15.0-10 The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed set point); high pressure (fixed set point);
low pressure (fixed set point); and overpower and overtemperature T (variable set points).
The limit value, which was used as the DNBR limit for all accidents, is conservative compared to the actual design DNBR value required to meet the DNB design basis as discussed in Section 4.4.
The difference between the limiting trip point assumed for the analysis and the nominal trip point represents an allowance for instrumentation channel error and setpoint error. Nominal trip setpoints are specified in the plant Technical Specifications. During plant startup tests, it was demonstrated that actual instrument time delays are equal to or less than the assumed values.
Additionally, protection system channels are calibrated and instrument response times determined periodically in accordance with the plant Technical Specifications.
15.0.7 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS The NSSS is designed to afford proper protection against the possible effects of natural phenomena, postulated environmental conditions and dynamic effects of the postulated accidents.
In addition, the design incorporates features which minimize the probability and effects of fires and explosions. Chapter 17 discusses the quality assurance program which has been implemented to assure that the NSSS satisfactorily performs its assigned safety functions. The incorporation of these features in the NSSS, coupled with the reliability of the design, ensures that the normally operating systems and components listed in Table 15.0-6 are available for mitigation of the events discussed in Chapter 15. In determining which systems are necessary to mitigate the effects of these postulated events, the classification system of ANSI-N18.2-1973 is utilized. The design of systems important to safety (including protection systems) is consistent with IEEE Standard 379-1972 and Regulatory Guide 1.53 in the application of the single failure criterion.
In the analysis of the Chapter 15 events, control system action is considered only if that action results in more severe accident results. No credit is taken for control system operation if that operation mitigates the results of an accident. For some accidents, the analysis is performed both with and without control system operation to determine the worst case.
15.0.8 FISSION PRODUCT INVENTORIES 15.0.8.1 Inventory in the Core The fission product inventory in the reactor core is consistent with the requirements of Regulatory Guide 1.183. The computer code ORIGEN-ARP was used to generate the inventory assuming a core power level of 3723 MWt. Core activities are shown in Table 15.0-7.
Revision 3306/30/20 MPS-3 FSAR 15.0-11 15.0.8.2 Inventory in the Fuel Clad Gap The fission product inventory in the fuel clad gap is based on the release fraction requirements for LOCA and non-LOCA design basis accidents as described in Tables 2 and 3 of Regulatory Guide 1.183.
15.0.8.3 Reactor Coolant Activity Reactor coolant activity is based upon the uprated power level of 3723 MWt (102% of rated power level of 3650 MWt), an 18-month fuel cycle and other conservative assumptions. Iodine activity is based on the Technical Specification limit of 1 Ci/gm DEQ I-131. Nobel gas activity is based on the Technical Specification limit of 81.2 Ci/gm DEQ Xe-133. This level of activity represents 0.29% failed fuel. Gross gamma activity, which includes non-iodine isotopes (including noble gases and other fission products), reflects these limits and 0.29% failed fuel.
These activities are listed in Table 15.0-10.
15.0.9 RESIDUAL DECAY HEAT 15.0.9.1 Total Residual Heat Residual heat in a subcritical core is calculated for the small break loss-of-coolant accident per the requirements of Appendix K of 10 CFR 50.46 (10 CFR 50.46 and Appendix K of 10 CFR 50), as described in WCAP-10054, 1985. These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For all other accidents, unless noted otherwise, the same models are used except that fission product decay energy is based on core average exposure at the end of the equilibrium cycle.
15.0.9.2 Decay Heat Modeling for Small Break Loss-of-Coolant Accident During a loss-of-coolant accident the core is rapidly shut down by void formation or rod cluster control assembly insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4 percent which represents the fraction of heat generated within the clad and pellet drops to 95 percent for the hot rod in a loss-of-coolant accident.
15.0.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident The decay heat model within Westinghouse COBRA/TRAC is described in detail in Section 8 of WCAP-16009-P-A. The model has been benchmarked against the ANSI/ANS 5.1-1979 Standard.
Westinghouse COBRA/TRAC solves for the composite decay heat of the reactor using the fission rate fractions derived from specific physics calculations for the fuel lattice design. The decay heat modeling for the LBLOCA methodology has been approved for use in WCAP-16009-P-A.
Revision 3306/30/20 MPS-3 FSAR 15.0-12 15.0.10 COMPUTER CODES UTILIZED Summaries of some of the principal computer codes used in transient analyses are given below.
Other codes, in particular very specialized codes in which the modeling has been developed to simulate one given accident, such as those used in the analysis of the reactor coolant system pipe rupture (Section 15.6), are summarized in their respective accident analyses sections. The codes used in the analyses of each transient have been listed in Table 15.0-2.
15.0.10.1 FACTRAN The FACTRAN computer program calculates the transient temperature distribution in a cross section of a metal clad, UO2 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density). The code uses a fuel model which exhibits the following features simultaneously:
- 1. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents
- 2. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation
- 3. The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, Zircaloy-water reaction and partial melting of the materials FACTRAN is further discussed in WCAP-7908-A.
15.0.10.2 LOFTRAN The LOFTRAN program is used for studies of transient response of a PWR system to specified perturbations in process parameters. LOFTRAN simulates a multi-loop system by a model containing reactor vessel, hot and cold leg piping, steam generator (tube and shell sides) and the pressurizer. The pressurizer heaters, spray, relief and safety valves are also considered in the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron and rods are included.
The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The reactor protection system is simulated to include reactor trips on high neutron flux, overtemperature T, overpower T, high and low pressure, low flow, and high pressurizer level. Control systems are also simulated including rod control, steam dump, feedwater control and pressurizer pressure control.
The emergency core cooling system, including the accumulators, is also modeled.
LOFTRAN is a versatile program which is suited to both accident evaluation and control studies as well as parameter sizing.
LOFTRAN is further discussed in WCAP-7907-P-A and WCAP-7907-A.
Revision 3306/30/20 MPS-3 FSAR 15.0-13 LOFTTR2, a derivative of the LOFTRAN program, is used for the steam generator tube rupture analysis. More details on the LOFTTR2 code and its application are provided in Section 15.6.3.
15.0.10.3 Casmo5 Casmo5 is a multigroup two-dimensional transport theory code for burnup calculations on PWR assemblies or simple pin cells. The code handles a geometry consisting of cylindrical fuel rods of varying composition in a square pitch array with allowance for absorber-loaded fuel rods, Integral Fuel Burnable Absorber (IFBA), burnable absorber rods, cluster control rods, in-core instrument channels, and water gaps. See Section 4.3.3 for more details.
15.0.10.4 Simulate5 Simulate5 is a multi-group analytical nodal code for the steady-state analysis of both PWRs and BWRs, capable of two dimensional and three dimensional calculations. Simulate5 is emplyed as the reference core physics model for all safety analysis calculations, power distributions, peaking factors, critical boron concentrations, control rod worths and reactivity coefficients. It has the capability of calculating discrete pin powers from the nodal information as well. See Section 4.3.3 for more details.
15.0.10.5 TWINKLE The TWINKLE program is a multidimensional spatial neutron kinetics code, which was patterned after steady codes presently used for reactor core design. The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two and three dimensions. The code uses six delayed neutron groups and contains a detailed multiregion fuel-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 8,000 spatial points, and performs its own steady state initialization. Aside from basic cross section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits are provided, e.g., channelwise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.
The TWINKLE Code is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.
TWINKLE is further described in WCAP-7979-P-A and WCAP-8028-A.
15.0.10.6 VIPRE The VIPRE computer program performs thermal-hydraulic calculations. This code calculates coolant density, mass velocity, enthalpy, void fractions, static pressure and DNBR distributions along flow channels within a reactor core.
Revision 3306/30/20 MPS-3 FSAR 15.0-14 15.0.10.7 RETRAN RETRAN is used for studies of transient response of a PWR system to specified perturbations in process parameters. This code simulates a multi-loop system by a lumped parameter model containing the reactor vessel, hot-leg and cold-leg piping, RCPs, steam generators (tube and shell sides), main steam lines, and the pressurizer. The pressurizer heaters, spray, relief valves, and safety valves can also be modeled. RETRAN includes a point neutron kinetics model and reactivity effects of the moderator, fuel, boron, and control rods. The secondary side of the steam generator uses either a detailed nodalization (WCAP-14882-P-A) or a single node VEP-FRD PA-A) for the thermal transients. The RTS simulated in the code includes reactor trips on high neutron flux, high neutron flux rate, OTT, OPT, low reactor coolant flow, low reactor coolant pump speed, high-pressurizer and low-pressurizer pressure, high pressurizer level, and low-low steam generator water level. Control systems are also simulated including rod control and pressurizer pressure control. Parts of the safety injection system, including the accumulators, are also modeled.
15.0.11 REFERENCES FOR SECTION 15.0 15.0-1 Belle, J. 1961. Uranium Dioxide Properties and Nuclear Applications. Naval Reactors, Division of Reactor Development United States Atomic Energy Commission.
15.0-2 Booth, A.H. 1957. A Suggested Method for Calculating the Diffusion of Radioactive Rate Gas Fission Products from UO Fuel Elements. DCI-27.
15.0-3 10 CFR 50.46 and Appendix K of 10 CFR 50. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors. Federal Register, Volume 39, Number 3, 1974.
15.0-4 DiNunno, J.J. et al., 1962. Calculation of Distance Factors for Power and Test Reactor Sites. TID-14844.
15.0-5 Meek, M.E. and Rider, B.F. 1968. Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum of 14 Mev Neutron Energies.
APED-5398.
15.0-6 Stone & Webster Engineering Corporation Topical Report RP-8A. Radiation Shielding Design and Analysis Approach for Light Water Reactor Power Plants.
15.0-7 Toner, D.F. and Scott, J.S. 1961. Fission - Product Release from UO2. Nuclear Safety 3, No. 2, 15-20 15.0-8 WCAP-3269-26, 1963. Barry, R.F. LEOPARD - A Spectrum Dependent Nonspatial Depletion Code for the IBM-7094.
15.0-9 WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R.F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
Revision 3306/30/20 MPS-3 FSAR 15.0-15 15.0-10 WCAP-7908-A, 1989. Hargrove, H.G. FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod.
15.0-11 WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), 1984, Burnett, T.W.T., et al., LOFTRAN Code Description.
15.0-12 WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.H., Jr. and Barry, R.F. TWINKLE - A Multidimensional Neutron Kinetics Computer Code.
15.0-13 WCAP-10054-P-A (Proprietary) 1985. Lee, N. et al., Westinghouse Small Break ECCS Evaluation Model using NOTRUMP Code.
15.0-14 WCAP-16009-P-A (Proprietary) and WCAP-16009-NP-A (Nonproprietary), 2005.
Nissley, M. E., Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM).
15.0-15 WCAP-14565-P-A (Proprietary) and WCAP-15306-NP-A (Nonproprietary), 1999.
Sung Y. X. et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
15.0-16 WCAP-14882-P-A (Proprietary) and WCAP-15234-NP-A (Nonproprietary), 1999.
Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
15.0-17 Letter from R. V. Guzman (USNRC) to D. A. Heacock (Dominion), Millstone Power Station, Unit NO. 3 - Issuance of Amendment Adopting Dominion Core Design and Safety Analysis Methods and Addressing the Issues Identified in Three Westinghouse Communication Documents (CAC NO. MF6251), July 28, 2016. Dominion Serial No.16-317, ADAMS Accession No. ML16131A728.
15.0-18 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
15.0-19 VEP-FRD-41-P-A, Revision 0, Minor Revision 3 (Proprietary) and VEP-FRD-41-A, Revision 0, Minor Revision 3 (Nonproprietary), 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
Revision 3306/30/20 MPS-3 FSAR 15.0-16 TABLE 15.0-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS (MWt)
NSSS thermal power output (0 MWt Pump Heat) 3650 NSSS thermal power output (0 MWt Pump Heat) 3723 a NSSS thermal power output (16 b MWt nominal Pump Heat) 3666 NSSS thermal power output (16 (b) MWt nominal Pump Heat) 3739 (a)
- a. Includes 2.0% power uncertainty
- b. Four loop pump heat
Revision 3306/30/20 TABLE 15.0-2
SUMMARY
OF INITIAL CONDITIONS AND COMPUTER CODES USED Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (b)
Computer Temperature Moderator Density Power Output Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MWt)
Increase in heat removal 15.1 by the secondary system Feedwater system 0.50 (Full Power); lower (c) malfunctions that result in RETRAN, Function of moderator (Full Power); see
- Section 15.1.2 and 0 & 3,666 an increase in feedwater VIPRE density (Section 15.1.2, flow Figure 15.1-11) for HZP Figure 15.1-14 for HZP Excessive increase in See N/A See Section 15.1.3 See Section 15.1.3 3,666 secondary steam flow Section 15.1.3 Inadvertent opening of a Results bounded steam generator relief or by steam system - N/A safety valve piping failure MPS-3 FSAR Function of moderator Refer to Steam system piping RETRAN,
- density (Section 15.1.5, Section 15.1.5, 0 (Subcritical) failure VIPRE-D Figure 15.1-11) Figure 15.1-14 15.0-17
TABLE 15.0-2
SUMMARY
OF INITIAL CONDITIONS AND COMPUTER CODES USED (CONTINUED)
Revision 3306/30/20 Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (b)
Computer Temperature Moderator Density Power Output Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MWt)
Decrease in heat removal 15.2 by the secondary system 3,712 (core),
Loss of external electrical RETRAN, (c) 0.0 lower 3,739 (pressure load and/or turbine trip VIPRE-D case)
Results bounded Loss of non-emergency by loss of AC power to the station - N/A normal auxiliaries feedwater Loss of normal feedwater flow RETRAN 0.0 0.45 upper (c) 3,739 (b)
Feedwater system pipe RETRAN 0.0 0.45 upper and lower(c) 3,739 (b)
MPS-3 FSAR break Decrease in reactor 15.3 coolant system flow rate Partial and complete loss RETRAN, 3,666 of forced reactor coolant VIPRE-D 0.0 upper (c) 3,712 flow Reactor coolant pump shaft seizure (locked RETRAN, rotor) pressure, VIPRE 0.0 upper (c) 3,739 15.0-18 temperature transient
TABLE 15.0-2
SUMMARY
OF INITIAL CONDITIONS AND COMPUTER CODES USED (CONTINUED)
Revision 3306/30/20 Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (b)
Computer Temperature Moderator Density Power Output Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MWt)
Reactor coolant pump RETRAN, 3,666 shaft seizure (locked VIPRE-D 0.0 upper (c) 3,712 rotor)--rods in DNB Reactivity and power 15.4 distribution anomalies Uncontrolled rod cluster Least Negative control assembly bank Doppler RETRAN, withdrawal from a 5.0 - Temperature 0 VIPRE-D subcritical or lower power Coefficient -
startup condition 2.0 pcm/°F
-0.9 pcm/°F (least 5.0 (part negative) and -
Uncontrolled rod cluster power), 0.0 RETRAN, 3.2 pcm/°F (most 387.2, 2243, and MPS-3 FSAR control assembly bank (full power, -
VIPRE-D negative Doppler 3728 withdrawal at power -64.5 (most Temperature negative)
Coefficients Rod cluster control LOFTRAN, 3,666 assembly misalignment Simulate5 3,712 (core) 15.0-19
TABLE 15.0-2
SUMMARY
OF INITIAL CONDITIONS AND COMPUTER CODES USED (CONTINUED)
Revision 3306/30/20 Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (b)
Computer Temperature Moderator Density Power Output Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MWt)
Chemical and volume RETRAN control system (MODE 1) malfunction that results in 0.0 N/A -2.05 (pcm)/°F 3,712 (core) a decrease in the boron N/A concentration in the (MODES 2-6) reactor coolant Inadvertent loading and operation of a fuel LEOPARD,
- N/A N/A assembly in an improper TURTLE position Coefficient for all Refer to cases is consistent Spectrum of rod cluster TWINKLE, Section 15.4.8 with least negative MPS-3 FSAR control assembly ejection - 0 & 3,650 FACTRAN min., max. doppler defect accidents feedback values listed in Table 15.4-3 Increase in reactor 15.5 coolant inventory Inadvertent operation of the ECCS during power RETRAN - - 3,739 operation 15.0-20
TABLE 15.0-2
SUMMARY
OF INITIAL CONDITIONS AND COMPUTER CODES USED (CONTINUED)
Revision 3306/30/20 Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (b)
Computer Temperature Moderator Density Power Output Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MWt)
CVCS malfunction that results in an increase in the reactor coolant RETRAN - - - 3,739 (b) inventory.
Decrease in reactor 15.6 coolant inventory Inadvertent opening of a Figure 15.0-6 most pressurizer safety or relief RETRAN 0.0 negative lower (c) 3,666 valve Steam generator tube Figure 15.0-6 most failure LOFTTR2 0.0 negative upper (c) 3,739 Loss-of-coolant accidents MPS-3 FSAR resulting from the Refer to Refer to spectrum of postulated ASTRUM, Section 15.6.5, - Section 15.6.6, 3,650, 3,723 piping breaks within the NOTRUMP References References reactor coolant pressure boundary NOTES:
(a) Refer to Table 15.0-1.
(b) A maximum pump heat of 20 MWt was modeled in the cases with offsite power available.
(c) Refer to Figure 15.0-2.
15.0-21
Revision 3306/30/20 MPS-3 FSAR 15.0-22 TABLE 15.0-3 NOMINAL VALUES OF PERTINENT PLANT PARAMETERS UTILIZED IN THE ACCIDENT ANALYSIS Equivalent Steam Generator Tube 0% 10%
Plugging (all loops)
NSSS Thermal Power (MWt) Table 15.0-2 HFP Vessel Average Temperature (°F) 589.5 571.5 589.5 571.5 Pressurizer Pressure (psia) 2,250 2,250 2,250 2,250 Total Reactor Coolant Flow Thermal Design Flow (gpm) 363,200 363,200 363,200 363,200 Minimum Measure Flow (gpm) 379,200 379,200 379,200 379,200 Assumed HFP Feedwater Temperature Maximum (°F) 445.3 445.3 445.3 445.3 Minimum (°F) 390.0 390.0 390.0 390.0 Steam Flow from NSSS (106 lb/hr)
At Maximum Feedwater Temperature 16.30 16.20 16.29 16.19 At Minimum Feedwater Temperature 15.12 15.03 15.10 15.02 Steam Pressure at SG Outlet (psia) 962 815 942 797 Maximum Steam Moisture Content (%) 0.25 0.25 0.25 0.25 Average Core Heat Flux (Btu/hr-ft2) 203,099 203,099 203,099 203,099
Revision 3306/30/20 MPS-3 FSAR 15.0-23 TABLE 15.0-4 TRIP POINT AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Limiting Trip Point Assumed Time Delay Trip Function in Analysis (a) (Seconds)
Power range high neutron flux, high setting 116.5% 0.5 Power range high neutron flux, low setting 35% 0.5 Power range high positive neutron flux rate (b) 6.5% 3.0 Overtemperature T Variable; see Figure 15.0-1 7.0 (c)
Overpower T Variable; see Figure 15.0-1 7.0 (c)
High pressurizer pressure 2410 psig 2.0 Low pressurizer pressure 1845 psig 2.0 Low reactor coolant flow (from loop flow 85% loop flow 1.0 detectors)
Reactor coolant pump underspeed 92% nominal 0.6 Turbine trip Not applicable 1.5 (d)
Low-Low steam generator water level 0% of narrow range span 2.0 High-high steam generator level trip of the 100% of narrow range level span 2.5 (e) feedwater pumps and closure of feedwater system valves, and turbine trip 7.0 (f)
Pressurizer water level high 100% of span 2.0 (a) Tabulated values conservatively bound technical specification values with uncertainties.
Refer to Section 15.6.3 for SGTR trip point assumptions.
(b) Credited in the analysis of Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power event (Section 15.4.2)
(c) Total time delay from time the temperature difference in the coolant loop exceeds the trip setpoint until the RCCAs are free to fall. Delay includes the response characteristics of the RTD/thermowell/scoop configuration, electronic delays, trip breaker opening delays, and gripper opening delays.
(d) Direct reactor trip following turbine trip not credited to meet the acceptance criteria.
(e) From time setpoint is reached to turbine trip.
(f) From time setpoint is reached to feedwater isolation.
Revision 3306/30/20 MPS-3 FSAR 15.0-24 TABLE 15.0-5 DELETED BY PKG FSC 07-MP3-049
Revision 3306/30/20 TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT REQUIRED FOR THE MITIGATION OF TRANSIENT AND ACCIDENT CONDITIONS 15.1 Increase in Heat Removal by the Secondary System Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment Power range high flux, High-High steam generator reactor trip caused by level-produced feedwater turbine trip on high-high isolation and turbine trip, SI Feedwater system steam generator level, initiated by low steam line Feedwater isolation valves ---
malfunctions manual, overtemperature pressure or low pressurizer T, overpower T, turbine pressure will produce trip feedwater isolation, manual Power range high flux, Pressurizer self-actuated Excessive increase in overtemperature T, N/A safety valves, steam ---
secondary steam flow overpower T, manual, low generator safety valves pressurizer pressure Low pressurizer pressure, low compensated steam line Inadvertent opening of Low pressurizer pressure, pressure, high negative Feedwater isolation valves, Auxiliary feedwater a steam generator relief manual, SIS, power range MPS-3 FSAR steam pressure rate, steam steam line iso valves system, ECCS or safety valve high flux trip, overpower T generator low-low water level, manual Low pressurizer pressure, SIS, low pressurizer low compensated steam line pressure, power range high pressure, high negative Steam system piping Feedwater isolation valves, Auxiliary feedwater flux trip, overpower T, steam pressure rate, hi-1 failure steam line iso valves system, ECCS steam generator low-low containment pressure, steam water level, manual generator low-low water level, manual 15.0-25
Revision 3306/30/20 15.2 Decrease in Heat Removal by the Secondary System Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment High pressurizer pressure, Loss of external overtemperature T, Pressurizer safety valves, electrical load/turbine overpower T, steam N/A steam generator safety ---
trip generator low-low level, valves manual Loss of non-emergency Steam generator low-low Steam generator low-low Steam generator safety Auxiliary feedwater AC power to the station level, turbine trip, low RCS level, manual, loss of offsite valves system auxiliaries flow, manual power Steam generator low-low Loss of normal level, overtemperature T, Steam generator low-low Steam generator safety Auxiliary feedwater feedwater flow high pressurizer pressure, level, manual valves system manual Hi-1 containment pressure, Steam line isolation valves, Steam generator low-low steam generator low-low feedline isolation, Feedwater system pipe level, high pressurizer water level, low Auxiliary feedwater pressurizer self-actuated break pressure, overtemperature compensated steam line system, ECCS safety valves, steam T, SIS, manual pressure, low pressurizer generator safety valves pressure, manual MPS-3 FSAR 15.0-26
Revision 3306/30/20 15.3 Decrease in Reactor Coolant System Flow Rate Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment Partial loss of forced Steam generator safety Low flow, manual N/A ---
reactor coolant flow valves Complete loss of forced Low flow, RCP Steam generator safety N/A ---
reactor coolant flow underspeed, manual valves Reactor coolant pump Pressurizer safety valves, shaft seizure (locked Low flow, manual N/A steam generator safety ---
rotor) valves 15.4 Reactivity and Power Distribution Anomalies Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment Power range high flux (low Uncontrolled rod cluster and high setpoints), source control assembly bank range high flux, withdrawal from a intermediate range high N/A --- ---
subcritical or low power flux, power range neutron startup condition See MPS-3 FSAR flux high positive flux rate, Note 1 manual Power range high flux, Power range high positive neutron flux rate, high Uncontrolled rod cluster Pressurizer safety valves, pressurizer water level control assembly bank N/A steam generator safety ---
overtemperature T, withdrawal at power valves overpower T high pressurizer pressure, manual 15.0-27
15.4 Reactivity and Power Distribution Anomalies Revision 3306/30/20 Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment Overtemperature T, Rod cluster control overpower T, low N/A --- ---
assembly misalignment pressurizer pressure, manual Chemical and volume Source range high flux, control system power range high flux (high Low insertion limit malfunction that results and low setpoint), N/A annunciators shutdown ---
in a decrease in boron overtemperature T, margin monitors concentration in the manual reactor coolant Spectrum of rod cluster Power range high flux (high control assembly and low setpoint), high N/A --- ---
ejection accidents positive flux rate, manual 15.5 Increase in Reactor Coolant Inventory Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment MPS-3 FSAR Pressurizer power operated Inadvertent operation of relief valves, low Manual, safety injection the ECCS during power N/A pressurizer pressure cold ---
trip operation leg injection permissive signal CVCS malfunction that results in an increase in Pressurizer power operated Manual N/A ---
the reactor coolant relief valves inventory 15.0-28
Revision 3306/30/20 15.6 Decrease in Reactor Coolant Inventory Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipment Inadvertent opening of a Pressurizer low pressure, pressurizer safety or overtemperature T, N/A --- ---
relief valve manual Service water system, component cooling water system, Steam Generator Water Level Control (SGWLC), steam Emergency core Low pressurizer pressure, Low pressurizer pressure, Steam generator tube generator safety and/or cooling system, Overtemperature T, steam generator low-low failure relief valves, main steam auxiliary feedwater manual water level isolation valves, system emergency diesel generator, pressurizer power operated relief valves or pressurizer spray Loss-of-coolant Service water system, accidents resulting from Emergency core component cooling water the spectrum of Low pressurizer pressure, Hi- cooling system, MPS-3 FSAR Low pressurizer pressure, system, steam generator postulated piping breaks 1 & Hi-3 containment auxiliary feedwater manual safety and/or relief valves, within the reactor pressure system, containment emergency diesel coolant pressure heat removal system generator boundary
- 1. Administrative controls have been implemented to preclude an uncontrolled rod/bank withdrawal from a subcritical condition when plant conditions are not bounded by safety analysis assumptions.
NOTE:
15.0-29 N/A ESF actuation functions are not applicable for these accidents.
Revision 3306/30/20 MPS-3 FSAR 15.0-30 TABLE 15.0-7 FISSION PRODUCT INVENTORY IN REACTOR CORE Nuclide Curies Ba 139 1.70E+08 Ba 140 1.79E+08 Ba 141 9.47E+07 Br 84 1.70E+07 Ce 141 1.64E+08 Ce 143 1.50E+08 Ce 144 1.29E+08 Cm 242 4.83E+06 Cm 244 5.56E+05 Cs 134 1.98E+07 Cs 136 6.29E+06 Cs 137 1.25E+07 Cs 138 1.69E+08 I 131 9.89+07 I 132 1.45E+08 I 133 2.03+E08 I 134 2.13E+08 I 135 1.89E+08 Kr 85 1.05E+06 Kr 85m 2.27E+07 Kr 87 4.14E+07 Kr 88 6.11E+07 La 140 1.86E+08 La 141 1.61E+08 La 142 1.52E+08 Mo 99 1.84E+08 Nb 95 1.67E+08 Nd 147 6.61E+07 Np 239 2.04E+09
Revision 3306/30/20 MPS-3 FSAR 15.0-31 TABLE 15.0-7 FISSION PRODUCT INVENTORY IN REACTOR CORE (CONTINUED)
Nuclide Curies Pr 143 1.47E+08 Pu 238 4.06E+05 Pu 239 3.30E+04 Pu 240 4.62E+04 Pu 241 1.49E+07 Rb 86 2.19E+05 Rb 88 6.47E+07 Rb 89 5.47E+07 Rh 105 1.03E+08 Ru 103 1.60E+08 Ru 105 1.11E+08 Ru 106 5.83E+07 Sb 127 8.73E+06 Sb 128m 1.35E+07 Sb 129 3.11E+07 Sb 131 5.06E+07 Sr 89 9.10E+07 Sr 90 9.05E+06 Sr 91 1.12E+08 Sr 92 1.15E+08 Tc 99m 1.64E+08 Te 127 8.60E+06 Te 127m 1.44E+06 Te 129 3.03E+07 Te 129m 6.17E+06 Te 131 7.65E+07 Te 131m 1.97E+07 Te 132 1.42E+08 Te 133 6.29E+07 Te 133m 7.54E+07
Revision 3306/30/20 MPS-3 FSAR 15.0-32 TABLE 15.0-7 FISSION PRODUCT INVENTORY IN REACTOR CORE (CONTINUED)
Nuclide Curies Te 134 1.39E+08 Xe 133 2.03E+08 Xe 135 5.60E+07 Xe 135m 3.66E+07 Xe 138 8.46E+07 Y 90 9.46E+06 Y 91 1.19E+08 Y 92 1.23E+08 Y 93 9.40E+07 Zr 95 1.66E+08 Zr 97 1.57E+08
Revision 3306/30/20 MPS-3 FSAR 15.0-33 TABLE 15.0-8 POTENTIAL DOSE DUE TO ACCIDENTS FSAR EAB TEDE (1) LPZ TEDE (1) Control Room Postulated Accident Section (rem) (rem) TEDE (rem)
MSLB 15.1.5 Concurrent Iodine Spike 4.0E-01 2.2E-01 3.6E+00 Pre-accident Iodine Spike 9.6E-02 4.4E-02 1.6E+00 Locked Rotor Accident 15.3.3 2.4E+00 4.4E-01 3.9E+00 Rod Ejection Accident 15.4.8 Containment 5.1E-01 2.5E-01 1.5E+00 Secondary Side 1.2E-01 1.6E-02 5.1E-02 Small Line Break outside (2) 15.6.2 2.5E+00 (3)
Containment SGTR 15.6.3 Concurrent Iodine Spike 1.0E+00 2.0E-01 1.7E+00 Pre-accident Iodine Spike 2.2E+00 2.0E-01 3.3E+00 LOCA 15.6.5 5.4E+00 1.1E+00 3.4E+00 FHA 15.7.4 Spent Fuel Assembly 2.7E+00 1.5E-01 4.8E+00 Insert Component (4) (4) 4.3E+00 Spent Fuel Cask Drop 15.7.5 (3) (3) (3)
Radioactive Liquid Waste 5.7E-04 (WB) (2) (3)
System Leak of Failure 11.2.3 (Atmospheric Release) 4.4E-01 (THY) 2.2E-01 (WB) (2) (3)
Gaseous Waste System Failure 11.3.3 0.0E+00 (THY)
NOTES:
(1) - except as noted (2) - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of release or less; a thirty day dose is not applicable (3) - not applicable, see listed FSAR section for details (4) - Bounded by the consequences of the FHA - Spent Fuel Assembly
Revision 3306/30/20 MPS-3 FSAR 15.0-34 TABLE 15.0-9 TYPICAL POWER-TEMPERATURE DISTRIBUTION FOR FULL CORE Fuel Temperature Percent Volume of Core Percent of Power Within Range (°F) Within Temperature Range Temperature Range 3800 - 3600 0.005 0.01 3600 - 3400 0.03 0.08 3400 - 3200 0.15 0.33 3200 - 3000 0.46 0.96 3000 - 2800 1.10 2.16 2800 - 2600 2.23 4.11 2600 - 2400 3.64 6.31 2400 - 2200 4.93 8.18 2200 - 2000 6.03 9.67
< 2000 81.43 68.19
Revision 3306/30/20 MPS-3 FSAR 15.0-35 TABLE 15.0-10 TECHNICAL SPECIFICATION COOLANT CONCENTRATIONS RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Kr 85m 3.20E-01 Kr 87 2.48E-01 Kr 88 6.50E-01 Xe 131m 5.66E-02 Xe 133m 2.24E-01 Xe 133 7.42E+00 Xe 135m 2.7E-01 Xe 135 1.61E+00 Xe 138 1.91E-01 Br 83 2.06E-02 Br 84 1.02E-02 4.69E-07 Cs 134 6.76E+00 7.44E-03 Cs 134m 1.38E-02 Cs 136 1.03E+00 1.11E-03 Cs 137 4.73E+00 5.34E-03 Cs 138 2.94E-01 8.67E-06 Rb 86 4.26E-02 4.60E-05 Rb 88 6.78E-01 2.00E-05 Rb 89 4.23E-02 1.68E-06 Ba 137m 4.45E+00 1.31E-04 Ba 139 2.28E-02 6.74E-06 Ba 140 1.10E-03 6.59E-07 Ce 144 1.30E-04 7.84E-08 Co 58 1.70E-02 1.06E-05 Co 60 2.10E-03 1.31E-06 Fe 55 1.70E-03 1.05E-06 Fe 59 1.10E-03 6.62E-07 La 140 3.69E-04 1.98E-07 La 142 7.13E-05 Mn 54 3.30E-04 2.02E-07 Mo 99 1.54E+00 8.83E-04
Revision 3306/30/20 MPS-3 FSAR 15.0-36 TABLE 15.0-10 TECHNICAL SPECIFICATION COOLANT CONCENTRATIONS (CONTINUED)
RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Mo 101 6.15E-03 2.44E-07 Nb 95 1.69E-04 9.99E-08 Np 239 1.98E-02 1.10E-05 Ru 106 5.90E-05 3.66E-08 Sr 89 8.83E-04 5.41E-07 Sr 90 5.74E-05 3.53E-08 Sr 91 3.81E-04 1.47E-07 Sr 92 2.76E-04 Tc 99m 7.99E-01 2.36E-04 Tc 101 5.99E-03 2.37E-07 Te 127m 9.08E-04 5.65E-07 Te 129 3.95E-03 Te 129m 3.87E-03 2.39E-06 Te 131 3.69E-03 Te 131m 9.77E-03 5.02E-06 Te 132 8.11E-02 4.64E-05 Te 133 2.51E-03 9.94E-08 Te 133m 5.58E-03 4.19E-07 Te 134 8.52E-03 6.04E-07 Y 91 4.18E-03 2.54E-06 Y 91m 2.27E-04 Zr 95 1.67E-04 1.03E-07 I 131 7.81E-01 8.04E-02 I 132 3.20E-01 1.44E-02 I 133 1.19E+00 1.09E-01 I 134 1.81E-01 4.19E-03 I 135 7.00E-01 5.00E-02
Revision 3306/30/20 MPS-3 FSAR 15.0-37 TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS EAB X/Qs (sec m-3) (1)
Ground-level release-containment 5.42 x 10-4 Ground-level release-ventilation vent 4.30 x 10-4 Elevated release Millstone Stack 1.00 x 10-4 LPZ X/Qs (sec m-3)
Ground-level release (applies to ventilation vent and containment) 0-8 hr 2.91 x 10-5 8-24 hr 1.99 x 10-5 1-4 days 8.66 x 10-6 4-30 days 2.63 x 10-6 Elevated release Millstone stack 0-4 hr 2.69 x 10-5 4-8 hr 1.07 x 10-5 8-24 hr 6.72 x 10-6 1-4 days 2.46 x 10-6 4-30 days 5.83 x 10-7
Revision 3306/30/20 MPS-3 FSAR 15.0-38 TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS (CONTINUED)
Millstone 3 Millstone Unit 3 Control room X/Qs (sec m-3) (see Note (2))
- a. Ground-level release-containment 0-2 hr 5.34 x 10-4 2-8 hr 3.23 x 10-4 8-24 hr 1.38 x 10-4 1-4 days 8.78 x 10-5 Millstone 3
- b. Elevated release Millstone stack (3) 0-4 hr 1.39 x 10-4 4-8 hr 3.23 x 10-5 8-24 hr 1.56 x 10-5 1-4 days 3.20 x 10-6 4-30 days 3.30 x 10-7
- c. Ground-level release-ventilation vent 0-2 hr 2.82 x 10-3 2-8 hr 1.65 x 10-3 8-24 hr 6.67 x 10-4 1-4 days 4.83 x 10-4 4-30 days 3.80 x 10-4
Revision 3306/30/20 MPS-3 FSAR 15.0-39 TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS (CONTINUED)
- d. Unit 3 MSVB (includes MSPRVs and MSSVs) 0-2 hr 1.46 x 10-3 2-8 hr 8.76 x 10-4 8-24 hr 3.42 x 10-4 1-4 days 2.71 x 10-4 4-30 days 1.96 x 10-4
- e. Unit 3 ESFB 0-2 hr 3.18 x 10-4 2-8 hr 2.26 x 10-4 8-24 hr 9.06 x 10-5 1-4 days 6.42 x 10-5 4-30 days 4.59 x 10-5
- f. Unit 3 RWST 0-2 hr 2.61 x 10-4 2-8 hr 1.59 x 10-4 Millstone 3 8-24 hr 6.45 x 10-5 1-4 days 4.83 x 10-5 4-30 days 3.63 x 10-5
Revision 3306/30/20 MPS-3 FSAR 15.0-40 TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS (CONTINUED)
- g. Unit 3 Turbine Building 0-2 hr 5.40 x 10-3 2-8 hr 3.51 x 10-3 8-24 hr 1.38 x 10-3 1-4 days 1.01 x 10-3 4-30 days 8.49 x 10-4 NOTES:
- 1. 0-2 hr EAB X/Qs are applied for the worst two hour EAB dose determination.
- 2. Control room X/Qs do not include occupancy factor.
- 3. Fumigation conditions assumed for 0-4 hour period.
Revision 3306/30/20 MPS-3 FSAR 15.0-41 TABLE 15.0-12 REACTOR COOLANT IODINE CONCENTRATIONS ASSUMING PRE-ACCIDENT IODINE SPIKE Isotope Concentration (Ci/gram) (1)
I 131 46.8 I 132 19.2 I 133 71.2 I 134 10.9 I 135 42.0 NOTES:
- 1. Based on 60 Ci/gram I-131 dose equivalent.
Revision 3306/30/20 MPS-3 FSAR 15.0-42 TABLE 15.0-13 IODINE RELEASE RATES INTO REACTOR COOLANT DUE TO CONCURRENT IODINE SPIKE Isotope Release Rate (Ci/sec) (1)
I 131 3.03 I 132 3.93 I 133 5.61 I 134 4.73 I 135 4.72 NOTE:
- 1. Equivalent to 500 times equilibrium iodine appearance rate based upon Technical Specification conditions (i.e., 1 Ci/gram I-131 dose equivalent). SGTR analysis values are listed in Table 15.6.3-6 and are 335 times equilibrium iodine appearance rates.
Revision 3306/30/20 MPS-3 FSAR 15.0-43 FIGURE 15.0-1 ILLUSTRATION OF OVERTEMPERATURE AND OVERPOWER T PROTECTION
Revision 3306/30/20 MPS-3 FSAR 15.0-44 FIGURE 15.0-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.0-45 FIGURE 15.0-2 DOPPLER POWER COEFFICIENT USED IN ACCIDENT ANALYSIS
Revision 3306/30/20 FIGURE 15.0-3 RCCA POSITION VERSUS TIME TO DASHPOT MPS-3 FSAR 15.0-46
Revision 3306/30/20 MPS-3 FSAR 15.0-47 FIGURE 15.0-4 NORMALIZED ROD WORTH VERSUS PERCENT INSERTED
Revision 3306/30/20 MPS-3 FSAR 15.0-48 FIGURE 15.0-5 NORMALIZED RCCA BANK REACTIVITY WORTH VERSUS DROP TIME
Revision 3306/30/20 MPS-3 FSAR 15.0-49 FIGURE 15.0-6 DELETED BY FSARCR PKG FSC 07-MP3-049 Deleted by FSARCR PKG FSC 07-MP3-049
Revision 3306/30/20 MPS-3 FSAR 15.0-50 FIGURE 15.0-7 ABBREVIATIONS ABBREVIATIONS USED:
AFWS - AUXILIARY FEEDWATER SYSTEM CCWS - COMPONENT COOLING WATER SYSTEM CI - CONTAINMENT ISOLATION CL - COLD LEG CS - CONTAINMENT SPRAY CVCS - CHEMICAL AND VOLUME CONTROL SYSTEM ECCS - EMERGENCY CORE COOLING SYSTEM ESFAS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM FW - FEEDWATER HL - HOT LEG HPI - HIGH PRESSURE INJECTION LPI - LOW PRESSURE INJECTION RCS - REACTOR COOLANT SYSTEM RT - REACTOR TRIP RTS - RECTOR TRIP SYSTEM SG - STEAM GENERATOR SI - SAFETY INJECTION SIS - SAFETY INJECTION SYSTEM SWS - SERVICE WATER SYSTEM NOTES:
- 1. For Trip Initiation and Safety System Actuation, multiple signals are shown but only a single signal is required. The other signals are backups.
- 2. No timing sequence is implied by position of various branches. Refer to Event Timing Sequences presented in tabular form in pertinent Accident Analysis section of Chapter 15 of the FSAR.
Revision 3306/30/20 MPS-3 FSAR 15.0-51 FIGURE 15.0-7 ABBREVIATIONS (CONTINUED)
DIAGRAM SYMBOLS:
- Event Title
- Branch Point for Different Plant Conditions
- Safety System
- Safety Action SF - System Required to Meet Single-Failure Criteria P - Manual Action Required During System Operation
Revision 3306/30/20 FIGURE 15.0-8 EXCESSIVE HEAT REMOVAL DUE TO FEEDWATER SYSTEMS MALFUNCTION MPS-3 FSAR 15.0-52
Revision 3306/30/20 MPS-3 FSAR 15.0-53 FIGURE 15.0-9 EXCESSIVE LOAD INCREASE
Revision 3306/30/20 FIGURE 15.0-10 DEPRESSURIZATION OF MAIN STEAM SYSTEM MPS-3 FSAR 15.0-54
Revision 3306/30/20 MPS-3 FSAR 15.0-55 FIGURE 15.0-11 LOSS OF EXTERNAL LOAD/TURBINE TRIP
Revision 3306/30/20 FIGURE 15.0-12 LOSS OF OFFSITE POWER TO STATION AUXILIARIES MPS-3 FSAR 15.0-56
Revision 3306/30/20 FIGURE 15.0-13 LOSS OF NORMAL FEEDWATER MPS-3 FSAR 15.0-57
Revision 3306/30/20 FIGURE 15.0-14 MAJOR RUPTURE OF A MAIN FEEDWATER LINE MPS-3 FSAR 15.0-58
Revision 3306/30/20 FIGURE 15.0-15 LOSS OF FORCED REACTOR COOLANT FLOW MPS-3 FSAR 15.0-59
Revision 3306/30/20 FIGURE 15.0-16 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL MPS-3 FSAR 15.0-60
Revision 3306/30/20 MPS-3 FSAR 15.0-61 FIGURE 15.0-17 DROPPED ROD CLUSTER CONTROL ASSEMBLY
Revision 3306/30/20 MPS-3 FSAR 15.0-62 FIGURE 15.0-18 SINGLE ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL AT FULL POWER
Revision 3306/30/20 MPS-3 FSAR 15.0-63 FIGURE 15.0-19 NOT USED
Revision 3306/30/20 MPS-3 FSAR 15.0-64 FIGURE 15.0-20 NOT USED
Revision 3306/30/20 FIGURE 15.0-21 RUPTURE OF CONTROL ROD DRIVE MECHANISM HOUSING (ROD EJECTION)
MPS-3 FSAR 15.0-65
Revision 3306/30/20 MPS-3 FSAR 15.0-66 FIGURE 15.0-22 INADVERTENT ECCS OPERATION AT POWER INADVERTENT ECCS OPERATION AT POWER FULL POWER LOW PRESSURIZER PRESSURE 2/4 RTS MANUAL SIS
- S F S F REACTOR TRIP TURBINE BREAKERS TRIP S F CONTROL RODS GRAVITY INSERTION S F CONTROL ROD REACTIVITY CONTROL
- NOT CREDITED IN THE SAFETY ANALYSIS
Revision 3306/30/20 FIGURE 15.0-23 ACCIDENTAL DEPRESSURIZATION OF REACTOR COOLANT SYSTEM MPS-3 FSAR 15.0-67
Revision 3306/30/20 FIGURE 15.0-24 STEAM GENERATOR TUBE RUPTURE MPS-3 FSAR DOUBLE ENDED RUPTURE OF ONE STEAM GENERATOR TUBE MANUAL 2/4 LOW PRESSURIZER PRESSURE ESFAS 2/4 LOW PRESSURIZER (SI SIGNAL)
RTS MANUAL PRESSURE OPERATOR (CIA)
SI SIGNAL SF OT'T STEAM GENERATOR MAIN DIESEL ECCS CONTAINMENT RELIEF AND SAFETY REACTOR TRIP FEEDWATER GENERATOR INJECTION ISOLATION BREAKERS VALVES FLOW ISOLATION SWP SF SF (P)
CONTROL ROD AFWS SI TERMINATION RELIEF OF GRAVITY CONTAINMENT SECONDARY INSERTION LEAKAGE SIDE SF CONTROL PRESSURE PASSIVE (P) OPERATOR (P)**
CONTROL OF OPERATION OF AFW ON 50 RESIDUAL HEAT LEVEL REMOVAL SYSTEM FOOTOTES: 1. SEQUENCE OF EVENTS SHOWN IS FOR A CONDITION CONTROL SG LEVEL (P)
- OF NO OFFSITE POWER BEING AVAILABLE ROD INDICATION IDENTIFICATION OF COINCIDENCE WITH S.G. TUBE RUPTURE.
REACTIVITY RUPTURED STEAM CONTROL GENERATOR CORE COOLING 2. SEE TABLE 2.5-1 FOR INDICATORS AND RECORDERS AVAIL ABLE TO THE OPERATOR FOLLOWING EVENT.
MPS-3 FSAR MAIN STEAM 3. OPERATOR ACTIONS INCLUDES OPERATION OF SG ISOLATION VALVE ATMOSPHERIC BYPASS VALVES TO DUMP STEAM (RUPTURED STEAM AND REDUCE RC'S SUBCOOLING, PRESSURIZER (P) GENERATOR) RELIEF VALVE TO REDUCE RC'S PRESSURE AND SI TERMINAL TO STOP PRIMARY-TO-SECONDARY BREAK FLOW.
SG ATMOSPHERIC DUMP BYPASS VALVES (INTACT SG'S)
(P)
- ADDITIONAL IDENTIFICATION BY MAIN STEAMLINE RADIATION MONITORS OR SAMPLING S.G. SHELL SIDE FLUID REQUIRED PRESSURIZER IF NOT IDENTIFIED BY S.G. LEVEL INDICATION RELIEF VALVE (P)
- OPERATOR INITIATES OPERATION OF RESIDUAL HEAT REMOVAL SYSTEM AT APPROPRIATE REACTOR COOLANT SYSTEMS CONDITIONS ISOLATION OF RUPTURED STEAM GENERATOR 15.0-68
Revision 3306/30/20 FIGURE 15.0-25 LOSS OF COOLANT ACCIDENT MPS-3 FSAR 15.0-69
Revision 3306/30/20 MPS-3 FSAR 15.0-70 FIGURE 15.0-26 CVCS LETDOWN LINE RUPTURE CVCS LETDOWN LINE RUPTURE REACTOR COOLANT ACTIVITY RELEASE TO SAFEGUARDS BLDG ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE SAFEGUARDS BLDG DUCT RADIATION MONITOR OPERATOR P CLOSES LETDOWN ISOLATION VALVE AFTER RECEIPT OF THE ALARM WITHIN 30 MINUTES
Revision 3306/30/20 MPS-3 FSAR 15.0-71 FIGURE 15.0-27 GWPS GAS DECAY TANK RUPTURE GWPS GAS DECAY TANK RUPTURE RELEASE TO BUILDING ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE VENTILATION VENT RADIATION MONITOR OPERATOR P
TERMINATES PROCESS GAS INFLUENT ISOLATON TIME 2 HRS
Revision 3306/30/20 MPS-3 FSAR 15.0-72 FIGURE 15.0-28 FLOOR DRAIN TANK FAILURE FLOOR DRAIN TANK FAILURE (30,000 GAL)
RELEASE TO RELEASE TO GROUND BUILDING ATMOSPHERE UNFILTERED RELEASE ENTERS
- TO GROUNDWATER ATMOSPHERE
- SEE SECTION 2.4.13
Revision 3306/30/20 MPS-3 FSAR 15.0-73 FIGURE 15.0-29 FUEL HANDLING ACCIDENT IN FUEL BUILDING FUEL HANDLING ACCIDENT IN FUEL BUILDING GASES RELEASED FROM FUEL POOL WATER SF FILTERED BY PRIMARY PLANT VENTILATION SYSTEM IODINE ADSORBER TO ATMOSPHERE RADIOLOGICAL CONTROL
Revision 3306/30/20 MPS-3 FSAR 15.0-74 FIGURE 15.0-30 FUEL HANDLING ACCIDENT INSIDE CONTAINMENT FUEL HANDLING ACCIDENT INSIDE CONTAINMENT ACTIVITY RELEASED FROM REFUELING CAVITY FILTERED BY CONTAINMENT AIR CLEANUP UNITS TO ATMOSPHERE RADIOLOGICAL CONTROL
Revision 3306/30/20 MPS-3 FSAR 15.0-75 FIGURE 15.0-31 SPENT FUEL CASK DROP ACCIDENT SPENT FUEL CASK DROP (FROM HT 30 FT)
NO RELEASE:
NO CASK DAMAGE
Revision 3306/30/20 MPS-3 FSAR 15.1-1 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated which could result in an increase in heat removal from the reactor coolant system (RCS) by the secondary system. Detailed analyses are presented for several such events which have been identified as limiting cases.
Discussions of the following RCS cooldown events are presented in this section.
- 3. Excessive increase in secondary steam flow.
- 4. Inadvertent opening of a steam generator relief or safety valve.
- 5. Steam system piping failure.
The above are considered to be American Nuclear Society (ANS) Condition II events, with the exception of steam system piping failures, which are considered to be ANS Condition III (minor) and Condition IV (major) events. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.
15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature cause an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower/overtemperature protection (neutron overpower, overtemperature and overpower T trips) prevents any power increase which could lead to a departure from nucleate boiling ratio (DNBR) less than the limit.
A reduction in feedwater temperature may be caused by the accidental opening of a feedwater bypass valve which diverts flow around a portion of the feedwater heaters and trip of the heater drain pumps as well as loss of extraction steam to the high pressure feedwater heater. For this event, there is a sudden reduction in feedwater inlet temperature to the steam generators. At power, this increased subcooling creates a greater load demand on the RCS.
With the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.
Revision 3306/30/20 MPS-3 FSAR 15.1-2 The net effect on the RCS due to a reduction in feedwater temperature is similar to the effect of increasing secondary steam flow, i.e., the reactor reaches a new equilibrium condition at a power level corresponding to the new steam generator T.
A decrease in normal feedwater temperature is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
The protection available to mitigate the consequences of a decrease in feedwater temperature is the same as that for an excessive steam flow increase, as discussed in Section 15.0.8 and listed in Table 15.0-6.
15.1.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by computing conditions at the feedwater pump inlet following opening of the heater bypass valve. These feedwater conditions are then used to recalculate a heat balance through the high pressure heaters. This heat balance gives the new feedwater conditions at the steam generator inlet.
The following assumptions are made.
- 1. Plant initial power level corresponding to guaranteed nuclear steam supply system (NSSS) thermal output.
- 2. Low pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the low pressure heaters.
- 3. Heater drain pumps trip; this increases the effect of the cold bypass flow.
- 4. Loss of extraction steam to the high pressure feedwater heater.
Plant characteristics and initial conditions are further discussed in Section 15.0.3.
Results Opening of a low pressure heater bypass valve and trip of the heater drain pumps as well as loss of extraction steam to high pressure feedwater heater causes a reduction in feedwater temperature which increases the thermal load on the primary system. The calculated maximum reduction in feedwater temperature is less than 65°F, resulting in an increase in heat load on the primary system of less than 10 percent of full power. The increased thermal load, due to opening of the low pressure heater bypass valve and trip of the heater drain pumps as well as loss of extraction steam to the high pressure feedwater heater, would result in a transient very similar (but of reduced magnitude) to that presented in Section 15.1.3 for an excessive increase in secondary steam flow, which evaluates the consequences of a 10 percent step load increase. Therefore, the transient results of this analysis are not presented.
Revision 3306/30/20 MPS-3 FSAR 15.1-3 15.1.1.3 Conclusions The decrease in feedwater temperature transient is less severe than the increase in secondary steam flow event (Section 15.1.3). Based on results presented in Section 15.1.3, the applicable acceptance criteria for the decrease in feedwater temperature event have been met.
15.1.1.4 Radiological Consequences Since no fuel damage is postulated for this transient, a specific radiological release calculation was not performed.
15.1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW 15.1.2.1 Identification of Causes and Accident Description Addition of excessive feedwater causes an increase in core power by decreasing reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overtemperature T trip, the overpower T trip, and the power range high neutron flux trip prevent any power increase which could lead to a DNBR less than the limit.
An example of excessive feedwater flow would be a full opening of a feedwater control valve due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant at no-load conditions, the addition of an excess of feedwater may cause a decrease in RCS temperature and thus a reactivity insertion due to the effects of the negative moderator coefficient of reactivity.
Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which closes the feedwater valves. Feedwater isolation may also occur as a result of a safety injection signal initiated by low steam line pressure or low pressurizer pressure.
An increase in normal feedwater flow is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of ANS Condition II events.
Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6.
15.1.2.2 Analysis of Effects and Consequences Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed by using the detailed digital computer RETRAN code (WCAP-14882-P-A). This code simulates a multiloop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes
Revision 3306/30/20 MPS-3 FSAR 15.1-4 pertinent plant variables including temperatures, pressures, and power level. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR. The results met the applicable limit as specified in Section 4.4.
The system is analyzed to demonstrate plant behavior in the event that excessive feedwater addition, due to a control system malfunction or operator error which allows a feedwater control valve to open fully, occurs. Six cases are analyzed as follows:
- 1. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor just critical at zero load conditions. For these two cases, a negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position is assumed. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
- 2. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor in automatic control at full power with automatic and manual rod control.
The feedwater system malfunction event is analyzed with the following assumptions.
- 1. For the single loop feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction, resulting in a step increase to 234 percent of nominal feedwater flow to one steam generator.
- 2. For the multiple loop feedwater control malfunction at full power, a malfunction is assumed such that there is a step increase to 234 percent of nominal feedwater flow to all four steam generators.
- 3. For the feedwater control valve accident at zero load condition, a feedwater control valve malfunction occurs which results in an increase in flow to one steam generator to 250 percent of the nominal full load value for one steam generator.
- 4. For the multiple loop feedwater control malfunction at zero load condition, a malfunction is assumed such that there is a step increase to 250 percent of nominal feedwater flow to all four steam generators.
- 5. For the zero load condition, feedwater temperature is at a conservatively low value of 87°F.
- 6. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
Revision 3306/30/20 MPS-3 FSAR 15.1-5
- 7. The feedwater flow resulting from a fully open control valve is terminated by a steam generator high-high level signal which closes all feedwater control and isolation valves, trips the main feedwater pumps, and trips the turbine. Feedwater isolation may also occur as a result of a safety injection signal initiated by low steam line pressure or low pressurizer pressure.
Initial operating conditions are assumed at values consistent with steady state operation.
Plant characteristics and initial conditions are further discussed in Section 15.0.3.
Normal reactor control systems are not required to function. The reactor protection system may function to trip the reactor due to overpower or turbine trip on high-high steam generator water level conditions. No single active failure will prevent operation of the reactor protection system.
A discussion of anticipated transients without trip (ATWT) considerations is presented in WCAP-8330 (1974).
Results In the case of an accidental full opening of one feedwater control valve with the reactor at zero power and the above mentioned assumptions, DNB is precluded, thus assuring adequate heat transfer between the fuel clad and the reactor coolant. The hot zero power cases have been determined to be non-limiting with respect to both DNB and peak fuel centerline temperature.
The limiting full power case (multiple loop, maximum reactivity feedback coefficients, manual rod control) gives the largest reactivity feedback and results in the greatest power increase.
Assuming the reactor to be in the automatic rod control mode results in a slightly less severe transient. The rod control system is not required to function for an excessive feedwater flow event.
Transient results (Figures 15.1-1 and 15.1-2) show the core heat flux, pressurizer pressure, Tavg and DNBR, as well as the increase in nuclear power associated with the increased thermal load on the reactor. The DNBR does not drop below the safety analysis limit.
Since the power level rises during the excessive feedwater flow incident, the fuel temperatures also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant, hence the peak value does not exceed 116.5 percent of its nominal value (i.e., the assumed high neutron flux trip set point). The peak fuel temperature will thus remain well below the fuel melting temperature.
The transient results show that DNB does not occur at any time during the excessive feedwater flow incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature therefore does not rise significantly above its initial value during the transient.
The calculated sequence of events for this accident is shown in Table 15.1-1.
Revision 3306/30/20 MPS-3 FSAR 15.1-6 15.1.2.3 Conclusions The results of the analysis show that the DNBRs encountered for excessive feedwater addition events are at all times above the limiting values. Therefore, the DNBR design basis as described in Section 4.4 is met.
15.1.2.4 Radiological Consequences Since no fuel damage is postulated for this transient a specific radiological release calculation was not performed.
15.1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW 15.1.3.1 Identification of Causes and Accident Description An excessive increase in secondary system steam flow (excessive load increase incident) is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the range of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor protection system. Steam flow increases greater than 10 percent are analyzed in Sections 15.1.4 and 15.1.5.
This accident could result from either an administrative violation such as excessive loading by the operator or an equipment malfunction in the steam dump control or turbine speed control.
During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a reactor trip has occurred.
Protection against an excessive load increase accident is provided by the following reactor protection system signals:
- 1. overpower T
- 2. overtemperature T
- 3. power range high neutron flux
- 4. low pressurizer pressure.
An excessive load increase incident is considered to be an ANS Condition II event, a fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
Revision 3306/30/20 MPS-3 FSAR 15.1-7 15.1.3.2 Analysis of Effects and Consequences Method of Analysis Given the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an explicit analysis was not performed as part of the Stretch Power Uprate Program. Instead, an evaluation of this event was performed. The evaluation model consists of the generation of state points based on generic conservative data. The state points are in the form of changes in temperature, pressure, power and flow that are applied to the plants initial conditions. These conditions are then compared to the core thermal limits to ensure that DNBR limit is not violated.
The core thermal limits are based on a VIPRE-D analysis, using the safety limits in Section 4.4.
State points for the following cases were evaluated:
- 1. Reactor control in manual with minimum moderator reactivity feedback.
- 2. Reactor control in manual with maximum moderator reactivity feedback.
- 3. Reactor control in automatic with minimum moderator reactivity feedback.
- 4. Reactor control in automatic with maximum moderator reactivity feedback.
The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. The automatic function is not required.
15.1.3.3 Results and Conclusions It has been demonstrated that for a 10 percent step load increase, the DNBR remains above the safety analysis limit; the design basis for DNBR as described in Section 4.4 is met. The plant reaches a stabilized condition rapidly following the load increase.
15.1.3.4 Radiological Consequences Since no fuel damage is postulated for this transient a specific radiological release calculation was not performed.
15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE CAUSING A DEPRESSURIZATION OF THE MAIN STEAM SYSTEM 15.1.4.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the main steam system are associated with an inadvertent opening, with failure to close, of the largest of any single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steam line are given in Section 15.1.5.
Revision 3306/30/20 MPS-3 FSAR 15.1-8 The steam release as a consequence of this accident results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient (or positive moderator density coefficient), the cooldown results in an insertion of positive reactivity.
The analysis is performed to demonstrate that the following criterion is satisfied:
Assuming a stuck rod cluster control assembly, with offsite power available, and assuming a single failure in the engineered safety features system there will be no consequential damage to the core or reactor coolant system after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.
Accidental depressurization of the secondary system is classified as an ANS Condition II event.
See Section 15.0.1 for a discussion of Condition II events.
The following systems provide the necessary protection against an accidental depressurization of the main steam system due to the opening of a steam generator relief or safety valve.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three low steam line pressure signals in a steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which closes the main feedwater valves following reactor trip, a safety injection signal rapidly closes all feedwater control valves and back up feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast-acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- b. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
Revision 3306/30/20 MPS-3 FSAR 15.1-9 Plant systems and equipment which are available to mitigate the effects the accident are also discussed in Section 15.0.8 and listed in Table 15.0-6.
15.1.4.2 Analysis of Effects and Consequences Method of Analysis The consequences of an inadvertent opening of a steam generator relief or safety valve are bounded by the zero power steam system piping failure discussed in Section 15.1.5. The opening of a steam generator relief or safety valve causes a less severe steam generator blowdown and subsequent RCS cooldown than the steam system piping failure event. This would result in a lower peak power level if a return to power were to occur as predicted for the zero power steam system piping failure. The minimum DNBR for the zero power steam system piping failure, which remains above the safety analysis limit, would be lower than that for the opening of a steam generator relief or safety valve.
Results and Conclusions Since the minimum DNBR for the zero power steam system piping failure (Section 15.1.5) remains above the safety analysis limit, there would be no fuel failure predicted for an inadvertent opening of a steam generator relief or safety valve.
The steam generator atmospheric dump bypass valves are Safety Class 2 (QA Category I) motor operated valves and are manually controlled only with no automatic control circuitry. As such, malfunction of these valves would not be postulated. However, even if an inadvertent opening of one of these valves were to be assumed, the event will be bounded by the events described in Section 15.1.5 where it is demonstrated that no DNB occurs and no system design limits are exceeded. Thus, the conclusions provided in Section 15.1.4.3 also apply to these valves.
15.1.4.3 Radiological Consequences Since no fuel damage is postulated for this transient a specific radiological release calculation was not performed.
15.1.5 STEAM SYSTEM PIPING FAILURE 15.1.5.1 Identification of Causes and Accident Description The steam release arising from a rupture of a main steam line would result in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient (or positive moderator density coefficient), the cooldown results in an insertion of positive reactivity. If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased possibility that the core could become critical and return to power. A return to power
Revision 3306/30/20 MPS-3 FSAR 15.1-10 following a steam line rupture is a potential problem mainly because of the high power peaking factors which exist assuming the most reactive RCCA to be stuck in its fully withdrawn position.
The analysis of a main steam line rupture is performed to demonstrate that the following criterion is satisfied.
Assuming the most limiting single failure of a stuck RCCA with or without offsite power, and assuming the most limiting single failure in the engineered safety features, the core remains in place and intact. Radiation doses do not exceed the guidelines of 10 CFR 50.67.
Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis shows that the DNB design basis is met for any rupture assuming the most reactive RCCA stuck in its fully withdrawn position. The DNB design basis is discussed in Section 4.4.
A major steam line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a discussion of Condition IV events.
Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as Condition III events, as described in Section 15.0.1.3.
The major rupture of a steam line is the most limiting cooldown transient and is analyzed at zero power with no decay heat. Decay heat would retard the cooldown, thereby reducing the return to power. A detailed analysis of this transient with the most limiting break size, a double ended rupture, is presented here.
The following functions provide the protection for a steam line rupture.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three hi-1 containment pressure signals;
- c. two out of three low steam line pressure signals in one steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower (neutron flux and T) and low pressurizer pressure reactor trips, and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Isolation of the main feedwater lines, via closure of the redundant main feedwater isolation valves
Revision 3306/30/20 MPS-3 FSAR 15.1-11 Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which closes the main feedwater valves, a safety injection signal rapidly closes all feedwater control valves and backup feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. 2 out of 3 hi-2 containment pressure signals;
- b. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- c. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
Fast-acting isolation valves (main steam isolation valves) are provided in each steam line; these valves are assumed to close within 12 seconds of the generation of the steam line isolation signal following a large break in the steam line. For breaks downstream of the isolation valves, closure of all valves would completely terminate the blowdown. For breaks upstream of the isolation valves, one steam generator is assumed to blow down. A description of steam line isolation is included in Chapter 10.
Steam flow is measured by monitoring dynamic head in nozzles located in the throat of the steam generator. The effective throat area of the nozzles is 1.388 square feet, which is considerably less than the main steam pipe area; thus, the nozzles also serve to limit the maximum steam flow for a break at any location.
Table 15.1-2 lists the equipment required in the recovery from a high energy line rupture. Not all equipment is required for any one particular break, since the requirements vary depending upon postulated break locations and details of balance of plant design and pipe rupture criteria as discussed elsewhere in this application. Design criteria and methods of protection of safety related equipment form the dynamic effects of postulated piping ruptures are provided in Section 3.6.
15.1.5.2 Analysis of Effects and Consequences Method of Analysis The analysis of the steam pipe rupture has been performed to determine:
- 1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN code (VEP-FRD-41-P-A) has been used.
- 2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE-D (DOM-NAF-2-P-
Revision 3306/30/20 MPS-3 FSAR 15.1-12 A), has been used to determine if DNB occurs for the core conditions computed in RETRAN.
The analysis has been performed with four reactor coolant loops in operation.
The following conditions were assumed to exist at the time of a main steam line break accident.
- 1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.
- 2. A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked at limiting statepoints for the cases analyzed. The statepoints were selected on the basis of core parameters at specific points in the transient analysis that resulted in minimum DNBR. This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity used in the RETRAN kinetics analysis was greater than the reactivity value calculated by the core physics code for all statepoints. This verifies conservatism of the method; i.e.,
underprediction of negative reactivity feedback from power generation in the RETRAN simulation.
- 3. Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the safety injection system.
The most restrictive single failure corresponds to the flow delivered by one intermediate head safety injection pump delivering its full flow to the cold leg header.
Revision 3306/30/20 MPS-3 FSAR 15.1-13 The sequence of events in the safety injection system are as follows. The two out of three low steam line pressure signals in one steam line generate the safety injection signal (SIS). The SIS begins the appropriate delays for instrumentation, logic, signal transport, pump startup and emergency diesel generator startup if applicable. The pumps will not discharge to the reactor coolant cold leg until a low RCS pressure condition exists (Permissive-19) to open the last isolation valve to the cold leg. The delivery of safety injection flow is not determined by P-19 in the analysis.
The Technical Specification minimum RWST boric acid concentration is assumed for the safety injection flow. No credit has been taken for the borated water which must be swept from the lines downstream of the RWST prior to the delivery of safety injection flow to the reactor coolant loops. Due to this modeling, boron does not reach the core before steam generator dryout.
The accumulators are also modeled in the steam line break accident analysis and are assumed to contain the minimum Technical Specification boric acid concentration. The system pressure does not drop low enough to actuate the accumulators in the analysis.
- 4. Since the steam generators are provided with integral flow restrictors at the main steam nozzles with a 1.388 square foot throat area, any rupture in a steam line with a break area greater than 1.388 square feet, regardless of location, would have the same effect on the NSSS as the 1.388 square foot break. The analysis of the steam pipe rupture modes a 1.4 square foot steam generator outlet nozzle. The following cases have been considered in determining the core power and RCS transients.
- a. Complete severance of a pipe, with the plant initially at no-load conditions, full reactor coolant flow with offsite power available.
- b. Case (a) with loss of offsite power simultaneous with the steam line break.
Loss of offsite power results in reactor coolant pump coastdown.
- 5. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life.
The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break. This void, in conjunction with the large negative moderator coefficient, partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.
The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.
Revision 3306/30/20 MPS-3 FSAR 15.1-14 The analysis assumes initial hot shutdown conditions at time zero. Should the reactor be just critical or operating at power at the time of a steam line break, the reactor is tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analysis are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as cooldown and reactivity insertions proceed in the analysis which assumes no-load conditions at time zero.
- 6. In computing the steam flow during a steam line break, the Moody Curve (Moody 1965) for fL/D = 0 is used.
Results The calculated sequence of events for both cases analyzed is shown in Table 15.1-1. The results presented are a conservative indication of the events which would occur assuming a steam line rupture since it is postulated that all of the conditions described above occur simultaneously.
Core Power and Reactor Coolant System Transient Figures 15.1-15 through 15.1-17 show the RCS transient and core heat flux following a main steam line rupture (complete severance of a pipe) at initial no-load conditions (case a). Offsite power is assumed available so that full reactor coolant flow exists. The transient shows an uncontrolled steam release from only one steam generator.
Should the core be critical at or near zero power when the rupture occurs, the initiation of safety injection by low steam line pressure trips the reactor. Sustained steam release from more than one steam generator is prevented by automatic trip of the fast acting isolation valves in the steam lines by high containment pressure signals or by low steam line pressure signals. Specifically, the release is limited to approximately 13 seconds for the other steam generators while the one generator blows down. The main steam isolation valves are designed to be fully closed in less than 10 seconds from receipt of a closure signal.
As shown on Figure 15.1-15, the core attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) before the faulted steam generator dries out. As a result of the steam generator dry out, the RCS temperatures rise (and stabilize) resulting in a reduction in the reactivity of the core in the presence of a negative moderator temperature coefficient (or positive moderator density coefficient) and effectively turning around the transient. A peak core power less than the nominal full power value is attained.
The calculation modeled a minimum boric acid concentration in the accumulators and RWST.
However, the accumulators do not actuate and the liquid volume from the RWST to cold leg
Revision 3306/30/20 MPS-3 FSAR 15.1-15 injection point is not purged of non-borated water by the time of steam generator dryout. Only safety injection water with a zero boron concentration enters the reactor core during the transient.
The variation of mass flow rate in the RCS due to water density changes is included in the calculation as is the variation of flow rate in the safety injection system due to changes in the RCS pressure. The safety injection system flow calculation includes the line losses in the system as well as the pump head curve.
Based on the results of a generic study (WCAP-9227), the case with loss of offsite power (case b) is less severe than that described above. The loss of the main coolant pumps reduce the flow in the reactor coolant system. The loss of forced circulation makes the transient less severe than the case with forced circulation. This is due to: 1) the core and steam generator are more decoupled, hence the time to go critical is much longer, 2) without forced coolant, the rate of heat transfer is reduced in the steam generator, thereby reducing the core cooldown rate, and 3) local density feedback effects minimize the power level following the assumed steam break. All of these effects result in the case with forced coolant flow being much more severe than the case without offsite power for the potential of clad damage. Results from the case b RETRAN analysis align with the WCAP-9927 observations.
It should be noted that following a steam line break, only one steam generator blows down completely. Thus, the remaining steam generators in operation are still available for dissipation of decay heat after the initial transient is over. In the case of loss of offsite power, this heat is removed to the atmosphere via the steam line safety valves, and power-operated relief valves.
Margin to Critical Heat Flux A DNB analysis was performed for the limiting case with offsite power available and the non-limiting case that models a loss of offsite power. It was found that the DNB design basis, as stated in Section 4.4, was met for both cases.
15.1.5.3 Conclusions The analysis has shown that the criteria stated earlier in Section 15.1.5.1 are satisfied.
Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and not precluded by the criteria, the above analysis shows that no DNB occurs for any rupture assuming the most reactive RCCA stuck in its fully withdrawn position. The radiological consequences of this limiting event are within the acceptable criteria of 10 CFR 50.67.
15.1.5.4 Radiological Consequences The main steam line break is postulated to occur in a main steam line outside the containment.
The plant is assumed to have operated with Technical Specification fuel defects. A 1 gpm primary to secondary leakage is assumed to occur such that 0.35 gpm leakage takes place in the affected steam generator and 0.65 gpm leakage takes place evenly in the other steam generators.
Revision 3306/30/20 MPS-3 FSAR 15.1-16 Associated with this accident is the assumption of RCS activity equivalent to 1 Ci/gm DEQ I-131. This is equivalent to 0.29% failed fuel for both iodine and gross gamma activity. The activity associated with the damaged fuel rods is uniformly mixed with the primary coolant and is therefore available for release to the atmosphere via primary to secondary leakage.
The iodine partition factor is assumed to be 1.0 for the steam release from the affected steam generator. An iodine partition factor of 0.01 is used for the releases from the unaffected steam generators. Offsite power is also assumed to be lost, thus making the condensers unavailable for steam dump. The steam released from all steam generators is assumed to be released directly to the environment at ground level.
Two cases are analyzed and reported for four loop plant operating conditions. The first case assumes a concurrent iodine spike condition. The second case includes a pre-accident iodine spike condition when the steam line break occurs.
The radiological consequences of a main steam line break (both cases) are reported in Table 15.0-
- 8. The assumptions used to perform this evaluation are summarized in Table 15.1-3 and Table 15.6-12. The use of these assumptions together with the atmospheric dispersion values listed in Table 15.0-11, are used to compute the doses to the Control Room, EAB and LPZ as reported in Table 15.0-8.
The evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The radiological consequences of the main steam line break are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and LPZ for the concurrent spike 15.
1.6 REFERENCES
FOR SECTION 15.1 15.1-1 Moody, F. S. 1965. Transactions of the ASME, Journal of Heat Transfer. Figure 3, page 134.
15.1-2 WCAP-14882-P-A, 1999. RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
15.1-3 Letter from A.C. Thadani (NRC) to W.J. Johnson (Westinghouse), January 31, 1989, Acceptance for Referencing of Licensing Topical Report, WCAP-9226-P/9227-NP, Reactor Core Response to Excessive Secondary Steam Releases.
15.1-4 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
15.1-5 WCAP-9227, 1978, Reactor Core Response to Excessive Secondary Steam Release.
15.1-6 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
Revision 3306/30/20 MPS-3 FSAR 15.1-17 15.1-7 DOM-NAF-2-PA-A, Revision 0, Minor Revision 3, September 2014, Reactor Core Thermal Hydraulics Using the VIPPRE-D Computer Code.
Revision 3306/30/20 MPS-3 FSAR 15.1-18 TABLE 15.1-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE AN INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)
Feedwater system Main feedwater control valve fails fully open 0.0 malfunctions that result in an High-high steam generator water level signal 28.0 increase in feedwater flow generated (100% NRS)
Turbine trip occurs due to high-high steam 30.4 generator level Reactor trip occurs 32.4 Minimum DNBR occurs 32.5 Feedwater isolation valves close automatically 34.9 Steam system piping failure:
- 1. Complete severance of a Steam line ruptures 0.1 pipe, no-load conditions, full Feedwater isolation complete 9.7 reactor coolant flow with offsite power available Steam line isolation complete 12.9 (Case a) Pressurizer empties (1) 14.2 Criticality attained 36.2 Safety Injection flow initiation (2) 36.6 Peak heat flux/minimum DNBR reached 112.3 Faulted steam generator dries out 292
- 2. Complete severance of a Steam line ruptures 0.1 pipe, no-load conditions, Reactor coolant pumps trip 0.2 reactor coolant pump coastdown due to a loss of Feedwater isolation complete 9.7 offsite power (Case b) Steam line isolation complete 12.9 Pressurizer empties (1) 16.4 Criticality attained 41.1 Safety Injection flow initiation (2) 49.6 Peak heat flux/minimum DNBR reached 171.1 Cooldown terminates/core begins to heat 290 NOTES:
(1) Defined by the end of the rapid draindown.
(2) Boron does not reach the core before event termination.
Revision 3306/30/20 TABLE 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAM LINE Short-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Reactor trip and safeguards actuation Auxiliary feedwater system Steam generator atmospheric relief valves (can be manually channels including sensors circuitry, and including pumps, water supply, operated locally).
processing equipment (the protection and system valves and piping Control for defeating automatic safety injection actuation circuits used to trip the reactor on low (this system must be available during a cooldown and depressurization.
reactor coolant pump shaft speed, and to supply water to operable turbine trip may be excluded). steam generators no later than 10 minutes after the incident).
Safety injection system including the Capability for obtaining a Residual heat removal system including pumps, heat pumps, the refueling water storage tank, reactor coolant system sample. exchanger, and systems valves and piping necessary to cool and the systems valves and piping. and maintain the reactor coolant system in a cold shutdown condition.
Diesel generators and emergency power distribution equipment.
Reactor plant component cooling water service water system.
MPS-3 FSAR Quench spray system containment recirculation system.
Auxiliary feedwater system including pumps, water supplies, piping and valves.
Main feedwater control valves (trip closed feature).
Bypass feedwater control valves (trip closed feature).
15.1-19 Primary and secondary safety valves.
TABLE 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAM LINE (CONTINUED)
Revision 3306/30/20 Short-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Circuits and/or equipment required to trip the main feedwater pumps.
Main feedwater isolation valves (trip closed feature).
Main steam line stop valves (trip closed feature).
Steam generator blowdown isolation valves (automatic closure feature).
Batteries (Class IE).
Control room ventilation.
Control room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.
MPS-3 FSAR Emergency lighting.
Post-accident monitoring system.*
NOTE:
- See Section 7.5 for a discussion of the post-accident monitoring system.
15.1-20
Revision 3306/30/20 MPS-3 FSAR 15.1-21 TABLE 15.1-3 ASSUMPTIONS USED IN MAIN STEAM LINE BREAK ANALYSIS Analysis Input Parameters
- 1. Reactor thermal power level plus 2% uncertainty (MWt) 3,723
- 2. Primary coolant concentrations Table 15.0-10
- 3. Primary to secondary leak rate (gpm) 1.0
- 4. Secondary coolant concentrations Table 15.0-10
- 5. Iodine partition factor in affected steam generator 1.0 throughout accident
- 6. Iodine partition factors in unaffected steam generators 0.01 throughout accident
- 7. Duration of release (hours) 36.25 (intact S/Gs) 65.75 (affected S/G)
- 8. Initial steam and water release from affected steam 165,000 generator over the first 16.5 seconds of the accident (lb)
- 9. Long-term (65.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />) steam release from the affected 11,511 steam generator (lb)
- 10. Steam release from unaffected steam generators (lbm/min)
- a. 0-2 hours 3.58E+03
- b. 2-11hours 2.37E+3
- c. 11-24 hours 2.37E+3
- d. 24-36.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> 2.73E+2
- 11. Offsite power Lost
- 12. Initial steam generator contents (lb/SG) 165,000
- 13. Iodine spike factor Pre-accident iodine concentrations shown in Table 15.0-12. Concurrent iodine appearance rates in Table 15.0-13.
- 14. Atmospheric Dispersion Factors (1) See Table 15.0-11.
NOTE:
- 1. EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
Revision 3306/30/20 MPS-3 FSAR 15.1-22 TABLE 15.1-4 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.1-23 FIGURE 15.1-1 FEEDWATER CONTROL VALVE MALFUNCTION
Revision 3306/30/20 MPS-3 FSAR 15.1-24 FIGURE 15.1-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.1-25 FIGURE 15.1-2 FEEDWATER CONTROL VALVE MALFUNCTION This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.1-26 FIGURE 15.1-2 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.1-27 FIGURE 15.1-3 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-28 FIGURE 15.1-4 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-29 FIGURE 15.1-5 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-30 FIGURE 15.1-6 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-31 FIGURE 15.1-7 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-32 FIGURE 15.1-8 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-33 FIGURE 15.1-9 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-34 FIGURE 15.1-10 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-35 FIGURE 15.1-11 TYPICAL(1)Keffective VERSUS TEMPERATURE (1) This figure shows the typical effect of a change in moderator temperature (at constant pressure) on core reactivity; however, the figure should not be relied upon for an absolute value of the moderator feedback.
Revision 3306/30/20 MPS-3 FSAR 15.1-36 FIGURE 15.1-12 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-37 FIGURE 15.1-12 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.1-38 FIGURE 15.1-13 DELETED BY FSARCR PKG FSC 07-MP3-050
Revision 3306/30/20 MPS-3 FSAR 15.1-39 FIGURE 15.1-13 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.1-40 FIGURE 15.1-14 TYPICAL(1)DOPPLER POWER FEEDBACK (1) This figure shows the typical effect of a change in moderator temperature (at constant pressure) on core reactivity; however, the figure should not be relied upon for an absolute value of the moderator feedback.
Revision 3306/30/20 MPS-3 FSAR 15.1-41 FIGURE 15.1-15 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.1-42 FIGURE 15.1-15 A 1.4 SQ. FT STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.1-43 FIGURE 15.1-16 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.1-44 FIGURE 15.1-16 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.1-45 FIGURE 15.1-17 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.1-46 FIGURE 15.1-17 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-1 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the reactor coolant system (RCS). Detailed analyses are presented in this section for several such events which have been identified as more limiting than the others.
Discussions of the following RCS coolant heatup events are presented in Section 15.2.
- 1. Steam pressure regulator malfunction or failure that results in decreasing steam flow.
- 2. Loss of external electrical load.
- 3. Turbine trip.
- 4. Inadvertent closure of main steam isolation valves.
- 5. Loss of condenser vacuum and other events resulting in turbine trip.
- 6. Loss of nonemergency AC power to the station auxiliaries.
- 7. Loss of normal feedwater flow.
- 8. Feedwater system pipe break.
The above items are considered to be American Nuclear Society (ANS) Condition II events, with the exception of a feedwater system pipe break, which is considered to be an ANS Condition IV event. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.
15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW There are no steam pressure regulators in Millstone 3 whose failure or malfunction could cause a steam flow transient.
15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite alternating current (AC) power remains available to operate plant components such as the reactor coolant pumps; as a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves occurs. This causes a sudden reduction in
Revision 3306/30/20 MPS-3 FSAR 15.2-2 steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise.
For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. The plant would be expected to trip from the reactor protection system if a safety limit were approached. A continued steam load of approximately 5 percent would exist after total loss of external electrical load because of the steam demand of plant auxiliaries.
In the event that a safety limit is approached, protection would be provided by the high pressurizer pressure, overtemperature T and steam generator low-low level trips. Following a complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an overfrequency of less than 6 Hz. Any increased frequency to the reactor coolant pump motors results in slightly increased flow rate and subsequent additional margin to safety limits. For postulated loss of load and subsequent turbine generator overspeed, turbine trip and the opening of the generator breaker terminate the overfrequency condition seen by other safety-related pump motors, reactor protection system equipment, or other safeguards loads. Safeguards loads are supplied from offsite power or, alternatively, from emergency diesel generators. Reactor protection system equipment is supplied from the 120 V AC instrument power supply system, which in turn is supplied from the inverters; the inverters are supplied from a Class IE 125 V direct current (DC) bus energized from batteries or by a rectified Class IE AC voltage from safeguards buses.
In the event the steam dump valves fail to open following a large loss of load, the steam generator safety valves may lift and the reactor may be tripped by the high pressurizer pressure signal, or the overtemperature T signal. In the event of feedwater flow also being lost, the reactor may be tripped by a steam generator low-low level signal. The steam generator shell side pressure and reactor coolant temperatures increase rapidly. However, the pressurizer safety valves and steam generator safety valves are sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, pressurizer spray, pressurizer power-operated relief valves, automatic rod cluster control assembly control or direct reactor trip on turbine trip.
The steam generator safety valve capacity is sized sufficiently to remove the steam flow from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure within 110 percent of the RCS design pressure.
A more complete discussion of overpressure protection can be found in WCAP-7769.
A loss of external load is classified as an ANS Condition II event, fault of moderate frequency.
See Section 15.0.1 for a discussion of Condition II events.
Revision 3306/30/20 MPS-3 FSAR 15.2-3 A loss of external load event results in a nuclear steam supply system (NSSS) transient that is less severe than a turbine trip event (see Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load.
The primary side transient is caused by a decrease in heat transfer capability from primary to secondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of feedwater flow (should feed flow not be reduced, a larger heat sink would be available and the transient would be less severe). Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in not less than 0.3 seconds. Following a turbine trip event, termination of a steam flow occurs via turbine stop valve closure, which occurs in not less than 0.1 seconds. Therefore, the transient in primary pressure, temperature, and water volume is less severe for the loss of external load than for the turbine trip due to a slightly slower loss of heat transfer capability.
The protection available to mitigate the consequences of a loss of external load is the same as that for a turbine trip, as listed in Table 15.0-6.
15.2.2.2 Analysis of Effects and Consequences Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more severe than those expected for the loss of external load, as discussed in Section 15.2.2.1.
Normal reactor control systems and engineered safety systems are not required to function during a loss of external load.
The reactor protection system may be required to function following a complete loss of external load to terminate core heat input and prevent departure from nucleate boiling (DNB). Depending on the magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function. See WCAP 8330 for a discussion of anticipated transients without trip (ATWT) considerations.
15.2.2.3 Conclusions Based on results obtained for the turbine trip event (Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.
15.2.2.4 Radiological Consequences Since no fuel damage is postulated for this transient, a specific radiological calculation was not performed.
Revision 3306/30/20 MPS-3 FSAR 15.2-4 15.2.3 TURBINE TRIP 15.2.3.1 Identification of Causes and Accident Description For a turbine trip event, the reactor would be tripped directly (unless below the Power Range Neutron Flux Reactor Trip System interlock P-9) from a signal derived from the turbine stop emergency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly (with a minimum delay time of 0.1 seconds) on loss of trip fluid pressure actuated by a turbine trip signal. Turbine trip initiation signals include:
- generator trip
- low condenser vacuum
- loss of lubricating oil
- turbine thrust bearing failure
- turbine overspeed
- moisture separator water level high
- manual trip Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop valves detect the turbine trip and cause reactor trip if core power is above the Power Range Neutron Flux Reactor Trip System interlock P-9. Steam dump would be initiated following a reactor trip. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external load event. A slightly more severe transient occurs for the turbine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.
The automatic steam dump system would normally accommodate the excess steam generation.
Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser was not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost, causing steam generator water level to fall. For this situation feedwater flow would be maintained by the auxiliary feedwater system to ensure adequate residual and decay heat removal capability. Should the steam dump system fail to operate, the steam generator safety valves may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the transient.
A turbine trip is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
Revision 3306/30/20 MPS-3 FSAR 15.2-5 A turbine trip event is more limiting than loss of external load, loss of condenser vacuum, and other turbine trip events. As such, this event has been analyzed in detail. Results and discussion of the analysis are presented in Section 15.2.3.2.
The plant systems and equipment available to mitigate the consequences of a turbine trip are discussed in Section 15.0.8 and listed in Table 15.0-6.
15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the unit is evaluated for a complete loss of steam load from 100 percent of full load power without direct reactor trip primarily to show the adequacy of the pressure relieving devices and also to demonstrate core protection margins; that is, the turbine is assumed to trip without actuating all the sensors for reactor trip on the turbine stop valves. The assumption delays reactor trip until conditions in the RCS result in a trip due to other signals.
Thus, the analysis assumes a worst transient. In addition, no credit is taken for steam dump. Main feedwater flow is terminated at the same time of turbine trip, with no credit taken for auxiliary feedwater to mitigate the consequences of the transient.
The turbine trip transients are analyzed by employing the detailed digital computer program RETRAN (WCAP-14882-P-A). The program simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The program computes pertinent plant variables including temperatures, pressures, and power level.
Initial operating conditions are assumed at values consistent with steady state four loop operation.
Plant characteristics and initial conditions are discussed in Section 15.0.3, and any deviations from Section 15.0.3 are noted below.
Major assumptions are summarized as follows:
- 1. Initial operating conditions The initial reactor power and RCS pressure and temperatures are assumed at their nominal values consistent with steady state full-power operation. Uncertainties, including allowances for calibration and instrument errors in initial conditions, are included in the DNBR limit as discussed in Section 15.0.3.2. Cases with four loops in operation are considered.
- 2. Moderator and Doppler coefficients of reactivity The turbine trip is analyzed for minimum reactivity feedback. This involves modeling the most positive value for the moderator temperature coefficient, along with least negative Doppler power coefficients (Figure 15.0-2).
Revision 3306/30/20 MPS-3 FSAR 15.2-6
- 3. Reactor control From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
- 4. Steam release No credit is taken for the operation of the steam dump system or steam generator atmospheric relief valves. The steam generator pressure rises to the safety valve set point where steam release through safety valves limits secondary steam pressure to less than 110 percent of the steam system design temperature.
- 5. Pressurizer spray and power operated relief valves
- a. Full credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the DNB and main steam system overpressurization cases. Safety valves are also available.
- b. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the RCS overpressurization case. Safety valves are operable.
- 6. Feedwater flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition is reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on low-low steam generator water level. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
- 7. Reactor trip is actuated by the first reactor protection system trip set point reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, overtemperature T, and low-low steam generator water level.
Plant characteristics and initial conditions are further discussed in Section 15.0.3.
Except as discussed above, normal reactor control system and engineered safety systems are not required to function.
The reactor protection system may be required to function following a turbine trip. Pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system
Revision 3306/30/20 MPS-3 FSAR 15.2-7 pressures below allowable limits. No single active failure will prevent operation of any system required to function. A discussion of ATWT considerations is presented in WCAP 8330.
Results The transient responses for a turbine trip from 100 percent of full power operation are shown for three cases: RCS overpressurization DNBR, and main steam system overpressurization (Figures 15.2-1 through 15.2-6). The calculated sequence of events for the accident is shown in Table 15.2-1.
Figures 15.2-1 and 15.2-2 show the turbine trip transient responses for the RCS Overpressurization case modeling minimum reactivity feedback and assuming no credit for pressurizer sprays or power operated relief valves (PORVs). No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure trip signal. The pressurizer safety valves lift and maintain primary system pressure below 110 percent of the design value. The steam generator safety valves limit the secondary steam conditions to saturation at the safety valve set point.
Figures 15.2-3 and 15.2-4 show the turbine trip transient responses for the DNBR case modeling minimum reactivity feedback and pressurizer sprays and PORVs. The reactor is tripped by the high pressurizer pressure trip signal. The DNBR decreases slightly below its initial value during the very beginning of the transient. Pressurizer relief and safety valves and spray prevent primary system overpressurization; steam generator safety valves prevent overpressurization in the secondary side.
Figures 15.2-5 and 15.2-6 show the turbine trip transient responses for the MSS Overpressurization case modeling minimum reactivity feedback and pressurizer pressure control, sprays and PORVs. No credit is taken for the steam dump. The reactor is tripped by the high pressurizer pressure trip signal. The pressurizer PORVs, safety valves and sprays lift to maintain primary system pressure and the steam generator safety valves actuate to maintain secondary side pressure below 110% of the design value.
WCAP-7769 presents additional results of analysis for a complete loss of heat sink (i.e., turbine trip) including loss of main feedwater. This analysis shows the overpressure protection that is afforded by the pressurizer and steam generator safety valves.
15.2.3.3 Conclusions Results of the analysis, including those in WCAP-7769 show that the plant design is such that a turbine trip without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.
The integrity of the core is maintained by operation of the reactor protection system, i.e., the DNBR will be maintained above the safety analysis limit. DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of
Revision 3306/30/20 MPS-3 FSAR 15.2-8 minimum DNBR. The results met the applicable limit as specified in Section 4.4. Applicable acceptance criteria as listed in Section 15.0.1 have been met. The above analysis demonstrates the ability of the nuclear steam supply system to safely withstand a full load rejection.
15.2.3.4 Radiological Consequences Since no fuel damage is postulated for this transient a specific radiological calculation was not performed.
15.2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES Inadvertent closure of the main steam isolation valves would result in a turbine trip. Turbine trips are discussed in Section 15.2.3.
15.2.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 15.2.3. A loss of condenser vacuum would preclude the use of steam dump to the condenser; however, since steam dump is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as listed in Section 15.2.3.1, are covered by Section 15.2.3. Possible overfrequency effects due to a turbine overspeed, as discussed in Section 15.2.2.1, are not a concern for this type of event.
15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES 15.2.6.1 Identification of Causes and Accident Description A complete loss of nonemergency AC power may result in the loss of all power to the station auxiliaries; i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite AC distribution system.
This transient is different than the turbine trip event analyzed in Section 15.2.3 because for this case the decrease in heat removal by the secondary is accompanied by a flow coastdown which further reduces the capacity of the primary coolant to remove heat from the core. The reactor trips:
- 1. due to turbine trip;
- 2. upon reaching one of the trip set points in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or
Revision 3306/30/20 MPS-3 FSAR 15.2-9
- 3. due to loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.
Following a loss of AC power with turbine and reactor trips, the sequence described below occurs.
- 1. Plant vital instruments are supplied from emergency DC power sources.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves may be automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
- 3. As the no-load temperature is approached, the steam generator atmospheric relief valves (or the self actuated safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
- 4. The emergency diesel generators, started on loss of voltage on the plant emergency buses, begin to supply plant vital loads.
The auxiliary feedwater system is started automatically as follows.
Two motor-driven auxiliary feedwater pumps are started on any of the following:
- 1. two of four low-low water level signals in any one steam generator;
- 2. safety injection signal;
- 3. loss of offsite power;
- 4. manual actuation; or
- 5. AMSAC actuation signal.
One turbine driven auxiliary feedwater pump is started on any of the following:
- 1. two of four low-low water level signals in any two of four steam generators;
- 2. manual actuation; or
- 3. AMSAC actuation signal.
Refer to Section 10.4.9 for a description of the auxiliary feedwater system.
Revision 3306/30/20 MPS-3 FSAR 15.2-10 The motor-driven auxiliary feedwater pumps are supplied power by the diesels and the turbine-driven pump utilizes steam from the secondary system. Both type pumps are designed to start within 60 and 90 seconds, respectively, even if a loss of all AC power occurs simultaneously with loss of normal feedwater. The turbine exhausts the secondary steam to the atmosphere. The auxiliary pumps take suction from the demineralized water storage tank (DWST) for delivery to the steam generators.
Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops. A loss of nonemergency AC power to the station auxiliaries is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
With respect to maximum calculated primary and secondary side pressure, the loss of AC event, as described above, is bounded by the turbine trip initiated decrease in secondary heat removal without loss of AC power, which was analyzed in Section 15.2.3. The DNB transient for this event is bounded by the complete loss of flow transient analyzed in Section 15.3.2. A loss of AC power to the station auxiliaries as postulated above could also result in a loss of normal feedwater if the condensate pumps lose power to operate. A loss of normal feedwater is the most limiting Condition II event in the decrease in secondary heat removal category, and is analyzed with loss of AC power in Section 15.2.7. Therefore, detailed analytical results for a loss of AC power transient are not presented here. The results of the analysis in Section 15.2.7 address the loss of feedwater aspect of the loss of AC power event.
Following the reactor coolant pump coastdown caused by the loss of AC power, the natural circulation capability of the RCS removes residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. The analyses is presented in Section 15.2.7 show that the natural circulation flow in the RCS following a loss of AC power event is sufficient to remove residual heat from the core.
The plant systems and equipment available to mitigate the consequences of a loss of AC power event are discussed in Section 15.0.8 and listed in Table 15.0-6.
15.2.6.2 Analysis of Effects and Consequences Method of Analysis As stated above, the DNB consequences of this event are bounded by the complete loss of flow event. With respect to overpressurization of the primary and secondary sides, this event is bounded by the turbine trip analysis described in Section 15.2.3. The loss of feedwater aspects are covered by the analyses presented in Section 15.2.7 (specifically those cases that assume loss of offsite power). Based on this, transient analysis results of this event are not presented in this section. However, in support of the flow coastdown test performed at initial plant startup, analyses similar to those discussed in Section 15.2.7 have been performed for this plant to determine the equilibrium natural circulation flow rate as a function of the residual reactor power expected under these conditions. To do this, steady state cases were run at a number of power levels consistent with the decay heat generation rates expected. Equilibrium conditions were established
Revision 3306/30/20 MPS-3 FSAR 15.2-11 and the natural circulation flow through the core was recorded for each power level. These results are presented in Table 15.2-2.
The data presented in Table 15.2-2 is not used as input in any FSAR Chapter 15 analysis for Millstone Unit 3. However, the acceptability of the natural circulation model for use in Millstone Unit 3 transient analyses was confirmed at initial startup by showing that the actual natural circulation flow rate, determined from the startup tests, met or exceeded these values. In the applicable transient analyses, the natural circulation flow rate is calculated by the LOFTRAN computer code based on transient conditions.
Results The results of the loss of nonemergency AC power are not produced here because this event is bounded by other events. The transient response of the RCS following a loss of AC power is less severe than for the loss of normal feedwater with a loss of offsite power event analyzed in Section 15.2.7. The results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and reactor coolant pump coastdown.
The first few seconds of the loss of AC power transient closely resembles a simulation of the complete loss of flow incident, i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. This aspect of the loss of AC power event is bounded by the complete loss of flow event analyzed in Section 15.3.2 that demonstrates that the DNB design basis is met. With respect to overpressurization of the primary and secondary sides, this event is bounded by the turbine event (Section 15.2.3). After the reactor trip, stored and residual decay heat must be removed to prevent damage to either the RCS or the core.
The natural circulation flow as a function of residual reactor power is presented in Table 15.2-2.
15.2.6.3 Conclusions Analysis of the natural circulation capability of the RCS has demonstrated that sufficient heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage.
The loss of AC power transient is less severe than the loss of normal feedwater with a loss of offsite power event as analyzed in Section 15.2.7. It is also less severe than the turbine trip event analyzed in Section 15.2.3, which demonstrates that primary and secondary side pressures remain below 110% of design value. Finally, this event is less severe than the complete loss of flow event analyzed in Section 15.3.2, which demonstrates that the DNBR acceptance limit is met.
15.2.6.4 Radiological Consequences Since no fuel damage is postulated to occur for this transient, a specific radiological calculation was not performed.
Revision 3306/30/20 MPS-3 FSAR 15.2-12 15.2.7 LOSS OF NORMAL FEEDWATER FLOW 15.2.7.1 Identification of Causes and Accident Description A loss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) results in a reduction in capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.
Two cases are presented for a loss of normal feedwater event with four loops operating initially.
The first is the case where offsite AC power is maintained, and the second is the case where offsite AC power is lost which results in reactor coolant pump coastdown as described in Section 15.2.6.
The case with offsite AC power available is limiting because of the additional heat from the reactor coolant pumps which must be removed by the auxiliary feedwater system.
The following events occur upon loss of normal feedwater.
- 1. Plant vital instruments are supplied from emergency DC power sources for the cases with a loss of offsite power.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power-operated relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
The following provide the necessary protection against a loss of normal feedwater.
- 1. Reactor trip on low-low water level in any steam generator.
- 2. High pressurizer pressure.
- 3. Reactor trip on over temperature T.
The Auxiliary Feedwater System is started automatically as discussed in Section 15.2.6.1.
A full analysis of the system transient is presented below to show that following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition.
Revision 3306/30/20 MPS-3 FSAR 15.2-13 A loss of normal feedwater is classified as an ANS Condition II event, a fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
15.2.7.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN Code (WCAP-14882-P-A) is performed in order to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant thermal kinetics, RCS including the natural circulation, pressurizer, steam generators and feedwater system. The digital program computes pertinent variables including the steam generator level, pressurizer water level, and reactor coolant average temperature.
Assumptions made in the analysis are as follows:
- 1. The plant is initially operating at 102 percent of the NSSS-rated thermal power.
- 2. The core residual heat generation is based on the 1979 version of ANS 5.1 (ANSI/
ANS-5.1-1979) assuming long-term operation at the initial power level.
- 3. For the case with a loss of offsite power, a heat transfer coefficient in the steam generator associated with RCS natural circulation is used.
- 4. Reactor trip occurs on steam generator low-low water level.
- 5. The worst single failure in the auxiliary feedwater system occurs; i.e., failure of the turbine-driven auxiliary feedwater pump.
- 6. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow, via both motor-driven AFW pumps, to all four steam generators. The cases analyzed model AFW flow as a function of steam generator pressure. A 60-second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and the motor-driven auxiliary feedwater pumps.
- 7. Secondary system steam relief is achieved through the self- actuated safety valves.
Note that steam relief is, in fact through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater. However, for the sake of analysis these have been assumed unavailable.
- 8. The pressurizer heaters and sprays are assumed to be available as their operation maximizes the pressurizer insurge and minimizes the margin to a water-solid condition in the pressurizer.
Revision 3306/30/20 MPS-3 FSAR 15.2-14
- 9. Because the plant is allowed to operate over a range of RCS average coolant temperatures (Tavg), and because the pressurizer level program varies over the range, several analyses were performed to establish the most limiting initial Tavg to model in each of the two cases (i.e., with and without offsite power). For the case with offsite power available, a Tavg of 587°F minus 4°F for uncertainty was limiting. For the case without offsite power, a Tavg of 571.5°F minus 4°F for uncertainty was limiting. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty as a result of an error in the Hysteresis of Weed Resistance Temperature Detectors.
- 10. Reactivity parameters were assumed to represent a zero moderator temperature coefficient.
- 11. The initial pressurizer pressure is 50 psi higher than nominal.
The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing long term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization or loss of RCS water.
As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.
One such assumption is the loss of external (offsite) AC power. This assumption results in coolant flow decay down to natural circulation conditions and a corresponding reduction in the steam generator heat transfer coefficient. Following a loss of offsite AC power, the first few seconds of a loss of normal feedwater transient is virtually identical to the transient response (including DNBR and neutron flux versus time) presented in Section 15.3.2 for the complete loss of forced reactor coolant flow.
If AC power is maintained for this incident the reactor coolant flow remains at its normal value and the reactor would trip via the low-low steam generator level trip with no change in DNBR below the value at the start of the transient. The auxiliary feedwater system has sufficient capacity, even assuming the worst single failure, to preclude filling the pressurizer.
Plant characteristics and initial conditions are further discussed in Section 15.0.3. Plant systems and equipment which are available to mitigate the effects of a loss of normal feedwater accident are discussed in Section 15.0.8 and listed in Table 15.0-6. Normal reactor control systems are not required to function during this transient. The reactor protection system is required to function following a loss of normal feedwater as analyzed here. The auxiliary feedwater system is required to deliver a minimum auxiliary feedwater flow rate. No single active failure will prevent operation of any system required to function. A discussion of ATWT considerations is presented in WCAP 8330.
Revision 3306/30/20 MPS-3 FSAR 15.2-15 Results Figures 15.2-9 through 15.2-12 show the significant plant parameter transients following a loss of normal feedwater with four loops in operation initially with offsite power.
Figures 15.2.9A through 15.2-12A are for four loops in operation initially with a loss of offsite power.
Following the reactor and turbine trip from full load, the water level in the steam generators falls due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. One minute following the initiation of the low-low steam generator water level trip, both motor-driven auxiliary feedwater pumps are automatically started, reducing the rate of water level decrease.
The capacity of the auxiliary feedwater pumps is such that the water level in the steam generator being fed does not recede below the lowest level at which sufficient heat transfer area is available to dissipate core residual heat without water relief from the RCS relief or safety valves. From Figures 15.2-11, 15.2-12, 15.2-11A, and 15.2-12A, it can be seen that at no time is the tubesheet uncovered in the steam generators receiving auxiliary feedwater flow and that at no time is there water relief from the pressurizer.
The calculated sequence of events for this accident is listed in Table 15.2-1. As shown on the figures presented, the plant approaches a stabilized condition following reactor trip and auxiliary feedwater addition. Standard plant shutdown procedures may be followed to further cool down the plant.
15.2.7.3 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system since the auxiliary feedwater capacity is such that reactor coolant water is not relieved from the pressurizer relief or safety valves, and the water level in all steam generators receiving auxiliary feedwater is maintained above the tubesheets.
The results of the cases that assume loss of offsite power also show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and reactor coolant pump coastdown.
15.2.7.4 Radiological Consequences Since no fuel damage is postulated to occur for this transient, a specific radiological calculation was not performed.
Revision 3306/30/20 MPS-3 FSAR 15.2-16 15.2.8 FEEDWATER SYSTEM PIPE BREAK 15.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedline between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break. (A break upstream of the feedline check valve would affect the nuclear steam supply system only as a loss of feedwater. This case is covered by the evaluation in Section 15.2.7).
Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either a RCS cooldown (by excessive energy discharge through the break) or a RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.
A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons.
- 1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.
- 2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.
- 3. The break may be large enough to prevent the addition of any main feedwater after trip.
An auxiliary feedwater system is provided to assure that adequate feedwater will be available such that:
- 1. no substantial overpressurization of the RCS shall occur, and
- 2. decay heat is removed in order to maintain sufficient liquid in the RCS to keep the reactor core covered.
Refer to Section 10.4.9 for a description of the auxiliary feedwater system interfaces.
A major feedwater line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a discussion of Condition IV events.
A main feedwater line rupture is the most limiting event in the decrease in secondary heat removal category. Therefore, a full transient analysis is presented here.
The severity of the feedwater line rupture transient depends on a number of system parameters including break size, initial reactor power, and credit taken for the functioning of various control
Revision 3306/30/20 MPS-3 FSAR 15.2-17 and safety systems. A number of cases of feedwater line break have been analyzed. Based on these analyses, it has been shown that the most limiting feedwater line rupture is a double ended rupture of the largest feedwater line, occurring at full power with and without loss of offsite power. These cases are analyzed below.
The following provides the necessary protection for a main feedwater rupture.
- 1. A reactor trip on any of the following conditions:
- a. high pressurizer pressure;
- b. overtemperature T;
- c. low-low steam generator water level in any steam generator; or
- d. safety injection signals from any of the following:
- 1. low steam line pressure,
- 2. high containment pressure (hi-1), or
- 3. low pressurizer pressure (Refer to Chapter 7 for a description of the actuation system).
- 2. An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal. (Refer to Section 10.4.9 for a description of the auxiliary feedwater system).
15.2.8.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN Code (WCAP-14882-P-A) is performed in order to determine the plant transient following a feedwater line rupture. The code describes the plant thermal kinetics, RCS including natural circulation, pressurizer, steam generators, and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water level, and reactor coolant average temperature.
The cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.
Major assumptions made in the analyses are as follows.
- 1. The plant is initially operating at 102 percent of NSSS-rated thermal power.
- 2. Initial reactor coolant average temperature is 5.0°F above the nominal value, and the initial pressurizer pressure is 50 psi above its nominal value.
Revision 3306/30/20 MPS-3 FSAR 15.2-18
- 3. No credit is taken for pressurizer spray. Based on a sensitivity study, the pressurizer power operated relief valves (PORVs) are assumed to be unavailable.
- 4. Initial pressurizer level is at the nominal programmed value plus 7.6 percent (error); initial steam generator water level is at the nominal value plus 12.0 percent (error) for the steam generator with the ruptured feedline and minus 12.0 percent (error) for the steam generator in the intact feedlines.
- 5. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).
- 6. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.
- 7. The feedline break discharge quality is calculated by the RETRAN code as a function of pressure and temperature.
- 8. Reactor trip is assumed to be actuated by low-low water level in the affected steam generator.
- 9. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow to the three intact steam generators.
The cases model AFW flow as a function of steam generator pressure.
A 60 second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and both motor-driven auxiliary feedwater pumps.
The failure of the turbine-driven AFW pump is to be assumed the most limiting single active failure for this event. A delay of up to 90 seconds in the startup time of the turbine-drive AFW pump has been evaluated and found to be acceptable for this event.
- 10. Credit has been taken for limited coolant to metal heat transfer in the RCS during the heatup, consistent with NRC approved Thick Metal Mass Heat Transfer Model that is documented in WCAP-14882-SI-P-A.
- 11. No credit is taken for charging or letdown.
- 12. Steam generator heat transfer across the tube is adjusted as the shell side liquid inventory decreases.
Revision 3306/30/20 MPS-3 FSAR 15.2-19
- 13. The core residual heat generation is based on the 1979 version of ANS 5.1 (ANSIANS-5.1-1979) assuming long-term operation at the initial power level.
- 14. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:
- a. high pressurizer pressure
- b. overtemperature T
- c. high pressurizer level
- d. high containment pressure A 49 second delay in initiation of the SI system is assumed. An evaluation has been completed that demonstrates acceptable results are obtained with an increase in that delay time to 65 seconds. However, the specific results reported continue to reflect the 49 second delay.
Receipt of two of four low-low steam generator water level signals in at least one steam generator starts the motor-driven auxiliary feedwater pumps, which then deliver auxiliary feedwater flow to the steam generators. The turbine-driven auxiliary feedwater pump is initiated if the two of four low-low steam generator water level signals are reached in any two of four steam generators.
Similarly, receipt of a low steam line pressure signal in at least one steam line initiates a steam line isolation signal which closes the main steam line isolation valves in all steam lines. This signal or a low pressurizer pressure signal gives a safety injection signal which initiates flow of borated water into the RCS. The amount of safety injection flow is a function of RCS pressure.
Emergency operating procedures following a secondary system line rupture call for the following actions to be taken by the reactor operator.
- 1. Isolate feedwater flow spilling out the feedline break and align auxiliary feedwater system so level in intact steam generators recovers.
- 2. Stop high head safety injection pumps if water level in the pressurizer is recovering, and the RCS is in subcooled condition and pressure is stable or increasing and is above the high head injection pumps shut off pressure, and a secondary heat sink exists.
Isolating feedwater flow through the break allows additional auxiliary feedwater flow to be diverted to the intact steam generators (see Assumption 9, above).
Subsequent to meeting the SI termination criteria noted above, the high head safety injection pumps are turned off and plant operating procedures followed in cooling the plant to hot shutdown conditions. Plant characteristics and initial conditions are further discussed in Section 15.0.3.
Revision 3306/30/20 MPS-3 FSAR 15.2-20 The reactor protection system is required to function following a feedwater line rupture as analyzed here. No single active failure will prevent operation of this system.
The engineered safety systems assumed to function are the auxiliary feedwater system and the safety injection system. For the auxiliary feedwater system, passive flow limiting devices (cavitating venturis) limit flow to the faulted steam generator and permits all intact steam generators to receive auxiliary feedwater following the break.
For the feedwater line break with loss of offsite power case, following the trip of the reactor coolant pumps, there is a flow coastdown until flow in the loops reaches the natural circulation value. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss of AC power transient, to be sufficient to remove core decay heat following reactor trip. Pump coastdown characteristics are demonstrated in Sections 15.3.1 and 15.3.2 for single and multiple reactor coolant pump trips, respectively.
A detailed description and analysis of the safety injection system is provided in Section 6.3. The auxiliary feedwater system is described in Section 10.4.9.
Results Calculated plant parameters following a major feedwater line rupture are shown on Figures 15.2-13 through 15.2-24. Results for the cases with offsite power available are presented on Figures 15.2-13 through 15.2-18. Results for the cases where offsite power is lost are presented on Figures 15.2-19 through 15.2-24. The calculated sequence of events for all cases presented are listed in Table 15.2-1.
The system response following the feedwater line rupture is similar for all cases analyzed. Results presented on Figures 15.2-14 and 15.2-18 (with offsite power), and on Figures 15.2-20 and 15.2-24 (without offsite power) show that the RCS and main steam system pressure remain below 110 percent of the respective design pressures. Pressurizer pressure remains fairly constant until reactor trip occurs on low-low steam generator water level. Pressure then decreases, due to the loss of heat input, until the safety injection system is actuated on either low steam line pressure in the ruptured loop, or low pressurizer pressure. Coolant expansion occurs due to reduced heat transfer capability in the steam generators; the pressurizer safety valves (PSVs) open to maintain primary pressure at an acceptable value. The PORVs which are qualified for water relief and would be available to maintain primary pressure below the pressurizer safety valve setpoint are conservatively assumed inoperable. The pressurizer fills at approximately 25 minutes. Addition of the safety injection flow aids in cooling down the primary and helps to ensure that sufficient fluid exists to keep the core covered with water.
Figures 15.2-13 and 15.2-19 show that, following reactor trip, the core remains subcritical except for a brief return to criticality for the case with offsite power. This is due to the cooldown caused by the steam generator blowdown. This condition is terminated when boron from the safety injection system reaches the core at approximately 170 seconds.
Revision 3306/30/20 MPS-3 FSAR 15.2-21 This event is not limiting with respect to DNB. Based on this, it is not explicitly analyzed for DNB concerns. Therefore, the minimum DNBR value would remain well above the safety analysis value throughout the transient. Release of radioactivity due to the steam generator blowdown is less than that calculated for the steam line rupture, analyzed in Section 15.1.5.
RCS pressure is maintained at the PSV set point until final RCS cooldown begins. At this time, the heat removal capability of the Steam Generators, being fed by the auxiliary feedwater, exceeds NSS heat generation. The reactor core remains covered with water throughout the transient, since no bulk boiling occurs in the reactor coolant loops.
The major difference between the with and without offsite power cases analyzed can be seen in the plots of hot and cold leg temperatures, Figures 15.2-16 and 15.2-17 (with offsite power), and on Figures 15.2-22 and 15.2-23 (without offsite power). It is apparent from the initial portion of the transient (150 to 200 seconds), that the case without offsite power results in a less severe cooldown and subsequently higher temperatures in the hot leg. For longer times, however, the case with offsite power results in a more severe rise in temperature. The core remains covered with water at all times since no boiling occurs in the reactor coolant loops.
15.2.8.3 Conclusions Results of the analyses show that for the postulated feedwater line rupture, the assumed auxiliary feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. Radioactivity doses from the postulated feedwater line rupture are less than those previously presented for the postulated steam line break.
All applicable acceptance criteria are therefore met.
15.2.8.4 Radiological Consequences The feedwater line break with the most significant consequences would be one that occurred inside the containment between a steam generator and the feedwater check valve. In this case, the contents of the steam generator and the PORV discharge from the Pressurizer Relief Tank would be released to the containment. Since no fuel failures are postulated, the radioactivity released is less than that from the steam line break. Furthermore, automatic isolation of the containment would further reduce any radiological consequences from this postulated event.
15.
2.9 REFERENCES
FOR SECTION 15.2 15.2-1 WCAP-7769, Rev. 1, June 1972, Mangan, M.A. et al., Overpressure Protection for Westinghouse Pressurized Water Reactors.
15.2-2 WCAP-7908, 1972, Hargrove, H.G. FACTRAN-A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod.
15.2-3 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
Revision 3306/30/20 MPS-3 FSAR 15.2-22 15.2-4 WCAP-14882-P-A, April 1999, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
15.2-5 ANSI/ANS-5.1-1979, August 1979, American National Standard for Decay Heat Power in Light Water Reactors.
15.2-6 WCAP-11397-P-A, 1989, Friedland, A. J., Revised Thermal Design Procedure.
15.2-7 WCAP-14882-SI-P-A, October 2005, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactors Non-LOCA Safety Analyses, Supplement 1 -
Thick Metal Mass Heat Transfer Model and NUTRUMP-Based Steam Generator Mass Calculation Method.
15.2-8 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
Revision 3306/30/20 MPS-3 FSAR 15.2-23 TABLE 15.2-1 TIME SEQUENCE FOR EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec)
- 1. RCS Turbine trip, loss of main feed flow 0.0 Overpressurization High pressurizer pressure reactor trip point 6.2 case (minimum reached feedback, without pressure control) Rods begin to drop 8.2 Peak pressurizer pressure occurs 9.9 Initiation of steam release from steam generator 13.4 safety valves
- 2. DNBR case Turbine trip, loss of main feed flow 0.0 (minimum feedback, High pressurizer pressure reactor trip point 8.1 with pressure control) reached Initiation of steam release from steam generator 8.5 safety valves Rods begin to drop 10.1 Minimum DNBR occurs 11.3
- 3. MSS Turbine trip, loss of main feed flow 0.0 Overpressurization Initiation of steam release from steam generator 5.4 case (minimum safety valves feedback, with pressure control) High pressurizer pressure reactor trip point 8.9 reached Rods begin to drop 10.9 Peak secondary side pressure occurs 15.9
Revision 3306/30/20 MPS-3 FSAR 15.2-24 TABLE 15.2-1 TIME SEQUENCE FOR EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM (CONTINUED)
Accident Event Time (sec)
Loss of normal feedwater Main feedwater flow stops 0.0 flow and loss of offsite Low steam generator water level trip 39.5 power Rods begin to drop 41.5 Reactor coolant pumps begin to coastdown 43.5 Four steam generators begin to receive auxiliary 99.5 feedwater from two motor-driven auxiliary feedwater pumps Peak water level in pressurizer occurs 2,922 Core decay heat decreases to auxiliary feedwater ~ 2,980 heat removal capacity Loss of normal feedwater Main feedwater flow stops 0.0 flow with offsite power Low steam generator water level trip 34.0 Rods begin to drop 36.0 Four steam generators begin to receive auxiliary 94.0 feedwater from two motor-driven auxiliary feedwater pumps.
Long term peak water level in pressurizer occurs 2,210 Core decay heat plus pump heat decreases to ~ 2,280 auxiliary feedwater heat removal capacity Feedwater system pipe break
- 1. With offsite power Main feedline rupture occurs 0.0 available Low-low steam generator level reactor trip 5.5 setpoint reached in affected steam generator Rods begin to drop 7.5 Three intact steam generators begin to receive 65.5 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Low pressurizer pressure safety injection 82.3 setpoint reached Safety injection flow starts 131.3
Revision 3306/30/20 MPS-3 FSAR 15.2-25 TABLE 15.2-1 TIME SEQUENCE FOR EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM (CONTINUED)
Accident Event Time (sec)
Low steam line pressure setpoint reached in 169.2 affected steam generator All main steam line isolation valves close 181.2 Pressurizer safety valve setpoint reached 496.0 Steam generator safety valve setpoint reached in 668.6 intact steam generators
- 2. Without offsite power Main feedline rupture occurs 0.0 Low-low steam generator level reactor trip 5.5 setpoint reached in affected steam generator Rods begin to drop 7.5 Power lost to the reactor coolant pumps 9.5 Low steam line pressure setpoint reached in 52.6 affected steam generator All main steam line isolation valves close 64.6 Three intact steam generators begin to receive 65.5 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Safety injection flow starts 101.6 Pressurizer safety relief valve setpoint reached 242.1 Steam generator safety valve setpoint reached in 436.2 intact steam generators
Revision 3306/30/20 MPS-3 FSAR 15.2-26 TABLE 15.2-2 NATURAL CIRCULATION FLOW Power (percent) Natural Circulation Flow (percent) 5.0 4.76 4.0 4.40 3.0 3.97 2.0 3.45 1.0 2.72 Note: The data presented in this table was utilized in initial plant startup testing and it is retained for historical information only. This data was not used in any of the FSAR Chapter 15 analysis for Millstone Unit 3.
Revision 3306/30/20 MPS-3 FSAR 15.2-27 FIGURE 15.2-1 TURBINE TRIP - RCS OVERPRESSURIZATION CASE
Revision 3306/30/20 MPS-3 FSAR 15.2-28 FIGURE 15.2-1A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-29 FIGURE 15.2-2 TURBINE TRIP - RCS OVERPRESSURIZATION CASE
Revision 3306/30/20 MPS-3 FSAR 15.2-30 FIGURE 15.2-2A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-31 FIGURE 15.2-3 TURBINE TRIP-DNBR CASE 1.2 Nuclear Power (Fraction of Nominal) 1 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 Pressurizer Water Volume (ft^3) 1600 1500 1400 1300 1200 1100 0 20 40 60 80 Time (seconds)
Revision 3306/30/20 MPS-3 FSAR 15.2-32 FIGURE 15.2-3A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-33 FIGURE 15.2-4 TURBINE TRIP-DNBR CASE 610 605 Vessel Average Temperature (Deg. F) 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 590 585 Vessel Inlet Temperature (Deg. F) 580 575 570 565 560 555 0 20 40 60 80 Time (seconds) 4 3.5 DNBR 3
2.5 2
0 20 40 60 80 Time (seconds)
This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.2-34 FIGURE 15.2-4A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-35 FIGURE 15.2-5 TURBINE TRIP-MSS OVER PRESSURIZATION CASE 1.2 1
Nuclear Power (Fraction of Nominal) 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 1600 Pressurizer Water Volume (ft^3) 1500 1400 1300 1200 1100 1000 0 20 40 60 80 Time (seconds)
Revision 3306/30/20 MPS-3 FSAR 15.2-36 FIGURE 15.2-5A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-37 FIGURE 15.2-6 TURBINE TRIP-MSS OVER PRESSURIZATION CASE 615 Vessel Average Temperature (Deg. F) 610 605 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 690 Vessel Inlet Temperature (Deg. F) 685 580 575 570 565 560 0 20 40 60 80 Time (seconds) 1350 Steam Generator Pressure (psia) 1300 1250 1200 1150 1100 1050 1000 0 20 40 60 80 Time (seconds)
Revision 3306/30/20 MPS-3 FSAR 15.2-38 FIGURE 15.2-6A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-39 FIGURE 15.2-7 DELETED BY FSARCR PKG FSC 07-MP3-051
Revision 3306/30/20 MPS-3 FSAR 15.2-40 FIGURE 15.2-7A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-41 FIGURE 15.2-8 DELETED BY FSARCR PKG FSC 07-MP3-051
Revision 3306/30/20 MPS-3 FSAR 15.2-42 FIGURE 15.2-8A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-43 FIGURE 15.2-9 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-44 FIGURE 15.2-9A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-45 FIGURE 15.2-10 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-46 FIGURE 15.2-10A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-47 FIGURE 15.2-11 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-48 FIGURE 15.2-11A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-49 FIGURE 15.2-12 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-50 FIGURE 15.2-12A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-51 FIGURE 15.2-13 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-52 FIGURE 15.2-13A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-53 FIGURE 15.2-14 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-54 FIGURE 15.2-14A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-55 FIGURE 15.2-15 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-56 FIGURE 15.2-15A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-57 FIGURE 15.2-16 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-58 FIGURE 15.2-16A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-59 FIGURE 15.2-17 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-60 FIGURE 15.2-17A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-61 FIGURE 15.2-18 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-62 FIGURE 15.2-18A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-63 FIGURE 15.2-19 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-64 FIGURE 15.2-19A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-65 FIGURE 15.2-20 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-66 FIGURE 15.2-20A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-67 FIGURE 15.2-21 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-68 FIGURE 15.2-21A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-69 FIGURE 15.2-22 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-70 FIGURE 15.2-22A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-71 FIGURE 15.2-23 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-72 FIGURE 15.2-23A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.2-73 FIGURE 15.2-24 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE
Revision 3306/30/20 MPS-3 FSAR 15.2-74 FIGURE 15.2-24A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.3-1 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE A number of faults are postulated which could result in a decrease in reactor coolant system flow rate. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.
Discussions of the following flow decrease events are presented in Section 15.3.
- 1. Partial loss of forced reactor coolant flow.
- 2. Complete loss of forced reactor coolant flow.
- 3. Reactor coolant pump shaft seizure (locked rotor).
- 4. Reactor coolant pump shaft break.
Item 1 above is considered to be an ANS Condition II event, Item 2 an ANS Condition III event, and Items 3 and 4 ANS Condition IV events. Section 15.0.1 contains a discussion of ANS classifications.
15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.3.1.1 Identification of Causes and Accident Description A partial loss-of-coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.
Normal power for the pumps is supplied through individual buses connected to the generator.
When a turbine or generator trip occurs, the buses continue to receive power from an offsite source and the pumps continue to supply coolant flow to the core.
This event is classified as an ANS Condition II incident (an incident of moderate frequency) as defined in Section 15.0.1.
The necessary protection against a partial loss-of-coolant flow accident is provided by the low primary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive 8, low flow in any loop actuates a reactor trip.
Between approximately 10 percent power (Permissive 7) and the power level corresponding to Permissive 8, low flow in any two loops actuates a reactor trip.
Revision 3306/30/20 MPS-3 FSAR 15.3-2 15.3.1.2 Analysis of Effects and Consequences Method of Analysis One case has been analyzed for the loss of one pump with four loops in operation.
This transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A)
Code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux and DNBR during the transient based on the nuclear power core inlet enthalpy and flow and core exit pressure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR.
The results met the applicable limit as specified in Section 4.4.
Initial Conditions Initial reactor power, pressure, and reactor coolant system (RCS) temperature are assumed to be at their nominal values. Uncertainties in initial conditions are included in the limit DNBR. Plant characteristics and initial conditions are further discussed in Section 15.0.3.
Reactivity Coefficients A conservatively large absolute value of Doppler-only power coefficient is used (Figure 15.0-2).
This is equivalent to a total integrated Doppler reactivity from 0 to 100 percent power of 0.016 k.
The most positive moderator temperature coefficient (MTC) at full power (0 pcm/°F) is assumed since this maximizes the core power at the time minimum DNBR is reached. The 0 pcm/°F MTC and full power assumptions are conservative compared to other power level and MTC combinations.
Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equations, a pump momentum balance, and the pump characteristics and is based on high estimates of system pressure losses.
Plant systems and equipment which are necessary to mitigate the effects of the accident are discussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.
Revision 3306/30/20 MPS-3 FSAR 15.3-3 Results Figures 15.3-1 through 15.3-4 show the transient response for the loss of one reactor coolant pump. Figure 15.3-4 shows the DNBR to be always greater than the limit value.
Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.
The calculated sequence of events table for the case analyzed is shown in Table 15.3-1 The affected reactor coolant pump continues to coastdown, and the core flow reaches a new equilibrium value corresponding to the number of pumps still in operation. With the reactor tripped, a stable plant condition is eventually obtained. Normal plant shutdown may then proceed.
15.3.1.3 Conclusions The analysis shows that the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.
15.3.1.4 Radiological Consequences A partial loss of reactor coolant flow from full load would result in a reactor and turbine trip.
Assuming in addition that the condenser is not available, atmospheric steam dump may be required.
Since no fuel damage is postulated for this transient, a specific radiological release calculation was not performed.
15.3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 15.3.2.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor were not tripped promptly.
Normal power for the reactor coolant pumps is supplied through buses from a transformer connected to the generator. When a turbine or generator trip occurs, the buses continue to receive power from an offsite source, and the pumps continue to supply coolant flow to the core.
This event is classified as an ANS Condition III incident (an infrequent incident), as defined in Section 15.0.1.
The following signals provide the necessary protection against a complete loss of flow accident:
Revision 3306/30/20 MPS-3 FSAR 15.3-4
- 1. reactor coolant pump underspeed
- 2. low reactor coolant loop flow The reactor trip on reactor coolant pump underspeed is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of nonemergency AC power. This function is blocked below approximately 10 percent power (Permissive P-7).
The reactor trip on reactor coolant pump underspeed is also provided to trip the reactor for an underfrequency condition, resulting from frequency disturbances on the power grid. If the maximum grid frequency decay rate is less than approximately 5 Hertz/second, this trip protects the core from underfrequency events (Section 7.2). This effect is fully described in WCAP-8424, Revision 1 (1975). A specific analysis of a frequency decay event was performed as described in Section 15.3.2.3.
The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive P-8, low flow in any loop actuates a reactor trip. Between approximately 10 percent power (Permissive P-7) and the power level corresponding to Permissive P-8, low flow in any two loops actuates a reactor trip.
15.3.2.2 Analysis of Effects and Consequences One case has been analyzed for the loss of four pumps with four loops in operation.
This transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A)
Code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux and DNBR transient based on the nuclear power core inlet enthalpy and flow and core exit pressure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR. The results met the applicable limit as specified in Section 4.4.
The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.3.1, except that following the loss of power supply to all pumps at power, a reactor trip is actuated by reactor coolant pump underspeed.
Results Figures 15.3-5 through 15.3-8 show the transient response for the loss of power to all reactor coolant pumps. The reactor is assumed to be tripped on an underspeed signal. Figure 15.3-8 shows the DNBR to be always greater than the limit value.
Revision 3306/30/20 MPS-3 FSAR 15.3-5 Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rods is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.
The calculated sequence of events is shown in Table 15.3-1. The reactor coolant pumps continue to coastdown, and natural circulation flow is eventually established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition would be attained. Normal plant shutdown may then proceed.
15.3.2.3 Underfrequency A loss of forced primary coolant flow can result from a reduction in reactor coolant pump motor supply frequency. Therefore, the complete loss of flow accident was also analyzed where the initiating event is a frequency decay. The same signals which provide the necessary protection against a complete loss of flow provide for protection against an underfrequency event. The analysis is the same as that for the complete loss of flow with the exception of the simulation of the frequency decay. That is, rather than the reactor coolant pumps coasting down freely, the decrease in electrical frequency (5 Hz/sec) decelerates the reactor coolant pumps faster than a loss of power.
Results Figures 15.3-13 through 15.3-16 show the transient response for the frequency decay to all reactor coolant pumps. The minimum DNBR is greater than the limit value, as shown on Figure 15.3-16. The calculated sequence of events table is shown in Table 15.3-1A.
15.3.2.4 Conclusions The analyses performed have demonstrated that for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.
15.3.2.5 Radiological Consequences A complete loss of reactor coolant flow from full load results in a reactor and turbine trip.
Assuming in addition that the condenser is not available, atmospheric steam dump would be required. The quantity of steam released would be the same as for a loss of offsite power incident.
Since no fuel damage is postulated for this transient, a specific radiological release calculation was not performed.
Revision 3306/30/20 MPS-3 FSAR 15.3-6 15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR) 15.3.3.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.
Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect, as well as the pressure reducing effect of the spray, are not included in the analysis.
This event is classified as an ANS Condition IV incident (a limiting fault) as defined in Section 15.0.1.
15.3.3.2 Analysis of Effects and Consequences Method of Analysis Two digital-computer codes are used to analyze this transient. The RETRAN Code (WCAP-14882-P-A) is used to calculate the resulting loop and core flow transients following the pump seizure, the time of reactor trip based on the loop flow transients, the nuclear power following reactor trip, and to determine the peak pressure. The thermal behavior of the fuel located at the core hot spot is investigated using the VIPRE Code (Section 4.4), which uses the core flow and the nuclear power calculated by RETRAN. The VIPRE Code includes a film boiling heat transfer coefficient.
Two case were analyzed:
- 1. Peak clad temperature (PCT) reactor coolant system (RCS) over pressurization, four loops in operation, one locked rotor.
- 2. Rods-in-DNB, four loops in operation, one locked rotor.
At the beginning of the PCT/RCS over pressurization (i.e., at the time the shaft in one of the reactor coolant pumps is assumed to seize) the plant is assumed to be in operation under the most
Revision 3306/30/20 MPS-3 FSAR 15.3-7 adverse steady state operating conditions (i.e., the maximum guaranteed steady state thermal power, maximum steady state pressure) and maximum steady state coolant average temperature.
Plant characteristics and initial conditions are further discussed in Section 15.0.3. The accident as evaluated bounds with and without offsite power available, with the loss of one protection train.
To bound the scenario of a loss of offsite power, power to the unaffected pumps is assumed to be lost simultaneously with a reactor trip.
For the peak pressure evaluation, the initial pressure is conservatively estimated as 50 psi above nominal pressure (2,250 psia) to allow for errors in the pressurizer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. Figure 15.3-10 shows the pressure response at the point of maximum pressure in the cold leg as well as the lower plenum of the reactor vessel.
A second case was run with VIPRE-D to confirm that the number of rods-in-DNB is less than that assumed in the radiological analysis. Initial core power was assumed to be at its nominal value consistent with steady-state, full power operation. The reactor coolant system (RCS) pressure and average coolant temperature were assumed to be at their nominal values. Minimum measured flow is also assumed. Uncertainties in initial conditions were accounted for in the DNBR limit value as described in the Statistical DNBR Evaluation Methodology (VEP-NE-2-A). Results of the rods-in-DNB analysis using VIPRE-D demonstrated DNBR remains above the applicable limit as specified in Section 4.4.
Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is assumed to begin one second after the flow in the affected loop reaches 85 percent of nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump, or controlled feedwater flow after plant trip. Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.
The pressurizer safety valves start to open at 2,575 psia and are fully open at 2,652 psia.
Evaluation of DNB in the Core during the Accident For this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the consequences, with respect to fuel rod thermal transients, is performed with VIPRE-01 (WCAP-14565-P-A). Results obtained for analysis of this hot spot condition represent the upper limit with respect to clad temperature and zirconium water reaction.
In the evaluation, the rod power at the hot spot is conservatively assumed to exceed 2.6 times the average rod power (i.e., FQ = 2.6) at the initial core power level.
Revision 3306/30/20 MPS-3 FSAR 15.3-8 Film Boiling Coefficient The film boiling coefficient is calculated in the VIPRE-01 Code (WCAP-14565-P-A) using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperature (average between wall and bulk temperatures). The program calculates the film coefficient at every time step, based upon the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate as a function of time are used as program input.
Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between pellet and clad. Based on investigations on the effect of the gap coefficient upon the maximum clad temperature during the transient, the gap coefficient in the VIPRE-01 (WCAP-14565-P-A) analysis was assumed to increase from a steady state value consistent with initial fuel temperature to 10,000 Btu/hr-ft2 -°F at the initiation of the transient. Thus, the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation of the transient.
Zirconium Steam Reaction The zirconium steam reaction can become significant above 1,800°F (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium steam reaction.
d(w2)/dt = 33.3 x 106exp((-45500/1.986T))
where:
w = amount reacted (mg/cm2) t = time (sec)
T = temperature (K)
The reaction heat is 1,510 cal/gm.
The effect of zirconium-steam reaction is included in the calculation VIPRE-01 (WCAP-14565-P-A) of the hot spot clad temperature transient.
Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.
Revision 3306/30/20 MPS-3 FSAR 15.3-9 Results The transient results for the peak clad temperature and over pressurization cases are shown on Figures 15.3-9 through 15.3-12. The results of these calculations are also summarized in Table 15.3-2. The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits (approximately 3,200 psig). Also, the peak clad surface temperature is considerably less than 2,700°F. It should be noted that the clad temperature was conservatively calculated assuming that DNB occurs at the initiation of the transient.
15.3.3.3 Conclusions
- 1. Since the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.
- 2. Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2,700°F, the core remains in place and intact with no loss of core cooling capability.
15.3.3.4 Radiological Consequences It is postulated that if a locked rotor accident occurs, the activity in the gap of the fuel rods suffering clad damage is released to the reactor coolant. The released activity leaks to the secondary side of the steam generator at a leak rate of 1 gpm. Seven percent of the fuel rods in the core are postulated to have clad damage for four-loop operation. Secondary coolant activities are assumed to be at Technical Specification concentration. A main steam pressure relief valve is postulated to stick open, thereby allowing one steam generator to empty. All the initial secondary side fluid, plus the feedwater flow and the primary coolant leakage to that steam generator for the first 20 minutes, is assumed to be released to the atmosphere. The affected steam generator is isolated, by operator action, to close the isolation valve upstream of the relief valve within 20 minutes. A partition factor of 0.01 for iodine occurs between the water and steam phases in the unaffected steam generators during the course of the accident. The iodine partition factor for the affected steam generator is assumed to be 1.0. The release to the environment continues for 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />, after which RHR is used for cooldown and steaming is not required.
Offsite power is assumed to be lost, thereby making the condenser unavailable for steam dump.
The radiological consequences of a postulated locked rotor accident are reported in Table 15.0-8.
The assumptions used to perform this evaluation are summarized in Tables 15.3-3 and 15.6-12 for the control room.
The evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The radiological consequences of the locked rotor accident are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, and 2.5 rem to the EAB and LPZ.
Revision 3306/30/20 MPS-3 FSAR 15.3-10 15.3.4 REACTOR COOLANT PUMP SHAFT BREAK 15.3.4.1 Identification of Causes and Accident Description The accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor seizure event. Reactor trip is initiated on a low flow signal in the affected loop.
Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced, first because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect, as well as the pressure reducing effect of the spray, is not included in the analysis.
This event is classified as an ANS Condition IV incident (a limiting fault) as defined in Section 15.0.1.
The locked rotor analysis described in Section 15.3.3 conservatively bounds both the locked rotor and shaft break transients.
15.3.4.2 Conclusions The radiological consequences of a reactor coolant pump shaft break are no worse than those calculated for the locked rotor incident (Section 15.3.3). With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position, as assumed in the locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady state) core flow. For both the shaft break and locked rotor incidents, reactor trip occurs very early in the transient. In addition, the locked rotor analysis conservatively assumes that DNB occurs at the beginning of the transient.
15.
3.5 REFERENCES
FOR SECTION 15.3 15.3-1 WCAP-14882-P-A, April 1999, D. S. Huegel, et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
15.3-2 WCAP-14565-P-A, 1999, Y. X. Sung, et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
Revision 3306/30/20 MPS-3 FSAR 15.3-11 15.3-3 WCAP-8424, Revision 1, 1975, Baldwin, M.S.; Merrian, M.M.; Schenkel, H.S.; and Van DeWalle, D.J., An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in Westinghouse PWRs.
15.3-4 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
Revision 3306/30/20 MPS-3 FSAR 15.3-12 TABLE 15.3-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT SYSTEM FLOW Accident Event Time (sec)
Partial loss of forced reactor coolant flow Four loops operating, one pump Coastdown begins 0.0 coasting down Low flow reactor trip 1.7 Rods begin to drop 2.7 Minimum DNBR occurs 3.6 Complete loss of forced reactor All operating pumps lose power and begin 0.0 coolant flow coasting down Reactor coolant pump underspeed trip point 0.9 reached Rods begin to drop 1.5 Minimum DNBR occurs 3.3 Reactor coolant pump shaft Rotor on one pump locks 0.0 seizure (locked rotor) Low flow trip point reached 0.06 (without offsite power)
Rods begin to drop 1.06 Remaining pumps begin to coast down 1.06 Maximum clad temperature 3.7 Maximum RCS pressure occurs 4.1
Revision 3306/30/20 MPS-3 FSAR 15.3-13 TABLE 15.3-1A TIME SEQUENCE OF EVENTS FOR UNDERFREQUENCY EVENT Accident Event Time (sec)
Underfrequency Event All operating pumps lose power and begin coasting 0.00 down Reactor coolant pump underspeed trip point reached 1.0 Rods begin to drop 1.6 Minimum DNBR occurs 3.7
Revision 3306/30/20 MPS-3 FSAR 15.3-14 TABLE 15.3-2
SUMMARY
OF RESULTS FOR LOCKED ROTOR TRANSIENTS Without Offsite Power Four Loops Initially Operating Maximum Reactor Coolant System Pressure (psia) 2617 Maximum Clad Temperature (°F) Core Hot Spot 1718.3 Zr-H20 Reaction at Core Hot Spot (percent by weight) 0.22
Revision 3306/30/20 MPS-3 FSAR 15.3-15 TABLE 15.3-3 ASSUMPTIONS USED IN LOCKED ROTOR ANALYSIS
- 1. Fuel Damage 7% Fuel Failure
- 2. Radial Peaking Factor: 1.7
- 4. Release from secondary side is coincident with loss of off-site power
- 5. Release Points: (1)
Off site Ground level- ventilation vent Control Room MSPRVs / MSSVs
- 6. Iodine Chemical Form Released to Environment: Elemental 97%
Organic 3%
- 7. Fraction of Fission Product Inventory in Gap: Halogens 0.08 Noble Gases 0.10 Alkali Metals 0.12
- 8. Iodine Partitioning in Intact Steam Generator 100
- 9. Intact Steam Generator Tube Uncovery No tube bundle uncovery assumed.
- 10. Affected steam generator goes dry, immediately
- 11. 100% flashing is assumed in affected SG
- 12. Release Duration Intact Steam Generators 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> Affected Steam Generator 20 minutes (operator action)
- 13. Total Steam Flows to Atmosphere from Intact 0-2 hours: 432,000 lbm SGs 2-11hours: 1,328,000 lbm 8-11 hours: 820,800 lbm 11-24 hours: 1,918,222 lbm 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 196,515 lbm
- 14. Mass Flow Rates from Intact Steam Generators 0-2 hours: 2.16E+05 lbm/hr 2-11hours: 1.48E+05 lbm/hr 11-24 hours: 1.48E+05 lbm/hr 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 1.67E+04 lbm/hr
- 15. Moisture carryover in intact Steam Generators: 1%
Revision 3306/30/20 MPS-3 FSAR 15.3-16 TABLE 15.3-3 ASSUMPTIONS USED IN LOCKED ROTOR ANALYSIS (CONTINUED)
- 16. Initial Steam Generator Liquid Mass 4.582E+07 grams / SG
- 17. Control Room Parameters See Table 15.6-12 NOTES:
- 1. X/Qs are from Table 15.0-11. EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
Revision 3306/30/20 MPS-3 FSAR 15.3-17 FIGURE 15.3-1 FLOW TRANSIENTS, ONE PUMP COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-18 FIGURE 15.3-2 NUCLEAR POWER AND PRESSURIZER PRESSURE TRANSIENTS, ONE PUMP COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-19 FIGURE 15.3-3 AVERAGE AND HOT CHANNEL HEAT FLUX TRANSIENT, ONE PUMP COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-20 FIGURE 15.3-4 DNBR VERSUS TIME, ONE PUMP COASTING DOWN This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.3-21 FIGURE 15.3-5 CORE FLOW COASTDOWN, FOUR PUMPS COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-22 FIGURE 15.3-6 NUCLEAR POWER & PRESSURIZER PRESSURE TRANSIENTS, FOUR PUMPS COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-23 FIGURE 15.3-7 AVERAGE & HOT CHANNEL TRANSIENTS, FOUR PUMPS COASTING DOWN
Revision 3306/30/20 MPS-3 FSAR 15.3-24 FIGURE 15.3-8 DNBR VERSUS TIME, FOUR PUMPS COASTING DOWN This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.3-25 FIGURE 15.3-9 FLOW TRANSIENTS, ONE LOCKED ROTOR
Revision 3306/30/20 MPS-3 FSAR 15.3-26 FIGURE 15.3-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.3-27 FIGURE 15.3-10 RCS PRESSURE, ONE LOCKED ROTOR
Revision 3306/30/20 MPS-3 FSAR 15.3-28 FIGURE 15.3-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.3-29 FIGURE 15.3-11 NUCLEAR POWER, AVERAGE AND CORE AVERAGE HEAT FLUX TRANSIENTS, ONE LOCKED ROTOR
Revision 3306/30/20 MPS-3 FSAR 15.3-30 FIGURE 15.3-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.3-31 FIGURE 15.3-12 MAXIMUM CLAD TEMPERATURE AT HOT SPOT, ONE LOCKED ROTOR
Revision 3306/30/20 MPS-3 FSAR 15.3-32 FIGURE 15.3-12 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.3-33 FIGURE 15.3-13 CORE FLOW TRANSIENT, FOUR PUMPS EXPERIENCING FREQUENCY DECAY
Revision 3306/30/20 MPS-3 FSAR 15.3-34 FIGURE 15.3-14 NUCLEAR POWER AND PRESSURIZER PRESSURE TRANSIENTS, FOUR PUMPS EXPERIENCING FREQUENCY DECAY
Revision 3306/30/20 MPS-3 FSAR 15.3-35 FIGURE 15.3-15 AVERAGE AND HOT CHANNEL HEAT FLUX TRANSIENTS, FOUR PUMPS EXPERIENCING FREQUENCY DECAY
Revision 3306/30/20 MPS-3 FSAR 15.3-36 FIGURE 15.3-16 DNBR VERSUS TIME, FOUR PUMPS EXPERIENCING FREQUENCY DECAY This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.4-1 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivity and power distribution anomalies. Reactivity changes could be caused by control rod motion or ejection, boron concentration changes, or addition of cold water to the reactor coolant system (RCS). Power distribution changes could be caused by control rod motion, misalignment, or ejection, or by static means such as fuel assembly mislocation. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.
Discussions of the following incidents are presented in Section 15.4.
- 1. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.
- 2. Uncontrolled rod cluster control assembly bank withdrawal at power
- 3. Rod cluster control assembly misalignment.
- 4. Startup of an inactive reactor coolant pump at an incorrect temperature.
- 5. A malfunction or failure of the flow controller in a BWR loop that results in an increased reactor coolant flow rate (Not applicable to Millstone 3).
- 6. Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant.
- 7. Inadvertent loading and operation of a fuel assembly in an improper position.
- 8. Spectrum of rod cluster control assembly ejection accidents.
Items 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II events, Item 7 is an ANS Condition III event, and Item 8 is an ANS Condition IV event. Item 3 entails both Condition II and III events. Section 15.0.1 contains a discussion of ANS classifications.
15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power excursion. Such a transient could be caused by a malfunction of the reactor control or rod control systems. This could occur with the reactor subcritical at hot zero power or at power. The at power case is discussed in Section 15.4.2.
Revision 3306/30/20 MPS-3 FSAR 15.4-2 Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution. The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (Section 15.4.6).
The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCAs from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide variable speed travel. The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth at maximum speed.
This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.
The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient. This self limitation of the power excursion is of primary importance since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient is terminated by the following automatic features of the reactor protection system.
- 1. Source range high neutron flux reactor trip Actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.
- 2. Intermediate range high neutron flux reactor trip Actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two out of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.
- 3. Power range high neutron flux reactor trip (low setpoint)
Actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two out of the four power range channels indicate a power level
Revision 3306/30/20 MPS-3 FSAR 15.4-3 above approximately 10 percent of full power and is automatically reinstated only after three out of the four channels indicate a power level below this value.
- 4. Power range high neutron flux reactor trip (high setpoint)
Actuated when two out of the four power range channels indicate a power level above a preset setpoint.
- 5. Power range neutron flux high positive rate reactor trip Actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicates a rate above the preset setpoint.
In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.
15.4.1.2 Analysis of Effects and Consequences Method of Analysis The transient is analyzed by the RETRAN digital computer code. This code includes the simulation of prompt and delayed neutrons (using the six-group model), the thermal kinetics of the fuel and moderator and the balance of the NSSS primary and secondary coolant system.
Thermal feedback is modeled via temperature dependent coefficients of reactivity. A detailed core thermal/hydraulics analysis, performed with the VIPRE-D computer code, demonstrates that cladding integrity is maintained throughout the transient. The analysis conservatively accounts for achievable power distribution at low power.
Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results for a startup accident, the following assumptions are made.
- 1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low (least negative) values as a function of temperature are used. See Section 15.0.4 and Table 15.0-2.
- 2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A conservative positive value is used in the analysis to yield the maximum peak heat flux.
Revision 3306/30/20 MPS-3 FSAR 15.4-4
- 3. The reactor is assumed to be at hot zero power (subcritical) with a corresponding Tavg of 557°F. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect, thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.
- 4. Reactor trip is assumed to be initiated by power range high neutron flux (low setpoint). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10 percent increase is assumed for the power range flux trip setpoint, raising it from the nominal value of 25 percent to 35 percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.0.5 for RCCA insertion characteristics.
- 5. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute).
Control rod drive mechanism design is discussed in Section 4.6.
- 6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.
- 7. The initial power level was assumed to be below the power level expected for zero power (just critical) condition (10-13 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
- 8. Three reactor coolant pumps (RCPs) are assumed to be in operation.
Plant systems and equipment, which are available to mitigate the effects of the accident, are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.
Since the power range high neutron flux (low setpoint) is not required to be OPERABLE in Modes 3, 4 or 5, plant administrative controls have been implemented to preclude an uncontrolled rod/bank withdrawal from occurring in these Modes when plant conditions are not bounded by the assumptions described herein.
Revision 3306/30/20 MPS-3 FSAR 15.4-5 Results Figures 15.4-1 and 15.4-3 show the transient behavior for the uncontrolled RCCA bank withdrawal incident, with the accident terminated by reactor trip at 35 percent of nominal power.
The reactivity insertion rate used is greater than that calculated for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region.
Figure 15.4-1 shows the neutron flux and core heat flux transients. The peak heat flux does not overshoot the nominal full power value.
The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is shown on Figure 15.4-1. The beneficial effect of the inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the full power nominal value. There is an adequate margin to DNB during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core. Figure 15.4-3 shows the response of the hot spot fuel and cladding temperatures. The fuel temperature increases to a value lower than the nominal full power value. The minimum DNBR, at all times, remains above the limit value.
The calculated sequence of events for this accident is shown in Table 15.4-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.
15.4.1.3 Conclusions In the event of a RCCA withdrawal accident from the subcritical condition, the core and the RCS are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the limit value. The DNBR design basis is described in Section 4.4; applicable acceptance criteria have been met.
15.4.1.4 Radiological Consequences Since no fuel damage is postulated following an uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition event, a specific radiological release calculation was not performed.
15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER 15.4.2.1 Identification of Causes and Accident Description Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert
Revision 3306/30/20 MPS-3 FSAR 15.4-6 damage to the fuel clad, the reactor protection system is designed to terminate any such transient before the DNBR falls below the safety analysis limit value.
This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.
The automatic features of the reactor protection system which prevent core damage following the postulated accident include the following:
- 1. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint, or a high positive rate setpoint.
- 2. Reactor trip is actuated if any two out of four channels exceed the high positive neutron flux rate setpoint.
- 3. Reactor trip is actuated if any two out of four channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
- 4. Reactor trip is actuated if any two out of four channels exceed an overpower T setpoint.
- 5. A high pressurizer pressure reactor trip is actuated from any two out of four pressure channels, which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
- 6. A high pressurizer water level reactor trip is actuated from any two out of three level channels when the reactor power is above approximately 10 percent (Permissive P-7).
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- 1. high neutron flux (one out of four power range);
- 2. overpower T (two out of four); and
- 3. overtemperature T (two out of four).
The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of RCS conditions is described in Chapter 7. Figure 15.0-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as protection lines on the diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines.
Revision 3306/30/20 MPS-3 FSAR 15.4-7 The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the safety analysis limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.
The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low pressure (fixed setpoint); overpower and over temperature T (variable setpoints) and the opening of the steam generator safety valve.
15.4.2.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by the RETRAN Code (VEP-FRD-41-P-A). This code simulates the neutron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. A detailed DNB analysis is performed with the thermal and hydraulic computer code VIPRE-D (DOM-NAF-2-P-A). This accident is analyzed with the Statistical DNBR Evaluation Methodology (VEP-NE-2-A). Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to obtain conservative results for an uncontrolled rod withdrawal at power accident, the following assumptions are made.
- 1. Initial reactor power and RCS temperatures are assumed to be at their nominal values consistent with steady state full power operation. The initial RCS pressure is assumed at a nominal value consistent with steady state full power operation.
- 2. Reactivity coefficients - two cases are analyzed:
- a. Minimum reactivity feedback.
A moderator temperature coefficient of 0 pcm/°F is assumed for power
> 70 percent.
A positive moderator temperature coefficient of reactivity is assumed for power 70 percent corresponding to the beginning of core life. A conservatively small (in absolute magnitude) Doppler temperature coefficient is assumed.
- b. Maximum reactivity feedback A conservatively large negative moderator temperature coefficient and a large (in absolute magnitude) negative Doppler temperature coefficient are assumed.
Revision 3306/30/20 MPS-3 FSAR 15.4-8
- 3. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 116.5 percent nominal full power. The T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.
- 4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
- 5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.
- 6. Cases are analyzed for operation with four loops in service, assuming a spectrum of reactivity insertion rates and initial reactor power levels.
- 7. To be conservative with respect to DNB, the pressurizer spray system and relief valves are assumed operational since they limit the reactor coolant pressure increase.
Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident. A discussion of anticipated transients without trip (ATWT) considerations is presented in Section 15.8.
Results Figures 15.4-4 through 15.4-6 show the transient response for a rapid RCCA withdrawal incident starting from full power and assuming a 100 pcm/sec. withdrawal rate. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg result and margin to DNB is maintained. The design basis for DNBR is described in Section 4.4.
The transient response for a slow RCCA withdrawal from full power assuming a 1.5 pcm/sec.
withdrawal rate is shown on Figures 15.4-7 through 15.4-9. Reactor trip on over temperature T occurs after a longer period and the rise in temperature is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater than the safety analysis limit value.
Figure 15.4-10 shows the minimum DNBR as a function of reactivity insertion rate from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature T channels. The minimum DNBR is never less than the safety analysis limit value.
Figures 15.4-11 and 15.4-12 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60 and 10 percent power, respectively. The results are similar to the 100 percent power case, except as the initial power is decreased, the range over
Revision 3306/30/20 MPS-3 FSAR 15.4-9 which the over temperature T trip is effective is increased. The DNB safety analysis limit is met in all cases except for the most limiting cases from 10 percent power. In order to ensure the DNB design basis is met for all cases.
The shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.
Referring to the minimum feedback cases in Figure 15.4-10, for example, it is noted that:
- 1. For high reactivity insertions (i.e., higher than 10 pcm/sec), reactor trip is initiated by the high neutron flux trip relatively early in the transient. The neutron flux level in the core rises rapidly for these insertion rates while the core heat flux and coolant system pressure lag behind due to the thermal capacity of the fuel and coolant. Thus, the reactor is tripped prior to a significant increase in heat flux of coolant temperature with resultant high minimum DNBRs for these cases.
- 2. As reactivity insertion is decreased, reactor trip on high neutron flux occurs later in the transient allowing for greater increases in core heat flux and coolant temperatures. As a result, for reactivity insertions between 10 pcm/sec and 2 pcm/
sec, the minimum DNBRs decrease rapidly, but always remain above the safety analysis limit value.
- 3. Reactor trip on over temperature T (OTT) occurs for very low reactivity insertion rates (i.e., below 2 pcm/sec). These cases experience the largest increase in coolant temperature and are, therefore, typically limiting with respect to DNBR.
However, the minimum DNBR for these cases also remains above the safety analysis limit value.
Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 116.5 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel center-line temperature still remains below the fuel melting temperature.
For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the over temperature T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 116.5 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel center-line temperature remains below the fuel melting temperature.
The reactor is tripped sufficiently fast during the RCCA withdrawal at power transient to ensure that the ability of the primary coolant to remove heat from the fuel rods in not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.
Revision 3306/30/20 MPS-3 FSAR 15.4-10 The calculated sequence of events for selected cases of this accident is shown in Table 15.4-1.
With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.
15.4.2.3 Conclusions The high neutron flux and over temperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates.
15.4.2.4 Radiological Consequences The reactor trip causes a turbine trip and heat is removed from the secondary system through the steam generator power relief valves or safety valves. Since no fuel damage is postulated to occur following an uncontrolled rod cluster control assembly bank withdrawal at power event, a specific radiological release calculation was not performed.
15.4.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT 15.4.3.1 Identification of Causes and Accident Description RCCA misalignment accidents include:
- 1. a dropped full length assembly;
- 2. a dropped full length assembly bank;
- 3. Statically misaligned full length assembly (Table 15.4-2); and
- 4. withdrawal of a single full length assembly.
Each RCCA has a position indicator channel which displays position of the assembly. The displays of assembly positions are grouped for the operators convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates an indicating light and annunciator in the control room. Group demand position is also indicated.
Full length RCCAs are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Each bank of RCCAs is divided into two groups. The rods comprising a group operate in parallel through multiplexing thyristors. The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism.
Since the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group. Mechanical failures are in the direction of insertion, or immobility.
Revision 3306/30/20 MPS-3 FSAR 15.4-11 The dropped assembly, dropped assembly bank, and statically misaligned assembly events are classified as ANS Condition II incidents (faults of moderate frequency) as defined in Section 15.0.1. The single RCCA withdrawal incident is classified as an ANS Condition III event, as discussed below.
No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation. The operator could deliberately withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures or multiple deliberate operator actions and subsequent and repeated operator disregard of event indication. It is the position of Westinghouse that the probability of such a combination of conditions is so low that the limiting consequences may include slight fuel damage.
Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant, and shall not cause more than a small fraction of fuel elements in the reactor to be damaged...
This selection of criterion is not in violation of General Design Criterion (GDC) 25 which states, The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods. (Emphasis has been added). It has been shown that failures resulting in RCCA bank withdrawal do not violate specified fuel design limits.
Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that criterion established for the withdrawal of a single RCCA at power is appropriate and in accordance with GDC 25.
A dropped assembly bank is detected by:
- 1. sudden drop in the core power level as seen by the nuclear instrumentation system;
- 2. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
- 3. rod at bottom signal;
- 4. rod deviation alarm;
- 5. rod position indication.
Misaligned assemblies are detected by:
- 1. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
Revision 3306/30/20 MPS-3 FSAR 15.4-12
- 2. rod deviation alarm;
- 3. rod position indicators.
The resolution of the rod position indicator is +/- 4 steps (+/- 2.5 inches). The computer or rod position indication system deviation alarms alert the operator to a control rod deviation greater than 12 steps (+/- 7.5 inches) with respect to the group position or any other rod in a group.
Deviation of any rod control bank assembly from its group by twice this distance (24 steps or 15 inches) will not cause power distribution worse than the design limits.
If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to assure the alignment of the nonindicated assemblies. The operator is also required to take action as required by the Technical Specifications.
In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal, rod deviation would be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase in core power, and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the overtemperature T reactor trip, although due to the increase in local power density it is not possible in all cases to provide assurance that the core safety limits are not violated.
Plant systems and equipment which are available to mitigate the effects of the various control rod misoperations are discussed in Section 15.0.8 and listed in Table 15.0-6. (Note that automatic protection for the dropped assembly and dropped assembly bank events is provided by the overtemperature T, overpower T and low pressurizer pressure functions. However, the analysis shows that their actuation is not required.) No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.
15.4.3.2 Analysis of Effects and Consequences
- 1. Dropped assembly, dropped assembly bank, and statically misaligned assembly.
Method of Analysis
- a. One or more dropped assemblies from the same group.
For evaluation of the dropped assembly event, the transient system response is calculated using the LOFTRAN code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.
Revision 3306/30/20 MPS-3 FSAR 15.4-13 Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using dropped rod limit lines developed with VIPRE-D.
The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in WCAP-11395-A, Methodology for the Analysis of the Dropped Rod Event.
- b. Statically misaligned RCCA Steady state power distribution are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then compared to peaking factor limits developed using the VIPRE-D code, which are based on meeting the DNB design criterion.
Results
- a. One or more dropped RCCAs Single or multiple RCCAs within the same group result in a negative reactivity insertion (maximum absolute value for RCCA worth used in the analysis is a conservatively large 1000 pcm). The core is not adversely affected initially following a dropped RCCA(s) event since power is decreasing rapidly. Power may be re-established either by reactivity feedback or control bank withdrawal. The automatic rod withdrawal feature of the rod control system has been disabled. Therefore, following a dropped rod event the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, and a power overshoot is not predicted.
Figures 15.4-13 and 15.4-14 are generic curves for a typical transient response to a dropped RCCA (or RCCAs) without automatic rod withdrawal. In all cases, the minimum DNBR remains above the limit values.
Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.
- b. Dropped RCCA bank A dropped RCCA bank typically results in a reactivity insertion with an absolute value greater than 500 pcm. The core is not adversely affected during the insertion period, since power is decreasing rapidly. The transient
Revision 3306/30/20 MPS-3 FSAR 15.4-14 will proceed as described in part a. Following plant stabilization, normal shutdown procedures may subsequently be followed to further cool down the plant.
- c. Statically misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is inserted to rod insertion limits with one D bank rod fully withdrawn, or any one RCCA fully inserted. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one control rod fully inserted, or any one D bank control rod fully withdrawn without the DNBR failing below the limiting value.
The insertion limits in the Technical Specifications may vary depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor (Section 4.4) allows. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.
For the RCCA misalignment with bank D inserted to its full power insertion limit and one other RCCA fully inserted, DNBR does not fall below the limit value. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case was analyzed assuming at nominal full power, nominal RCS pressure, nominal RCS average temperature, and minimum measured RCS flow, with the increased radial peaking factor associated with the misaligned RCCA.
Calculations have not been specifically performed for RCCAs missing from other control banks which are permitted to be either fully or partially inserted at part power conditions. However, it has been determined on a generic basis that the increase in radial peaking factor necessary to reach the DNBR limit at reduced power conditions is greater than the credible increase in radial peaking factors associated with reduced thermal power levels and deeper permitted control bank insertion. Therefore, the full power case discussed above with bank D at the insertion limit is more limiting than any credible part power RCCA misalignment scenario involving rods at the rod insertion limit.
Revision 3306/30/20 MPS-3 FSAR 15.4-15 For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the limit value. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, but with the increased radial peaking factor associated with the misaligned RCCA.
DNB does not occur for the RCCA misalignment incident, and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.
Following the identification of an RCCA misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.
- 2. Single RCCA Withdrawal Method of Analysis Core power distributions simulating a single RCCA withdrawal event are calculated using the computer code Simulate5. The case of the worst rod withdrawal from control bank D inserted at the insertion limit, with the reactor initially at full power, is identified and analyzed. The purpose of this calculation is to confirm that the number of fuel rods that experience DNB is less than the safety analysis limit of 5 percent. The Simulate5 calculated peaking factors are compared to the design peaking factor used to set the over temperature T trip. Over temperature T trip setpoints are established to prevent exceeding DNBR limits. If the calculated peaking factors are above the design peaking factor limit, including appropriate calculational uncertainty, a fuel census is generated for the most limiting case to determine the percentage of rods in the core which exceed the design peaking factor. All rods which exceed the design peaking factor are assumed to undergo DNB prior to reaching the power and coolant conditions that would trip the plant on over temperature T.
The Simulate5 calculations are performed at the time in core life which has the highest peak FH. Power distributions are generated for unique combinations of control bank D inserted to the full power insertion limit, with one control bank D RCCA fully withdrawn. Xenon reconstruction is used to skew the axial flux difference to the upper allowable limit. The most limiting configuration is determined by the case that produces the highest peaking factors under these conditions.
Revision 3306/30/20 MPS-3 FSAR 15.4-16 Results
- a. Since the automatic rod withdrawal capability has been disabled, only the manual case for the single rod withdrawal event is considered. Continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the over temperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the safety analysis limit value is 5 percent.
For the above event a reactor trip results, although not sufficiently fast in all instances to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures may be followed to further cooldown the plant.
15.4.3.3 Conclusions For cases of dropped single RCCAs or dropped banks, the DNBR remains greater than the limit value; therefore, the DNB design basis is met.
For all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limit with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the limit value. Thus, the DNB design basis as described is Section 4.4 is met.
For the case of the accidental withdrawal of a single RCCA, with the reactor initially operating at full power with bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core.
15.4.3.4 Radiological Consequences A specific radiological release calculation was not performed following a rod cluster control assembly misoperation. The cases of dropped single RCCAs or dropped banks, and the case of statically misaligned RCCA, do not result in a fuel failure. The case of accidental withdrawal of a single RCCA results in a limited fuel damage which is bounded by the reactor coolant pump shaft seizure event discussed in Section 15.3.3.
Revision 3306/30/20 MPS-3 FSAR 15.4-17 15.4.4 STARTUP OF AN INACTIVE REACTOR COOLANT PUMP AT AN INCORRECT TEMPERATURE AND BORON CONCENTRATION This accident is precluded by technical specifications and administrative procedures.
15.4.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE This section is not applicable to Millstone 3.
15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT 15.4.6.1 Identification of Causes and Accident Description The accident scenario considered here is the inadvertent opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. The addition of unborated water to the RCS results in a positive reactivity insertion and an erosion of available shutdown margin. For at power and start-up conditions, technical specification Modes 1 and 2, the dilution accident erodes the shutdown margin made available through reactor trip. For shutdown mode initial conditions, technical specification Modes 3, 4, 5, and 6, the dilution accident erodes the shutdown margin inherent in the borated RCS inventory and that which may be provided by control rods (control and shutdown banks) made available through reactor trip.
The accident is mitigated by the manual isolation of the dilution flow path and the initiation of borated flow to the RCS. Unchecked, the reactivity addition due to an inadvertent boron dilution may lead to the loss of shutdown margin. In Modes 1 and 2 (power and start-up), this would result in an increase in power level and/or loss of the capability to maintain subcriticality following the trip of the control rods. In the shutdown modes, the reactivity insertion may cause criticality and complete loss of shutdown margin if all control rods are inserted or may cause complete loss of shutdown margin and criticality following reactor trip if rods were available for insertion.
For the at power modes, the analysis is performed to identify the amount of time available for operator mitigation of an inadvertent boron dilution prior to complete loss of shutdown margin.
The calculated time is presented as that required for operator or automatic action to effectively mitigate the accident prior to complete loss of shutdown margin. For the shutdown modes, analyses are performed to define minimum shutdown margin requirements. These shutdown margin requirements ensure that minimum time requirements are met for the time from alarm/
indication to loss of shutdown margin. The analyses for all modes are performed employing conservative assumptions.
Prior to complete loss of shutdown margin, RCS and core transient parameters are predicted to be within the bounds of those calculated for other FSAR non-LOCAs. Therefore, the FSAR boron dilution accident is not limiting with respect to the critical non-LOCA acceptance criteria such as
Revision 3306/30/20 MPS-3 FSAR 15.4-18 minimum DNBR, maximum RCS pressure, maximum steam generator secondary pressure, and core decay heat removal.
Limiting Dilution Flow Path The limiting dilution flow path is identified as the lowest resistance flow path for an unintentional dilution. The boron dilution analysis excludes deliberate dilution operations from considerations.
During intentional boron dilution operations, the plant operators are keenly aware of and continuously monitor the dilution process in progress for any sign of deviation or malfunction, such that the possibility of an undetected malfunction is considered remote. This is a standard assumption in the boron dilution analysis methodology. Thus the limiting boron dilution flow path does not include either the normal dilute or the alternate dilute flow paths (these paths are used only for deliberate dilution operations). The limiting boron dilution flow path is the makeup flow path of the PGS used in normal boration/blend operations.
The most probable limiting dilution event is the misoperation of the CVCS reactor makeup control system (RMCS). The specific accident scenario identified is the inadvertent operation of the primary makeup control valve (FCV-111A) and failure of the blend system (either by controller or mechanical failure) which permits the primary makeup water system to inject directly to the charging pump suction (at the VCT outlet) without being blended with boric acid at the maximum rate permitted by the piping system (FT-111 fails forcing FCV-111A in the full-open position). The limiting dilution flow rate for this scenario has been concluded to be 150 gpm for Mode 1 through Mode 6. For conservatism, all the analyses for the boron dilution event assumed 150 gpm dilution flow rate.
For these limiting flow rates to be valid, valve V305 must be under strict administrative procedures during Modes 1-6 as required by plant technical specifications.
Safety Functions and Mitigating Systems An inadvertent boron dilution event due to a CVCS malfunction will be manually terminated.
Manual actions taken by the operator are as follows:
- Identification of the accident
- Isolation of the dilution flow path
- Initiation of RCS boration
- Manual reactor trip (if necessary)
All expected sources of dilution may be terminated by closing isolation valves in the CVCS. The lost shutdown margin (SDM) may be regained by the opening of isolation valves to the RWST, thus allowing the addition of borated water from the RWST to the RCS.
The status of the RCS makeup is continuously available to the operator by the following:
Revision 3306/30/20 MPS-3 FSAR 15.4-19
- 1. Indication of the boric acid and blended flow rates
- 2. CVCS and reactor makeup water system (RMWS) status lights for the following pumps:
- a. Charging pumps
- b. Boric acid transfer pumps
- c. Primary grade water supply pumps
- 3. Deviation alarms, if the boric or blended flow rates deviate from the preset values
- 4. Source range neutron flux when the reactor is subcritical
- a. Indicated source range neutron flux count rates
- b. Audible source range neutron flux count rate
- c. Source range neutron flux doubling alarm
- 5. When the reactor is critical
- a. Axial flux difference alarm (reactor power 50 percent RTP)
- b. Control rod insertion limit low and low-low alarms
- c. Overtemperature T alarm (at power)
- d. Overtemperature T turbine runback (at power)
- e. Overtemperature T reactor trip
- f. Power range neutron flux high, both high and low set point reactor trips.
Safety Analysis Criteria & Regulatory Requirements This event is classified as an ANS Condition II incident and as such can, at worst, result in a reactor trip with the plant capable of complete recovery and resumption of plant operation within the requirements of the technical specifications. Condition II criteria are met if analyses results demonstrate the following:
- 1. Minimum DNBR is greater than or equal to the design limit
- 2. Fuel centerline temperature is less than 4700°F
Revision 3306/30/20 MPS-3 FSAR 15.4-20
- 3. Maximum reactor coolant system pressure is less than or equal to 110 percent of design pressure (2500 x 1.1 = 2750 psia)
These specific criteria satisfy the relevant requirements of 10 CFR Part 50, Appendix A, GDC 10 and 15, and Section III, Article NB-7000 of the ASME Boiler and Pressure Vessel Code. The analysis assumptions used for this event satisfy the requirements of 10 CFR Part 50, Appendix A, GDC 26, by assuring that appropriate margin for malfunctions, such as stuck rods, are accounted for.
As discussed previously, the analysis for this event determines the amount of time available for operator mitigation of the boron dilution event prior to the complete loss of shutdown margin. If the calculated time is accepted as being sufficient, it can be assumed that manual actions will effectively prevent the complete loss of minimum allowable shutdown margin. Because shutdown margin is not lost, the condition of the plant at any point in the transient is within the bounds of those calculated for other FSAR Condition II transients. If the above Condition II criteria are shown to be met for the balance of the FSAR Condition II transients and the calculated amount of time is accepted as sufficient for the successful mitigation of the dilution event, it can be concluded that the above criteria are met for the FSAR boron dilution accident.
Since the sequences of events that may occur depend on plant conditions at the time of the inadvertent dilution, a broad range of initial operating conditions must be considered. The operating modes to be considered are refueling (Mode 6), cold shutdown (Mode 5), hot shutdown (Mode 4), hot standby (Mode 3), start-up (Mode 2), and power (Mode 1 both automatic and manual rod control). In all cases, the minimum time intervals available to the operator before a loss of shutdown margin occurs are calculated from the time an alarm alerts the operator to a dilution, not from the time the dilution begins. The minimum available operator action times for the various modes must be greater than or equal to the following:
Mode 6 Refueling 30 minutes Mode 5 Cold Shutdown 15 minutes Mode 4 Hot Shutdown 15 minutes Mode 3 Hot Standby 15 minutes Mode 2 Start-up 15 minutes Mode 1 Power Operation 15 minutes 15.4.6.2 Analysis of Effects and Consequences Method of Analysis Conservative analysis assumptions for each mode of operation were used; i.e., high RCS critical boron concentrations, high boron worths, minimum shutdown margins, and minimum RCS volumes. These assumptions result in conservative determinations of the time available for operator or system response after detection of a dilution transient in progress. For Operating
Revision 3306/30/20 MPS-3 FSAR 15.4-21 Modes 1 and 2, the boron dilution analysis is performed to identify the amount of time available from alarm to total loss of shutdown margin. The analysis is intended to verify that the calculated times are greater than the above specified minimum requirements.
For Operating Modes 3, 4, and 5, the boron dilution event is analyzed to generate minimum shutdown margin requirements as a function of the critical boron concentration. The solution technique employed assumes the presence of the flux multiplication alarm and quantifies the amount of time available from the triggering of the alarm to the loss of shutdown margin.
For each shutdown mode considered, the dilution event is analyzed assuming a conservatively small dilution volume and the 150 gpm dilution flow rate previously defined. Combinations of initial and critical boron concentrations are determined that produce a predicted time to critical that corresponds to the minimum safety analysis acceptance criteria. For Modes 3, 4, and 5, the resulting shutdown margin versus critical boron concentration curves guarantee the operator a minimum of 15 minutes from alarm to criticality following initiation of the assumed boron dilution. The analysis assumes that a doubling of the count rate, as detected by the Shutdown Margin Monitor (SMM) (see Section 7.6.10), is required to initiate an alarm and a 10-second delay time in the actual alarm actuation is also included. Acceptable values of minimum count rate and alarm ratio for the SMM are specified in the plant Core Operating Limits Report (COLR) to assure that the 15 minute operator action time and count rate doubling criteria are maintained.
Dilution During Refueling (Mode 6)
An analysis is not performed for an uncontrolled boron dilution accident during refueling. In this mode, the event is prevented by the Technical Specifications for all potentially unborated water paths to the CVCS to preclude the addition of unborated water to the reactor vessel via the CVCS.
Dilution During Cold Shutdown (Mode 5)
The plant is maintained in the cold shutdown mode when RCS temperatures of less than or equal to 200°F are required. Occasionally, reduced RCS Inventory may be necessary. Mode 5 can also be a transition mode to either refueling (Mode 6) or hot shutdown (Mode 4). The water level can be dropped to the midplane of the hot leg for maintenance work that requires the steam generators to be drained. Throughout the cycle, the plant may enter Mode 5 if reduced temperatures are required in containment or as the result of a technical specification action statement. The plant is maintained in Mode 5 at the beginning of cycle for start-up testing of certain systems. During this mode of operation, the control banks are fully inserted. The following conditions are assumed for an uncontrolled boron dilution during cold shutdown.
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum water volume (3885 ft3) in the RCS is used. This is a conservative estimate of the active volume of the RCS while on one train of residual heat removal (RHR). This active volume does not include the reactor vessel upper head volume.
Revision 3306/30/20 MPS-3 FSAR 15.4-22 When the water level is drained down to the midplane of the hot leg from a filled and vented condition in cold shutdown, an uncontrolled boron dilution accident may be prevented by administrative controls which isolate the RCS from the potential source of unborated water.
Nevertheless, analysis has been performed, and shutdown margin versus critical boron concentration plots provided for a Mode 5 drained case. The minimum water volume for this scenario in the RCS is 3624 ft3.
Dilution During Hot Shutdown (Mode 4)
In Mode 4, the plant is being taken from a short term mode of operation, cold shutdown (Mode 5),
to a long term mode of operation, hot standby (Mode 3). Typically, the plant is maintained in the hot shutdown mode to achieve plant heatup before entering Mode 3. The plant is maintained in Mode 4 at the beginning of cycle for start-up testing of certain systems. Throughout the cycle, the plant will enter Mode 4 if reduced temperatures are required in containment or as a result of a technical specification action statement. During this mode of operation, the control banks are fully inserted. In Mode 4 the primary coolant forced flow which provides mixing can be provided by either the RHR system or a reactor coolant pump, depending on system pressure. The following conditions are assumed for an uncontrolled boron dilution during hot shutdown:
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failure of control valves.
- 2. In this mode for Millstone 3, RCS flow is conservatively assumed to be provided by the RHR system. With no RCP in operation during hot shutdown (with the required RHR pumps in operation), a conservatively low RCS water volume (3885 ft3) is used. This active volume does not include the reactor vessel upper head volume.
- 3. Perfect mixing in the RCS is assumed.
Dilution During Hot Standby (Mode 3)
During this mode, rod control is in manual and the rods can be either withdrawn or inserted. In Mode 3, all reactor coolant pumps may not be in operation. In an effort to balance the heat loss through the RCS and the heat removal of the steam generators, one or more of the pumps may be shut off to decrease heat input into the system. In the approach to Mode 2, the operator must manually withdraw the control rods and may initiate a limited dilution according to shutdown margin requirements not simultaneously. If the shutdown or control banks are withdrawn, the dilution scenario is similar to the Mode 2 analysis where the failure to block the source range trip results in a reactor trip and immediate shutdown of the reactor. The dilution scenario is more limiting if the control rods are not withdrawn and the reactor is shut down by boron to the technical specifications minimum requirement for Mode 3. The following conditions are assumed for an uncontrolled boron dilution during hot standby:
Revision 3306/30/20 MPS-3 FSAR 15.4-23
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum water volume (8760 ft3) in the RCS is used. This volume corresponds to the active volume of the RCS with one RCP in operation, excluding the pressurizer and the surge line. The volume specified here is conservative in that no consideration is given to mixing in the upper head region.
- 3. This mode is explicitly analyzed for four-loop operation.
Dilution During Start-up (Mode 2)
In this mode, the plant is being taken from one long term mode of operation, hot standby, to another, power operation. The plant is maintained in the start-up mode only for the purpose of start-up testing at the beginning of each cycle. Assumed conditions at start-up require the reactor to have available at least 1.30 percent k shutdown margin. The following conditions are assumed for an uncontrolled boron dilution during start-up:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This active RCS volume for Mode 2 includes the reactor vessel plus the active loops. Nonmixing regions (i.e., the pressurizer and surge line) are not included.
This mode of operation is a transitory operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a very high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The technical specifications require that the shutdown margin shall be determined, prior to approaching criticality, to be above the minimum requirement by verifying that the predicted position of the rods is within the rod insertion limits, thus assuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip (nominally at 105 cps) after receiving P-6 from the intermediate range. Too fast a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor.
However, in the event of an unplanned approach to criticality or dilution during power escalation while in the start-up mode, the plant status is such that minimal impact will result. The plant will slowly escalate in power to a reactor trip on the power range neutron flux low set point. After reactor trip, the operator has more than 15 minutes to determine the cause of dilution, isolate the
Revision 3306/30/20 MPS-3 FSAR 15.4-24 unborated water source, and initiate boration before the total shutdown margin is lost. Mode 2 results are summarized in Table 15.4-1.
Dilution During Power Operation (Mode 1)
Mode 1 is divided into two cases. The first case is with the reactor in the manual Tavg/rod control mode; the second case is with the reactor in automatic rod control. With the reactor in manual rod control, dilution will result in a positive reactivity insertion and the power and temperature rise will cause the reactor to reach the over temperature T trip set point resulting in a reactor trip. In this case, the boron dilution transient up to the time of trip is essentially equivalent to an uncontrolled RCCA bank withdrawal at power. With the reactor in automatic rod control, the power and temperature increase from boron dilution results in insertion of the control rods and a decrease in the available shutdown margin. As the dilution and rod insertion continue, the rod insertion limit alarms (low and low-low settings) and axial flux difference alarm alert the operator that a dilution event is in progress and that the technical specification requirement for shutdown margin may be challenged.
The effective reactivity addition rate primarily is a function of the dilution rate, boron concentration, and boron worth. The following conditions are assumed for an uncontrolled boron dilution during full power:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This corresponds to a conservative estimate of the active RCS volume excluding the pressurizer and surge line.
- 3. A 1.3 percent minimum shutdown margin is assumed in the analysis.
With the reactor in manual control, a boron dilution event will result in an increase in the power and temperature followed by a reactor trip on the over temperature T trip set point if no operator action is taken. Following reactor trip, the operator has greater than 15 minutes to terminate the transient. In this case, the boron dilution accident up to the time of reactor trip is essentially identical to the RCCA withdrawal at power accident. In addition, prior to the over temperature T trip, an over temperature T alarm and turbine runback would be actuated. There is adequate time available after a reactor trip for the operator to determine the cause of dilution, isolate the unborated water source, and initiate boration before the reactor can return to criticality. Mode 1 results are summarized in Table 15.4-1.
With the reactor in automatic control, the power and temperature increase from boron dilution results in insertion of the RCCAs and a decrease in the shutdown margin. The rod insertion limit alarms (low and low-low settings) provide the operator with greater than 15 minutes after reactor trip to determine the cause of the dilution, isolate the unborated water source, and initiate boration before the total shutdown margin is lost.
Revision 3306/30/20 MPS-3 FSAR 15.4-25 15.4.6.3 Conclusions For operating Modes 1 through 5, the results presented above show that adequate time is available for the operator to manually terminate the source of dilution flow, assuming the specified shutdown margin requirements are met. Following termination of the dilution flow, the operator can initiate boration to recover the shutdown margin.
No analysis is presented for Mode 6 operation since dilution during refueling is precluded by the Technical Specifications requirements.
15.4.6.4 Radiological Consequences Since no fuel failure is postulated for this transient, a specific radiological release calculation was not performed.
15.4.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY IN AN IMPROPER POSITION 15.4.7.1 Identification of Causes and Accident Description Fuel and core loading errors, such as those which can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment, lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies without burnable poison rods when burnable poison rods are specified.
Error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments. There is a 5 percent uncertainty margin included in the design value of power peaking factor assumed in the analysis of Condition I and Condition II transients. The incore system of movable flux detectors which is used to verify power shapes at the start of life, is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.
To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. During core loading, the identification number is checked before each assembly is moved into the core. Serial numbers read during fuel movement are subsequently recorded on the loading diagram as a further check on proper placing after the loading is completed.
The power distribution misplaced fuel assemblies with significant different burnup would raise peaking factors and would be readily observable with incore flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally
Revision 3306/30/20 MPS-3 FSAR 15.4-26 high coolant enthalpy rise. Incore flux measurements are taken during the startup, subsequent to every refueling operation.
This event is classified as an ANS Condition III incident (an infrequent fault) as defined in Section 15.0.1.
15.4.7.2 Analysis of Effects and Consequences Method of Analysis Steady state power distribution in the x-y plane of the core is calculated using the TURTLE Code (WCAP-7213-A and WCAP-7758-A) based on macroscopic cross section calculated by the LEOPARD Code (WCAP-3269-26). A discrete representation is used wherein each individual fuel rod is described by a mesh interval. The power distribution in the x-y plane for a correctly loaded core assembly is also given in Chapter 4 based on enrichments given in that section.
For each core loading error case analyzed, the typical percent deviations from detector readings for a normally loaded core are shown at all incore detector locations (Figures 15.4-21 through 15.4-25, inclusive).
Results The following core loading error cases have been analyzed.
Case A:
Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case considered was the interchange to two adjacent assemblies near the periphery of the core (Figure 15.4-21).
Case B:
Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly.
Two analyses have been performed for this case (Figures 15.4-22 and 15.4-23).
In Case B-1, the interchange is assumed to take place with the burnable poison rods transferred with the Region 2 assembly mistakenly loaded into Region 1.
In Case B-2, the interchange is assumed to take place closer to core center and with burnable poison rods located in the correct Region 2 Position, but in a Region 1 assembly mistakenly loaded in the Region 2 position.
Case C:
Enrichment error: Case in which a Region 2 fuel assembly is loaded in the core central position (Figure 15.4-24).
Revision 3306/30/20 MPS-3 FSAR 15.4-27 Case D:
Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core periphery (Figure 15.4-25).
15.4.7.3 Conclusions Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication.
In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures are limited to the incorrectly loaded pin or pins and perhaps the immediately adjacent pins.
Fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects are either readily detected by the incore movable detector system or cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.
15.4.7.4 Radiological Consequences There are no radiological consequences associated with inadvertent loading and operation of a fuel assembly in an improper position since activity is retained within the fuel rods and reactor coolant system.
15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing, resulting in the ejection of a RCCA and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion together with an adverse core power distribution, possibly leading to localized fuel rod damage.
15.4.8.1.1 Design Precautions and Protection Certain features in the Millstone 3 pressurized water reactor are intended to preclude the possibility of a rod ejection accident, or to limit the consequences if the accident were to occur.
These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high power levels.
Revision 3306/30/20 MPS-3 FSAR 15.4-28 Mechanical Design The mechanical design is discussed in Section 4.6. Mechanical design and quality control procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are listed below.
- 1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4,100 psi.
- 2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.
- 3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design basis earthquake can be accepted within the allowable primary stress range specified by the American Society of Mechanical Engineers (ASME) Code,Section III, for Class 1 components.
- 4. The latch mechanism housing and rod travel housing are each a single length of forged Typed 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.
A significant margin of strength in the elastic range together with the large energy absorption capability in the plastic range gives additional assurance that gross failure of the housing will not occur. The joints between the latch mechanism housing and head adapter, and between the latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.
Nuclear Design Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the RCCAs inserted only far enough to control design flux shape. Reactivity changes caused by core depletion and xenon transients are compensated by boron changes. Further, the location and grouping of control RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur. However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs withdrawn above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm occurs if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration at low level alarm and immediate boration at the low-low alarm.
Revision 3306/30/20 MPS-3 FSAR 15.4-29 Reactor Protection The reactor protection in the event of a rod ejection accident has been described in WCAP-7588.
The protection for this accident is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip. These protection functions are described in detail in Section 7.2.
Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. The full length control rod drive mechanism is described in Section 3.9N.4.
Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor coolant pressure of 2,250 psia. The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the hollow tube along which the coil assemblies are mounted.
If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings were on the periphery, they might bend outward from their bases. The housing material is quite ductile; plastic hinging without cracking would be expected. Housing adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.
Effect of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, the broken off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When the projectile reached the missile shield it would partially penetrate the shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield.
If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. The top end plates of the position indicator coil assemblies would prevent the broken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage.
Revision 3306/30/20 MPS-3 FSAR 15.4-30 Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected to lead to a more severe transient, since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fail on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.
Summary The considerations given above lead to the conclusion that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase severity of the initial accident.
15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident. See Section 15.0.1 for a discussion of ANS classifications. Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence.
Comprehensive studies of the threshold of fuel failure and of the threshold of significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project by the Idaho Nuclear Corporation (Taxelius 1970). Extensive tests of UO2 zirconium clad fuel rods representative of those in pressurized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Liimataninen and Testa 1966) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10 percent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure rise) even for irradiated rods, did not occur below 300 cal/gm.
In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are as follows.
- 1. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.
- 2. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
Revision 3306/30/20 MPS-3 FSAR 15.4-31
- 3. Fuel melting will be limited to less than 10 percent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion 1 above.
15.4.8.2 Analysis of Effects and Consequences Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.
Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient.
A detailed discussion of the method of analysis can be found in WCAP-7588, Rev. 1-A.
Average Core Analysis The spatial kinetics computer code, TWINKLE (WCAP-7979-A and WCAP-8028-A) is used for the average core transient analysis. This code uses cross sections generated by LEOPARD (WCAP-3269-26) to solve the two group neutron diffusion theory kinetic equation in one, two, or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2,000 spatial points. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat transfer model for calculation of pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described below) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Section 15.0.11.
Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spot before and after ejection are coincident. This is very conservative since the peak after ejection occurs in or adjacent to the assembly with the ejected rod, and prior to ejection the power in this region is necessarily depressed.
The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN (WCAP-7908-A). This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions.
Revision 3306/30/20 MPS-3 FSAR 15.4-32 The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.
FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation (Bishop, Sandburg, and Tong 1965) to determine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used assuming zero bulk fluid quality. The DNBR is not calculated; instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 15.0.11.
System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.
The pressure surge was calculated generally (WCAP-7588, Rev. 1-A) by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC (Section 4.4) calculation was conducted to determine the volume surge.
Finally, the volume surge was simulated in a plant transient computer code. This code calculates the pressure transient taking into account fluid transport in the RCS and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the control rod pressure housing.
15.4.8.2.1 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below. Table 15.4-3 presents the parameters used in this analysis.
Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three dimensional static methods or by a synthesis method employing one dimensional and two dimensional calculations. The computer codes as described in Table 4.1-2 are used in the analysis.
No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation to provide worst case results.
Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.
Revision 3306/30/20 MPS-3 FSAR 15.4-33 Power distribution before and after ejection for a worst case can be found in WCAP-7588, Rev.
1-A. During initial plant startup physics testing, ejected rod worths and power distributions were measured in the zero and full power configurations and compared to values used in the analysis. It has been found that the ejected rod worth and power peaking factors are consistently overpredicted in the analysis.
Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks occur in channels where the power is higher than average. Since the weight of a region is dependent of flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting multipliers which when applied to single channel feedbacks correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative compared to three dimensional analysis (WCAP-7588, Rev. 1-A).
Moderator and Doppler Coefficient The critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.
The Doppler reactivity defect is determined as a function of power level using a one dimensional steady state computer code with a Doppler weighting factor of 1.0. The Doppler defect used is given in Table 15.4-3. The Doppler weighting factor increases under accident conditions, as discussed above.
Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.75 percent at beginning-of-life and 0.40 percent at end-of-life. The accident is sensitive to eff if the ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of eff of 0.50 percent at beginning of cycle and 0.40 percent at end of cycle were used in the analysis.
Revision 3306/30/20 MPS-3 FSAR 15.4-34 Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 15.4-3 and includes the effect of one stuck RCCA adjacent to the ejected rod. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay includes the delays for the instrument channel to produce a signal, for the trip breaker to open and for the coil to release the rods. A curve of trip rod insertion versus time was used which assumed that insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip point is reached before significant shutdown reactivity is inserted into the core. This conservatism is important for hot full power accidents.
The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, and adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculation uncertainties. The available margin is such that even after accounting for the effect of two stuck RCCAs (one of which is the worst ejected rod), the reactor will be subcritical when the core return to HZP conditions following a reactor trip from an RCCA ejection accident.
To address the effects of the loss of primary system integrity as a result of the failed control rod housing, depressurization calculations have been performed for a typical four-loop plant, assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The safety injection system is actuated on low pressurizer pressure within 1 minute after the break. The RCS pressure continues to drop and reaches saturation (1,200 psi) in about 2 to 3 minutes. Due to the large thermal inertia of primary and secondary system, there has been no significant decrease in the RCS temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2 percent k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated (2,000 ppm) safety injection flow starting 1 minute after the break is sufficient to ensure that the core remains subcritical during the cooldown.
Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high rate of neutron increase trip. These protection functions are part of the reactor trip system. No single failure of the reactor trip system will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.
Results Cases are presented for both beginning and end-of-life at zero and full power.
Revision 3306/30/20 MPS-3 FSAR 15.4-35
- 1. Beginning of cycle, full power Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.25 percent k and 6.0, respectively. The peak hot spot fuel center temperature reached melting at 4900°F. However, it was restricted to less than 10 percent of the pellet.
- 2. Beginning of cycle, zero power For this condition, control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.78 percent k and a hot channel factor of 11.5. The peak fuel center temperature was 4096°F.
- 3. End of cycle, full power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.25 percent k and 7.0, respectively. The peak hot spot fuel center temperature reached melting at 4800°F. However, melting was restricted to less than 10 percent of the pellet.
- 4. End of cycle, zero power The ejected rod worth and hot channel factor for this case were obtained assuming control bank D to be fully inserted with banks C and B at their insertion limits. The results were 0.85 percent k and 26.0, respectively. The peak fuel center temperature was 4115°F. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor.
A summary of the parameters used for the above analysis is given in Table 15.4-3. The nuclear power and hot spot fuel and clad temperature transients for the worst cases (beginning of life, full power, and end of life zero power) are presented on Figures 15.4-26 through 15.4-29.
The calculated sequence of events for the worst case rod ejection accidents are presented in Table 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated. As discussed previously in Section 15.4.8.2.2, the reactor remains subcritical following reactor trip.
The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents are discussed in Section 15.6.5.
Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss-of-coolant accident to recover from the event.
Revision 3306/30/20 MPS-3 FSAR 15.4-36 Fission Product Release It is assumed that fission products are released from the gaps of all rods entering DNB. In all cases considered, less than 10 percent of the rods entered DNB based on a detailed three dimensional THINC analysis (WCAP-7588, Rev. 1-A). Although limited fuel melting at the hot spot was predicted for the beginning-of-life and the full power cases, in practice melting is not expected since the analysis conservatively assumed that the hot spots before and after ejection were coincident.
Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits (WCAP-7588, Rev. 1-A). Since the severity of the present analysis does not exceed the worst case analysis, the accident for this plant does not result in an excessive pressure rise or further damage to the RCS.
Lattice Deformations A large temperature gradient exists in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing tends to increase the under-moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow is sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.
15.4.8.3 Conclusions Even on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS.
The analyses have demonstrated that less than 10 percent of the fuel rods entered DNB.
Revision 3306/30/20 MPS-3 FSAR 15.4-37 The RCS integrated break flow to containment following a rod ejection accident is shown on Figure 15.4-30.
15.4.8.4 Radiological Consequences The radiological consequences of a postulated rod ejection accident incorporate the fuel failure modes described in Regulatory Guide 1.183.
To evaluate the radiological consequences of a control rod ejection accident, it is assumed that 10 percent of the fuel rods experience clad damage, thereby releasing their respective gap activities to the reactor coolant. The gap activity is assumed to be released instantaneously into the containment atmosphere via the break in the reactor vessel head. In addition, it is further postulated that 0.25 percent of the core fuel experiences melting resulting in 100 percent of the noble gases and 25 percent of iodines in the fraction of melted fuel to be available for release from the containment. The releases to the environment from the secondary system are coincident with loss of offsite power and are assumed to continue for 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> until the RHR system is capable of removing all decay heat. The activity available for release from the secondary system due to primary to secondary leakage is based on 1) RCS at Technical Specification levels of reactor coolant activity commensurate with 1 mCi/gm Dose Equivalent Iodine-131 (DEQ I-131), 2) 10%
of the core gap activity (with associated release fractions of 10% noble gases and iodines) and 0.25% of the activity from fuel melt (with associated release fractions of 100% noble gases and 50% of iodines) and 3) S/G secondary system liquid activity at technical specification levels.
The releases from containment are assumed to continue for 30 days after initiation of the accident.
Pertinent parameters used to describe the releases are presented in Tables 15.4-4 and Table 15.6-9.
A SIS signal is generated within 2 minutes following the accident which initiates secondary containment. Assumptions regarding the time for the secondary containment to achieve negative pressure are the same as that which was used for the LOCA analysis. The bypass leakage is released unfiltered to the environment at ground level. The leakage which is not bypass leakage is assumed to be processed by the secondary containment filtration system. A more detailed description of containment leakage is found in Section 15.6.5.4.
The releases, together with the atmospheric dispersion factors listed in Table 15.0-11 and control room parameters in Table 15.6-12, are used to compute the doses to the Control Room, EAB and LPZ.
The radiological consequences of a postulated rod ejection accident are analyzed with the information contained in Regulatory Guide 1.183 and the Standard Review Plan 15.0.1. The calculated dose results described in Table 15.0-8 for the rod ejection accident are presented separately for the releases from the containment building and the releases via the secondary system.
Revision 3306/30/20 MPS-3 FSAR 15.4-38 The evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The radiological consequences of the rod ejection accident are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, and 6.3 rem to the EAB and LPZ.
15.
4.9 REFERENCES
FOR SECTION 15.4 15.4-1 Bishop, A. A.; Sandburg, R. O.; and Tong, L. S., 1965. Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux. ASME 65-HT-31.
15.4-2 Liimataninen, R. C. and Testa, F. J. 1966. Studies in TREAT of Zircaloy-2-Clad, UO2 Core Simulated Fuel Elements. ANL-7225, January - June 1966, p. 177.
15.4-3 WCAP-3269-26, 1963. Barry, R. F. LEOPARD - A Spectrum Dependent Non- spatial Depletion Code for the IBM-7094.
15.4-4 WCAP-7213-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R. F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
15.4-5 WCAP-7588, Revision 1-A, 1975. Risher, D. H., Jr. An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods.
15.4-6 WCAP-7907-P-A (Proprietary), WCAP 7907-A (Nonproprietary), April 1984, Burnett, T. W. T., et al., LOFTRAN Code Description.
15.4-7 WCAP-7908-A, 1989. Hargrove, H. G. FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod.
15.4-8 WCAP-7979-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.
H., Jr. and Barry, R. F. TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code.
15.4-9 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
15.4-10 Taxelius, T. G. (Ed) 1970. Annual Report- Spert Project, October, 1968, September, 1969. Idaho Nuclear Corporation IN-1370.
15.4-11 WCAP-11394-P-A (Proprietary), WCAP-11395-A (Nonproprietary), January 1990.
Haessler, R. L., et al., Methodology for the Analysis of the Dropped Rod Event.
15.4-12 WCAP-14882-P-A (Proprietary), WCAP-15234-A (Nonproprietary), 1999. Huegel, D.S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
15.4-13 WCAP-14565-P-A (Proprietary), WCAP-15306-NP-A (Nonprorietary), October 1999.
Sung Y., et al., VIPRE Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
Revision 3306/30/20 MPS-3 FSAR 15.4-39 15.4-14 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
15.4-15 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, September 2014, Reactor Core Thermal Hydraulics Using the VIPRE-D Computer Code.
Revision 3306/30/20 MPS-3 FSAR 15.4-40 TABLE 15.4-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec)
Uncontrolled RCCA bank Initiation of uncontrolled rod withdrawal from 0.00 withdrawal from a subcritical or 10-9 of nominal power low-power startup condition Power range high neutron flux low setpoint 10.85 reached Peak nuclear power occurs 10.98 Rods begin to fall into core 11.35 Minimum DNBR occurs 13.50 Peak heat flux occurs 13.50 Peak average clad temperature occurs 14.05 Peak average fuel temperature occurs 14.15 Uncontrolled RCCA bank withdrawal at power
- 1. Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power high reactivity insertion rate (100 pcm/sec)
Power range high neutron flux high trip point 1.13 reached Rods begin to fall into core 1.63 Minimum DNBR occurs 2.6
- 2. Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power small reactivity insertion rate (1.5 pcm/sec)
Overtemperature T, reactor trip point reached 85.35 Rods begin to fall into core 86.85 Minimum DNBR occurs 87.3 CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant
- 1. Dilution during start-up Reactor trip on power range high neutron flux, 0.00 low setpoint Time to criticality for unmitigated event > 900
Revision 3306/30/20 MPS-3 FSAR 15.4-41 TABLE 15.4-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE REACTIVITY AND POWER DISTRIBUTION ANOMALIES (CONTINUED)
Accident Event Time (sec)
- 2. Dilution during full-power operation
- a. Automatic reactor Dilution begins 0.00 control Time to criticality for unmitigated event > 900
- b. Manual reactor control Dilution begins 0.00 Reactor trip signal on OTDT is generated 124 (power range high neutron flux) and operator initiates corrective action Time to criticality for unmitigated event 1024 Rod cluster control assembly ejection accident
- 1. Beginning-of-life full Initiation of rod ejection 0.00 power Power range high neutron flux setpoint reached 0.04 Peak nuclear power occurs 0.14 Rods begin to fall into core 0.54 Peak fuel average temperature occurs 2.23 Peak clad temperature occurs 2.31 Peak heat flux occurs 2.32
- 2. End-of-life, zero power Initiation of rod ejection 0.00 Power range high neutron flux low setpoint 0.18 reached Peak nuclear power occurs 0.21 Rods begin to fall into core 0.68 Peak clad temperature occurs 1.54 Peak heat flux occurs 1.54 Peak average fuel temperature occurs 1.80
Revision 3306/30/20 MPS-3 FSAR 15.4-42 TABLE 15.4-2 DELETED BY FSARCR UCR-M3-2019-003
Revision 3306/30/20 MPS-3 FSAR 15.4-43 TABLE 15.4-3 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT Time in Life Beginning Beginning End End Power level (percent) 102 0 102 0 Ejected rod worth (percent K) 0.25 0.78 0.25 0.85 Delayed neutron fraction (percent) 0.50 0.50 0.40 0.40 Feedback reactivity weighting 1.355 2.081 1.486 3.765 Trip reactivity (percent K) 4.0 2.0 4.0 2.0 Fq before rod ejection 2.60 -- 2.60 --
Fq after rod ejection 6.0 11.5 7.0 26.0 Doppler Defect (pcm, 0 to 10% power) -900 -900 -900 -900 Number of operational pumps 4 2 4 2 Max. fuel pellet average temperature (°F) 4028 3575 3988 3690 Max. fuel center temperature (°F) 4966 4096 4874 4115 Max fuel stored energy (cal/gm) 176 152 174 158
Revision 3306/30/20 MPS-3 FSAR 15.4-44 TABLE 15.4-4 PARAMETERS USED IN ROD EJECTION ACCIDENT ANALYSIS Analysis Input Parameters
- 1. Core thermal power 2% uncertainty (MWt) 3,723
- 2. Containment free volume (ft3) 2.35x106
- 3. Primary coolant concentrations Table 15.0-10
- 4. Primary to secondary leak rate (gpm) 1.0
- 5. Secondary coolant concentration Table 15.0-10
- 6. Failed fuel as a result of the accident (%) 10.0
- 7. Core activity Table 15.0-7
- 8. Quantity of fuel in the core which melts as a result of the accident (%) 0.25
- 9. Quantity of radionuclides from the melted fuel available for release from the containment (%):
- a. Iodine 25.0
- b. Noble gases 100
- 10. Quantity of radionuclides from the melted fuel available for release from the secondary side via primary-to-secondary leakage (%):
- a. Iodines 50.0
- b. Noble gases 100
- 11. Iodine partition factor in steam generator prior to and during accident 0.01
- 12. Offsite power Lost
- 13. Steam release (lbm)
- a. 0 - 1200 seconds 2.000 E+05
- b. 2 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 3.246 E+06
- c. 24 - 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> 1.974 E+05
- 14. Containment leak rate (% per day)
- a. 0-24 hours 0.30
- b.24-720 hours 0.15
- 15. Bypass leakage (fraction of containment leakage) 0.06
- 16. Time between accident and equalization of primary and secondary 1200 pressures (sec)
- 17. Time to initiate SIS (min) 2
Revision 3306/30/20 MPS-3 FSAR 15.4-45 TABLE 15.4-4 PARAMETERS USED IN ROD EJECTION ACCIDENT ANALYSIS (CONTINUED)
Analysis Input Parameters
- 18. Time estimated for SLCRS to become effective (min) 2
- 19. Duration of leakage from containment (hr) 720.0
- 20. Iodine removal filter efficiency (%) 95.0
- 21. Steam generator liquid contents (lbm/SG) 100,933
- 22. RCS mass (lbm) 4.45 E+05
- 23. Credit for Sprays No
- 24. Control Room Parameters Table 15.6-12
- 25. Containment Release Points Same as LOCA, see Table 15.6-9
- 26. Secondary Side Release Points EAB / LPZ Ground Level -
ventilation vent Control Room MSPRVs / MSSVs
- use MSVB X/Qs
Revision 3306/30/20 MPS-3 FSAR 15.4-46 TABLE 15.4-5 INTEGRATED BREAK FLOW (lbm) IN CONTAINMENT Time (sec) Flow (lbm) 0.0 0.0 5.0 4,826.2 10.0 9,473.1 20.0 18,285.4 40.0 34,282.3 100.0 65,591.4 202.0 78,065.5 300.0 88,254.2 405.0 98,641.3 500.0 107,619.0 750.0 129,291.3 1,000.0 148,214.9 2,000.0 259,376.7 3,000.0 438,923.8 5,000.0 819,305.3 7,000.0 1,124,734.1 10,000.0 1,528,285.8 NOTE:
Time between accident and equalization of primary and secondary system pressures = 140 sec.
Revision 3306/30/20 MPS-3 FSAR 15.4-47 TABLE 15.4-6 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-48 FIGURE 15.4-1 NEUTRON AND THERMAL FLUX TRANSIENTS FOR UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION 10.00 Nuclear Power (Fraction of Nominal) 1.00 0.10 0.01 0.00 0 10 20 30 40 50 60 70 80 Time (sec) 0.60 Core Average Heat Flux (Fraction of Nominal) 0.50 0.40 0.30 0.20 0.10 0.00 0 10 20 30 40 50 60 70 80 Time (sec)
Revision 3306/30/20 MPS-3 FSAR 15.4-49 FIGURE 15.4-2 OMITTED
Revision 3306/30/20 MPS-3 FSAR 15.4-50 FIGURE 15.4-3 FUEL AND CLAD TEMPERATURE TRANSIENTS FOR UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION Fuel Pellet Centerline 1955.00 Temperature Fuel Average Temperature 1755.00 Hot Spot Fuel Temperature (º F) 1555.00 1355.00 1155.00 955.00 755.00 555.00 0.00 10.00 20.00 30.00 40.00 Time (sec) 1550.00 1450.00 1350.00 1250.00 Clad Inner Temperature (º F) 1150.00 1050.00 950.00 850.00 750.00 650.00 550.00 0.00 20.00 40.00 60.00 80.00 Time (sec)
Revision 3306/30/20 MPS-3 FSAR 15.4-51 FIGURE 15.4-4 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 1.4 1.2 Nuclear Power [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 2 4 6 8 10 Time [seconds]
1.2 Core Heat Flux [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0 2 4 6 8 10 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-52 FIGURE 15.4-4 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-53 FIGURE 15.4-5 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 2330.0 2310.0 Pressurizer Pressure [psia]
2290.0 2270.0 2250.0 2230.0 2210.0 0 2 4 6 8 10 Time [seconds]
1190.0 1180.0 Pressurizer Water Volume [Cubic Feet]
1170.0 1160.0 1150.0 1140.0 1130.0 1120.0 0 2 4 6 8 10 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-54 FIGURE 15.4-5 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-55 FIGURE 15.4-6 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 595.0 590.0 Vessel Average Temperature [deg-F]
585.0 580.0 575.0 570.0 565.0 0 2 4 6 8 10 Time [seconds]
10.0 9.0 8.0 7.0 6.0 DNBR 5.0 4.0 3.0 2.0 1.0 0.0 0 2 4 6 8 10 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-56 FIGURE 15.4-6 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-57 FIGURE 15.4-7 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 1.2 Nuclear Power [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
1.2 Core Heat Flux [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-58 FIGURE 15.4-7 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-59 FIGURE 15.4-8 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 2400.0 2350.0 2300.0 Pressurizer Pressure [psia]
2250.0 2200.0 2150.0 2100.0 2050.0 2000.0 0 20 40 60 80 100 Time [seconds]
1500.0 1450.0 Pressurizer Water Volume [Cubic Feet]
1400.0 1350.0 1300.0 1250.0 1200.0 1150.0 0 20 40 60 80 100 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-60 FIGURE 15.4-8 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-61 FIGURE 15.4-9 UNCONTROLLED RCCA BANK WITHDRAWAL FROM FULL POWER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 605.0 600.0 Vessel Average Temperature [deg-F]
595.0 590.0 585.0 580.0 0 20 40 60 80 100 Time [seconds]
7.0 6.0 5.0 4.0 DNBR 3.0 2.0 1.0 0.0 0 20 40 60 80 100 Time [seconds]
Revision 3306/30/20 MPS-3 FSAR 15.4-62 FIGURE 15.4-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-63 FIGURE 15.4-10 MINIMUM DNBR VERSUS REACTIVITY INSERTION RATE ROD WITHDRAWAL FROM 100% RTP 2.1 100% Pow w/Min Feedback 100% Pow w/Max Feedback 2
1.9 Minimum DNBR OTDT 1.8 HNF 1.7 1.6 1.5 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
Revision 3306/30/20 MPS-3 FSAR 15.4-64 FIGURE 15.4-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-65 FIGURE 15.4-11 MINIMUM DNBR VERSUS REACTIVITY INSERTION RATE ROD WITHDRAWAL FROM 60% RTP 2.6 60% Pow w/Min Feedback 60% Pow w/Max Feedback 2.4 2.2 Minimum DNBR OTDT HNF 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
Revision 3306/30/20 MPS-3 FSAR 15.4-66 FIGURE 15.4-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-67 FIGURE 15.4-12 MINIMUM DNBR VERSUS REACTIVITY INSERTION RATE ROD WITHDRAWAL FROM 10% RTP 3
10% Pow w/Min Feedback 2.8 10% Pow w/Max Feedbak 2.6 Minimum DNBR 2.4 OTDT HNF 2.2 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
Revision 3306/30/20 MPS-3 FSAR 15.4-68 FIGURE 15.4-13 DROPPED ROD CLUSTER CONTROL ASSEMBLY, MANUAL CONTROL
Revision 3306/30/20 MPS-3 FSAR 15.4-69 FIGURE 15.4-14 DROPPED ROD CLUSTER CONTROL ASSEMBLY, MANUAL CONTROL
Revision 3306/30/20 MPS-3 FSAR 15.4-70 FIGURE 15.4-15 NOT USED FIGURE 15.4-16 NOT USED FIGURE 15.4-17 NOT USED FIGURE 15.4-18 NOT USED FIGURE 15.4-19 NOT USED FIGURE 15.4-20 NOT USED
Revision 3306/30/20 MPS-3 FSAR 15.4-71 FIGURE 15.4-21 INTERCHANGE BETWEEN REGION 1 AND REGION 3 ASSEMBLY
Revision 3306/30/20 MPS-3 FSAR 15.4-72 FIGURE 15.4-22 INTERCHANGE BETWEEN REGION 1 AND REGION 2 ASSEMBLY, BURNABLE POISON RODS BEING RETAINED BY THE REGION 2 ASSEMBLY
Revision 3306/30/20 MPS-3 FSAR 15.4-73 FIGURE 15.4-23 INTERCHANGE BETWEEN REGION 1 AND REGION 2 ASSEMBLY, BURNABLE POISON RODS BEING RETAINED BY THE REGION 1 ASSEMBLY
Revision 3306/30/20 MPS-3 FSAR 15.4-74 FIGURE 15.4-24 ENRICHMENT ERROR: A REGION 2 ASSEMBLY LOADED INTO THE CORE CENTRAL POSITION
Revision 3306/30/20 MPS-3 FSAR 15.4-75 FIGURE 15.4-25 LOADING A REGION 2 ASSEMBLY INTO A REGION 1 POSITION NEAR CORE PERIPHERY
Revision 3306/30/20 MPS-3 FSAR 15.4-76 FIGURE 15.4-26 NUCLEAR POWER TRANSIENT BOL HFP RCCA EJECTION
Revision 3306/30/20 MPS-3 FSAR 15.4-77 FIGURE 15.4-26 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-78 FIGURE 15.4-27 HOT SPOT FUEL AND CLAD TEMPERATURE VERSUS TIME -
BOL HFP RCCA EJECTION
Revision 3306/30/20 MPS-3 FSAR 15.4-79 FIGURE 15.4-27 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.4-80 FIGURE 15.4-28 NUCLEAR POWER TRANSIENT EOL HZP RCCA EJECTION (TWO RCPS RUNNING)
Revision 3306/30/20 MPS-3 FSAR 15.4-81 FIGURE 15.4-29 HOT SPOT FUEL AND CLAD TEMPERATURE VERSUS TIME -
EOL HZP RCCA EJECTION (TWO RCPS RUNNING)
Revision 3306/30/20 MPS-3 FSAR 15.4-82 FIGURE 15.4-30 REACTOR COOLANT SYSTEM INTEGRATED BREAK FLOW FOLLOWING A ROD EJECTION ACCIDENT
Revision 3306/30/20 MPS-3 FSAR 15.5-1 15.5 INCREASE IN REACTOR COOLANT INVENTORY Discussion and analysis of the following events are presented in this section.
- 1. Inadvertent operation of the emergency core cooling system during power operation.
- 2. Chemical and volume control system malfunction that increases reactor coolant inventory.
- 3. A number of BWR transients (not applicable to Millstone 3).
These events, considered to be ANS Condition II, cause an increase in reactor coolant inventory.
Section 15.0.1 contains a discussion of ANS classifications.
15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION This event is analyzed for POWER OPERATION only. Analysis for shutdown modes is not required.
15.5.1.1 Identification of Causes and Accident Description Spurious emergency core cooling system (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels as described in Section 7.3.
Upon receipt of the inadvertent safety injection actuation signal (SI), the reactor will trip with subsequent turbine trip, letdown will be isolated, and the centrifugal charging pumps will align to take suction from the refueling water storage tank (RWST) to inject into the RCS cold legs and the RCP seals. The opening of the charging pump cold leg injection valves will be controlled by the Cold Leg Injection Permissive (P-19). The Cold Leg Injection Permissive is activated when two of four pressurizer pressure channels indicate less than 1900 psia.
If an inadvertent SI signal is initiated from nominal hot full power conditions and no other transient is in progress, the RCS pressure will remain above the P-19 setpoint. Therefore, the Cold Leg Injection Permissive will prevent charging pump flow through the ECCS col leg injection valves during spurious ECCS operation at power. Since RCS pressure will also be above the shutoff head of the Safety Injection and Residual Heat Removal pumps, the only source of water addition to the RCS is the charging pump injection into the RCP seals. With letdown isolated, the seal injection will result in an increase in Reactor Coolant System inventory.
If an inadvertent SI signal is initiated from hot full power conditions that include the most adverse combination of instrument and control system uncertainties, it is possible for RCS pressure to decrease to the P-19 setpoint during the event. P-19 prevents charging pump flow through the ECCS cold leg injection valves up until P-19 is satisfied. During this time, the only source of
Revision 3306/30/20 MPS-3 FSAR 15.5-2 water addition to the RCS is RCP seal injection. After P-19 is satisfied, RCS injection is through the RCP seals and the ECCS cold leg injection path. Injection through the RCP seals and the cold leg injection path will result in an increase in RCS inventory.
15.5.1.2 Analysis of Effects and Consequences Method of Analysis Inadvertent operation of the ECCS is analyzed using the RETRAN computer code (VEP-FRD-41-P-A). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. The criteria established for Condition II events include the following.
- a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,
- b. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and,
- c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.
Based on historical precedence and a detailed understanding of the transient conditions associated with this event, conditions do not approach the core thermal DNB limits as the core power, RCS pressure and RCS temperatures remain relatively unchanged. Therefore, the DNBR typically increases and does not approach the DNBR safety analysis limit following event initiation. For this reason, it is not necessary to calculate a minimum DNBR value for this event.
Since operator action to terminate ECCS flow may not occur before the pressurizer becomes water solid, water relief from the pressurizer through the power-operated relief valves (PORVs) or the pressurizer safety relief valves (PSRVs) could occur for this event. Therefore, to conclude that criterion (c) is met, the evaluation of this event must demonstrate the integrity of these valves after being subjected to water discharge. The ability to isolate the RCS and maintain the integrity of the RCS pressure boundary must be demonstrated so that this Condition II event does not lead to a more serious plant condition.
American Nuclear Society standard 51.1/N18.2-1973 describes example 15 of a Condition II event as a minor reactor coolant system leak which would not prevent orderly reactor shutdown and cooldown assuming makeup is provided by normal makeup systems only. In said standard, normal makeup systems are defined as those systems normally used to maintain reactor coolant inventory under respective conditions of startup, hot standby, power operation, or cooldown, using onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS
Revision 3306/30/20 MPS-3 FSAR 15.5-3 inventory during the postulated event and establishes the magnitude of the subject leak).
Therefore, the above example of a Condition II event is met provided orderly reactor shutdown is also met.
To ensure orderly reactor shutdown can occur, the RCS pressure boundary must ultimately be isolatable once the source of the ECCS flow is terminated. To ensure the RCS pressure boundary can be isolated, the PSRVs must function as designed and the PORVs and/or block valves must be available to the operator (after the operator action time) to provide isolation functions.
To assess the capability of the PSRVs to function properly following the discharge of subcooled water, the fluid conditions associated with the water being discharged through these valves must be determined and the integrity of the valves shown to be acceptable for these conditions.
However, with one or more PORVs available, the PSRV setpoint will not be reached and any subsequent water discharge from the RCS would be through the PORV(s). In the latter case, isolation of the RCS following operator action to terminate ECCS flow is obtainable by use of the PORV block valve(s).
To address criterion (c), an analysis is performed to demonstrate that the PSRVs will not be actuated with the pressurizer in a water solid condition. For the potential condition of the plant operating with all the PORVs blocked, action must be taken to either terminate the ECCS flow to avert a water solid condition or to confirm that at least one PORV is unblocked and available for water relief prior to reaching the PSRV setpoint. This avoids any concerns regarding subcooled water relief through the plant PSRVs. Should water relief through the pressurizer power-operated relief valves (PORVs) occur, the PORV block valves would be available to isolate the RCS.
Furthermore, the acceptability of water discharge through the PORV(s) and associated piping has been confirmed via plant-specific analyses.
Therefore, the inadvertent ECCS actuation at power event is analyzed to demonstrate that the integrity of the PSRVs is maintained by demonstrating that they will not be actuated with the pressurizer in a water solid condition. To ensure that this criterion is met, the time allowed for operator action is established as the shortest time to pressurizer overfill.
The analysis assumptions for the most limiting case are as follows:
A. Initial Operating Conditions The most limiting results are obtained at hot full power (+2% uncertainty). Sensitivity to core power variations near full power is minimal. Uncertainties applied to initial average coolant temperature, initial pressurizer pressure and initial pressurizer level are +4°F, -
29.6 psi, and -7.6% respectively. Low initial fuel temperature is targeted.
B. Reactivity Feedback and Kinetics Parameters Since the reactor trips on receipt of the SI actuation signal, reactivity feedback and core kinetics parameters do not play a significant role in this analysis Trip reactivity is sufficient to sustain the reactor in a subcritical state throughout the event.
Revision 3306/30/20 MPS-3 FSAR 15.5-4 C. Pressurizer Pressure Control Pressurizer heaters are assumed to fail so that P-19 is satisfied during the initial depressurization allowing injection through the cold leg injection path thereafter. In addition, pressurizer spray is allowed to operate as designed in order to slow the increase in RCS pressure and allow higher RCS injection flow rates.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item F below for additional information pertaining to PORV operation during this event.
D. Reactor Trip Reactor trip is assumed to occur upon receipt of the SI actuation signal including appropriate time delay.
E. Decay Heat Core residual heat is based on ANSI/ANS-5.1-1979 minus uncertainty. Minimizing decay heat in this manner results in a quicker cooldown and depressurization and the earliest time to satisfy P-19. This allows RCS injection through the cold leg injection path to begin earlier and results in the shortest time to pressurizer overfill.
F. Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate ECCS flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
G. Pressurizer Safety Valves The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
H. Secondary Heat Removal Condenser steam dumps are assumed to be operable in the limiting case. This maximizes the initial cooldown and depressurization allowing the P-19 to be satisfied. The condenser steam dumps control RCS temperature to a lower value than the atmospheric relief valves or main steam safety valves. This gives lower RCS pressure and higher injection flowrates which result in the shortest time to pressurizer overfill.
Revision 3306/30/20 MPS-3 FSAR 15.5-5 I. Feedwater The motor driven auxiliary feedwater pumps are assumed to start upon receipt of the SI actuations signal. Main feedwater is assumed to be isolated on receipt of the SI actuation signal.
J. Cold Leg Injection Permissive (P-19) Setpoint Uncertainty in the P-19 setpoint of 20.4 psi is added to the nominal setpoint. This is conservative for maximizing the mass addition to the RCS during the event.
K. Charging System Flow Prior to satisfying P-19, minimum charging flow through the RCP seals is assumed. After satisfying P-19, RCS injection though the cold leg injection pathway is assumed at the maximum flowrate for two charging pumps.
Results Representative transient response for the Inadvertent Operation of ECCS case is shown in Figures 15.5-1 and 15.5-2. Table 15.5-1 shows a representative analysis sequence of events.
ECCS actuation is followed by reactor trip. A rapid cooldown of the RCS follows due to the action of the condenser steam dump system. Coolant contraction results in a short-term reduction in pressurizer pressure and water level. As the RCS temperature reduction slows, the coolant contraction ceases and ECCS injection flow (which increases after P-19 is satisfied) causes the pressure and level transients to turn around. Pressurizer water level then increases throughout the remainder of the transient. The analysis shows that with credit for the cold leg injection permissive, the operators have at least 23 minutes to complete actions to prevent the pressurizer from filling and thereby prevent water relief through the PSRVs. The time available for operator action is expected to be enough for the operators either to terminate the RCS mass addition or to assure that at least one PORV is available. With at least one PORV available, the analysis shows that water discharge through the PSRV is precluded. Once a PORV is available for water discharge, operator action to terminate the ECCS flow can be performed according to existing procedures.
15.5.1.3 Conclusions The transient response to the Inadvertent Operation of ECCS shows that the reactor power, coolant temperature and pressure decrease rapidly after the reactor trip. The primary temperature continues to decrease gradually due to injection of cold water and decay heat removal by the condenser dump system while pressure increase due to the continued mass addition. RCS conditions do not approach the DNBR safety limit following the initiation of this event.
The key acceptance criterion for this event is that it may not propagate to cause a more serious fault (i.e., a Condition III or IV event). To satisfy this criterion, operator action is required to
Revision 3306/30/20 MPS-3 FSAR 15.5-6 prevent water relief through the PSRVs and terminate ECCS. This is accomplished by performing both of the following operator actions:
- 1. Make at least one PORV available prior to pressurizer overfill (i.e., 23 minutes of event initiation),
and
- 2. Terminate excess RCS injection (i.e., terminate ECCS, restore normal charging and restore letdown within 73 minutes of event initiation.
15.5.1.4 Radiological Consequences There are only minimal radiological consequences associated with inadvertent ECCS operation.
The reactor trip causes a turbine trip and heat is removed from the secondary system through the (condenser dump system), steam generator pressure relief valves or safety valves. Since no fuel damage is postulated to occur following an inadvertent operation of the ECCS during power operation, a specific calculation for radiological releases from the secondary system was not performed.
Water relief from the pressurizer PORVs may result in overpressurization of the pressurizer relief tank (PRT), breaching the rupture disk and spilling contaminated fluid into containment. The radiological releases (offsite doses) resulting from breaking the PRT rupture disk have been found to be within acceptable limits.
15.5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY 15.5.2.1 Identification of Causes and Accident Description Increases in reactor coolant inventory caused by a malfunction of the chemical and volume control system may be postulated to result from operator error or a control signal malfunction.
Transients examined in this section are characterized by increasing pressurizer level, increasing pressurizer pressure, and a constant boron concentration. The transients described in this section are analyzed to demonstrate that there is adequate time for the operator to take corrective action to ensure that the integrity of the PSRVs is maintained (i.e., the PSRVs do not actuate) with the pressurizer in a water-solid condition. An increase in reactor coolant inventory, which results from the addition of cold, unborated water to the RCS, is analyzed in Section 15.4.6, Chemical and Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the Reactor Coolant.
The most limiting case would result if charging was in automatic control and the pressurizer level channel used for charging control failed in a low direction. This would cause maximum charging flow to be delivered to the RCS and letdown flow to be isolated. The worst single failure for this event would be a second pressurizer level channel failing in an as-is condition or a low condition.
This will defeat the reactor trip on two-out-of-three high pressurizer level channels. To ensure that
Revision 3306/30/20 MPS-3 FSAR 15.5-7 the integrity of the PSRVs is maintained., the operator must be relied upon to terminate charging or unblock at least one pressurizer PORV.
15.5.2.2 Analysis of Effects and Consequences Method of Analysis The CVCS malfunction is analyzed using the RETRAN computer code (WCAP-14882-P-A, 1999). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
The code computes pertinent plant variables including temperatures, pressures, and power level.
The analysis assumptions are as follows:
A. Initial Operating Conditions Initial conditions with maximum uncertainties on power (+2%), vessel average temperature (-4.0°F), and pressurizer pressure (-50 psi) are assumed.
B. Pressurizer Pressure Control The Pressurizer heaters are assumed operable to maximize the fluid expansion in the pressurizer. Pressurizer spray is assumed available in order to minimize RCS pressure which allows for more flow to be injected. In addition, modeling spray increases the rate of the pressurizer level increase due to the density effects between the spray fluid (which is taken from the cold leg) and the pressurizer inventory.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item D below for additional information pertaining to PORV operation during this event.
C. Reactor Trip No reactor trip is assumed D. Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate charging flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
Revision 3306/30/20 MPS-3 FSAR 15.5-8 E. Pressurizer Safety Valves The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
F. Main Steam Safety Valves Secondary side pressure is controlled via the Main Steam Safety Valves. Steam generator PORVs and steam dump valves are conservatively assumed to be inoperable.
G. Auxiliary Feedwater Auxiliary feedwater is not credited.
H. Charging System Flow Maximum charging flow as a function of RCS pressure is assumed to be delivered to the RCS. Cases are examined with one and two charging pumps operating. The charging flow is assumed to have the same boron concentration as the RCS.
15.5.2.3 Results The transient response for the limiting CVCS malfunction cases are shown in Figures 15.5-3 and 15.5-4. Table 15.5-2 shows the calculated sequence of events. In all cases analyzed, core power and RCS temperatures remain relatively constant.
The pressurizer level increases throughout the transient as a result of the injected flow. The pressurizer backup heaters are actuated on a high pressurizer water level deviation signal. In the case with one pump operating, the pressurizer reaches a water solid condition at approximately 12.7 minutes following event initiation, with the PSRVs opening (if the PORVs are unavailable) at 19.3 minutes. In the case with two pumps operating, the pressurizer reaches a water solid condition at approximately 8.4 minutes following event initiation, with the PSRVs opening (if the PORVs are unavailable) at 10.0 minutes. If available, one PORV has sufficient capacity to preclude actuation of the PSRVs.
At the same time the failure of the pressurizer level channel occurs, a number of main control board alarms will be generated, including the following:
- Pressurizer Level Deviation
- Pressurizer Level Low Heater Off and Letdown Secure
- Pressurizer Heater Backup Group Auto Trip
- Pressurizer Heater Control Group Auto Trip
Revision 3306/30/20 MPS-3 FSAR 15.5-9 Upon receipt of these alarms, the operators will be alerted to take manual control of charging flow to prevent pressurizer overfill. Guidance is provided in plant procedures to defeat the failed channel, restore letdown, and switch charging control to one of the two operable channels and terminate the event. This type of malfunction is routinely included in the operator simulator training and this operator training provides assurance that the operator action to terminate the overfill will occur within the required time frame.
15.5.2.4 Conclusions The results show none of the transient conditions during the event approach the core thermal DNB limits. With respect to not creating a more serious plant condition, water relief out of the PSRVs due to a water solid pressurizer would occur at a time which is longer than the time required for the operators to respond to event and to terminate the RCS inventory addition or to unblock at least one pressurizer PORV. The sequence of events presented in Table 15.5-1 shows the operators have sufficient time to take corrective action.
15.5.3 A NUMBER OF BWR TRANSIENTS This section is not applicable to Millstone 3.
15.
5.4 REFERENCES
FOR SECTION 15.5 15.5-1 WCAP-14882-P-A (Proprietary), April 1999 and WCAP-15234-A (Nonproprietary)
May 1999, Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
15.5-2 DELETED 15.5-3 ANSI/ANS-5.1-1979, August 1979, American National Standard for Decay Heat Power in Light Water Reactors.
15.5-4 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
Revision 3306/30/20 MPS-3 FSAR 15.5-10 TABLE 15.5-1 TIME SEQUENCE OF EVENTS - INADVERTENT OPERATION OF ECCS Event Time (sec)
Initiating event: inadvertent SI signal 0.02 Reactor trip on SI signal 0.24 Main Feedwater Isolation 1.82 Turbine trip 2.64 Start MDAFW pumps 5.04 P-19 Satisfied, Cold Leg Injection Begins 68.7 Pressurizer water solid 1416.0 PSV opens 1476.8
Revision 3306/30/20 TABLE 15.5-2 TIME SEQUENCE OF EVENTS - CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY Case Event Time (sec)
CVCS malfunction, One pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 117.3 Pressurizer reaches water-solid condition 761.0 Pressurizer safety valve setpoint reached 1156.2 CVCS malfunction, Two pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 78.6 Pressurizer reaches water-solid condition 503.0 Pressurizer safety valve setpoint reached 601.4 MPS-3 FSAR 15.5-11
Revision 3306/30/20 MPS-3 FSAR 15.5-12 FIGURE 15.5-1 CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY, NUCLEAR POWER AND VESSEL AVERAGE TEMPERATURE VERSUS TIME 2450 2400 2350 2300 2250 Pressure [psia]
2200 2150 2100 2050 2000 1950 1900 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
Revision 3306/30/20 MPS-3 FSAR 15.5-13 FIGURE 15.5-2 CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY, PRESSURIZER PRESSURE AND PRESSURIZER WATER VOLUME VERSUS TIME 115 105 95 85 Pressurizer Level [%]
75 65 55 45 35 25 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
Revision 3306/30/20 MPS-3 FSAR 15.5-14 FIGURE 15.5-3 CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY, NUCLEAR POWER AND VESSEL AVERAGE TEMPERATURE VERSUS TIME
Revision 3306/30/20 MPS-3 FSAR 15.5-15 FIGURE 15.5-4 CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY, PRESSURIZER PRESSURE AND PRESSURIZER WATER VOLUME VERSUS TIME
Revision 3306/30/20 MPS-3 FSAR 15.6-1 15.6 DECREASE IN REACTOR COOLANT INVENTORY Events which result in a decrease in reactor coolant inventory as discussed in this section are as follows.
- 1. Inadvertent opening of a pressurizer safety or relief valve.
- 2. Break in instrument line or other lines from reactor coolant pressure boundary (RCPB) that penetrate containment.
- 3. Steam generator tube failure.
- 4. Spectrum of boiling water reactor (BWR) steam system piping failures outside of containment (not applicable to Millstone 3).
- 5. Loss-of-coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the RCPB.
- 6. A number of BWR transients (not applicable to Millstone 3).
15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the reactor coolant system (RCS) could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flow rate of a relief valve, and therefore allows a much more rapid depressurization upon opening, the most severe core conditions are associated with an inadvertent opening of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS pressure which could reach the hot leg saturation pressure without reactor protection system intervention. The pressure continues to decrease throughout the transient. The effect of the pressure decrease would be to increase power via the moderator density feedback. However, the plant (if in the automatic mode) functions to maintain the power essentially constant throughout the initial stage of the transient. The average coolant temperature remains approximately the same but the pressurizer pressure decreases until reactor trip (and beyond) because of the stuck open safety valve.
The reactor may be tripped by the following reactor protection system signals:
- 1. Overtemperature T
- 2. Pressurizer low pressure An inadvertent opening of a pressurizer relief valve is classified as an American Nuclear Society (ANS) Condition II event, a fault of moderate frequency. Although a stuck open safety valve is classified as an ANS Condition IV event, it is modeled here to bound the stuck open relief valve
Revision 3306/30/20 MPS-3 FSAR 15.6-2 and is shown to meet the more restrictive condition II criteria. Section 15.0.1 discusses Condition II events.
15.6.1.2 Analysis of Effects and Consequences Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code RETRAN (WCAP-14882-P-A, 1999). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level.
Initial operating conditions are assumed at values consistent with steady state operations. Plant characteristics and initial conditions are discussed in Section 15.0.3. To give conservative results in calculating the departure from nucleate boiling ratio (DNBR) during the transient, the following assumptions are made.
- 1. Plant characteristics and initial conditions are discussed in Section 15.0.3.
Uncertainties in initial conditions are included in the calculation of the limit value DNBR. Consistent with this approach, nominal values are assumed for the initial reactor power, pressure, and RCS temperature along with the minimum measured RCS flow.
- 2. A zero moderator temperature coefficient of reactivity is assumed. The spatial affect of voids due to local or subcooled boiling is not credited in the analysis with respect to reactivity feedback or core power shape.
- 3. A least negative Doppler-only power coefficient is assumed (see Figure 15.0-2) so that the resultant amount of negative feedback is conservatively low in order to augment any power increase due to moderator reactor feedback.
- 4. Cases are analyzed considering four loops in operation.
Plant systems and equipment which are necessary to mitigate the effects of RCS depressurization caused by an inadvertent safety valve opening are discussed in Section 15.0.8 and listed in Table 15.0-6.
Control systems are assumed to function only if their operation yields more severe accident results. For an Accidental Depressurization of the Reactor Coolant System event, the automatic rod control system is assumed to be functional. The rod control system is designed to maintain Tavg at the nominal full power Tavg. This delays reactor trip, which results in a more limiting transient.
Revision 3306/30/20 MPS-3 FSAR 15.6-3 Results The system response to an inadvertent opening of a pressurizer safety valve is shown on Figures 15.6-1 and 15.6-2. Figure 15.6-1 illustrates the nuclear power transient following the depressurization. Nuclear power remains essentially unchanged until reactor trip occurs on overtemperature T. The pressure decay transient and average temperature transient following the accident are given on Figure 15.6-2. Pressure drops more rapidly while core heat generation is reduced via the trip and then slows once saturation temperature is reached in the hot leg. The departure from nucleate boiling ratio (DNBR) decreases initially but increases rapidly following the trip (Figure 15.6-1). The DNBR remains above the limit value throughout the transient. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4.
The calculated sequence of events for the inadvertent opening of a pressurizer safety valve incident is shown in Table 15.6-1.
15.6.1.3 Conclusions The results of the analysis show that the pressurizer low pressure and the overtemperature T reactor protection system signals provide adequate protection against the RCS depressurization event. The DNBR remains above the limit value throughout the transient; thus, the DNB design basis as described in Section 4.4 is met.
15.6.1.4 Radiological Consequences An inadvertent opening of a pressurizer safety or relief valve releases primary coolant to the pressurizer relief tank. Since no fuel damage is predicted for this event, a specific radiological release calculation was not performed.
15.6.2 FAILURE OF SMALL LINES CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT There are no instrument lines connected to the RCS that penetrate the containment. There are, however, the sample lines from the hot legs of reactor coolant loops 1 and 3, from the cold legs of each reactor coolant loop, from the steam space of the pressurizer, the Post Accident Sampling System (PASS) lines, and the chemical and volume control system (CHS) letdown and RCP seal return lines penetrating the containment. The hot leg, cold leg, and pressurizer vapor space sample lines are provided with normally open automatic isolation valves on both sides of the containment wall. The PASS lines are provided with a normally closed automatic isolation valve inside containment and a locked closed remote-manual isolation valve outside containment. The CHS letdown and RCP seal return lines are provided with normally open automatic containment isolation valves on both sides of the containment wall. In all cases the containment isolation valves are designed in accordance with the requirements of General Design Criterion 55.
The most severe pipe rupture with regard to radioactivity release during normal plant operation occurs in the CHS. This would be a complete severance of the 3-inch letdown line just outside
Revision 3306/30/20 MPS-3 FSAR 15.6-4 containment, but between the outboard letdown isolation valve and letdown heat exchanger (Figure 9.3-8), at rated power condition. The occurrence of a complete severance of the letdown line would result in a loss of reactor coolant at the rate of approximately 152 gpm (referenced at a density of 62 lb/ft3) which would not cause engineered safety features system actuation.
Area radiation and leakage detection instrumentation provide the means for detection of a letdown line rupture. Frequent operation of the CHS reactor makeup control system and other CHS instrumentation also aids the operator in diagnosing a letdown line rupture. The time required for the operator to identify the accident and manually isolate the rupture is expected to be within 30 minutes of the rupture. Once the rupture is identified, the operator would isolate the letdown line rupture by closing the letdown orifice isolation valves or the letdown line containment isolation valves. The letdown containment isolation valves are credited to close and isolate the leak. All valves are provided with control switches at the main control board. There are no single failures that would prevent isolation of the letdown line rupture.
Radiological Consequences The plant is assumed to be operating at the technical specification primary coolant activity.
The complete severance of the letdown line results in a LOCA at the rate of approximately 152 gpm which may not result in the activation of the engineered safety features (ESF) systems for the duration of the release. This implies that the supplementary leak collection and release system (SLCRS) and auxiliary building filters are not in operation and the releases to the environment from the severed line are assumed to be at ground level. The time needed to identify and isolate the rupture is conservatively assumed to be 30 minutes.
The fraction of iodine release to the environment is derived from a calculated fraction of approximately 0.40 of the primary coolant flashing during pipe leakage. This is based on a direct release of primary coolant at primary coolant temperature, which conservatively bounds potential accident sequences.
Due to transients in the core at the time of the accident, it is assumed that an iodine spike occurs concurrently with the letdown line rupture.
The radiological consequences of the postulated small line break are reported in Table 15.0-8. The assumptions used to perform this evaluation are summarized in Table 15.6-2. The assumptions listed in Table 15.6-2 together with the atmospheric dispersion values listed in Table 15.0-11 (for containment releases) are used to compute the doses to the EAB (0-2 hr). The resulting doses to the exclusion area boundary (EAB) are within the TEDE limits defined by Regulatory Guide 1.183 for accidents involving a coincident iodine spike.
15.6.3 STEAM GENERATOR TUBE FAILURE Two different analyses are performed for steam generator tube failure to determine the off site radiation doses and the margin to steam generator overfill, respectively. To maximize doses or steam generator overfill, each analysis uses a different methodology and set of assumptions.
Revision 3306/30/20 MPS-3 FSAR 15.6-5 Section 15.6.3.2.1 describes the margin to steam generator overfill analysis. Section 15.6.3.2.2 describes the off site radiation dose analysis.
15.6.3.1 Identification of Causes and Accident Description The accident examined is the complete severance of a single steam generator tube. This event is considered an ANS Condition IV event, a limiting fault (Section 15.0.1). The accident is assumed to take place at full power with the reactor coolant contaminated with fission products corresponding to the continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in contamination of the secondary system due to leakage of radioactive coolant from the RCS. In the event of a coincident loss of off site power, or failure of the condenser steam dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or atmospheric dump valves.
Complete severance of the steam generator tube rupture is considered a somewhat conservative assumption since the Inconel-600 tube material is highly ductile. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the secondary system is subject to continual surveillance and an accumulation of minor leaks which exceed the limits established in the Technical Specifications is not permitted during unit operation.
The operator is expected to determine that a steam generator tube rupture has occurred, to identify and isolate the ruptured steam generator, and to complete the required recovery actions to stabilize the plant and terminate the primary to secondary break flow. These actions should be performed on a restricted time scale in order to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the faulted unit. Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the recovery procedure can be carried out on a time scale which ensures that break flow to the secondary system is terminated before water in the ruptured steam generator rises into the main steam pipe. Sufficient indications and controls are provided to enable the operator to carry out these functions satisfactorily.
If normal operation of the various plant control systems is assumed, the following sequence of events is initiated by a tube rupture.
- 1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, steam flow/feedwater flow mismatch occurs as feedwater flow to the ruptured steam generator is reduced as a result of primary coolant break flow to that unit.
- 2. The main steamline radiation monitors, the condenser air ejector radiation monitor, or the steam generator blowdown liquid monitor may alarm, indicating a sharp increase in radioactivity in the secondary system. At this point, steam generator blowdown is manually isolated.
- 3. The decrease in RCS pressure due to the continued loss of reactor coolant inventory leads to a reactor trip signal on low pressurizer pressure or overtemperature T. The resultant plant cooldown following reactor trip leads to a
Revision 3306/30/20 MPS-3 FSAR 15.6-6 rapid decrease in RCS pressure and pressurizer level, and a safety injection signal initiated by low pressurizer pressure follows soon after reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater (AFW) addition via automatic initiation of the motor-driven AFW pumps.
- 4. The reactor trip automatically trips the turbine, and if off site power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of off site power, the steam dump valves automatically close to protect the condenser. The steam generator pressure rapidly increases, resulting in steam discharge to the atmosphere through the steam generator safety and/or atmospheric dump valves.
- 5. Following reactor trip and safety injection actuation, the continued action of the auxiliary feedwater supply and borated safety injection flow provides a heat sink which absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of off site power, steam relief to the atmosphere.
- 6. Safety injection flow results in increasing RCS pressure and pressurizer water level, and the RCS pressure trends toward the equilibrium value where the safety injection flow rate equals the break flow rate.
In the event of a steam generator tube rupture (SGTR), the plant operators must diagnose the SGTR and perform the required recovery actions to stabilize the plant and terminate the primary to secondary leakage. The operator actions for SGTR recovery are provided in the Emergency Operating Procedures. The major operator actions include identification and isolation of the ruptured steam generator, cooldown and depressurization of the RCS to restore inventory, and termination of SI to stop primary to secondary leakage. These operator actions are described below.
- 1. Identify the ruptured steam generator.
High secondary side activity, as indicated by the main steamline radiation monitors, the condenser air ejector radiation monitor, or steam generator blowdown radiation monitors, typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level or a high radiation indication from a main steamline or a steam generator sample. For an SGTR that results in a reactor trip at high power, the steam generator water level will decrease significantly for all of the steam generators. The AFW flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will increase more rapidly in that steam generator.
This response, as indicated by the steam generator water level instrumentation,
Revision 3306/30/20 MPS-3 FSAR 15.6-7 provides confirmation of an SGTR event and also identifies the ruptured steam generator.
- 2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.
Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.
- 3. Cool down the RCS using the intact steam generators.
After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators.
This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If off site power is available, the normal steam dump system to the condenser can be used to perform this cooldown.
However, if off site power is lost, the RCS is cooled using the atmospheric dump bypass valves on the intact steam generators.
- 4. Depressurize the RCS to restore reactor coolant inventory.
When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped. Since leakage from the primary side will continue after SI flow is stopped until RCS and ruptured steam generator pressures equalize, an excess amount of inventory is needed to ensure that pressurizer level remains on span.
The excess amount required depends on RCS pressure and reduces to zero when RCS pressure equals the pressure in the ruptured steam generator.
The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if off site power is lost or the RCPs are not running for some other reason, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.
- 5. Terminate SI to stop primary to secondary leakage.
Revision 3306/30/20 MPS-3 FSAR 15.6-8 The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressure equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.
Following SI termination, the plant conditions will be stabilized, the primary to secondary break flow will be terminated, and all immediate safety concerns will have been addressed. At this time, a series of operator actions are performed to prepare the plant for cooldown to cold shutdown conditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam generator.
15.6.3.2 Analysis of Effects and Consequences 15.6.3.2.1 Margin to Steam Generator Overfill An SGTR results in the leakage of contaminated reactor coolant into the secondary system and subsequent release of a portion of the activity to the atmosphere, and an analysis is typically performed to assure that the off site radiation doses resulting from an SGTR are within the allowable guidelines. However, one of the major concerns for an SGTR is the possibility of steam generator overfill since this could potentially result in a significant increase in the off site radiation doses. Therefore, to ensure that steam generator overfill will not occur for a design basis SGTR for Millstone Unit 3, an analysis was performed to demonstrate margin to steam generator overfill assuming the limiting single failure relative to overfill.
The steam generator tube rupture analysis was performed for Millstone Unit 3 using the methodology developed in WCAP-10698. This analysis methodology was developed by the SGTR Subgroup of the Westinghouse Owners Group and was approved by the NRC in a Safety Evaluation Report dated March 30, 1987. The LOFTTR2 program, an updated version of the LOFTTR1 program, was used to perform the SGTR analysis for Millstone Unit 3. The LOFTTR1 program was developed as part of the revised SGTR analysis methodology and was used for the SGTR evaluations in WCAP-10698. However, the LOFTTR1 program was subsequently modified to accommodate steam generator overfill and the revised program, designated as LOFTTR2, was used for the evaluation of the consequences of overfill in WCAP-11002. The LOFTTR2 program is identical to the LOFTTR1 program, with the exception that the LOFTTR2 program has the additional capability to represent the transition from two regions (steam and water) on the secondary side to a single water region if overfill occurs, and the transition back to two regions again depending upon the calculated secondary conditions. Since the LOFTTR2 program has been validated against the LOFTTR1 program, the LOFTTR2 program is also appropriate for performing licensing basis SGTR analyses.
Plant response to the SGTR event was modeled using the LOFTTR2 computer code with conservative assumptions of break size and location, condenser availability and initial secondary water mass in the ruptured steam generator. The analysis methodology includes the simulation of
Revision 3306/30/20 MPS-3 FSAR 15.6-9 the operator actions for recovery from a steam generator tube rupture based on the Millstone Unit 3 Emergency Operating Procedures (EOPs), which were developed from the Westinghouse Owners Group Emergency Response Guidelines (ERGs). The operator action times used for the analysis are based on the results of simulator studies of the SGTR recovery operations which were performed by the Millstone Unit 3 operations personnel using the plant training simulator. Thus, the SGTR analysis is based on the application of the actual plant procedures and operator training.
The limiting single failure was assumed to be the failure of the main steam pressure relief valve (MSPRV) bypass valves on two of the intact steam generators to open on demand when the operator initiates cooling of the RCS using the intact steam generators. This is consistent with the methodology in WCAP-10698. The LOFTTR2 analysis to determine the margin to overfill was performed for the time period from the tube rupture until the primary and secondary pressures are equalized and the break flow is terminated. The water volume in the secondary side of the ruptured steam generator was calculated as a function of time to demonstrate that overfill does not occur. The results of this analysis demonstrate that there is margin to steam generator overfill for a design basis SGTR for Millstone Unit 3.
15.6.3.2.2 Radiological Consequences An analysis was also performed to determine the off site radiological consequences of an SGTR using the methodology in WCAP-10698 and Supplement 1 to WCAP-10698, assuming the limiting single failure relative to off site doses without steam generator overfill. Since steam generator overfill does not occur, the results of this analysis represent the limiting consequences for an SGTR for Millstone Unit 3. A thermal and hydraulic analysis was performed to determine the plant response for a design basis SGTR, and to determine the integrated primary to secondary break flow and the mass releases from the ruptured and intact steam generators to the atmosphere.
This information was then used to calculate the resulting radiological consequences.
15.6.3.2.2.1 Thermal and Hydraulic Analysis The plant response following an SGTR was analyzed with the LOFTTR2 program for the time period from the tube rupture until the primary and secondary pressures are equalized and the break flow is terminated. The reactor protection system and the automatic actuation of the engineered safeguards systems were modeled in the analysis. The major operator actions which are required to terminate the break flow for an SGTR were also simulated in the analysis.
Analysis Assumptions The accident modeled is a double-ended break of one steam generator tube located at the top of the tube sheet on the outlet (cold leg) side of the steam generator. It was assumed that the reactor is operating at full power at the time of the accident and the secondary mass was conservatively assumed to be 10% more than the mass corresponding to full power operation at the nominal steam generator water level plus a penalty to account for the mass added due to a turbine runback.
It was also assumed that a loss of off site power occurs at the time of reactor trip and the highest worth control assembly was assumed to be stuck in its fully withdrawn position at reactor trip.
Revision 3306/30/20 MPS-3 FSAR 15.6-10 Other important analysis assumptions include:
A. NSSS power = 3666 MWt* 1.02 (uncertainty) = 3739 MWt B. Average RCS temperature = 571.5°F (581.5°F with a 10°F coastdown)
C. RCS pressure = 2250 psia - 50 psi (uncertainty) = 2200 psia D. Thermal design flow = 363,200 gpm E. Pressurizer level = 45.4%
F. SG tube plugging = 0%
G. Auxiliary feed flow = 1200 gpm at 1140 psia H. Auxiliary feed flow delay time = 60 seconds I. Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia J. Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia K. Pressurizer power operated relief valve flow = 210,000 lbm/hr/valve at 2500 psia The limiting single failure was assumed to be the failure of the MSPRV on the ruptured steam generator. Failure of this MSPRV in the open position will cause an uncontrolled depressurization of the ruptured steam generator which will increase primary to secondary leakage and the mass release to the atmosphere. It was assumed that the ruptured steam generator MSPRV fails open when the ruptured steam generator is isolated, and that the MSPRV is isolated by closing the associated isolation valve.
The major operator actions required for the recovery from an SGTR are discussed in Section 15.6.3.1, and these operator actions were simulated in the analysis. The operator action times used for the analysis are based on the results of the Millstone Unit 3 plant training simulator studies, and the times are presented in Table 15.6.3-1. It is noted that the MSPRV on the ruptured steam generator was assumed to fail open at the time the ruptured steam generator was isolated.
Before proceeding with the recovery operations, the failed open MSPRV on the ruptured steam generator was assumed to be isolated by closing the associated isolation valve. It was assumed that the ruptured steam generator MSPRV is isolated 20 minutes after the valve was assumed to fail open. After the ruptured steam generator was isolated, an additional 8-minute delay (Table 15.6.3-1) was assumed before the operator initiates the RCS cooldown.
There are several operator actions credited to recover from a steam generator tube rupture. The actions assumed in the analysis bound the performance of the operators using the EOPs. The acceptability of the EOP performance can be demonstrated by examining the impact on total dose released or margin to overfill.
Revision 3306/30/20 MPS-3 FSAR 15.6-11 Transient Description The LOFTTR2 analysis results are described below. The sequence of events for this transient is presented in Table 15.6.3-2.
Following the tube rupture, reactor coolant flows from the primary into the secondary side of the ruptured steam generator since the primary pressure is greater than the stream generator pressure.
In response to this loss of reactor coolant, pressurizer level decreases as shown in Figure 15.6.3-1.
The RCS pressure also decreases as shown in Figure 15.6.3-2, as the steam bubble in the pressurizer expands. As the RCS pressure decreases due to the continued primary to secondary leakage, automatic reactor trip occurs on an overtemperature T trip signal at 135 seconds.
After reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves close, and steam flow to the turbine is terminated. The steam dump system is designed to actuate following reactor trip to limit the increase in secondary pressure, but the steam dump valves remain closed due to the loss of condenser vacuum resulting from the assumed loss of off site power at the time of reactor trip. Thus, the energy transfer from the primary system causes the secondary side pressure to increase rapidly after reactor trip until the MSPRV (and safety valves if their setpoints are reached) lift to dissipate the energy, as shown in Figure 15.6.3-3. The main feedwater flow will be terminated, and AFW flow will be automatically initiated following reactor trip and the loss of off site power.
The RCS pressure and pressurizer level continue to decrease after reactor trip as energy transfer to the secondary shrinks the reactor coolant and the tube rupture break flow continues to deplete primary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI signal at approximately 143 seconds. After SI actuation, the SI flow rate initially exceeds the tube rupture break flow rate, and the RCS pressure and pressurizer level begin to increase and approach the equilibrium values where the SI flow rate equals the break flow rate.
Since off site power is assumed lost at reactor trip, the RCPs trip and a gradual transition to natural circulation flow occurs. Immediately following reactor trip, the temperature differential across the core decreases as core power decays (see Figures 15.6.3-4 and 15.6.3-5); however, the temperature differential subsequently increases as natural circulation flow develops. The increase in the temperature differential slows the rate of the pressurizer level and pressure decrease as shown in Figures 15.6.3-1 and 15.6.3-2, respectively. The cold leg temperatures initially trend toward the steam generator temperature as the fluid residence time in the tube region increases.
The RCS hot leg temperatures slowly decrease until the time when the ruptured steam generator atmospheric relief valve is assumed to fail open.
This event is not limiting with respect to DNB. The SGTR results in a relatively slow depressurization with reactor trip occurring on over temperature delta-T or low pressurizer pressure. Based on this, SGTR is not explicitly analyzed for DNB.
Major Operator Actions
- 1. Identify and Isolate the Ruptured Steam Generator
Revision 3306/30/20 MPS-3 FSAR 15.6-12 The ruptured steam generator level reached the AFW isolation level of 8% NRS at 178 seconds. Isolating the ruptured steam generators steamline occurred at 1500 seconds.
The ruptured steam generator MSPRV is also assumed to fail open at this time.
However, the actual time used in the analysis is 2 seconds longer because of the computer program numerical requirements for simulating the operator actions. The failure of the MSPRV causes the ruptured steam generator to rapidly depressurize as shown in Figure 15.6.3-3. The depressurization of the ruptured steam generator increases the break flow (Figure 15.6.3-6), and the energy transfer from primary to secondary results in a decrease in the ruptured loop temperatures as shown in Figure 15.6.3-4. The intact steam generator loop temperatures also decrease, as shown in Figure 15.6.3-5, until the failed open MSPRV is isolated. The decrease in the RCS temperatures results in an initial decrease in the pressurizer level and RCS pressure. However, the increased SI flow subsequently causes the pressurizer level and RCS pressure to stabilize and begin to increase as shown in Figures 15.6.3-1 and 15.6.3-2, respectively. It was assumed that the time required for the operator to identify that the ruptured steam generator MSPRV is open and to close the associated block valve is 20 minutes. Thus, the MSPRV was isolated at 2702 seconds which terminates the depressurization of the ruptured steam generator, and the ruptured steam generator pressure begins to increase after that time.
- 2. Cool Down the RCS to Establish Subcooling Margin After the ruptured MSPRV isolation is closed, an 8-minute operator action time was imposed prior to initiation of cooldown. Since off site power is lost, the RCS was cooled by dumping steam to the atmosphere using the MSPRV bypass valves on the three intact steam generators. The cooldown was continued until RCS subcooling at the ruptured steam generator pressure is 20°F plus an allowance of 32°F for subcooling uncertainty. The depressurization of the ruptured steam generator due to the failed open MSPRV affects the RCS cooldown target temperature since the target temperature is dependent upon the pressure in the ruptured steam generator. Although the ruptured steam generator pressure is increasing when the cooldown is initiated, the pressure is substantially below the MSPRV setpoint. The lower pressure in the ruptured steam generator results in a lower RCS cooldown temperature, which extends the time required for cooldown.
The RCS cooldown was initiated at 3182 seconds by opening the MSPRV bypass valves on the three intact steam generators, and was completed at 3690 seconds.
The reduction in the intact steam generator pressure required to accomplish the cooldown is shown in Figure 15.6.3-3, and the effect of the cooldown on the intact loop temperatures is shown in Figure 15.6.3-5. The RCS pressure also decreases initially during the cooldown due to shrinkage of the reactor coolant as shown in Figure 15.6.3-2, and then begins to increase again as the SI flow increases. It is noted that the ruptured steam generator pressure continues to increase during the cooldown until the pressure approaches the MSPRV setpoint again.
Revision 3306/30/20 MPS-3 FSAR 15.6-13
- 3. Depressurize to Restore Inventory After the RCS cooldown was completed, a 3-minute operator action time was assumed prior to depressurization. The RCS depressurization was initiated at 3872 seconds to assure adequate coolant inventory prior to terminating SI flow. With the RCPs stopped, normal pressurizer spray is not available, and thus the RCS was depressurized by opening a pressurizer PORV. The depressurization was continued until any of the following conditions are satisfied: RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than the allowance of 16% for pressurizer level uncertainty, or pressurizer level is greater than 73%, or RCS subcooling is less than the 32°F allowance for subcooling uncertainty. The RCS depressurization reduces the break flow as shown in Figure 15.6.3-6 and increases SI flow to refill the pressurizer as shown in Figure 15.6.3-1. For this case, the depressurization was terminated when the RCS pressure is reduced to the ruptured steam generator pressure (Figure 15.6.3-7) and the pressurizer level is above 16% (Figure 15.6.3-1). When the pressurizer PORV is closed, the level continues to increase and subsequently reaches a maximum of approximately 60% when SI flow is terminated.
- 4. Terminate SI to Stop Primary to Secondary Leakage The previous actions have established adequate RCS subcooling, verified a secondary side heat sink, and restored the reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, the SI flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage. The SI flow is terminated at this time if RCS subcooling is greater than the 32°F allowance for subcooling uncertainty, minimum AFW flow is available or at least one intact steam generator level is in the narrow range, the RCS pressure is increasing, and the pressurizer level is greater than the 16%
allowance for uncertainty. To assure that the RCS pressure is increasing, SI was not terminated in the analysis until the RCS pressure increases by at least 50 psi.
After depressurization was completed, an operator action time of 6 minutes was assumed prior to SI termination. Since the above requirements are satisfied, SI termination was performed at this time. After SI termination, the RCS pressure begins to decrease as shown in Figure 15.6.3-2, and the differential pressure between the RCS and ruptured steam generator decreases as shown in Figure 15.6.3-7. The intact MSPRV bypass valves are also opened to dump steam to maintain the prescribed RCS temperature to ensure that subcooling is maintained. When the MSPRV bypass valves are opened, the increased energy transfer from primary to secondary also aids in the depressurization of the RCS to the ruptured steam generator pressure. As shown in Figure 15.6.3-6, the primary to secondary leakage continues after the SI flow is terminated until the RCS and ruptured steam generator pressures equalize.
Revision 3306/30/20 MPS-3 FSAR 15.6-14 The ruptured steam generator water volume is shown in Figure 15.6.3-8. For this case, the water volume in the ruptured steam generator is significantly less than the total steam generator volume of 5850 ft3 when the break flow is terminated. The mass of water in the ruptured steam generator is also shown as a function of time in Figure 15.6.3-9.
Mass Releases The mass releases due to an SGTR from the steam generators to the environment were determined for use in evaluating Control Room, EAB and LPZ doses.
The postulated break allows primary liquid to leak to the secondary side of one of the steam generators (denoted as the affected generator) with an assumed release to the environment through the MSPRVs. The MSPRV on the affected steam generator is assumed to open to control steam generator pressure at the beginning of the event, and then fail fully open after operator action was taken to close the MSPRV. The affected steam generator discharges steam to the environment for 2702 seconds (0.7506 hours0.0869 days <br />2.085 hours <br />0.0124 weeks <br />0.00286 months <br />) until the generator is isolated a second time by closure of the MSPRV isolation valve. Break flow into the affected steam generator continues until 6412 seconds, at which time the RCS is at a lower pressure. Additional releases from the affected steam generator are modeled from 2 to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> to complete depressurization of the steam generator early in the event to maximize dose consequences. Table 15.6.3-3 provides the mass releases associated with the thermal and hydraulic analysis. The mass release rates to the atmosphere from the LOFTTR2 analysis are presented in Figures 15.6.3-10 and 15.6.3-11 for the affected and intact steam generators respectively. Flashed break flow is presented in Figure 15.6.3-12.
The intact generators discharge steam for a period of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> until the primary system has cooled sufficiently (to 350°F) to initiate Residual Heat Removal (RHR) system cooling of the RCS.
During the entire steaming process, a primary to secondary leak rate of 1 gpm total to the intact steam generators is assumed.
15.6.3.2.2.2 Radiation Dose Analysis The evaluation of the radiological consequences of a steam generator tube rupture event assumes that the reactor has been operating at the maximum allowable Technical Specification iodine limit for primary coolant activity and with a primary to secondary leakage of 1 gpm total for sufficient time to establish equilibrium concentrations of radionuclides in the reactor coolant and in the secondary coolant. Radionuclides from the primary coolant enter the steam generator via the ruptured tube and are released to the atmosphere through the atmospheric dump valves and atmospheric dump bypass valves (and safety valves). It was assumed that a loss of off site power occurs at the time of SGTR. This is a conservative assumption that causes the condenser to be unavailable and the release to the environment to begin at the time of SGTR.
The quantity of radioactivity released to the environment, due to an SGTR, depends upon primary and secondary coolant activity, iodine spiking effects, primary to secondary break flow, break flow flashing fractions, attenuation of iodine carried by the flashed portion of the break flow, partitioning of iodine between the steam generator liquid and steam phases and the mass of fluid released from the generators. All of these parameters were conservatively evaluated in a manner
Revision 3306/30/20 MPS-3 FSAR 15.6-15 consistent with the recommendations in Standard Review Plans 15.6.3 and 15.0.1 (as supplemented by Regulatory Guide 1.183).
- 1. Design Basis Analytical Assumptions The major assumptions and parameters used in the analysis are itemized in Tables 15.6.3-4 and 15.6-12 (for the Control Room).
- 2. Source Term Calculations The radionuclide concentrations in the primary and secondary system, prior to and following the SGTR, are determined as follows:
- a. The iodine concentrations in the reactor coolant will be based upon accident initiated and pre-accident iodine spikes.
- i. Accident Initiated Spike - The initial primary coolant iodine concentration is 1.0 Ci/g of Dose Equivalent (D.E.) I-131.
Following the primary system depressurization associated with the SGTR, an iodine spike is initiated in the primary system which increases the iodine release rate from the fuel to the coolant to a value 335 times greater than the release rate corresponding to the initial primary system iodine concentration.
ii. Pre-accident Spike - A reactor transient has occurred prior to the SGTR and has raised the primary coolant iodine concentration from 1.0 to 60 Ci/gram of D.E. I-131.
- b. The initial secondary coolant iodine concentration is 0.1 Ci/gram of D.E.
- c. The gross activity concentrations in the reactor coolant are based on the Technical Specification limit of 1Ci/gm D.E. I-131 (equivalent to 0.29%
failed fuel).
- 3. Dose Calculations The radioactivity transport model utilized in this analysis is consistent with Regulatory Guide 1.183. The model considers break flow flashing, droplet size, bubble scrubbing, steaming, and partitioning. The model assumes that a fraction of the iodine carried by the break flow becomes airborne immediately due to flashing and atomization. Removal credit can be taken for scrubbing of iodine contained in the atomized coolant droplets as they rise from the rupture site to the secondary water surface. However, the benefit associated with the scrubbing of the steam bubbles has been shown to be relatively insignificant and has been neglected in this analysis. The fraction of primary coolant iodine which is not assumed to
Revision 3306/30/20 MPS-3 FSAR 15.6-16 become airborne immediately mixes with the secondary water and is assumed to become airborne at a rate proportional to the steaming rate and the iodine partition coefficient. This analysis conservatively assumes an iodine partition coefficient of 0.01 between the steam generator liquid and steam phases. Droplet removal by the dryers is conservatively assumed to be negligible.
The transport of gross activity in this analysis is consistent with Regulatory Guide 1.183. Noble gases are released from the primary system without mitigation or holdup. Particulate activity in the flashed break flow is released from the primary to the steam generator steam volume without mitigation. Particulate activity in the steam generator liquid volume is released through moisture carryover during steaming and is credited with a factor of 100 reduction due to assumed moisture carryover.
The following assumptions and parameters were used to calculate the activity released to the atmosphere and the doses following an SGTR.
- a. The mass of reactor coolant discharged into the secondary system through the rupture and the mass of steam released from the ruptured and intact steam generators to the atmosphere assumed in the radiation dose analysis are presented in Table 15.6.3-3. A loss of off site power is assumed to occur at the time of SGTR. This is a conservative assumption that causes the condenser to be unavailable and the release to the environment to begin at the time of the SGTR. Additionally, the steam release period is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry. This is followed by a 11.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> period of simultaneous steaming and RHR operation to address safety grade cold shutdown requirements.
- b. The amount of rupture flow that flashes to steam and is immediately released to the environment is presented in Figure 15.6.3-12. The amount of flashed break flow was conservatively calculated assuming that 100 percent of the break flow comes from the hot leg side of the steam generator, whereas the break flow actually comes from both the hot leg and the cold leg sides of the steam generator.
- c. The total primary to secondary leak rate is assumed to be 1.0 gal/min. All of the 1.0 gal/min leak rate is assumed to be to the three intact steam generators, since the effect of leakage to the ruptured steam generator is negligible compared to the activity in the primary to secondary break flow from the tube rupture.
- d. The iodine partition coefficient between the liquid and steam of the ruptured and intact steam generators is assumed to be 0.01.
Revision 3306/30/20 MPS-3 FSAR 15.6-17
- e. Radioactive decay and daughter production are modeled in this analysis, but no credit was taken for radioactive decay during release and transport, or for cloud depletion by ground deposition during transport to the Control Room, EAB or LPZ.
- f. Short-term atmospheric dispersion factors (X/Qs) for accident analysis are provided in Table 15.0-11.
- g. Moisture carryover in intact steam generators is assumed to be 1%.
- 4. Dose Calculation Models The dose calculation model used for control room, EAB and LPZ TEDE evaluation is based upon a modified version of the RADTRAD computer code discussed in Regulatory Guide 1.183. Dose conversion factors used in this model are from Federal Guidance Reports 11 and 12.
- 8. The radiological consequences of the steam generator tube rupture are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and LPZ for the concurrent spike.
15.6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT (NOT APPLICABLE TO MILLSTONE 3).
15.6.5 LOSS-OF-COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY 15.6.5.1 Identification of Causes and Frequency Classification A LOCA is the result of a pipe rupture of the RCPB (Section 5.2). For the analyses reported here, a major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0 square feet (ft2). This event is considered an ANS Condition IV event, a limiting fault, in that it is not expected to occur during the lifetime of the plant but is postulated as a conservative design basis (Section 15.0.1).
A minor pipe break (small break), as considered here, is defined as a rupture of the reactor coolant pressure boundary with a total cross-sectional area less than 1.0 ft2 in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is
Revision 3306/30/20 MPS-3 FSAR 15.6-18 considered a Condition III event, in that it is an infrequent fault which may occur during the life of the plant.
The Acceptance Criteria for the LOCA are described in 10 CFR 50.46 (10 CFR 50.46 and Appendix K of 10 CFR 50 1974) as follows.
- 1. The calculated peak fuel element clad temperature is below the requirement of 2,200°F.
- 2. The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1 percent of the total amount of Zircaloy in the reactor.
- 3. The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limit of 17 percent is not exceeded during or after quenching.
- 4. The core remains amenable to cooling during and after the break.
- 5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.
These criteria were established to provide significant margin in emergency core cooling system (ECCS) performance following a LOCA. Input parameters used in the ECCS analysis are described in Table 15.6-3 for large break LOCA and Table 15.6-15 for small break LOCA.
15.6.5.2 Best Estimate Large Break Loss of Coolant Analysis (BE-LBLOCA) 15.6.5.2.1 General When the Final Acceptance Criteria (FAC) governing the loss-of-coolant accident (LOCA) for Light Water Reactors was issued in Appendix K of 10 CFR 50.46, both the Nuclear Regulatory Commission (NRC) and the industry recognized that the stipulations of Appendix K were highly conservative. That is, using the then accepted analysis methods, the performance of the Emergency Core Cooling System (ECCS) would be conservatively underestimated, resulting in predicted Peak Clad Temperatures (PCTs) much higher than expected. At that time, however, the degree of conservatism in the analysis could not be quantified. As a result, the NRC began a large scale confirmatory research program with the following objectives:
- 1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those areas in which a purposely prescriptive approach was used in the Appendix K rule could be quantified with additional data so that a less prescriptive future approach might be allowed.
- 2. Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The
Revision 3306/30/20 MPS-3 FSAR 15.6-19 purpose of this research was to develop an accurate predictive capability so that the uncertainties in the ECCS performance and the degree of conservatism with respect to the Appendix K limits could be quantified.
Since that time, the NRC and the nuclear industry have sponsored reactor safety research programs directed at meeting the above two objectives. The overall results have quantified the conservatism in the Appendix K rule for LOCA analyses and confirmed that some relaxation of the rule can be made without a loss in safety to the public. It was also found that some plants were being restricted in operating flexibility by the overly conservative Appendix K requirements. In recognition of the Appendix K conservatism that was being quantified by the research programs, the NRC adopted an interim approach for evaluation methods. This interim approach is described in SECY-83-472. The SECY-83-472 approach retained those features of Appendix K that were legal requirements, but permitted applicants to use best-estimate thermal-hydraulic models in their ECCS evaluation model. Thus, SECY-83-472 represented an important step in basing licensing decisions on realistic calculations, as opposed to those calculations prescribed by Appendix K.
In 1998, the NRC Staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS Evaluation Models, to permit the use of a realistic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.
Under the amended rules, best-estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best-estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calculations to the prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate codes is provided in Regulatory Guide 1.157.
To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (NUREG/CR-5249). This method outlined an approach for defining an qualifying a best-estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.
A LOCA evaluation methodology for three-loop and four-loop Pressurized Water Reactor (PWR) plants based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated Edison and has been approved by the NRC (WCAP-12945-P-A).
Most recently, Westinghouse developed an alternative uncertainty methodology called ASTRUM, which stands for Automated Statistical TReatment of Uncertainty Method (WCAP-16009-P-A).
This method is still based on the CQD methodology and follows the steps in the CSAU methodology (NUREG/CR-5249). However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order statistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncertainty parameters are simultaneously sampled for each case. The ASTRUM methodology has received NRC approval for referencing in licensing calculations in WCAP-16009-P-A.
Revision 3306/30/20 MPS-3 FSAR 15.6-20 The three 10 CFR 50.46 criteria (peak clad temperature, maximum local oxidation, and core wide oxidation) are satisfied by running a sufficient number of WCOBRA/TRAC calculations (sample size). In particular, the statistical theory predicts that 124 calculations are required to simultaneously bound the 95th percentile values of three parameters with a 95 percent confidence level.
This analysis is in accordance with the applicability limits and usage conditions defined in Section 13-3 of WCAP-16009-P-A, as applicable to the ASTRUM methodology. Section 13-3 of WCAP-16009-P-A was found to acceptably disposition each of the identified conditions and limitations related to WCOBRA/TRAC and the CQD uncertainty approach per Section 4.0 of the ASTRUM Final Safety Evaluation Report appended to this topical report.
15.6.5.2.2 Method of Analysis The methods used in the application of WCOBRA/TRAC to the large break LOCA with ASTRUM are described in WCAP-12945-P-A and WCAP-16009-P-A. A detailed assessment of the computer code WCOBRA/TRAC was made through comparisons to experimental data. These assessments were used to develop quantitative estimates of the codes ability to predict key physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional uncertainties which are identified and quantified in the plant specific analysis. WCOBRA/TRAC MOD7A was used for the execution of ASTRUM for Millstone Unit 3 (WCAP-16009-P-A).
WCOBRA/TRAC combines two-fluid, three-field, multi dimensional fluid equations used in the vessel with one dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR. The best-estimate computer code contains the following features:
- 1. Ability to model transient three dimensional flows in different geometries inside the vessel.
- 2. Ability to model thermal and mechanical non equilibrium between phases.
- 3. Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes.
- 4. Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.
A typical calculation using WCOBRA/TRAC begins with the establishment of a steady state initial condition with all loops intact. The input parameters and initial conditions for this steady state calculation are discussed in the next section.
Following the establishment of an acceptable steady state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRATRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure is calculated
Revision 3306/30/20 MPS-3 FSAR 15.6-21 using the COCO code (WCAP-8326 and WCAP-8327) and mass and energy releases from the WCOBRA/TRAC calculation.
The final step of the best-estimate methodology, in which all uncertainties of the LOCA parameters are accounted for to estimate a PCT, local maximum oxidation (LMO), and core wide oxidation (CWO), at 95 percent probability, is described in the following sections.
- 1. Plant Model Development:
In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used in order to provide an accurate simulation of the transient.
However, specific guidelines are followed to ensure that the model is consistent with models used in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences, such as in the upper plenum of the reactor vessel or the ECCS injection configuration.
- 2. Determination of Plant Operating Conditions:
In this step, the expected or desired operating range of the plant to which the analysis applies is established. The parameters considered are based on a key LOCA parameters list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the initial transient. Next, several confirmatory runs are made, which may vary a subset of the key LOCA parameters over their expected operating range in one-at-a-time sensitivities. Because certain parameters are not included in the uncertainty analysis, these parameters are set at their bounding condition. This analysis is commonly referred to as the confirmatory analysis. The most limiting input conditions, based on those confirmatory runs, are then combined into the model that will represent the limiting state for the plant, which is the starting point for the assessment of uncertainties.
- 3. Assessment of Uncertainty:
The ASTRUM methodology is based on order statistics. The technical basis of the order statistics is described in Section 11 of WCAP-16009-P-A. The determination of the PCT uncertainty, LMO uncertainty, and CWO uncertainty relies on a statistical sampling technique. According to the statistical theory, 124 WCOBRA/
TRAC calculations are necessary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, CWO).
The uncertainty contributors are sampled randomly from their respective distributions for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are randomly sampled for each time in the cycle, break type
Revision 3306/30/20 MPS-3 FSAR 15.6-22 (split or double-ended guillotine), and break size for the split break are also sampled as uncertainty contributors within the ASTRUM methodology.
Results from the 124 calculations are tallied by ranking the PCT from highest to lowest. A similar procedure is repeated for LMO and CWO. The highest rank PCT, LMO, and CWO will bound 95 percent of their populations with 95 percent confidence level.
- 4. Plant Operating Range:
The plant operating range over which the uncertainty evaluation applies is defined.
Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range or may be narrower for some parameters to gain additional margin.
15.6.5.2.3 Analysis Assumptions The expected PCT and its uncertainty developed are valid for a range of plant operating conditions. The range of variation of the operating parameters has been accounted for in the uncertainty evaluation. Table 15.6-3 summarizes the operating ranges for Millstone Unit 3 as defined for the proposed operating conditions, which are supported by Best-Estimate LBLOCA analysis. Tables 15.6-4 and 15.6-7 summarize the LBLOCA containment data used for calculating containment pressure. If operation is maintained within these ranges, the LBLOCA results developed in this report using WCOBRA/TRAC are considered to be valid. Note that some of these parameters vary over their range during normal operation (accumulator pressure) and other ranges are fixed for a given operational condition (Tavg).
15.6.5.2.4 Design Basis Accident The Millstone Unit 3 PCT limiting transient is a double-ended cold leg guillotine break which analyzes conditions that fall within those listed in Table 15.6-3. Traditionally, cold leg breaks have been limiting for large break LOCA. This location is the one where flow stagnation in the core appears most likely to occur. Scoping studies with WCOBRA/TRAC have confirmed that the cold leg remains the limiting break location (WCAP-12945-P-A).
The large break LOCA transient can be divided into convenient time periods in which specific phenomena occur, such as various hot assembly heatup and cooldown transients. For a typical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the downward core flow phase. These are followed by the refill, reflood, and long term cooling periods. Specific important transient phenomena and heat flux regimes are discussed below, with the transient results shown in Figures 15.6-8 to 15.6-21. (The PCT limiting case was chosen to show a conservative representation of the response to a large break LOCA.)
- 1. Critical Heat Flux Phase:
Revision 3306/30/20 MPS-3 FSAR 15.6-23 Immediately following the cold leg rupture, the break discharge rate is subcooled and high (Figures 15.6-9 and 15.6-10). The regions of the RCS with the highest initial temperatures (core, upper plenum, upper head, and hot legs) begin to flash to steam, the core flow reverses and the fuel rods begin to go through departure from nucleate boiling (DNB). The fuel cladding rapidly heats up (Figure 15.6-8) while the core power shuts down due to voiding in the core. This phase is terminated when the water in the lower plenum and downcomer begins to flash (Figures 15.6-14 and 15.6-19, respectively). The mixture swells and intact loop pumps, still rotating in single-phase liquid, push this two-phase mixture into the core.
- 2. Upward Core Flow Phase:
Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be enhanced if the pumps are not degraded, or if the break discharge rate is low due to saturated fluid conditions at the break. If pump degradation is high or the break flow is large, the cooling effect due to upward flow may not be significant. Figure 15.6-11 shows the void fraction for one intact loop pump and the broken loop pump. The figure shows that the intact loop remains in single-phase liquid flow for several seconds, resulting in enhanced upward core flow cooling. This phase ends as the lower plenum mass is depleted, the loop flow becomes two-phase, and the pump head degrades.
- 3. Downward Core Flow Phase The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump flow becomes two-phase. The break flow begins to dominate and pulls flow down through the core, up the downcomer to the broken loop cold leg, and out the break. While liquid and entrained liquid flow provide core cooling, the top third of core vapor flow (Figure 15.6-12) best illustrates this phase of core cooling. Once the system has depressurized to the accumulator pressure (Figure 15.6-13), the accumulators begin to inject cold borated water into the intact cold legs (Figure 15.6-16). During this period, due to steam upflow in the downcomer, a portion of the injected ECCS water is calculated to be bypassed around the downcomer and out the break. As the system pressure continues to fall, the break flow, and consequently the downward core flow, are reduced. The core begins to heat up as the system pressure approaches the containment pressure and the vessel begins to fill with ECCS water (Figure 15.6-15).
- 4. Refill Period:
As the refill period begins, the core begins a period of heatup and the vessel begins to fill with ECCS water (Figures 15.6-16 and 15.6-17). This period is characterized by a rapid increase in cladding temperatures at all elevations due to the lack of liquid and steam flow in the core region. This period continues until the
Revision 3306/30/20 MPS-3 FSAR 15.6-24 lower plenum is filled and the bottom of the core begins to reflood and entrainment begins.
- 5. Reflood Period:
During the early reflood phase, the accumulators begin to empty and nitrogen enters the system. This forces water into the core, which then boils, causing system re-pressurization, and the lower core region begins to quench (Figure 15.6-18).
During this time, core cooling may increase due to vapor generation and liquid entrainment. During the reflood period, the core flow is oscillatory as cold water periodically re-wets and quenches the hot fuel cladding, which generates steam and causes system re-pressurization. The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out of the break. This flow path resistance is overcome by the downcomer water elevation head, which provides the gravity driven reflood force. From the later stage of blowdown to the beginning of reflood, the accumulators rapidly discharge borated cooling water into the RCS, filling the lower plenum and contributing to the filling of the downcomer. The pumped ECCS water aids in the filling of the downcomer and subsequently supplies water to maintain a full downcomer and complete the reflood period. As the quench front progresses up the core, the PCT location moves higher into the top of core region.
As the vessel continues to fill, the PCT location is cooled the early reflood period is terminated.
A second cladding heatup transient may occur due to boiling in the downcomer.
The mixing of ECCS water with hot water and steam from the core, in addition to the continued heat transfer from the hot vessel and vessel metal, reduces the subcooling of ECCS water in the lower plenum and downcomer. The saturation temperature is dictated by the containment pressure. If the liquid temperature in the downcomer reaches saturation, subsequent heat transfer from the vessel and other structures will cause boiling and level swell in the downcomer. The downcomer liquid will spill out of the broken cold leg and reduce the driving head, which can reduce the reflood rate, causing a late reflood heatup at the upper core elevations. Figure 15.6-19 shows only a slight reduction in downcomer level and indicates that a late reflood heatup does not occur.
15.6.5.2.5 Post Analysis of Record Evaluations In addition to the analyses presented in this section, evaluations and reanalyses may be performed as needed to address computer code errors and emergent issues, or to support plant changes. The issues or changes are evaluated, and the impact on the peak cladding temperature (PCT) is determined. The resultant increases or decreases in PCT is applied to the analysis of record PCT.
The PCT, including all penalties and benefits, is presented in Table 15.6-8 for the large break LOCA. The current PCT is demonstrated to be less than the 10 CFR 46(b) requirement of 2200°F.
Revision 3306/30/20 MPS-3 FSAR 15.6-25 In addition, 10 CFR 50.46 requires that licensees assess and report the effect of changes to or errors in the evaluation model used in the large break LOCA analysis. These reports constitute addenda to the analysis of record (AOR) provided in the UFSAR until the overall changes become significant as defined in 10 CFR 50.46. If the assessed changes or errors in the evaluation model results in significant changes in calculated PCT, a schedule for formal reanalysis or other action as needed to show compliance will be addressed in the report to the NRC.
Finally, the criteria of 10 CFR 50.46 requires that holders and users of the evaluation models establish a number of definitions and processes for assessing changes in the models or their use.
Westinghouse, in consultation with the PWR Owners Group (PWROG) has developed an approach for compliance with the reporting requirements. This approach is documented in WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting (Reference 15.6-34). The NRC is provided with annual and 30 day reports, as applicable, for Millstone Power Station.
15.6.5.2.6 Conclusions It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR 50.46 are met. The demonstration that these limits are met is as follows:
(b)(1) The limiting PCT corresponds to a bounding estimate of the 95th percentile PCT at 95 percent confidence level. The resulting PCT for the limiting case in the AOR is listed in Table 15.6-5. With the addition of post-AOR supplemental PCT adjustments, the licensing basis PCT is listed in Table 15.6-8, which is less than the 10 CFR 50.46 criterion (b)(1) of 2200°F.
(b)(2) The maximum cladding oxidation corresponds to a bounding estimate of the 95th percentile LMO at the 95 percent confidence level. Since the resulting LMO for the limiting case is 3.5 percent, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(2), (i.e., Local Maximum Oxidation of the cladding less than 17 percent), is demonstrated. The results are shown in Table 15.6-5.
(b)(3) The limiting core wide oxidation corresponds to a bounding estimate of the 95th percentile CWO at the 95 percent confidence level. The limiting Hot Assembly Rod (HAR) total maximum oxidation is 0.12 percent. A detailed CWO calculation takes advantage of the core power census that includes many lower power assemblies. Because there is a significant margin to the regulatory limit, the CWO value can be conservatively chosen as that calculated for the limiting HAR. A detailed CWO calculation is therefore not needed because the outcome will always be less than 0.12 percent. Since the resulting CWO is 0.12 percent, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(3), (i.e., Core Wide Oxidation less than 1 percent), is demonstrated. The results are shown in Table 15.6-5.
(b)(4) 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains amenable to cooling. This criterion has historically been satisfied by adherence to criteria (b)(1) and (b)(2), and by assuring that fuel deformation due to combined LOCA and seismic loads is
Revision 3306/30/20 MPS-3 FSAR 15.6-26 specifically addressed. It has been demonstrated that the PCT and maximum cladding oxidation limits remain in effect for Best-Estimate LOCA applications.
The approved methodology (WCAP-12945-P-A) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the 44 assemblies in the low power channel. This situation has not been calculated to occur for Millstone Unit 3. Therefore, acceptance criterion (b)(4) is satisfied.
(b)(5) 10 CFR 50.46 acceptance criterion (b)(5) requires that long term cooling be provided following the successful initial operation of the ECCS. Long term cooling is dependent on the demonstration of continued delivery of cooling water to the core. The actions, automatic or manual, that are currently in place at these plants to maintain long term cooling remain unchanged with the application of ASTRUM methodology (WCAP-16009-P-A).
Based on the analysis results, it is concluded that Millstone Unit 3 continues to maintain a margin of safety to the limits prescribed by 10 CFR 50.46.
15.6.5.3 Small Break LOCA 15.6.5.3.1 Description of Small Break LOCA Transient A LOCA can result from a rupture of the reactor coolant system (RCS) or of any line connected to that system up to the first isolation valve. Ruptures of small cross section will cause expulsion of the coolant at a rate that can be accommodated by the charging pumps. Breaks of greater size (up to 1 ft2 area) are defined as small breaks and are analyzed with the NOTRUMP computer code. A rupture in the reactor coolant system results in the discharge to the containment of reactor coolant and associated energy. The result of this discharge is a decrease in coolant pressure in the reactor coolant system and an increase in containment temperature and pressure.
The reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is reached. A safety injection system (SIS) signal is actuated when the appropriate pressurizer low pressure setpoint is reached, activating the high head safety injection pumps. The SIS actuation and subsequent activation of the emergency core cooling system, which results from the SIS signal, assumes the most limiting single failure of ECCS equipment.
Before the break occurs, the unit is assumed to be in an equilibrium condition, (i.e., the heat generated in the core is being removed via the secondary system). In the small break LOCA, the blowdown phase of the small break occurs over a long time period. Thus, for a small break LOCA, there are three characteristic stages: (1) a gradual blowdown in which the decrease in water level is checked by the inventory replenishment associated with safety injection, (2) core recovery, and (3) long term recirculation. The heat transfer between the reactor coolant system and the secondary system may be in either direction, depending on the relative temperature. For the case of continued heat addition to the secondary side, the secondary side pressure increases and the main steam safety valves may actuate to reduce the pressure. Make up to the secondary side is automatically provided by the auxiliary feedwater system. Coincident with the safety injection signal, normal feedwater flow is stopped by closing the main feedwater control valves
Revision 3306/30/20 MPS-3 FSAR 15.6-27 and tripping the main feedwater pumps. Emergency feedwater flow is initiated by starting the auxiliary feedwater pumps. The secondary side flow aids in the reduction of RCS pressure with the break being the primary means of heat removal. When the reactor coolant system depressurizes to approximately 600 psia, the accumulators begin to inject borated water into the reactor coolant loops. Reflecting the loss of off site power assumption, the reactor coolant pumps are assumed to be tripped at the time of reactor trip, and the effects of pump coastdown are included in the blowdown analysis.
15.6.5.3.2 Small Break LOCA Evaluation Model The NOTRUMP and LOCTA-IV computer codes are used to perform the analysis of LOCAs due to small breaks in the RCS. The NOTRUMP computer code, approved for this use by the U.S.
Nuclear Regulatory Commission in May 1985 (WCAP-10079-P-A and WCAP-10080-A), is used the calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of the flow through the break. This code is a one dimensional general network code incorporating a number of advanced features. Among these features are the utilization of non equilibrium thermal calculation in all-fluid volumes, flow regime-dependent drift flux calculations with counter current flooding limitations, mixture level tracking logic in multiple stack fluid nodes, regime-dependent heat transfer correlations. Also, safety injection into the broken loop is modeled using the COSI condensation model (WCAP-10054-P-A, Addendum 2).
The NOTRUMP small break LOCA emergency core cooling system evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-0611, Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants.
In NOTRUMP, the RCS is subdivided into fluid filled control volumes (fluid nodes) and metal nodes interconnected by flow paths and heat transfer links. The transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum applied to these nodes. The broken loop is modeled explicitly, and the intact loops are lumped into a second loop. A detailed description of the NOTRUMP code is provided in WCAP-10079-P-A, WCAP-10080-A, WCAP-10054-P-A, WCAP-10081-A, and WCAP-10054-P-A, Addendum 2.
In the NOTRUMP model, the reactor core is represented as a vertical stack of heated control volumes with an associated bubble rise model to permit a transient mixture height calculation.
The multimode capability of the program enables an explicit and detailed spatial representation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a LOCA.
Select RCS response boundary conditions are extracted from the NOTRUMP calculations and are used in the SBLOCTA fuel rod heat up code. SBLOCTA is a small break specific version of the LOCTA-IV code (WCAP-8301 and WCAP-8305). Peak cladding temperature calculations are performed with the LOCTA-IV code using the NOTRUMP calculated core pressure, fuel rod power history, uncovered core steam flow and mixture levels as boundary conditions. LOCTA-IV models the hot rod and the average hot assembly rod. As stated above, LOCTA-IV contains many heat transfer models, however, due to the relatively low velocities experienced in the core during the SBLOCTA transient, heat transfer is basically limited to forced convection to super heated
Revision 3306/30/20 MPS-3 FSAR 15.6-28 vapor and rod-to-rod radiation. In addition to PCT, SBLOCTA also calculates maximum local and hot rod axial average ZrO2.
Clad thermal analysis are performed with the LOCTA-IV code (WCAP-8301 and WCAP-8305) which uses as input the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture height from the NOTRUMP hydraulic calculations. For all computations, the NOTRUMP and LOCTA runs were terminated slightly after the time the core mixture level returned to the core following uncovery.
A schematic representation of the computer code interfaces is given in Figure 15.6-6.
15.6.5.3.3 Input Parameters and Initial Conditions Table 15.6-15 lists important input parameters and initial conditions used in the small break LOCA analysis.
The analysis presented in this section was performed with a reactor vessel upper head temperature equal to the RCS cold leg temperature. The effect of using the cold leg temperature in the reactor vessel upper head is described in WCAP-7907-P-A, 1984. In addition, the analysis in this section utilize the upflow barrel-baffle methodology described in WCAP-9168 and WCAP-9169, 1977.
The bases used to select the numerical values that are input parameters to the analysis have been conservatively determined from extensive sensitivity studies (WCAP-8341 and WCAP-8342, 1974; WCAP-8340 and WCAP-8356, 1974; WCAP-8565-P-A and WCAP-8566-A, 1975). In addition, the requirements of Appendix K, regarding specific model features, were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time that the LOCA occurs and include such items as the core peaking factors, the containment pressure, and the performance of the ECCS. Decay heat generated throughout the transient is also conservatively calculated.
15.6.5.3.4 Small Break Results The calculated peak clad temperature resulting from the limiting small break LOCA is less than that calculated for the limiting large break. Based on the results of the LOCA sensitivity studies (WCAP-8341 and WCAP-8342, 1974) the limiting small break was found to be less than a 10 inch diameter rupture of the RCS cold leg. Therefore, a range of small break analyses are presented, which establishes the limiting break size. The results of these analyses are summarized in Tables 15.6-14 and 15.6-16.
Based on the results of these studies, the limiting small break was determined to be a 4 inch diameter rupture of the RCS cold leg with a PCT of 1193°F. In none of the cases simulated did the clad rupture. In addition, sensitivity studies combined with the results of the present study indicate little or no uncovering will occur for break sizes that are less than 2 inches. A range of small break analyses are presented which establishes the limiting small break at 4 inches. The results of these analyses are summarized in Tables 15.6-14 and 15.6-16.
Revision 3306/30/20 MPS-3 FSAR 15.6-29 Figures 15.6-7 and 15.6-31 through 15.6-43 present the principal parameters of interest for the small break ECCS analyses. For all cases analyzed, the following transient parameters, where applicable, are presented:
- Reactor coolant system pressure
- Core mixture level
- Clad temperature transient at peak temperature elevation For the limiting (4 inch) break analyzed, the following additional transient parameters are presented:
- Core exit steam flow rate
- Clad surface heat transfer coefficient at peak clad temperature elevation
- Fluid temperature at peak clad temperature elevation.
- Pumped safety injection flow rate The maximum calculated PCT for all small breaks analyzed is 1193°F. These results are well below all acceptance criteria limits of 10 CFR 50.46.
The PCT margin is available to accommodate permanent penalties due to 10 CFR 50.59 Safety Evaluations and LOCA model assessments. These penalties are summarized in the 30 day and the annual 10 CFR 50.46 reporting of the PCT Margin Utilization. The reporting process and the attention to PCT margin assure that the PCT remains below 2200°F limit of 10 CFR 50.46.
The analysis assumed a limiting small break power shape consistent with a LOCA FQ(z) envelope of 2.60 at the core midplane elevation and 2.40 at the top of the core. The maximum local metal-water reaction is 0.08 percent, and the total core metal-water reaction is less than 1.0 percent for all cases analyzed. The clad temperature transients turn around at a time when the core geometry is still amenable to cooling.
The analyses described in the preceding sections demonstrate that one centrifugal charge pump and one high head safety injection pump, together with the accumulators, provide sufficient core flooding to keep the calculated PCT well below the required limits of 10 CFR 50.46 for breaks less than 8.75 inch diameter. For the 8.75 inch diameter break, the RHR pumps, along with one centrifugal charging pump, one high head safety injection pump, and the accumulators provide sufficient core flooding to keep the calculated PCT well below the required limits of 10 CFR 50.46 before switchover to recirculation.
Adequate protection is therefore afforded by the ECCS in the event of a small break LOCA.
15.6.5.4 Radiological Consequences A LOCA would increase the pressure in the primary containment building resulting in containment isolation and initiation of the ECCS and the containment spray systems. A safety injection system (SIS) signal automatically starts operation of the supplementary leak collection and release system (SLCRS) and the charging pump, component cooling water pump, and heat
Revision 3306/30/20 MPS-3 FSAR 15.6-30 exchanger area, MCC, rod control, cable vault, and auxiliary building filtration portions of the auxiliary building ventilation system (ABVS). These systems operating together maintain a negative pressure within the secondary containment enclosure, auxiliary building, engineered safety features (ESF) building, hydrogen recombiner building, and the main steam valve building during accident conditions. The nuclide inventory assumed to be initially available for release from within the containment building is consistent with Regulatory Guide 1.183 and is described in Table 15.6-9.
The containment pressure Hi-1 signal also initiates control room isolation (CBI), which initiates the pressurized filtration mode of operation. The containment pressure Hi-1 signal also initiates control room isolation (CBI) which initiates the pressurized filtration mode of operation.
Described in Section 9.4, the control building will pressurize within two (2) minutes of receipt of a CBI signal. After the control room isolates, unfiltered inleakage of 100 cfm is assumed while pressurized and 350 cfm while in neutral conditions.
The radiological analysis does not credit pressurization for the first 101 minutes following receipt of the CBI signal. During this period, the analysis conservatively assumes unfiltered inleakage at 350 cfm. After 101 minutes, unfiltered inleakage of 100 cfm is assumed.
Release Pathways The release pathways to the environment subsequent to a loss-of-coolant DBA are leakages from the containment building and ESF systems, which are collected and processed, and leakage from the containment building which is assumed to bypass SLCRS.
Containment Leakage Pathway The containment is assumed to leak at the design leak rate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident. After 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, since the pressure has been decreased significantly, Regulatory Guide 1.183 allows the containment leakage to be reduced to one half the design leak rate. For the dose calculations to the Control Room and Technical Support Center, a reduced containment leak rate was assumed at T = 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This was justified and approved as part of the Amendment that eliminated the post-LOCA negative pressure containment requirement. It is based on the fact that the Millstone Unit 3 containment pressure is rapidly reduced compared to typical PWRs because of its original design as a negative pressure containment.
The collection, processing, and release of containment leakage varies depending on the location of the leak. Ventilation characteristics and release paths are different for each building comprising the secondary containment.
Two emergency ventilation systems collect most of the containment leakage and process it through HEPA and charcoal filters. The SLCRS exhausts from the containment enclosure, auxiliary, ESF, and the main steam valve buildings, and the compartment of the hydrogen recombiner building abutting the containment. SLCRS flow is filtered and released through the Millstone stack. The charging pump, component cooling water pump, and heat exchanger area portion of the auxiliary building ventilation system (ABVS), described in Section 9.4.2, supplies and exhausts a relatively high flow on the 24 foot 6 inch elevation floor of the auxiliary building.
Revision 3306/30/20 MPS-3 FSAR 15.6-31 The exhaust flow is filtered and released through the ventilation vent on the roof of the turbine building.
Due to a higher /Q, all containment leakage is assumed to be collected and filtered by the ABVS except for the following:
- 1. The fraction of containment leakage which is assumed to bypass the secondary containment. This is assumed to be an unfiltered ground level release to the environment.
- 2. The initial containment leakage during the 2 minute time period required for SLCRS to establish negative pressure conditions. This is assumed to be an unfiltered ground level release to the environment.
- 3. The leakage past closed dampers which isolate non-ESF ventilation systems in the auxiliary, ESF and main steam valve building. This leakage is assumed to be released unfiltered from the auxiliary building ventilation vent location due to its proximity to the control building inlet.
- 4. The ductwork leakage from the auxiliary building into the SLCRS and emergency portion of the ABVS between the filter and the exhaust fan. This leakage is released unfiltered, along with the rest of the flow for these systems through the ventilation vent.
Credit is taken for iodine removal due to containment sprays during the duration of the accident.
Assumptions pertaining to the spray system are listed in Table 15.6-9.
ESF System Leakage Pathway Post-accident radioactive releases from the ESF system are derived from fluid leakages assumed during recirculation of containment sump water through systems located outside the containment building. The quantity of leakage is based on the assumption that the ESF equipment leaks at twice the maximum expected operational leak rate and that a fraction of the iodine nuclides contained in the leakage fluid becomes airborne in the areas containing ESF equipment. For purposes of analysis, all liquid leakage from the ESF systems are assumed to be in the auxiliary building. The nuclides which become airborne are collected and released to the environment through the auxiliary building ventilation system HEPA and charcoal filtration units.
RWST Back Leakage Pathway Post-accident radioactive releases from the ECCS are a result of ECCS subsystems containing recirculated sump fluid back leaking to the RWST. The backflow rate to the RWST, as a result of isolation valve leakage, is predefined and time dependent. Due to this time dependency, the contaminated sump fluid from back leakage does not arrive into the RWST until 4.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> post-LOCA. Since the RWST is vented to atmosphere, the release is the result of the breathing rate of the RWST due to solar heating.
Revision 3306/30/20 MPS-3 FSAR 15.6-32 Control Room Habitability The potential radiation dose to a control room operator is evaluated for the LOCA. The analysis is based on the assumptions and meteorological parameters (/Q values) given in Tables 15.6-12 and 15.0-11, respectively.
The control room is designed to be continuously occupied for the duration of the accident; i.e.,
30 days. The control building shielding serves to protect the operators from direct radiation due to the passing cloud of radioactive effluent assumed to have leaked from the containment structure and from the ESF system. The control building walls also provide shielding protection for radiation emanating from buildings located onsite which may contain significant quantities of radioactivity.
The control room ventilation system, as described in Sections 6.4 and 9.4, is designed to maintain the dose from activity inside the control room within 10 CFR 50.67 limits. The calculated TEDE is presented in Table 15.0-8 and is below the 10 CFR 50.67 limit of 5 rem.
Dose Computation The radiological dose consequences resulting from a postulated LOCA at Millstone 3 are reported in Table 15.0-8. Assumptions used to perform the evaluation are summarized in Table 15.6-9.
The dose methodology used to determine the results of the hypothetical DBAs is described in Regulatory Guide 1.183.
15.6.5.5 Conclusions The evaluated TEDE for the Control Room, EAB and LPZ are listed in Table 15.0-8. The radiological consequences of the LOCA are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel and 25 rem to the EAB and LPZ.
15.6.6 BWR TRANSIENTS Not applicable to Millstone 3.
15.
6.7 REFERENCES
FOR SECTION 15.6 15.6-1 Anderson, T. M. 1979. Westinghouse Electric Corporation (Westinghouse). Letter to Stolz, J., Nuclear Regulatory Commission (NRC), Letter Number NS TMA 2030.
15.6-2 Eicheldinger, C. 1976. (Westinghouse). Letter to Vassallo, D.B., (NRC).
15.6-3 Eicheldinger, C. 1978. (Westinghouse). Letter to Stolz, J.F., (NRC), Letter Number NS-CE-1672.
Revision 3306/30/20 MPS-3 FSAR 15.6-33 15.6-4 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, 1974. Acceptance Criteria for Emergency Core Cooling System for Light Water Cooled Nuclear Power Reactors.
15.6-5 WARD-TM-84, 1969. Porsching, T.A.; Murphy, J.H.; Redfield, J.A.; and Davis, V.C.
FLASH-4, A Fully Implicit FORTRAN-IV Program for the Digital Simulation of Transients in a Reactor Plant. WARD-TM-84, Bettis Atomic Power Laboratory.
15.6-6 WASH-1400, NUREG-75/104, 1975. Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.
15.6-7 WCAP-7907-P-A (proprietary), WCAP-7907-A (non proprietary), April 1984. Burnett, T. W. T. et al., LOFTRAN Code Description.
15.6-8 WCAP 8301 (Proprietary) and WCAP 8305 (non proprietary), 1974. Bordelon, F. M. et al., LOCTA IV Program: Loss of Coolant Transient Analysis.
15.6-9 WCAP-8327 (Proprietary) and WCAP-8326 (non proprietary) 1974. Bordelon, F.M.
and Murphy, E.T. Containment Pressure Analysis Code (COCO).
15.6-10 WCAP-8340 (Proprietary) and WCAP-8356 (non proprietary), 1974. Salvatori, R.,
Westinghouse ECCS - Plant Sensitivity Studies.
15.6-11 WCAP-8341 (Proprietary) and WCAP-8342 (non proprietary), 1974, Westinghouse ECCS Evaluation Model Sensitivity Studies.
15.6-12 WCAP-8586-P-A (Proprietary) and WCAP-8566-A (non proprietary), 1975. Johnson, W.J.; Massie, H.W.; and Thompson, C.M. Westinghouse ECCS-Four Loop Plant (17 x
- 17) Sensitivity Studies.
15.6-13 WCAP-8970 (Proprietary) and WCAP-8971 (non proprietary), 1977. Skwarek, R.J.;
Johnson, W.J.; and Meyer, P.E. Westinghouse Emergency Core Cooling System Small Break October 1975 Model.
15.6-14 WCAP-9168 (Proprietary) and WCAP-9169 (non proprietary), 1977. Johnson, W.J. and Thompson, C.M. Westinghouse Emergency Core Cooling System Evaluation Model -
Modified October 1975 Version.
15.6-15 ROHE, E.P. 1981. (Westinghouse). Letter to Tedesco, R.L., (NRC), Letter Number NS-ER-2538.
15.6-16 WCAP-10079-P-A (proprietary) and WCAP-10080-A (non proprietary), 1985. Meyer, P. E., NOTRUMP, A Nodal Transient Small Break and General Network Code.
Revision 3306/30/20 MPS-3 FSAR 15.6-34 15.6-17 WCAP-10054-P-A (proprietary) and WCAP-10081-A (non proprietary), 1985. Lee, N.
Rupprecht, S. D., Schwarz, W. R, and Tauche, W. D., Westinghouse Small ECCS Evaluation Model Using the NOTRUMP Code.
15.6-18 WCAP-10444-P-A, 1985. Davidson, S. L., ed., et al., VANTAGE 5 Fuel Assembly Reference Core Report.
15.6-19 WCAP-10698-P-A (proprietary) and WCAP-10750 (non proprietary), 1987, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill.
15.6-20 Supplement 1 to WCAP-10698-P-A, 1986, Evaluation of Off-site Radiation Doses for an SGTR Accident.
15.6-21 WCAP-11002 (proprietary) and WCAP-11003 (non proprietary), 1986, Evaluation of Steam Generator Overfill due to a SGTR Accident.
15.6-22 J. F. Opeka to U.S. Nuclear Regulatory Commission letter B15028, dated December 14, 1994, Millstone Nuclear Power Station, Unit No. 3, Proposed Revision to Technical Specifications, Supplemental Collection and Release System.
15.6-23 Postma, A.K. and Tam, P.S., Iodine Behavior in a PWR Cooling System Following a Postulated Steam Generator Tube Rupture, NUREG-0409.
15.6-24 WCAP-10054-P-A, Addendum 2, Revision 1, Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, Thompson, C. M., et al., July 1997.
15.6-25 WCAP-11145-P-A, Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, Rupprecht, S. D., et al., October 1986.
15.6-26 WCAP-15085, Model Changes to the Westinghouse Appendix K Small Break LOCA NOTRUMP Evaluation Model: 1988-1997, J. J. Akers, ed., July 1998.
15.6-27 WCAP-14882-P-A, RETRAN-O2 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, Huegel, D.S. et al., April 1999.
15.6-28 Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, January 4, 1974.
15.6-29 SECY-83-472, Information Report from W.J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, November 17, 1983.
15.6-30 Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, USNRC, May 1989.
Revision 3306/30/20 MPS-3 FSAR 15.6-35 15.6-31 NUREG/CR-5249, Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, B. Boyack, et al., 1989 15.6-32 WCAP-12945-P-A, Volume 1, Revision 2 and Volumes 2 through 5, Revision 1, Code Qualification Document for Best-Estimate LOCA Analysis, Bajorek, S.M., et al.,
1998.
15.6-33 WCAP-16009-P-A, Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), (Proprietary),
January 2005.
15.6-34 WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting, October 1992.
15.6-35 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
Revision 3306/30/20 MPS-3 FSAR 15.6-36 TABLE 15.6-1 TIME SEQUENCE OF EVENTS FOR INADVERTENT OPENING OF A PRESSURIZER SAFETY VALVE Accident Event Time (sec)
Inadvertent opening of a Safety valve fully opens 0.0 pressurizer safety valve Overtemperature T reactor trip signal initiated 40.4 Low pressurizer pressure reactor trip setpoint ---
reached Rods begin to drop 41.9 Minimum DNBR occurs 42.5
Revision 3306/30/20 MPS-3 FSAR 15.6-37 TABLE 15.6-2 ASSUMPTIONS USED IN ANALYSIS OF FAILURE OF SMALL LINES CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT Assumption
- 1. Primary coolant activity Table 15.0-10
- 2. Fraction of iodine assumed airborne 0.4
- 3. Fraction of other isotopes assumed airborne 1.0
- 4. Time to isolate letdown line (minutes) 30
- 5. Rate of release from ruptured line (gpm) 152
- 6. Pipe break size (inches) 3 Concurrent iodine release rate shown in
- 7. Iodine spike factor Table 15.0-13
- 8. Amount of reactor coolant released (lb.) 3.8 x 104
- 9. RCS mass (lbm) 4.483 x 105
- 10. Breathing rate (m3/sec) 3.5 x 10-4
Revision 3306/30/20 TABLE 15.6-3 PLANT OPERATING RANGE ALLOWED BY THE BEST ESTIMATE LARGE BREAK LOCA ANALYSIS 1.0 Plant Physical Description Parameter As Analysed Value or Range Operating Range or Target Value a) Dimensions Nominal N/A b) Pressurizer location On an intact loop N/A c) Hot assembly location Anywhere in core (1) d) Hot assembly type 17x17 RFA-2 fuel design 17x17 RFA-2 fuel design e) Steam generator tube plugging 10% 0% SGTP 10% (in any one steam generator) level 17x17 RFA-2 fuel with ZIRLO or Optimized 17x17 RFA-2 fuel with ZIRLO or Optimized f) Fuel assembly type ZIRLO cladding, non-IFBA or IFBA ZIRLO cladding, non-IFBA or IFBA 2.0 Plant Initial Operating Conditions 2.1 Reactor Power Parameter As Analysed Value or Range Operating Range or Target Value MPS-3 FSAR a) Core Power 102% of 3650 MWt 3650 MWt b) Peak Heat Flux hot channel factor (FQ) 2.6 2.6 c) Peak hot rod enthalpy rise hot channel factor (FH) 1.65 1.65 d) Hot assembly radial peaking factor (PHA) 1.65/1.04 1.65/1.04 e) Hot assembly heat flux hot 15.6-38 channel factor (FQHA) 2.6/1.04 2.6/1.04
Revision 3306/30/20 Parameter As Analysed Value or Range Operating Range or Target Value f) Axial power distribution (PBOT, Figure 15.6-20 Figure 15.6-20 PMID) g) Low power region relative power 0.2 PLOW 0.6 0.2 PLOW 0.6 (PLOW) h) Hot assembly burnup 75,000 MWD/MTU, lead rod (1) 62,000 MWD/MTU, lead rod (1) (2) i) MTC 0 at hot full power (HFP) 0 at hot full power (HFP) j) Typical cycle length 18 months 18 months k) Minimum core average burnup 10,000 MWD/MTU 10,000 MWD/MTU l) Maximum steady state depletion, FQ 2.0 2.0 2.2 Fluid Conditions Parameter As Analysed Value or Range Operating Range or Target Value a) Tavg 571.5-4.0°F Tavg 589.5+4.0°F 571.5 - 589.5 (3) b) Pressurizer Pressure 2250-50 psia PRCS 2250+50 psia 2250 psia (3)
MPS-3 FSAR c) Loop flow TDF 90,800 gpm/loop mmf 94,800 gpm/loop (4) d) Upper head design TCOLD TCOLD 64% of span (Tavg of 589.5°F), 45.4% of span 64% of span (Tavg of 589.5°F) (3), 45.4% of e) Pressurizer level (Tavg of 571.5°F) span (Tavg of 571.5°F) (3) f) Accumulator temperature 80°F TACC 120°F 80°F TACC 120°F g) Accumulator pressure 636 psia PACC 694 psia 636 psia PACC 694 psia 15.6-39 h) Accumulator liquid volume 6618 gallon VACC 7030 gallon 6618 gallon VACC 7030 gallon
Revision 3306/30/20 Parameter As Analysed Value or Range Operating Range or Target Value i) Accumulator L/D 6.264 (5) Current line configuration j) Minimum accumulator boron 2600 ppm 2600 ppm 3.0 Accident Boundary Conditions Parameter As Analysed Value or Range Operating Range or Target Value a) Minimum safety injection flow Table 15.6-6 Table 15.6-6 b) Safety injection temperature 40°F SI Temperature 100°F 40°F SI Temperature 100°F 40 seconds (with offsite power), 45 seconds (with 40 seconds (with offsite power), 45 seconds c) Safety injection delay loss of offsite power) (with loss of offsite power)
See Figure 15.6-21 and raw data in Tables 15.6- See Figure 15.6-21 and raw data in d) Containment modeling 4 and 15.6-7 Tables 15.6-4 and 15.6-7 e) Minimum containment air partial 8.9 psia 8.9 psia pressure f) Containment spray initiation delay 26.3 seconds 26.3 seconds g) Recirculation spray initiation Not modeled Not modeled delay MPS-3 FSAR h) Single failure Loss of one ECCS train Loss of one ECCS train NOTES:
(1) 44 peripheral locations will not physically be lead power assembly.
(2) Please note that the fuel temperature and rod internal pressure data is only provided up to 62,000 MWD/MTU. In addition, the hot assembly/hot rod will not have a burnup this high in ASTRUM analysis.
(3) Plant control systems are designed to control these parameters to the stated values.
(4) TDF plus uncertainties.
(5) fL/D based on average L/D of 447.4.
15.6-40
Revision 3306/30/20 MPS-3 FSAR 15.6-41 TABLE 15.6-4 LARGE BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE Containment Net Free Volume 2,350,000 ft3 Initial Conditions Minimum air initial containment partial pressure at full power operation 8.9 psia Minimum steam initial containment partial pressure at full power operation 0.00 psia Minimum initial containment temperature at full power operation 80°F RWST temperature 40.0°F Temperature outside containment -20°F Initial spray temperature 40.0°F Spray System Number of containment spray pumps operating 2 Post-accident containment spray system initiation delay 26.3 seconds Maximum spray system flow from all containment spray pumps 6500 gpm Fan Coolers Not modeled Recirculation Spray Not modeled
Revision 3306/30/20 MPS-3 FSAR 15.6-42 TABLE 15.6-5 ANALYSIS OF RECORD BEST ESTIMATE LARGE BREAK LOCA RESULTS 10 CFR 50.46 Requirement Value Criteria 95/95 PCT (1) (°F) 1,781 < 2,200 95/95 LMO (2) (%) 3.5 < 17 95/95 CWO (3) 0.12 <1 NOTE:
(1) Peak Cladding Temperature (2) Local Maximum Oxidation (3) Core Wide Oxidation
Revision 3306/30/20 MPS-3 FSAR 15.6-43 TABLE 15.6-6 TOTAL MINIMUM INJECTED SAFETY INJECTION FLOW USED IN BEST ESTIMATE LARGE BREAK LOCA ANALYSIS Reactor Coolant System Pressure (psia) Flow Rate (gpm) 14.7 3453.4 114.7 818.0 214.7 661.7 314.7 629.0 414.7 595.2 514.7 560.1 614.7 523.9 714.7 484.7 814.7 443.5 914.7 394.5 1014.7 339.3 1114.7 276.2 1214.7 194.4 1314.7 134.5 1414.7 118.2 1514.7 101.0 1614.7 83.3 1714.7 64.8 1814.7 43.5 1914.7 16.3 2014.7 0
Revision 3306/30/20 MPS-3 FSAR 15.6-44 TABLE 15.6-7 LARGE BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE Structural Heat Sinks Height Wall Thickness (feet) TAIR (°F) Area (ft3) (ft3) Tinitial (°F) 0.0375 stainless steel, 2.16 concrete 80 866 10.0 80 0.375 stainless steel, 1.50 concrete 80 7,674 10.0 80 1.36 concrete 80 133,277 10.0 80 2.11 concrete 80 17,926 10.0 80 3.00 concrete 80 6,563 10.0 80 1.75 concrete 80 2,007 10.0 80 2.00 concrete, 0.25 carbon steel, 10.00 55 12, 269 10.0 80 concrete 0.0428 carbon steel, 4.5 concrete 55 24,675 10.0 80 0.0428 carbon steel, 4.5 concrete -20 38,493 10.0 80 0.0462 carbon steel, 2.56 concrete -20 34,100 10.0 80 0.1075 stainless steel 80 1,722 10.0 80 0.0592 carbon steel 80 552 10.0 80 0.02 stainless steel 80 13,230 10.0 80 0.0548 stainless steel 80 2,063 10.0 80 0.0231 carbon steel 80 8,966 10.0 80 0.0825 carbon steel 80 1,282 10.0 80 0.0182 carbon steel 80 514,279 10.0 80 0.00925 carbon steel 80 182,517 10.0 80 0.0304 stainless steel 80 11,033 10.0 80 0.0651 carbon steel 80 37,068 10.0 80 0.0119 steel 80 21,000 10.0 80 2.16 concrete 80 866 10.0 80 1.50 concrete 80 7,674 10.0 80
Revision 3306/30/20 MPS-3 FSAR 15.6-45 TABLE 15.6-8 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST ESTIMATE LARGE BREAK LOCA (BE LBLOCA)
PCT for Analysis of Record (AOR) 1781°F Thermal Conductivity Degradation and Peaking Factor Burndown + 222°F Revised Heat Transfer Multiplier Distributions - 91°F HOTSPOT Burst Strain Error Correction +21°F BE LBLOCA PCT for Comparison to 10 CFR 50.46 1933°F
Revision 3306/30/20 TABLE 15.6-9 ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS
- 1. Power Level (MWt) 3,723 (includes 2% uncertainty).
- 2. Core Inventory Table 15.0-7
- 3. Containment Leak Rate: 0.3% by weight of the containment air per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (La).
- 4. Containment Bypass Leak Rate: 0.06 La.
- 5. Containment leak rate Reduction: 50% after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (offsite).
- 6. Secondary Containment Drawdown Time: 50% after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (control room).
- 7. Regulatory Guide 1.183 RELEASE FRACTIONS AND DURATION Isotope Group Gap Early In-Vessel Noble Gases 0.05 0.95 Halogens 0.05 0.35 MPS-3 FSAR Alkali Metals 0.05 0.25 Telluriums 0 0.05 Bariums 0 0.02 Noble Metals 0 0.0025 Ceriums 0 0.0005 Lanthanides 0 0.0002 Duration (hours) 0.5 1.3 15.6-46
- 8. Iodine Chemical Form in Containment Atmosphere: 95% Cesium Iodide; 4.85% Elemental Iodine; 0.15% Organic Iodine.
TABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA Revision 3306/30/20 ANALYSIS
- 10. Containment Sump pH: at least 7.
- 11. Dose Conversion Factors: FGR 11 and 12.
- 12. SLRCS Filter Efficiency: 95% all Iodines and Particulates.
- 13. Auxiliary Building Filter Efficiency: 95% all Iodines and Particulates.
- 14. Quench Spray System Effective Period: 80 - 10,000 seconds.
- 15. Recirculation Spray System Effectiveness Time: 5500 seconds - 30 days.
- 16. Mixing Rate for Unsprayed to Sprayed Regions 2 per hour.
- 17. Elemental Iodine Removal Coefficient: 10 per hour.
- 19. Particulate Iodine Removal Coefficient for Quench and Recirculation Spray: DF < 50: 13.57; DF 50: 1.36.
MPS-3 FSAR
- 21. Containment Free Volume 2.35E+06 ft3.
- 22. Quench Spray Volume of Containment: 1,166,200 ft3.
- 23. Quench and Recirculation Spray Volume: 1,515,858 ft3.
- 24. Recirculation Spray Volume 1,102,000 ft3.
- 25. Minimum Available RWST Volume: 1,072,886 gallons.
- 26. Minimum Quench Spray System Auto Trip Value: 47,652 gallons.
- 27. RWST Maximum Fill Volume: 1,206,644 gallons.
15.6-47
TABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA Revision 3306/30/20 ANALYSIS
- 28. Percentage of Total Containment Leakage into the Secondary Containment:
ESF Building 10.59.
MSV Building 23.31.
Enclosure Building/H2 Recombiner Building 8.47.
Auxiliary Building 57.63.
- 29. Secondary Containment Free Volume (ft3)
ESF Building 225,000.
MSV Building 70,000.
Enclosure Building/H2 Recombiner Building 831,000.
Auxiliary Building, all elevations 914,000
- 30. 50% mixing in all buildings that form the secondary containment.
MPS-3 FSAR
- 32. Unfiltered releases occur from ventilation vent, ESF Building roof vent and MSV Building roof vent.
- 33. All filtered releases are from the ventilation vent. This is conservative because Millstone stack releases have lower /Qs.
- 34. The Auxiliary Building is homogeneously mixed. The Auxiliary Building is treated as one compartment.
- 35. Unfiltered ventilation and leakage parameters (T=0 hours to 30 days post LOCA).
Ground Level Release CFM 3HVQ-FN2 (ESF building normal exhaust) 77 3HVV-FN1A&B (MSVB exhaust) 134 15.6-48 3HVQ*ACUS1A&B (ESF building AC) 4 3HVQ*ACUS2A&B (ESF building AC) 2
TABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA Revision 3306/30/20 ANALYSIS Ventilation Vent 3GWS-FN1A&B (Process Vent Fan) 70 (Auxiliary 66 foot 6 inches).
3HVR*FN12A&B (SLCRS exhaust duct leak) 63 (Auxiliary 66 foot 6 inches).
3HVR-FN5 (Auxiliary Building normal exhaust) 553 (Auxiliary 43 foot 6 inches & 66 foot 6 inches).
3HVR-FN7 (Auxiliary Building normal exhaust) 218 (Auxiliary Building - all elevations).
3HVR-FN8A & B (Waste Disposal Building normal exhaust) 43 (Auxiliary Building 66 foot 6 inches).
3HVR-FN11 (Electrical Tunnel purge air) 28.
3HVR-FN9 (Fuel Building exhaust duct leak) 75 (Auxiliary Building 66 foot 6 inches).
3HVR*FN6A & B (Auxiliary Building filter exhaust) 17 (Auxiliary Building 66 foot 6 inches).
3HVR*AOD44 A& B (Normal exhaust isolation) 113 (Auxiliary Building 24 foot 6 inches).
3HVR*AOD32A & B (Containment purge exhaust) 118 (Auxiliary Building 24 foot 6 inches).
- 36. Duration of Release from containment (hour) 720.
MPS-3 FSAR ECCS LEAKAGE ASSUMPTIONS
- 37. ECCS Leak Initiation and Cessation Times 2500 seconds to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />.
TABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS
- 38. ECCS System Leakage Outside of Containment (1): 5,000 cc/hr.
- 39. ECCS Leakage Location 100% Auxiliary Building.
15.6-49
- 40. Fraction of Core Iodine Inventory in ECCS Sump Water 0.05 during gap release, 0.35 during early in-vessel phase.
Revision 3306/30/20
TABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS
RWST BACKLEAKAGE ASSUMPTIONS
- 44. Time Dependent Backleakage Volume to the RWST:
Time Volume (ft3) (cumulative) 4.25 hrs 0.00 14.91 hrs 17.11 18.46 hrs 39.88 33.74 hrs 162.41 63.13 hrs 445.21 68.83 hrs 509.27 MPS-3 FSAR 72.21 hrs 552.68 720 hrs 9904.49
- 46. RWST Breathing Rate (cfm): 8.7.
NOTES:
- 1. In accordance with Appendix A of Regulatory Guide 1.183, the analysis assumed the maximum post-LOCA equipment leakage was a factor of at least 2 times the system leakage to give a total of 10,000 cc/hr.
15.6-50
Revision 3306/30/20 MPS-3 FSAR 15.6-51 TABLE 15.6-10 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-52 TABLE 15.6-11 DELETED BY CHANGE PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-53 TABLE 15.6-12 ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS Control room (CR) parameters:
Control room volume (ft3) 2.38 E+05 Control building concrete wall thickness (ft) 2 Unfiltered ventilation intake rate pre CR isolation (cfm) 1,595 Filtered ventilation intake rate post CR isolation (cfm) 230 Filtered recirculation rate post CR isolation (cfm) 666 Unfiltered Inleakage rate (cfm) 350 (neutral), 100 (pressurized)
Time to place control room emergency ventilation system in service:
Pressurized control room 101 minutes Recirculation 101 minutes Intake ventilation filter efficiencies (percent):
HEPA 95 Charcoal 95 (elemental), 95 (methyl)
Release points (distance to Unit 3 control room intake in meters):
Millstone stack 351 Unit 2 containment surface 223 Unit 3 containment surface 69.5 Unit 3 Turbine Building ventilation vent 37.3 Unit 3 RWST 150.1 Unit 3 Turbine Building 30.0 Unit 3 MSV Building 60.3 Unit 3 ESF Building 134.8 Control room air intake height 28.7 Leakage values based on single damper closure
Revision 3306/30/20 MPS-3 FSAR 15.6-54 TABLE 15.6-12 (CONTINUED) ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS TIMETABLE POST-ACCIDENT FOR CONTROL ROOM ISOLATION AND PRESSURIZATION PERIODS Control Room Isolated Control Room Pressurized (1)
LOCA 6 seconds (2) 1.683 hours0.00791 days <br />0.19 hours <br />0.00113 weeks <br />2.598815e-4 months <br /> MSLB 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> SGTR 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> FHA (4) 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> (5)
REA 2 min 10 seconds (6) 1.717 hours0.0083 days <br />0.199 hours <br />0.00119 weeks <br />2.728185e-4 months <br /> LRA 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> NOTES:
(1) Control Room is pressurized 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 41 minutes after CBI signal.
(2) Per Regulatory Guide 1.183, the onset of gap release does not start until 30 seconds post-LOCA. Therefore the Control Room is isolated due to CBI from Containment Pressure - High 1 prior to the plume reaching it.
(3) Control Room isolates on CBI due to ventilation intake radiation monitor alarm.
CBI generated within 4 seconds. Control Room isolates 6 seconds later.
(4) Fuel has decayed 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at start of FHA.
(5) CREVs filtered recirculation flow is placed in operation within 30 minutes of a drop of a spent fuel assembly.
(6) SI signal initiated 2 minutes post-accident. CBI generated within 4 seconds. Control Room isolates 6 seconds later.
Revision 3306/30/20 MPS-3 FSAR 15.6-55 TABLE 15.6-13 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 TABLE 15.6-14 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH CAUSE A DECREASE IN REACTOR COOLANT INVENTORY (SMALL BREAK)
Event (seconds) 1.5 inch 2.0 inch 3.0 inch 4.0 inch 6.0 inch 8.75 inch Transient Initiated 0.0 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 174 180 60 32 16 10 Safety Injection Signal 184 191 70 41 20 11 Safety Injection Begins (1) 224 231 110 81 60 51 Loop Seal Clearing Occurs (2) 2152 1092 422 255 127 18 Top of Core Uncovered (3) 2478 705 637 429 (3)
Accumulator Injection Begins N/A N/A 1919 887 386 176 (4)
Top of Core Recovered N/A 4290 2389 1550 445 N/A RWST Low Level (5) 5210 5164 N/A N/A N/A N/A (1) Safety Injection (SI) begins 40 seconds (SI delay time) after the safety injection signal.
MPS-3 FSAR (2) Loop seal clearing is considered to occur when the broken loop seal vapor flow rate is sustained above 1 lbm/sec.
(3) There is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case.
(4) For the 8.75 inch case, the broken loop (BL) accumulator is spilling to containment and the accumulator injection time listed here is only the intact loop (IL) accumulator injection time.
(5) The analysis assumes minimum usable RWST volume (598,000 gallons)* before the RWST low level signal for switchover to cold leg recirculation is reached.
- Actual RWST volume is 614,000 gallons (see Section 6.3.2 and Figure 6.3-6).
15.6-56
Revision 3306/30/20 MPS-3 FSAR 15.6-57 TABLE 15.6-15 INPUT PARAMETERS USED IN THE ECCS ANALYSIS (SMALL BREAK)
Parameter Value Core Power (MWt) (1) 3650 Peak linear power, includes 1.02 percent factor (kW/ft) 14.75 Total peaking factor (FTQ) 2.60 Power Shape Figure 15.6-7 Fuel Assembly array 17x17 Accumulator water volume, nominal (ft3/accumulator) 900 Accumulator tank volume, nominal (ft3/accumulator) 1350 Accumulator gas pressure, minimum (psia) 609.4 (2)
Safety Injection pumped flow See Tables 15.6-17 and 15.6-18 Containment parameters See Section 6.2 Initial loop flow (lb/sec) 9413.3 Vessel inlet temperature (°F) 555.6 Vessel outlet temperature (°F) 623.3 Reactor coolant pressure 2300 (3)
Steam pressure (psia) 936.5 Steam Generator tube plugging level (%) 10 (1) Two percent is added to this power to account for calorimetric error.
(2) This value is the minimum accumulator pressure of 636 psia minus 26.6 psi uncertainty.
(3) This value is the nominal RCS pressure of 2250 psia plus 50 psi uncertainty.
Revision 3306/30/20 TABLE 15.6-16 SMALL BREAK LOCA RESULTS FUEL CLADDING DATA 4.0 inch with Event (seconds) 1.5 inch (1) 2.0 inch 3.0 inch 4.0 inch Annular Pellets 6.0 inch 8.75 inch (1)
Peak Cladding Temperature, N/A 922 1128 1193 1193 527 N/A
(°F)
PCT Time, seconds N/A 3340 1646 971 971 438 N/A PCT Elevation, feet N/A 11.00 11.25 11.25 11.25 11.50 N/A Burst Time, seconds (2) N/A N/A N/A N/A N/A N/A N/A Burst Elevation, feet (2) N/A N/A N/A N/A N/A N/A N/A Maximum Hot Rod Zro2, % N/A 0.01 0.08 0.05 0.05 0.0 N/A Maximum Hot Rod Zro2 N/A 11.00 11.25 11.25 11.25 11.50 N/A Elevation, feet Hot Rod Average Zro2, % N/A 0.0 0.01 0.01 0.01 0.0 N/A (1) There is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case; therefore rod heatup MPS-3 FSAR calculations were not performed.
(2) None of the SBLOCTA calculations exhibited rod burst (hot rod or hot assembly average rod).
15.6-58
Revision 3306/30/20 MPS-3 FSAR 15.6-59 TABLE 15.6-17 SMALL BREAK LOCA SAFETY INJECTION FLOW RATE FOR 1.5 INCH TO 6 INCH BREAKS (BROKEN LOOP SI FLOWS SPILL TO RCS PRESSURE)
Intact Loop Injection Flow Broken Loop Injection Flow RCS Pressure (psia) (gpm) (gpm) 14.7 719.8 259.0 114.7 697.7 251.1 214.7 675.1 242.9 314.7 650.4 234.1 414.7 625.0 225.0 514.7 598.9 215.6 614.7 570.9 205.6 714.7 541.4 195.1 814.7 509.9 183.7 914.7 476.0 171.6 1014.7 438.7 158.1 1114.7 393.9 142.2 1214.7 334.1 120.7 1314.7 248.8 90.3 1414.7 173.4 63.4 1514.7 162.9 59.5 1614.7 152.1 55.6 1714.7 138.9 50.8 1814.7 125.1 45.7 1914.7 111.0 40.6 2014.7 96.9 35.4 2114.7 84.0 30.7 2214.7 74.4 27.2 2314.7 64.8 23.7 2414.7 55.2 20.1 2482.7 0.0 0.0
Revision 3306/30/20 MPS-3 FSAR 15.6-60 TABLE 15.6-18 SMALL BREAK LOCA SAFETY INJECTION FLOW RATE FOR 8.75 INCH BREAK BEFORE SWITCHOVER (Broken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 14.7 3453.4 1340.6 34.7 2884.7 1716.9 54.7 2290.5 2079.6 74.7 1768.3 2359.1 94.7 1353.8 2533.5 114.7 818.0 2732.0 134.7 686.2 2777.1 154.7 680.1 2778.4 174.7 673.9 2779.9 194.7 667.8 2781.4 214.7 661.7 2782.9 314.7 629.0 2791.2 414.7 595.2 2799.4 514.7 560.1 2807.5 614.7 523.9 2815.8 714.7 484.7 2823.8 814.7 443.5 2831.9 914.7 394.5 2870.0 1014.7 339.3 2880.3 1114.7 276.2 2891.1 1114.7 276.2 2891.1 1214.7 194.4 2902.4 1314.7 134.5 2909.6 1414.7 118.2 2915.6 1514.7 101.0 2919.4 1614.7 83.3 2923.4 1714.7 64.8 2927.5
Revision 3306/30/20 MPS-3 FSAR 15.6-61 TABLE 15.6-18 SMALL BREAK LOCA SAFETY INJECTION FLOW RATE FOR 8.75 INCH BREAK BEFORE SWITCHOVER (CONTINUED)
(Broken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 1814.7 43.5 2931.6 1914.7 16.3 2936.0 2014.7 0.0 2939.4 2114.7 0.0 2939.4 Note that the above flows are applicable before switchover to recirculation and include RHR flows.
Revision 3306/30/20 MPS-3 FSAR 15.6-62 TABLE 15.6-19 OMITTED
Revision 3306/30/20 MPS-3 FSAR 15.6-63 TABLE 15.6-20 OMITTED
Revision 3306/30/20 MPS-3 FSAR 15.6-64 TABLE 15.6-21 DELETED BY FSARCR 03-MP3-022
Revision 3306/30/20 MPS-3 FSAR 15.6-65 TABLE 15.6-22 DELETED BY FSARCR 03-MP3-022
Revision 3306/30/20 MPS-3 FSAR 15.6-66 TABLE 15.6.3-1 OPERATOR ACTION TIMES FOR DESIGN BASIS STEAM GENERATOR TUBE RUPTURE ANALYSIS Action Time Isolate AFW flow to the ruptured steam Calculated time to reach 30% narrow range level generator in the ruptured steam generator for overfill analysis.
Calculated time to reach 8% narrow range level in the ruptured steam generator for mass release analysis (input to doses).
Isolate ruptured steam generator 25 minutes from the time of break initiation.
Operator action time to isolate failed 20 minutes.
opened Main Steam Pressure Relief Valve (in mass release analysis)
Operator action to initiate cooldown 8 minutes from complete isolation of ruptured steam generator.
Reactor Coolant System cooldown LOFTTR2 calculated time for Reactor Coolant System cooldown.
Operator action time to initiate 3 minutes from end of cooldown.
depressurization Reactor Coolant System depressurization LOFTTR2 calculated time for Reactor Coolant System depressurization.
Operator action time to initiate safety Maximum of 6 minutes from end of injection termination depressurization or time to satisfy safety injection termination criteria.
Pressure equalization LOFTTR2 calculated time for equalization of Reactor Coolant System and ruptured steam generator pressures.
Revision 3306/30/20 MPS-3 FSAR 15.6-67 TABLE 15.6.3-2 STEAM GENERATOR TUBE RUPTURE ANALYSIS SEQUENCE OF EVENTS Event Time (seconds)
Steam Generator tube rupture 0 Reactor trip on OTT (1) 135 Safety Injection Actuated 143 Ruptured Steam Generator Auxiliary Feed Water isolation level 178 reached Ruptured steam line isolated 1500 Ruptured Steam Generator Main Steam Pressure Relief Valve fails 1502 open Ruptured Steam Generator Main Steam Pressure Relief Valve 2702 isolation valve closed Reactor Coolant System cooldown Initiated 3182 Break Flow stops flashing 3381 Reactor Coolant System cooldown Terminated 3690 Reactor Coolant System depressurization Initiated 3872 Reactor Coolant System depressurization Terminated 3952 Safety Injection terminated 4312 Break Flow terminated 6412 (1) The nominal trip setpoint specified in the Technical Specifications is modeled since earlier reactor trip is conservative for this analysis. Although the low pressurizer pressure reactor trip setpoint is not reached, the analysis modeled the Technical Specification value with positive uncertainties.
Revision 3306/30/20 TABLE 15.6.3-3 STEAM GENERATOR TUBE R MASS RELEASES TOTAL MASS FLOW (POUNDS)
Time Period Time of Reactor Time at Trip to Time at Which Break Start of Event to Which Break Flow is 24 Hours Time of Reactor Flow is Terminated to 2 Hours to 11 Hours to to 35.75 Trip (1) Terminated 2 Hours 11 Hours 24 Hours (2) Hours (3)
Ruptured steam generator to 159,610 0 0 0 0 0 condenser (lbm) (1)
Ruptured steam generator to 0 198,330 0 40,920 0 0 atmosphere (lbm) (1)
Intact steam generators (total for 3) 475,090 0 0 0 0 0 to condenser (lbm) (1)
Intact steam generators (total for 3) 0 344,190 47,960 1,678,380 2,424,000 196,555 to atmosphere (lbm) (1)
Total break flow (lbm) 7,040 222,750 (4) 0 0 0 0 Flashed break flow (lbm) 1,138.6 14,506.9 (5) 0 0 0 0 MPS-3 FSAR NOTES:
- 1. The thermal and hydraulic analysis assumes that a loss of offsite power occurs at time of reactor trip. Thus, the condenser is available during the first period identified above. The radiation dose analysis assumes that a loss of offsite power occurs at the time of Steam Generator Tube Rupture; thus, the condenser is unavailable. The radiation dose analysis assumes that the entire mass release is to the atmosphere.
- 2. The time period from 11 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not discussed in the thermal and hydraulic analysis. In the dose analysis, the steam release period is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry.
- 3. The time period from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> is a period of simultaneous steaming and RHR operation to address safety grade cold shutdown requirements.
15.6-68
- 4. Reactor Coolant System break flow terminates after 1.78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br />.
- 5. Flashed break flow terminates after 0.9392 hours0.109 days <br />2.609 hours <br />0.0155 weeks <br />0.00357 months <br />.
Revision 3306/30/20 MPS-3 FSAR 15.6-69 TABLE 15.6.3-4 STEAM GENERATOR TUBE RUPTURE ANALYSIS PARAMETERS USED IN EVALUATING RADIOLOGICAL CONSEQUENCES I. Source Data A. Total steam generator tube leakage, 1.0 prior to accident, gpm B. Reactor coolant iodine activity:
- 1. Accident-Initiated Spike The initial RC iodine activities based on 1.0 Ci/gram of D.E. I-131 are presented in Table 15.0-10. The iodine appearance rates assumed for the accident-initiated spike are presented in Table 15.6.3-6.
- 2. Pre-accident Spike Primary coolant iodine activities based on 60 Ci/gram of D.E. I-131 are presented in Table 15.6.3-5.
- 3. Gross Activity The initial primary coolant gross activities based on Technical Specification limit of 1 D.E. Ci/gm I-131 (equivalent to 0.29%
failed fuel) and are presented in Table 15.0-10.
C. Secondary system initial activity (1) Dose equivalent of 0.1 Ci/gm of I-131 and gross activity are presented in Table 15.0-10.
D. Initial Steam generator mass (each), 100, 933 concurrent to iodine spike; 9722 lbm pre-accident iodine spike E. Offsite power Lost at time of SGTR F. Primary-to-secondary leakage duration 35.75 for intact SG, hrs.
G. Species of iodine released to 97 percent elemental; 3 percent organic environment H. RCS volume (ft3) 10,000 concurrent iodine spike; 11,750 concurrent iodine spike
Revision 3306/30/20 MPS-3 FSAR 15.6-70 TABLE 15.6.3-4 STEAM GENERATOR TUBE RUPTURE ANALYSIS PARAMETERS USED IN EVALUATING RADIOLOGICAL CONSEQUENCES (CONTINUED)
II. Activity Release Data A. Ruptured steam generator
- 1. Break flow See Table 15.6.3-3
- 2. Flashed rupture flow See Table 15.6.3-3
- 3. Total steam release, lbm See Table 15.6.3-3
- 4. Iodine partition coefficient 0.01
- 5. Moisture Carryover 1 percent B. Intact steam generators
- 1. Total primary-to-secondary leakage, 1.0 gpm
- 2. Total steam release, lbm See Table 15.6.3-3
- 3. Iodine partition coefficient 0.01
- 4. Moisture Carryover 1 percent C. Atmospheric Dispersion Factors (2) See Table 15.0-11 III. Control Room Data See Table 15.6-12 NOTES:
- 1. There is no Technical Specification limit on Secondary Side gross activity, but gross activity was included for conservatism.
- 2. EAB and LPZ factors utilize the X/Qs for the ventilation vent because of near proximity to the release point. Control Room factors use the MSVB X/Qs because of near proximity to the release point.
Revision 3306/30/20 MPS-3 FSAR 15.6-71 TABLE 15.6.3-5 DELETED BY CHANGE PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-72 TABLE 15.6.3-6 STEAM GENERATOR TUBE RUPTURE ANALYSIS IODINE SPIKE APPEARANCE RATES Nuclide Appearance Rates (Curies/second)
I-131 2.03 I-132 2.63 I-133 3.76 I-134 3.17 I-135 3.16
Revision 3306/30/20 MPS-3 FSAR 15.6-73 TABLE 15.6.3-7 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-74 TABLE 15.6.3-8 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-75 TABLE 15.6.3-9 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-76 TABLE 15.6.3-10 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-77 FIGURE 15.6-1 INADVERTENT OPENING OF A PRESSURIZER SAFETY VALVE This figure shows typical DNBR transient results and should not be relied upon for an absolute value of the DNBR.
Revision 3306/30/20 MPS-3 FSAR 15.6-78 FIGURE 15.6-1 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-79 FIGURE 15.6-2 INADVERTENT OPENING OF A PRESSURIZER SAFETY VALVE
Revision 3306/30/20 MPS-3 FSAR 15.6-80 FIGURE 15.6-2 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-81 FIGURE 15.6-3 DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-82 FIGURE 15.6.3-1 PRESSURIZER LEVEL
Revision 3306/30/20 MPS-3 FSAR 15.6-83 FIGURE 15.6.3-2 REACTOR COOLANT SYSTEM PRESSURE
Revision 3306/30/20 MPS-3 FSAR 15.6-84 FIGURE 15.6.3-3 SECONDARY PRESSURE
Revision 3306/30/20 MPS-3 FSAR 15.6-85 FIGURE 15.6.3-4 RUPTURED LOOP HOT AND COLD LEG RCS TEMPERATURES
Revision 3306/30/20 MPS-3 FSAR 15.6-86 FIGURE 15.6.3-5 INTACT LOOP HOT AND COLD LEG RCS TEMPERATURES
Revision 3306/30/20 MPS-3 FSAR 15.6-87 FIGURE 15.6.3-6 PRIMARY TO SECONDARY BREAK FLOW RATE
Revision 3306/30/20 MPS-3 FSAR 15.6-88 FIGURE 15.6.3-7 DIFFERENTIAL PRESSURE BETWEEN REACTOR COOLANT SYSTEM AND RUPTURED STEAM GENERATOR
Revision 3306/30/20 MPS-3 FSAR 15.6-89 FIGURE 15.6.3-8 RUPTURED STEAM GENERATOR WATER VOLUME
Revision 3306/30/20 MPS-3 FSAR 15.6-90 FIGURE 15.6.3-9 RUPTURED STEAM GENERATOR WATER MASS
Revision 3306/30/20 MPS-3 FSAR 15.6-91 FIGURE 15.6.3-10 RUPTURED STEAM GENERATOR MASS RELEASE RATE TO THE ATMOSPHERE
Revision 3306/30/20 MPS-3 FSAR 15.6-92 FIGURE 15.6.3-11 INTACT STEAM GENERATORS MASS RELEASE RATE TO THE ATMOSPHERE
Revision 3306/30/20 MPS-3 FSAR 15.6-93 FIGURE 15.6.3-12 FLASHED BREAK FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-94 FIGURE 15.6-4 SEQUENCE OF EVENTS FOR LARGE BREAK LOCA ANALYSIS
Revision 3306/30/20 MPS-3 FSAR 15.6-95 FIGURE 15.6-5 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-96 FIGURE 15.6-6 CODE INTERFACE DESCRIPTION FOR SMALL BREAK LOCA MODEL PRESSURE CORE EXIT MASS FLOWRATE NOTRUMP MIXTURE LEVEL LOCTA CORE INLET ENTHALPY FUEL ROD POWER HISTORY
Revision 3306/30/20 MPS-3 FSAR 15.6-97 FIGURE 15.6-7 SMALL BREAK POWER SHAPE
Revision 3306/30/20 MPS-3 FSAR 15.6-98 FIGURE 15.6-8 LIMITING PCT CASE PCT AND PCT LOCATION
Revision 3306/30/20 MPS-3 FSAR 15.6-99 FIGURE 15.6-8 A DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-100 FIGURE 15.6-9 LIMITING PCT CASE VESSEL SIDE BREAK FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-101 FIGURE 15.6-10 LIMITING PCT CASE LOOP SIDE BREAK FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-102 FIGURE 15.6-11 LIMITING PCT CASE BROKEN AND INTACT LOOP VOID FRACTION
Revision 3306/30/20 MPS-3 FSAR 15.6-103 FIGURE 15.6-12 LIMITING PCT CASE HOT ASSEMBLY TOP THIRD OF CORE VAPOR FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-104 FIGURE 15.6-13 LIMITING PCT CASE PRESSURIZER PRESSURE
Revision 3306/30/20 MPS-3 FSAR 15.6-105 FIGURE 15.6-14 LIMITING PCT CASE LOWER PLENUM COLLAPSED LIQUID LEVEL
Revision 3306/30/20 MPS-3 FSAR 15.6-106 FIGURE 15.6-15 LIMITING PCT CASE VESSEL FLUID MASS
Revision 3306/30/20 MPS-3 FSAR 15.6-107 FIGURE 15.6-16 LIMITING PCT CASE LOOP 2 ACCUMULATOR FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-108 FIGURE 15.6-17 LIMITING PCT CASE LOOP 2 SAFETY INJECTION FLOW
Revision 3306/30/20 MPS-3 FSAR 15.6-109 FIGURE 15.6-18 LIMITING PCT CASE CORE AVERAGE CHANNEL COLLAPSED LIQUID LEVEL
Revision 3306/30/20 MPS-3 FSAR 15.6-110 FIGURE 15.6-19 LIMITING PCT CASE LOOP 2 DOWNCOMER COLLAPSED LIQUID LEVEL
Revision 3306/30/20 MPS-3 FSAR 15.6-111 FIGURE 15.6-20 BELOCA ANALYSIS AXIAL POWER SHAPE OPERATING SPACE ENVELOPE
Revision 3306/30/20 MPS-3 FSAR 15.6-112 FIGURE 15.6-21 LOWER BOUND CONTAINMENT PRESSURE
Revision 3306/30/20 MPS-3 FSAR 15.6-113 FIGURE 15.6-22 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-114 FIGURE 15.6-23 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-115 FIGURE 15.6-24 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-116 FIGURE 15.6-25 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-117 FIGURE 15.6-26 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-118 FIGURE 15.6-27 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-119 FIGURE 15.6-28 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-120 FIGURE 15.6-29 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-121 FIGURE 15.6-30 DELETED BY FSARCR PKG FSC 07-MP3-054
Revision 3306/30/20 MPS-3 FSAR 15.6-122 FIGURE 15.6-31 REACTOR COOLANT SYSTEM PRESSURE (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-123 FIGURE 15.6-32 CORE MIXTURE LEVEL (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-124 FIGURE 15.6-33 CLAD TEMPERATURE TRANSIENT AT PEAK TEMPERATURE ELEVATION (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-125 FIGURE 15.6-34 CORE EXIT STEAM FLOW RATE (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-126 FIGURE 15.6-35 CLAD SURFACE HEAT TRANSFER COEFFICIENT AT PEAK CLAD TEMPERATURE ELEVATION (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-127 FIGURE 15.6-36 FLUID TEMPERATURE AT PEAK CLAD TEMPERATURE ELEVATION (4 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-128 FIGURE 15.6-37 REACTOR COOLANT SYSTEM PRESSURE (1.5 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-129 FIGURE 15.6-38 REACTOR COOLANT SYSTEM PRESSURE (2 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-130 FIGURE 15.6-39 REACTOR COOLANT SYSTEM PRESSURE (3 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-131 FIGURE 15.6-40 REACTOR COOLANT SYSTEM PRESSURE (6 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-132 FIGURE 15.6-41 REACTOR COOLANT SYSTEM PRESSURE (8.75 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-133 FIGURE 15.6-42 CORE MIXTURE LEVEL (1.5 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-134 FIGURE 15.6-43 CORE MIXTURE LEVEL (2 INCH BREAK)
Revision 3306/30/20 MPS-3 FSAR 15.6-135 FIGURE 15.6-44 FIGURES 15.6-44 THROUGH 62 DELETED BY FSARCR PKG FSC 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.6-136 FIGURE 15.B-1 FIGURES DELETED BY FSARCR 02-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-1 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT Events which may result in a radioactive release from a subsystem or component are as follows:
- 1. Radioactive Gaseous Waste System Failure (Section 15.7.1)
- 2. Radioactive Liquid Waste System Leak or Failure (Atmospheric Release)
(Section 15.7.2)
- 3. Liquid Containing Tank Failure (Section 15.7.3)
- 4. Design Basis Fuel Handling Accidents (Section 15.7.4)
- 5. Spent Fuel Cask Drop Accidents (Section 15.7.5)
Items 1, 2, and 3 are classified as ANS Condition III events. Item 4 is classified as ANS Condition IV event. Item 5 is not assigned an ANS classification. Section 15.0.1 defines the ANS conditions.
15.7.1 RADIOACTIVE GASEOUS WASTE SYSTEM FAILURE This section has been moved to Section 11.3.3.
15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE (ATMOSPHERIC RELEASE)
This section has been moved to Section 11.2.3.1.
15.7.3 LIQUID CONTAINING TANK FAILURE This section has been moved to Section 11.2.3.2.
15.7.4 DESIGN BASIS FUEL HANDLING ACCIDENTS 15.7.4.1 Identification of Causes and Accident Description This accident results from the dropping of a spent fuel assembly onto another fuel assembly in the spent fuel pool, resulting in the rupture of the cladding of all the fuel rods in the dropped assembly and 19 fuel rods in the impacted assembly.
15.7.4.2 Sequence of Events and Systems Operation The method of analysis used for evaluating the potential radiological consequences of a fuel handling accident complies with Regulatory Guide 1.183, except that 67% of the damaged fuel rods do not comply with footnote 11 of Regulatory Guide 1.183. For these fuel rods, the gap activity fractions used are taken from Regulatory Guide 1.25, as modified by NUREG/CR-5009.
Revision 3306/30/20 MPS-3 FSAR 15.7-2 The atmospheric diffusion models for ground level releases, used in the fuel handling accident analysis, are based on Regulatory Guides 1.145 and 1.194, using on site meteorological data. See Table 15.7-8 for a list of assumptions used.
15.7.4.2.1 Fuel Handling Accident in the Fuel Building This accident has been re-analyzed using the methods and assumptions contained in Regulatory Guide 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified by NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of Regulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This analysis does not require re-alignment of the fuel building ventilation system, nor does it require fuel building integrity.
All fuel handling operations are conducted underwater using fuel handling equipment. The minimum water depth between the top of the irradiated fuel rods in the racks and the spent fuel pool surface is 23 feet.
A spent fuel assembly is dropped into the fuel pool onto another fuel assembly. This results in the rupture of all the rods in the dropped assembly and 19 rods in the impacted assembly. It is assumed that the gap activity from each ruptured fuel rod is released to the fuel pool. The retention of noble gases in the fuel pool water is negligible. It is assumed that the radioactive material from the fuel building is released to the environment, through the turbine building ventilation vent, over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period.
The fuel building ventilation system and its filters are not required while handling fuel in the fuel building, nor is fuel building integrity required. This allows any penetration to the fuel building (e.g., including roll-up doors) to be open during fuel movement. Suitable radiological monitoring is required per the Millstone Effluent Control Program when boundary integrity is not set to ensure releases to the environment are monitored.
15.7.4.2.2 Fuel Handling Accident in Containment This accident has been re-analyzed using the methods and assumptions contained in Regulatory Guide 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified by NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of Regulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This analysis does not require automatic isolation of purge from radiation monitor response, nor does it require containment integrity because it is assumed that containment penetrations such as the equipment hatch are open.
A fuel handling accident in containment is defined as the dropping of a spent fuel assembly onto another spent fuel assembly in the refueling cavity from the refueling machine. This results in the rupture of all rods in the dropped assembly and 19 rods in the impacted assembly. It is assumed that the gap activity from each ruptured fuel rod is released to the refuel pool. The retention of noble gases in the refuel pool water is negligible. The refuel pool water retains a large fraction of the gap activity of iodines.
Revision 3306/30/20 MPS-3 FSAR 15.7-3 Credit for the automatic closure of the purge valves is not assumed for the fuel handling accident in containment.
15.7.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool This event assumes a drop of an insert (non-spent fuel assembly) component into the spent fuel pool, assuming control room emergency ventilation system is not operable. Analysis shows that a 2.7 foot drop of a RCCA handling tool containing an Rod Cluster Control Assembly (RCCA) onto a spent fuel assembly will result in a maximum of 18 fractured rods if a Westinghouse 17x17 standard spent fuel assembly was impacted. There would e no fuel failure if the RCCA impacted a Westinghouse 17x17 RFA fuel assembly. The 17x17 standard fuel assemblies were removed from the core over 20 years ago. The radiological consequences analysis assumes that 30 rods are fractured in the event. Due to the long decay time of the 17x17 standard fuel assemblies, the radiological consequences of the failure of 30 rods is not significant.
Automatic isolation of the control room, filtered control room recirculation, filtered pressurization of the control room, and control room envelope integrity are not credited in this analysis. All other assumptions used in the fuel handling accident involving the drop of a spent fuel assembly are valid for this analysis.
15.7.4.3 Radiological Consequences The results of the analyses are listed in Table 15.0-8. The results are within the limits as defined by 10 CFR 50.67 and within the criteria identified in Regulatory Guide 1.183. The fuel gap activity is based on the halogen and noble gas inventory in the reactor core as listed in Table 15.0-7, and the assumptions in Table 15.7-8. These assumptions include decay time, number of fuel rods damaged, gap activity fractions, and peaking factor.
15.7.5 SPENT FUEL CASK DROP ACCIDENTS The upgraded spent fuel shipping cask trolley is designed with special features to the structure that will ensure that a single failure will not result in the loss of the capability of the system to safely retain the load. The upgraded shipping cask trolley is designed to meet the single failure proof requirements of NUREG-0554 and NUREG-0612. When a cask is rigged to the crane in accordance with single failure criteria, a cask drop is not credible; therefore, there will be no radiological consequences.
Revision 3306/30/20 MPS-3 FSAR 15.7-4 TABLE 15.7-1 OMITTED
Revision 3306/30/20 MPS-3 FSAR 15.7-5 TABLE 15.7-2 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-6 TABLE 15.7-3 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-7 TABLE 15.7-4 TABLE RELOCATED TO TABLE 11.2-12 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-8 TABLE 15.7-5 TABLE RELOCATED TO TABLE 11.2-11 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-9 TABLE 15.7-6 TABLE RELOCATED TO TABLE 11.2-13 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-10 TABLE 15.7-7 TABLE RELOCATED TO TABLE 11.2-14 BY FSARCR 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-11 TABLE 15.7-8 PARAMETERS FOR POSTULATED FUEL HANDLING ACCIDENT Fuel Building Containment Design Bases Design Bases Power level (MWt) 3,723 3,723 Radial peaking factor 1.7 1.7 Fuel damaged (Drop of a Fuel Assembly) 1 assembly plus 19 rods 1 assembly plus 19 rods Fuel damaged (Drop of an insert component 30 rods 30 rods on a fuel assembly) (1)
Percentage of Fuel Rods that do not comply 67% 67%
with footnote 11 of Regulatory Guide 1.183 Gap activity fractions:
For Fuel Rods that do not comply with I-131: 012 I-131: 0.12 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.30 Kr-85: 0.30 All others: 0.10 All others: 0.10 For Fuel Rods that comply with I-131: 0.08 I-131: 0.08 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.10 Kr-85: 0.10 All others: 0.05 All others: 0.05 Iodine chemical form, when released from pool (percent):
Inorganic 57 57 Organic 43 43 Time after shutdown (hours) 100 100 Fuel Building/Containment leak rate All activity is released All activity is released within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Duration of release 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> Spent fuel pool iodine decontamination 200 200 factor Release pathway Ventilation Vent (2) Ventilation Vent (2)
(unfiltered) (unfiltered)
Dose conversion factors FGR 11 and 12 FGR 11 and 12 Control Room Habitability Assumptions (3)
(consistent with Table 15.6-12 except as noted)
NOTES:
(1) A bounding analysis was performed that assumed 30 rods were fractured from a drop of an insert component. The number of standard fuel rods that would be damaged in this event was determined to be 18. Westinghouse evaluations demonstrate that fuel damage only occurs if the impacted fuel assembly is Westinghouse 17x17 standard fuel.
(2) For EAB & LPZ dose, containment-ground release X/Qs are used for conservatism.
Revision 3306/30/20 MPS-3 FSAR 15.7-12 (3) Control Room Habitability is nor credited in the analysis of the drop of an insert component in the spent fuel pool.
Revision 3306/30/20 MPS-3 FSAR 15.7-13 TABLE 15.7-9 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.7-14 TABLE 15.7-10 DELETED BY PKG FSC 07-MP3-056
Revision 3306/30/20 MPS-3 FSAR 15.7-15 TABLE 15.7-11 DELETED BY FSARCR PKG FSC 04-MP3-017
Revision 3306/30/20 MPS-3 FSAR 15.8-1 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM The worst common mode failure which is postulated to occur is the failure to scram the reactor after an anticipated transient has occurred. A series of generic studies [1 & 2] on Anticipated Transients Without Scram (ATWS) showed acceptable consequences would result provided that the turbine trips and auxiliary feedwater flow are initiated in a timely manner. A Millstone Unit 3 specific calculation at a NSSS thermal power of 3739 MWt has been performed to confirm applicability of the generic studies. The effects of ATWS events are not considered as part of the design basis for transients analyzed in Chapter 15. The final NRC ATWS rule [3] requires that Westinghouse-designed plants install ATWS Mitigation System Actuation Circuitry (AMSAC) to initiate turbine trip and actuate auxiliary feedwater flow independent of the Reactor Protection System (RPS). The Millstone Unit 3 AMSAC design is described in Section 7.8.
15.
8.1 REFERENCES
FOR SECTION 15.8 15.8-1 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
15.8-2 Anderson, T. M., ATWS Submittal, Westinghouse Letter NS-TMA-2182 to S. H. Hanauer of the NRC, December 1979.
15.8-3 ATWS Final Rule - Code of Federal Regulations 10 CFR 50.62 and Supplementary Information Package, Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.
15.8-4 NUREG-0460, Anticipated Transients Without Scram for Light Water Reactors, December 1978.
15.8-5 Anderson, T. M., Rule making on Anticipated Transients Without Scram, Westinghouse Letter NS-EPR-83-2833 to S. J. Chilk of the NRC, October 3, 1983.
Revision 3306/30/20 MPS-3 FSAR 15.A-1 APPENDIX 15A DOSE METHODOLOGY The radiological consequences of design basis accidents evaluated using the Alternate Source Term (AST) are quantified in terms of Total Effective Dose Equivalent (TEDE) at the control room, Exclusion Area Boundary (EAB) and Low Population Zone (LPZ). The dose methodology used is consistent with Regulatory Guide 1.183 and has been implemented via use of the RADTRAD computer code.
The radiological consequences of all other design-basis accidents are quantified in terms of thyroid doses and whole-body gamma doses at the exclusion area boundary (EAB), and at the low population zone (LPZ). The doses at the EAB are based upon releases of radionuclides over a period of two hours following the occurrence of an assumed accident; those at the LPZ are based upon releases over a thirty-day period following the occurrence of this accident.
Thyroid doses for these accidents are calculated based upon Equation 15A-1:
D thy = ( Ai ) ( Q ) ( B.R. ) ( Cthy ) (15A-1) i where:
Dthy = thyroid dose (rem)
Ai = activity of iodine isotope i released (curies)
/Q = atmospheric dispersion factor (sec/meter3)
B.R. = breathing rate (meter3/sec) and Cthy = thyroid dose conversion factor (rem/ci) (Reg. Guide 1.109, 1977)
The /Q values presented in Table 15.0-11 were calculated using the methodology described in FSAR Section 2.3.4.
Iodine nuclide contribution to the external whole body gamma dose for the nonrevised accidents is calculated using Equation 15A-2 (derived from equations in Regulatory Guide 1.4, 1974):
D = 0.25 A i E i ( Q ) (15A-2) i where:
D = gamma dose from a semi-infinite cloud (rem)
Ei = average gamma energy per disintegration of isotope i (MeV/dis)
Ai = activity of isotope i released over the given time interval (curies) and /Q = atmospheric dispersion factor (sec/m3)
Revision 3306/30/20 MPS-3 FSAR 15.A-2 As an alternate method, the thyroid doses and the whole body doses may be calculated by similar equations. However, the dose conversion factors from ICRP30 are used to calculate the thyroid dose. Dose factors from Table B-1, Regulatory Guide 1.109 Revision 1 or FGR 12 or ICRP 30 are used to calculate potential gamma whole body. The equation from Regulatory Guide 1.109 is as follows:
4 D = 3.17X10 ( Q i ) ( X Q ) DF i
(15A-3) i where:
D = gamma whole body dose (mrem)
Qi = release rate of radionuclide i (Ci/year)
X/Q = atmospheric dispersion factor (sec/meter3)
DFi = gamma whole body dose factor for a uniform semi-infinite cloud of radionuclide i mrem-m3/pCi-year The constant 3.17 x 104 is in units of pCi-year/Ci-sec.
The following is a list of computer programs which are used to calculate design-basis source terms and radiological consequences of the nonrevised design basis accidents in FSAR Chapter 15:
- 1. ACTIVITY 2 Program ACTIVITY 2 calculates the concentration of fission products in the fuel, coolant, waste gas decay tanks, ion exchangers, miscellaneous tanks, and release lines to the atmosphere for a PWR system. The program uses a library of properties of more than 100 significant fission products and may be modified to include as many as 200 isotopes. The output of ACTIVITY 2 presents the isotopic activity and energy spectrum at the selected part of the system for a given operating time.
- 2. RADIOISOTOPE Program RADIOISOTOPE calculates the activity of isotopes in a closed system by solving the appropriate decay equations. Based on the activity of any isotope in the system at an initial time, the program calculates the activity of that isotope and its offspring at any later time, provided that the decay scheme is contained in the program library. Furthermore, because gamma activity is important for dose rate
Revision 3306/30/20 MPS-3 FSAR 15.A-3 and shielding calculations, RADIOISOTOPE also calculates the energy releases in seven gamma energy groups from the decay of an inventory or radionuclides.
- 3. IONEXCHANGER Program IONEXCHANGER computes the buildup of isotopic activity in the resin bed of a demineralizer for constant feed flow rate and constant feed activity conditions. This program also calculates the energy releases in seven energy groups of gamma radiation accompanying decay for each of these isotopes, considering up to two parents of an isotope. A library of more than 100 isotopes is provided, and, when desired, has the ability to handle 200 different isotopes.
- 4. REM 123 REM 123 is a computer program developed to calculate the beta, gamma, and thyroid doses at the EAB and LPZ boundary. This calculation is based on the xenon releases, krypton releases, iodine releases, and X/Q values for a specified period of time. REM 123 makes use of built-in constants such as average gamma energies, thyroid dose conversion factors, and appropriate breathing rates; it performs its dose calculations in accordance with Regulatory Guides 1.3 and 1.4.
- 5. DRAGON 4 Program DRAGON 4 evaluates the activities, dose rates, and time-integrated dose in the reactor building and control room of a nuclear facility or at an adjacent site following release of halogens and noble gases from some control volume. The fission product release to the atmosphere, together with the activities and time-integrated activity concentrations of the halogens which are accumulated in the system, are also computed. Site dose calculations performed by DRAGON 4 employ the semi-infinite cloud models suggested by Regulatory Guides 1.3 and 1.4; the gamma dose in the control room is computed based upon a finite cloud model. Average gamma energies are used in all dose calculations.
- 6. QADMOD Program QADMOD calculates dose rates at specified detector locations for a number of different source points representing volumetric sources. The calculational technique employed by this program is commonly referred to as the point kernel technique. QADMOD is a modified version of the QAD P-5 program written at Los Alamos Scientific Laboratory by R.E. Malenfant. This modification includes a) the FASTER geometry routines, b) a point source option, c) a translated cylindrical source volume option, and d) an internal data library
Revision 3306/30/20 MPS-3 FSAR 15.A-4 which contains flux-to-dose conversion factors, buildup factor coefficients, and mass attenuation coefficients for several materials and compositions.
For the revised Millstone 3 dose calculations, the dose methodology incorporated Regulatory Guide 1.183 methods. The revised Millstone 3 dose calculations used the following computer codes to calculate the TEDE doses.
- 7. RADTRAD The RADionuclide, Transport, Removal, and Dose (RADTRAD) model estimates doses at offsite locations: the exclusion area boundary (EAB) or the low population zone (LPZ), and in the control room. The code has two optional source terms to describe fission product release from the reactor coolant system: those specified in: Calculation of Distance Factors for Power and Test Reactor Sites (TID-14844) along with Regulatory Guides 1.3 and 1.4; and those specified for boiling water reactors (BWRs) and pressurized water reactors (PWRs) in Accident Source Terms for Light Water Nuclear Power Plants (NUREG-1465).
As radioactive material is transported through the containment, the user can account for sprays and natural deposition that may reduce the quantity of radioactive material. Material can flow between buildings, from buildings to the environment, or into control rooms through high-efficiency particulate air (HEPA) filters, piping, or other connectors. An accounting of the amount of radioactive material retained due to these tortuous pathways is maintained. Decay and in-growth of daughters can be calculated over time as the material is transported. The code contains over 25 model and table options to perform these tasks. Dose Conversion Factors used in RADTRAD are from Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion and Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water and Soil. The RADTRAD code was originally developed by the Accident Analysis and Consequence Assessment Department at Sandia National Laboratories (SNL) for the U. S. Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation (NRR), Division of Reactor Program Management.
- 8. ORIGEN-ARP The ORIGEN-ARP code is a neutron depletion and decay code that is used to generate the reactor core inventory. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
- 9. ARCON96 ARCON96 was developed to calculate relative concentrations in plumes from nuclear power plants at control room air intakes in the vicinity of the release point.
ARCON96 implements a straight line Gaussian dispersion model with dispersion coefficients that are modified to account for low wind meander and building wake
Revision 3306/30/20 MPS-3 FSAR 15.A-5 effects. Hourly, normalized concentrations (X/Q) are calculated from hourly meteorological data. The hourly values are averaged to form X/Qs for periods ranging from 2 to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> in duration. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
15.A.1 REFERENCES FOR APPENDIX 15A 15.A-1 Regulatory Guide 1.109, Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
15.A-2 Regulatory Guide 1.4, Assumption Used for Evaluating the Potential Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
15.A-3 Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion, (FGR 11), 1988.
15.A-4 Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water, and Soil, (FGR 12), 1993.
15.A-5 International Commission on Radiological Protection Report No. 30, Limits of Intakes of Radionuclides by Workers, (ICRP 30), 1980.
Revision 3306/30/20 MPS-3 FSAR 15.B-1 APPENDIX 15B DELETED BY FSARCR 02-MP3-017