ML21201A171
Text
Millstone Power Station Unit 3 Safety Analysis Report Chapter 15: Accident Analyses
Table of Contents tion Title Page INTRODUCTION .................................................................................... 15.0-1
.1 Classification of Plant Conditions ............................................................ 15.0-1
.1.1 Condition I - Normal Operation and Operational Transients ................... 15.0-2
.1.2 Condition II - Faults of Moderate Frequency ........................................... 15.0-3
.1.3 Condition III - Infrequent Faults............................................................... 15.0-4
.1.4 Condition IV - Limiting Faults ................................................................. 15.0-5
.2 Optimization of Control Systems ............................................................. 15.0-6
.3 Plant Characteristics and Initial Conditions Assumed in the Accident Analyses .................................................................................... 15.0-6
.3.1 Design Plant Conditions ........................................................................... 15.0-6
.3.2 Initial Conditions ...................................................................................... 15.0-6
.3.3 Power Distribution .................................................................................... 15.0-7
.4 Reactivity Coefficients Assumed in the Accident Analyses .................... 15.0-8
.5 Rod Cluster Control Assembly Insertion Characteristics ......................... 15.0-8
.6 Trip Points and Time Delays to Trip Assumed in Accident Analyses ..... 15.0-9
.7 Plant Systems and Components Available for Mitigation of Accident Effects...................................................................................... 15.0-10
.8 Fission Product Inventories .................................................................... 15.0-10
.8.1 Inventory in the Core .............................................................................. 15.0-10
.8.2 Inventory in the Fuel Clad Gap............................................................... 15.0-11
.8.3 Reactor Coolant Activity ........................................................................ 15.0-11
.9 Residual Decay Heat............................................................................... 15.0-11
.9.1 Total Residual Heat ................................................................................ 15.0-11
.9.2 Decay Heat Modeling for Small Break Loss-of-Coolant Accident ........ 15.0-11
.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident .................................................................................................. 15.0-11
.10 Computer Codes Utilized........................................................................ 15.0-12
.10.1 FACTRAN.............................................................................................. 15.0-12
.10.2 LOFTRAN .............................................................................................. 15.0-12
.10.3 Casmo5 ................................................................................................... 15.0-13
tion Title Page
.10.4 Simulate5 ................................................................................................ 15.0-13
.10.5 TWINKLE .............................................................................................. 15.0-13
.10.6 VIPRE ..................................................................................................... 15.0-13
.10.7 RETRAN ................................................................................................ 15.0-14
.11 References for Section 15.0 .................................................................... 15.0-14 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.1-1
.1 Feedwater System Malfunctions that Result in a Decrease in Feedwater Tem-perature ..................................................................................................... 15.1-1
.1.1 Identification of Causes and Accident Description .................................. 15.1-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.1-2
.1.3 Conclusions............................................................................................... 15.1-3
.1.4 Radiological Consequences ...................................................................... 15.1-3
.2 Feedwater System Malfunctions that Result in an Increase in Feedwater Flow......................................................................................... 15.1-3
.2.1 Identification of Causes and Accident Description .................................. 15.1-3
.2.2 Analysis of Effects and Consequences ..................................................... 15.1-3
.2.3 Conclusions............................................................................................... 15.1-6
.2.4 Radiological Consequences ...................................................................... 15.1-6
.3 Excessive Increase In Secondary Steam Flow.......................................... 15.1-6
.3.1 Identification of Causes and Accident Description .................................. 15.1-6
.3.2 Analysis of Effects and Consequences ..................................................... 15.1-7
.3.3 Results and Conclusions ........................................................................... 15.1-7
.3.4 Radiological Consequences ...................................................................... 15.1-7
.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a De-pressurization of the Main Steam System................................................. 15.1-7
.4.1 Identification of Causes and Accident Description .................................. 15.1-7
.4.2 Analysis of Effects and Consequences ..................................................... 15.1-9
.4.3 Radiological Consequences ...................................................................... 15.1-9
.5 Steam System Piping Failure .................................................................... 15.1-9
.5.1 Identification of Causes and Accident Description .................................. 15.1-9
tion Title Page
.5.2 Analysis of Effects and Consequences ................................................... 15.1-11
.5.3 Conclusions............................................................................................. 15.1-15
.5.4 Radiological Consequences .................................................................... 15.1-15
.6 References for Section 15.1 .................................................................... 15.1-16 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.2-1
.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow ............................................................................................... 15.2-1
.2 Loss of External Electrical Load .............................................................. 15.2-1
.2.1 Identification of Causes and Accident Description .................................. 15.2-1
.2.2 Analysis of Effects and Consequences ..................................................... 15.2-3
.2.3 Conclusions............................................................................................... 15.2-3
.2.4 Radiological Consequences ...................................................................... 15.2-3
.3 Turbine Trip .............................................................................................. 15.2-4
.3.1 Identification of Causes and Accident Description .................................. 15.2-4
.3.2 Analysis of Effects and Consequences ..................................................... 15.2-5
.3.3 Conclusions............................................................................................... 15.2-7
.3.4 Radiological Consequences ...................................................................... 15.2-8
.4 Inadvertent Closure of Main Steam Isolation Valves ............................... 15.2-8
.5 Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip 15.2-8
.6 Loss of Nonemergency AC Power to the Station Auxiliaries .................. 15.2-8
.6.1 Identification of Causes and Accident Description .................................. 15.2-8
.6.2 Analysis of Effects and Consequences ................................................... 15.2-10
.6.3 Conclusions............................................................................................. 15.2-11
.6.4 Radiological Consequences .................................................................... 15.2-11
.7 Loss of Normal Feedwater Flow ............................................................ 15.2-12
.7.1 Identification of Causes and Accident Description ................................ 15.2-12
.7.2 Analysis of Effects and Consequences ................................................... 15.2-13
.7.3 Conclusions............................................................................................. 15.2-15
.7.4 Radiological Consequences .................................................................... 15.2-15
tion Title Page
.8 Feedwater System Pipe Break ................................................................ 15.2-16
.8.1 Identification of Causes and Accident Description ................................ 15.2-16
.8.2 Analysis of Effects and Consequences ................................................... 15.2-17
.8.3 Conclusions............................................................................................. 15.2-21
.8.4 Radiological Consequences .................................................................... 15.2-21
.9 References for Section 15.2 .................................................................... 15.2-21 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ........................................................................................................ 15.3-1
.1 Partial Loss of Forced Reactor Coolant Flow........................................... 15.3-1
.1.1 Identification of Causes and Accident Description .................................. 15.3-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.3-2
.1.3 Conclusions............................................................................................... 15.3-3
.1.4 Radiological Consequences ...................................................................... 15.3-3
.2 Complete Loss of Forced Reactor Coolant Flow...................................... 15.3-3
.2.1 Identification of Causes and Accident Description .................................. 15.3-3
.2.2 Analysis of Effects and Consequences ..................................................... 15.3-4
.2.3 Underfrequency ........................................................................................ 15.3-5
.2.4 Conclusions............................................................................................... 15.3-5
.2.5 Radiological Consequences ...................................................................... 15.3-5
.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor).............................. 15.3-6
.3.1 Identification of Causes and Accident Description .................................. 15.3-6
.3.2 Analysis of Effects and Consequences ..................................................... 15.3-6
.3.3 Conclusions............................................................................................... 15.3-9
.3.4 Radiological Consequences ...................................................................... 15.3-9
.4 Reactor Coolant Pump Shaft Break ........................................................ 15.3-10
.4.1 Identification of Causes and Accident Description ................................ 15.3-10
.4.2 Conclusions............................................................................................. 15.3-10
.5 References for Section 15.3 .................................................................... 15.3-10
tion Title Page REACTIVITY AND POWER DISTRIBUTION ANOMALIES ............ 15.4-1
.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcrit-ical or Low Power Startup Condition ....................................................... 15.4-1
.1.1 Identification of Causes and Accident Description .................................. 15.4-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.4-3
.1.3 Conclusions............................................................................................... 15.4-5
.1.4 Radiological Consequences ...................................................................... 15.4-5
.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power .................................................................................................... 15.4-5
.2.1 Identification of Causes and Accident Description .................................. 15.4-5
.2.2 Analysis of Effects and Consequences ..................................................... 15.4-7
.2.3 Conclusions............................................................................................. 15.4-10
.2.4 Radiological Consequences .................................................................... 15.4-10
.3 Rod Cluster Control Assembly Misalignment........................................ 15.4-10
.3.1 Identification of Causes and Accident Description ................................ 15.4-10
.3.2 Analysis of Effects and Consequences ................................................... 15.4-12
.3.3 Conclusions............................................................................................. 15.4-16
.3.4 Radiological Consequences .................................................................... 15.4-16
.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature and Boron Concentration................................................... 15.4-17
.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate................................................ 15.4-17
.6 Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant................................ 15.4-17
.6.1 Identification of Causes and Accident Description ................................ 15.4-17
.6.2 Analysis of Effects and Consequences ................................................... 15.4-20
.6.3 Conclusions............................................................................................. 15.4-25
.6.4 Radiological Consequences .................................................................... 15.4-25
.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position ................................................................................... 15.4-25
.7.1 Identification of Causes and Accident Description ................................ 15.4-25
.7.2 Analysis of Effects and Consequences ................................................... 15.4-26
tion Title Page
.7.3 Conclusions............................................................................................. 15.4-27
.7.4 Radiological Consequences .................................................................... 15.4-27
.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents ........... 15.4-27
.8.1 Identification of Causes and Accident Description ................................ 15.4-27
.8.1.1 Design Precautions and Protection ......................................................... 15.4-27
.8.1.2 Limiting Criteria ..................................................................................... 15.4-30
.8.2 Analysis of Effects and Consequences ................................................... 15.4-31
.8.2.1 Calculation of Basic Parameters ............................................................. 15.4-32
.8.3 Conclusions............................................................................................. 15.4-36
.8.4 Radiological Consequences .................................................................... 15.4-37
.9 References for Section 15.4 .................................................................... 15.4-38 INCREASE IN REACTOR COOLANT INVENTORY.......................... 15.5-1
.1 Inadvertent Operation of the Emergency Core Cooling System During Power Operation .................................................................................................. 15.5-1
.1.1 Identification of Causes and Accident Description .................................. 15.5-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.5-2
.1.3 Conclusions............................................................................................... 15.5-5
.1.4 Radiological Consequences ...................................................................... 15.5-6
.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory ..................................................................................... 15.5-6
.2.1 Identification of Causes and Accident Description .................................. 15.5-6
.2.2 Analysis of Effects and Consequences ..................................................... 15.5-7
.2.3 Results....................................................................................................... 15.5-8
.2.4 Conclusions............................................................................................... 15.5-9
.3 A Number of BWR Transients ................................................................. 15.5-9
.4 References for Section 15.5 ...................................................................... 15.5-9 DECREASE IN REACTOR COOLANT INVENTORY ........................ 15.6-1
.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve................... 15.6-1
.1.1 Identification of Causes and Accident Description .................................. 15.6-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.6-2
tion Title Page
.1.3 Conclusions............................................................................................... 15.6-3
.1.4 Radiological Consequences ...................................................................... 15.6-3
.2 Failure of Small Lines Carrying Primary Coolant Outside Containment. 15.6-3
.3 Steam Generator Tube Failure .................................................................. 15.6-4
.3.1 Identification of Causes and Accident Description .................................. 15.6-5
.3.2 Analysis of Effects and Consequences ..................................................... 15.6-8
.3.2.1 Margin to Steam Generator Overfill ......................................................... 15.6-8
.3.2.2 Radiological Consequences ...................................................................... 15.6-9
.3.2.2.1 Thermal and Hydraulic Analysis .............................................................. 15.6-9
.3.2.2.2 Radiation Dose Analysis......................................................................... 15.6-14 6.4 Spectrum of BWR Steam System Piping Failures Outside of Containment (Not Applicable to Millstone 3).............................................................. 15.6-17
.5 Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.......................... 15.6-17
.5.1 Identification of Causes and Frequency Classification........................... 15.6-17
.5.2 Best Estimate Large Break Loss of Coolant Analysis (BE-LBLOCA).. 15.6-18
.5.2.1 General.................................................................................................... 15.6-18
.5.2.2 Method of Analysis................................................................................. 15.6-20
.5.2.3 Analysis Assumptions............................................................................. 15.6-22
.5.2.4 Design Basis Accident ............................................................................ 15.6-22
.5.2.5 Post Analysis of Record Evaluations...................................................... 15.6-24
.5.2.6 Conclusions............................................................................................. 15.6-25
.5.3 Small Break LOCA................................................................................. 15.6-26
.5.3.1 Description of Small Break LOCA Transient......................................... 15.6-26
.5.3.2 Small Break LOCA Evaluation Model ................................................... 15.6-27
.5.3.3 Input Parameters and Initial Conditions ................................................. 15.6-28
.5.3.4 Small Break Results................................................................................ 15.6-28
.5.4 Radiological Consequences .................................................................... 15.6-29
.5.5 Conclusions............................................................................................. 15.6-32
.6 BWR Transients...................................................................................... 15.6-32
.7 References for Section 15.6 .................................................................... 15.6-32
tion Title Page RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT.......................................................................................... 15.7-1
.1 Radioactive Gaseous Waste System Failure............................................. 15.7-1
.2 Radioactive Liquid Waste System Leak or Failure (Atmospheric Release).............................................................................. 15.7-1
.3 Liquid Containing Tank Failure ............................................................... 15.7-1
.4 Design Basis Fuel Handling Accidents .................................................... 15.7-1
.4.1 Identification of Causes and Accident Description .................................. 15.7-1
.4.2 Sequence of Events and Systems Operation............................................. 15.7-1
.4.2.1 Fuel Handling Accident in the Fuel Building ........................................... 15.7-2
.4.2.2 Fuel Handling Accident in Containment .................................................. 15.7-2
.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool ........................................................... 15.7-3
.4.3 Radiological Consequences ...................................................................... 15.7-3
.5 Spent Fuel Cask Drop Accidents .............................................................. 15.7-3 ANTICIPATED TRANSIENTS WITHOUT SCRAM ............................ 15.8-1
.1 References for Section 15.8 ...................................................................... 15.8-1 endix 15A Dose Methodology............................................................................. 15.A-1 A.1 References for Appendix 15A ................................................................. 15.A-5 endix 15B Deleted by FSARCR 02-MP3-017 .....................................................15.B-1
List of Tables mber Title
-1 Nuclear Steam Supply System Power Ratings
-2 Summary of Initial Conditions and Computer Codes Used
-3 Nominal Values of Pertinent Plant Parameters Utilized in the Accident Analysis
-4 Trip Point and Time Delays to Trip Assumed in Accident Analyses
-5 Deleted by PKG FSC 07-MP3-049
-6 Plant Systems and Equipment Required for the Mitigation of Transient and Accident Conditions
-7 Fission Product Inventory in Reactor Core
-8 Potential Dose Due to Accidents
-9 Typical Power-Temperature Distribution for Full Core
-10 Technical Specification Coolant Concentrations
-11 Atmospheric Dispersion Data Used for Design Basis Accident Analysis
-12 Reactor Coolant Iodine Concentrations Assuming Pre-Accident Iodine Spike
-13 Iodine Release Rates into Reactor Coolant Due to Concurrent Iodine Spike
-1 Time Sequence of Events for Incidents Which Cause an Increase in Heat Removal by the Secondary System
-2 Equipment Required Following a Rupture of a Main Steam Line
-3 Assumptions Used in Main Steam Line Break Analysis
-4 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Time Sequence for Events for Incidents Which Cause a Decrease in Heat Removal by the Secondary System
-2 Natural Circulation Flow
-1 Time Sequence of Events for Incidents Which Result in a Decrease in Reactor Coolant System Flow
-2 Summary of Results for Locked Rotor Transients
-3 Assumptions Used in Locked Rotor Analysis
-1 Time Sequence of Events for Incidents Which Cause Reactivity and Power Distribution Anomalies
mber Title
-2 deleted by fsarcr ucr-m3-2019-003
-3 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident
-4 Parameters Used in Rod Ejection Accident Analysis
-5 Integrated Break Flow (lbm) in Containment
-6 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Time Sequence of Events - inadvertent operation of eccs
-2 Time Sequence of Events - CVCS Malfunction that Increases Reactor Coolant Inventory
-1 Time Sequence of Events for Inadvertent Opening of a Pressurizer Safety Valve
-2 Assumptions Used in Analysis of Failure of Small Lines Carrying Primary Coolant Outside Containment
-3 Plant Operating Range Allowed by the Best Estimate Large Break LOCA Analysis
-4 Large Break LOCA Containment Data Used for Calculation of Containment Pressure
-5 Analysis of Record Best Estimate Large Break LOCA Results
-6 Total Minimum Injected Safety Injection Flow Used in Best Estimate large Break LOCA Analysis
-7 Large Break LOCA Containment Data Used for Calculation of Containment Pressure
-8 Peak Clad Temperature including All Penalties and benefits, Best Estimate large Break LOCA (BE LBLOCA)
-9 Assumptions Used for the Radiological Consequences of a LOCA Analysis
-10 Deleted by FSARCR PKG FSC 04-MP3-017
-11 Deleted by Change PKG FSC 07-MP3-054
-12 Assumptions Used for the Control Room Habitability Analysis
-13 Deleted by FSARCR PKG FSC 04-MP3-017 6-14 Time Sequence of Events for Incidents Which Cause a Decrease in Reactor Coolant Inventory (Small Break)
-15 Input Parameters Used in the ECCS Analysis (small Break)
mber Title
-16 Small Break LOCA Results Fuel Cladding Data
-17 Small Break LOCA Safety Injection Flow Rate for 1.5 inch to 6 inch Breaks
-18 Small Break LOCA Safety Injection Flow Rate for 8.75 inch Break Before Switchover
-19 Omitted
-20 Omitted
-21 DELETED BY FSARCR 03-MP3-022
-22 DELETED BY FSARCR 03-MP3-022
.3-1 Operator Action Times for Design Basis Steam Generator Tube Rupture Analysis
.3-2 Steam Generator Tube Rupture Analysis Sequence of Events
.3-3 Steam Generator Tube R Mass Releases Total Mass Flow (Pounds)
.3-4 Steam Generator Tube Rupture Analysis Parameters Used in Evaluating Radiological Consequences
.3-5 Deleted by Change PKG FSC 07-MP3-054
.3-6 Steam Generator Tube Rupture Analysis Iodine Spike Appearance Rates
.3-7 Deleted by FSARCR PKG FSC 04-MP3-017
.3-8 Deleted by FSARCR PKG FSC 04-MP3-017
.3-9 Deleted by FSARCR PKG FSC 04-MP3-017
.3-10 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Omitted
-2 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017
-3 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017
-4 Table Relocated to Table 11.2-12 by FSARCR 04-MP3-017
-5 Table Relocated to Table 11.2-11 by FSARCR 04-MP3-017
-6 Table Relocated to Table 11.2-13 by FSARCR 04-MP3-017
-7 Table Relocated to Table 11.2-14 by FSARCR 04-MP3-017
-8 Parameters for Postulated Fuel Handling Accident
-9 Deleted by FSARCR PKG FSC 04-MP3-017
mber Title
-10 Deleted by PKG FSC 07-MP3-056
-11 Deleted by FSARCR PKG FSC 04-MP3-017
List of Figures mber Title
-1 Illustration of Overtemperature and Overpower T Protection
-1 A Deleted by FSARCR PKG FSC 02-MP3-017
-2 Doppler Power Coefficient Used in Accident Analysis
-3 RCCA Position Versus Time to Dashpot
-4 Normalized Rod Worth Versus Percent Inserted
-5 Normalized RCCA Bank Reactivity Worth Versus Drop Time
-6 Deleted by FSARCR PKG FSC 07-MP3-049
-7 Abbreviations
-8 Excessive Heat Removal Due to Feedwater Systems Malfunction
-9 Excessive Load Increase
-10 Depressurization of Main Steam System
-11 Loss of External Load/Turbine Trip
-12 Loss of Offsite Power to Station Auxiliaries
-13 Loss of Normal Feedwater
-14 Major Rupture of a Main Feedwater Line
-15 Loss of Forced Reactor Coolant Flow
-16 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal
-17 Dropped Rod Cluster Control Assembly
-18 Single Rod Cluster Control Assembly Withdrawal at Full Power 0-19 Not Used 0-20 Not Used
-21 Rupture of Control Rod Drive Mechanism Housing (Rod Ejection)
-22 Inadvertent ECCS Operation at Power 0-23 Accidental Depressurization of Reactor Coolant System
-24 Steam Generator Tube Rupture
-25 Loss of Coolant Accident
List of Figures (Continued) mber Title
-26 CVCS Letdown Line Rupture 0-27 GWPS Gas Decay Tank Rupture
-28 Floor Drain Tank Failure
-29 Fuel Handling Accident in Fuel Building
-30 Fuel Handling Accident Inside Containment
-31 Spent Fuel Cask Drop Accident
-1 Feedwater Control Valve Malfunction
-1 A Deleted by FSARCR PKG FSC 02-MP3-017
-2 Feedwater Control Valve Malfunction
-2 A Deleted by FSARCR PKG FSC 02-MP3-017
-3 Deleted by FSARCR PKG FSC 07-MP3-050
-4 Deleted by FSARCR PKG FSC 07-MP3-050
-5 Deleted by FSARCR PKG FSC 07-MP3-050
-6 Deleted by FSARCR PKG FSC 07-MP3-050
-7 Deleted by FSARCR PKG FSC 07-MP3-050
-8 Deleted by FSARCR PKG FSC 07-MP3-050
-9 Deleted by FSARCR PKG FSC 07-MP3-050
-10 Deleted by FSARCR PKG FSC 07-MP3-050
-11 Typical(1)Keffective Versus Temperature
-12 Deleted by FSARCR PKG FSC 07-MP3-050
-12 A Deleted by FSARCR PKG FSC 02-MP3-017
-13 Deleted by FSARCR PKG FSC 07-MP3-050
-13 A Deleted by FSARCR PKG FSC 02-MP3-017
-14 TYPICAL(1)Doppler Power Feedback
-15 1.4 SQ. FT. Steamline Rupture Offsite Power Available
-15 A 1.4 SQ. FT STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-16 1.4 SQ. FT. Steamline Rupture Offsite Power Available
List of Figures (Continued) mber Title
-16 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-17 1.4 SQ. FT. Steamline Rupture Offsite Power Available
-17 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-1 Turbine Trip - RCS Overpressurization Case
-1A Deleted by FSARCR 02-MP3-017
-2 Turbine Trip - RCS Overpressurization Case
-2A Deleted by FSARCR 02-MP3-017
-3 Turbine Trip-DNBR Case
-3A Deleted by FSARCR 02-MP3-017
-4 Turbine Trip-DNBR Case
-4A Deleted by FSARCR 02-MP3-017
-5 Turbine Trip-MSS Over pressurization Case
-5A Deleted by FSARCR 02-MP3-017
-6 Turbine Trip-MSS Over pressurization Case
-6A Deleted by FSARCR 02-MP3-017
-7 Deleted by FSARCR PKG FSC 07-MP3-051
-7A Deleted by FSARCR 02-MP3-017
-8 Deleted by FSARCR PKG FSC 07-MP3-051
-8A Deleted by FSARCR 02-MP3-017
-9 Loss of Normal Feedwater with Offsite Power Available
-9A Loss of Normal Feedwater without Offsite Power Available
-10 Loss of Normal Feedwater with Offsite Power Available
-10A Loss of Normal Feedwater without Offsite Power Available
-11 Loss of Normal Feedwater with Offsite Power Available
-11A Loss of Normal Feedwater without Offsite Power Available
-12 Loss of Normal Feedwater with Offsite Power Available
List of Figures (Continued) mber Title
-12A Loss of Normal Feedwater without Offsite Power Available
-13 Main Feedline Rupture with Offsite Power Available
-13A Deleted by FSARCR 02-MP3-017
-14 Main Feedline Rupture with Offsite Power Available
-14A Deleted by FSARCR 02-MP3-017
-15 Main Feedline Rupture with Offsite Power Available
-15A Deleted by FSARCR 02-MP3-017
-16 Main Feedline Rupture with Offsite Power Available
-16A Deleted by FSARCR 02-MP3-017
-17 Main Feedline Rupture with Offsite Power Available
-17A Deleted by FSARCR 02-MP3-017
-18 Main Feedline Rupture with Offsite Power Available
-18A Deleted by FSARCR 02-MP3-017
-19 Main Feedline Rupture without Offsite Power Available
-19A Deleted by FSARCR 02-MP3-017
-20 Main Feedline Rupture without Offsite Power Available
-20A Deleted by FSARCR 02-MP3-017
-21 Main Feedline Rupture without Offsite Power Available
-21A Deleted by FSARCR 02-MP3-017
-22 Main Feedline Rupture without Offsite Power Available
-22A Deleted by FSARCR 02-MP3-017
-23 Main Feedline Rupture without Offsite Power Available
-23A Deleted by FSARCR 02-MP3-017
-24 Main Feedline Rupture without Offsite Power Available
-24A Deleted by FSARCR 02-MP3-017
-1 Flow Transients, One Pump Coasting Down
-2 Nuclear Power and Pressurizer Pressure Transients, One Pump Coasting Down
-3 Average and Hot Channel Heat Flux Transient, One Pump Coasting Down
List of Figures (Continued) mber Title
-4 DNBR Versus Time, One Pump Coasting Down
-5 Core Flow Coastdown, Four Pumps Coasting Down
-6 Nuclear Power & Pressurizer Pressure Transients, Four Pumps Coasting Down
-7 Average & Hot Channel Transients, Four Pumps Coasting Down
-8 DNBR versus Time, Four Pumps Coasting Down
-9 Flow Transients, One Locked Rotor
-9 A Deleted by FSARCR 02-MP3-017
-10 RCS Pressure, One Locked Rotor
-10 A Deleted by FSARCR 02-MP3-017
-11 Nuclear Power, Average and Core Average Heat Flux Transients, One Locked Rotor
-11 A Deleted by FSARCR 02-MP3-017
-12 Maximum Clad Temperature at Hot Spot, One Locked Rotor
-12 A Deleted by FSARCR 02-MP3-017
-13 Core Flow Transient, Four Pumps Experiencing Frequency Decay
-14 Nuclear Power and Pressurizer Pressure Transients, Four Pumps Experiencing Frequency Decay
-15 Average and Hot Channel Heat Flux Transients, Four Pumps Experiencing Frequency Decay
-16 DNBR versus Time, Four Pumps Experiencing Frequency Decay
-1 Neutron and Thermal Flux Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition
-2 Omitted
-3 Fuel and Clad Temperature Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition
-4 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
-4 A Deleted by FSARCR 02-MP3-017
-5 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
List of Figures (Continued) mber Title
-5 A Deleted by FSARCR 02-MP3-017
-6 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
-6 A Deleted by FSARCR 02-MP3-017
-7 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-7 A Deleted by FSARCR 02-MP3-017
-8 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-8 A Deleted by FSARCR 02-MP3-017
-9 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-9 A Deleted by FSARCR 02-MP3-017
-10 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 100%
-10 A Deleted by FSARCR 02-MP3-017 4-11 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 60% RTP
-11 A Deleted by FSARCR 02-MP3-017 4-12 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 10% RTP
-13 Dropped Rod Cluster Control Assembly, Manual Control
-14 Dropped Rod Cluster Control Assembly, Manual Control 4-15 Not Used 4-16 Not Used 4-17 Not Used 4-18 Not Used 4-19 Not Used 4-20 Not Used
-21 Interchange Between Region 1 and Region 3 Assembly
-22 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly
List of Figures (Continued) mber Title
-23 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 1 Assembly
-24 Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position
-25 Loading a Region 2 Assembly into a Region 1 Position Near Core Periphery
-26 Nuclear Power Transient BOL HFP RCCA Ejection
-26 A Deleted by FSARCR 02-MP3-017
-27 Hot Spot Fuel and Clad Temperature versus Time - BOL HFP RCCA Ejection
-27 A Deleted by FSARCR 02-MP3-017
-28 Nuclear Power Transient EOL HZP RCCA Ejection (Two RCPs Running)
-29 Hot Spot Fuel and Clad Temperature versus Time - EOL HZP RCCA Ejection (Two RCPs Running)
-30 Reactor Coolant System Integrated Break Flow Following a Rod Ejection Accident
-1 CVCS Malfunction that increases Reactor Coolant Inventory, Nuclear Power and Vessel Average Temperature versus Time 5-2 CVCS Malfunction that increases Reactor Coolant Inventory, Pressurizer Pressure and Pressurizer Water Volume versus Time
-3 CVCS malfunction that increases reactor coolant inventory, nuclear power and vessel average temperature versus time
-4 cvcs malfunction that increases reactor coolant inventory, pressurizer pressure and pressurizer water volume versus time
-1 Inadvertent Opening of a Pressurizer Safety Valve
-1 A Deleted by FSARCR 02-MP3-017
-2 Inadvertent Opening of a Pressurizer Safety Valve
-2 A Deleted by FSARCR 02-MP3-017
-3 Deleted by FSARCR 02-MP3-017
.3-1 Pressurizer Level
.3-2 Reactor Coolant System Pressure
.3-3 Secondary Pressure
.3-4 Ruptured Loop Hot and Cold Leg RCS Temperatures
.3-5 Intact Loop Hot and Cold Leg RCS Temperatures
List of Figures (Continued) mber Title
.3-6 Primary to Secondary Break Flow Rate
.3-7 Differential Pressure Between Reactor Coolant System and Ruptured Steam Generator
.3-8 Ruptured Steam Generator Water Volume
.3-9 Ruptured Steam Generator Water Mass
.3-10 Ruptured Steam Generator Mass Release Rate to the Atmosphere
.3-11 Intact Steam Generators Mass Release Rate to the Atmosphere
.3-12 Flashed Break Flow
-4 Sequence of Events for Large Break LOCA Analysis
-5 Deleted by FSARCR PKG FSC 07-MP3-054
-6 Code Interface Description for Small Break LOCA Model
-7 Small Break Power Shape
-8 Limiting PCT Case PCT and PCT Location
-8 A Deleted by FSARCR PKG FSC 07-MP3-054
-9 Limiting PCT Case Vessel Side Break Flow
-10 Limiting PCT Case Loop Side Break Flow
-11 Limiting PCT Case Broken and Intact Loop Void Fraction
-12 Limiting PCT Case Hot Assembly Top Third of Core Vapor Flow
-13 Limiting PCT Case Pressurizer Pressure
-14 Limiting PCT Case Lower Plenum Collapsed Liquid Level
-15 Limiting PCT Case Vessel Fluid Mass
-16 Limiting PCT Case Loop 2 Accumulator Flow
-17 Limiting PCT Case Loop 2 Safety Injection Flow
-18 Limiting PCT Case Core Average Channel Collapsed Liquid Level
-19 Limiting PCT Case Loop 2 Downcomer Collapsed Liquid Level
-20 BELOCA Analysis Axial Power Shape Operating Space Envelope
-21 Lower Bound Containment Pressure
-22 Deleted by FSARCR PKG FSC 07-MP3-054
List of Figures (Continued) mber Title
-23 Deleted by FSARCR PKG FSC 07-MP3-054
-24 Deleted by FSARCR PKG FSC 07-MP3-054
-25 Deleted by FSARCR PKG FSC 07-MP3-054
-26 Deleted by FSARCR PKG FSC 07-MP3-054
-27 Deleted by FSARCR PKG FSC 07-MP3-054
-28 Deleted by FSARCR PKG FSC 07-MP3-054
-29 Deleted by FSARCR PKG FSC 07-MP3-054
-30 Deleted by FSARCR PKG FSC 07-MP3-054
-31 Reactor Coolant System Pressure (4 inch Break)
-32 Core Mixture Level (4 inch Break)
-33 Clad Temperature Transient at Peak Temperature Elevation (4 inch Break)
-34 Core Exit Steam Flow Rate (4 inch Break)
-35 Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation (4 inch Break)
-36 Fluid Temperature at Peak Clad Temperature Elevation (4 inch Break)
-37 Reactor Coolant System Pressure (1.5 inch Break)
-38 Reactor Coolant System Pressure (2 inch Break)
-39 Reactor Coolant System Pressure (3 inch Break)
-40 Reactor Coolant System Pressure (6 inch Break)
-41 Reactor Coolant System Pressure (8.75 inch Break)
-42 Core Mixture Level (1.5 inch Break)
-43 Core Mixture Level (2 inch Break)
-44 Figures 15.6-44 through 62 Deleted by FSARCR PKG FSC 02-MP3-017 B-1 Figures Deleted by FSARCR 02-MP3-017
INTRODUCTION s chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 egulatory Guide 1.70, Revision 3, as they apply to Millstone 3.
tain items in the guide warrant comment, as follows:
Items 1.3 and 2.1 - There are no pressure regulators in the nuclear steam supply system (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.
Item 6.2 - No instrument lines from the reactor coolant system boundary in the NSSS PWR design penetrate the containment. (For the definition of the reactor coolant system boundary, refer to ANSI-N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, Section 5, 1973.)
Items 7.1 (radioactive gas waste system leak or failure), 7.2 (radioactive liquid waste system leak or failure) and 7.3 (postulated radioactive releases due to liquid tank failures) from Table 15-1 of Regulatory Guide 1.70 have been transferred to Chapter 11.
0.1 CLASSIFICATION OF PLANT CONDITIONS ce 1970, the American Nuclear Society (ANS) classification of plant conditions has been used ch divides plant conditions into four categories in accordance with anticipated frequency of urrence and potential radiological consequences to the public. The four categories are as ows:
- 1. Condition I: Normal Operation and Operational Transients
- 2. Condition II: Faults of Moderate Frequency
- 3. Condition III: Infrequent Faults
- 4. Condition IV: Limiting Faults basic principle applied in relating design requirements to each of the conditions is that the t probable occurrences should yield the least radiological risk to the public, and those extreme ations having the potential for the greatest risk to the public shall be those least likely to occur.
ere applicable, reactor trip system and engineered safeguards functioning is assumed to the nt allowed by considerations such as the single failure criterion, in fulfilling this principle.
reby, only Seismic Category I, Class IE and IEEE qualified equipment, instrumentation, and ponents, are used in the ultimate mitigation of the consequences of faulted conditions ndition II, III, and IV events).
e diagrams.
tulated accidents with respective potential offsite rem doses are shown in Table 15.0-8.
.1.1 Condition I - Normal Operation and Operational Transients dition I occurrences are those which are expected frequently or regularly in the course of er operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I urrences are accommodated with margin between any plant parameter and the value of that meter which would require either automatic or manual protective action. Inasmuch as dition I occurrences occur frequently or regularly, they must be considered from the point of w of affecting the consequences of fault conditions (Conditions II, III, and IV). In this regard, lysis of each fault condition described is generally based on a conservative set of initial ditions corresponding to adverse conditions which can occur during Condition I operation.
pical list of Condition I events is listed below:
- 1. Steady state and shutdown operations
- a. Power operation (>5 to 100 percent of rated thermal power)
- b. Startup (K 0.99, 5 percent of rated thermal power)
- c. Hot standby (subcritical, residual heat removal system isolated)
- d. Hot shutdown (subcritical, residual heat removal system in operation)
- e. Refueling
- 2. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes. These include:
- a. Operation with components or systems out of service
- b. Leakage from fuel with clad defects
- c. Radioactivity in the reactor coolant
- 1. Fission products
- 2. Corrosion products
- d. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications
- e. Testing as allowed by the Technical Specifications
- 3. Operational transients
- a. Plant heatup and cooldown (up to 100°F/hour for the reactor coolant system; 200°F/hour for the pressurizer during cooldown and 100°F/hour for the pressurizer during heatup)
- b. Step load changes (+/-10 percent)
- c. Ramp load changes (up to 5 percent/minute)
- d. Load rejection up to and including design full load rejection transient
.1.2 Condition II - Faults of Moderate Frequency se faults, at worst, result in the reactor trip with the plant being capable of returning to ration. By definition (ANSI N18.2), these faults (or events) do not propagate to cause a more ous fault, i.e. Condition III or IV events. In addition, Condition II events are not expected to lt in fuel rod failures or reactor coolant system or secondary system overpressurization.
the purposes of this report, the following faults are included in this category:
- 1. Feedwater System Malfunctions that Result in a Decrease in Feedwater Temperature (Section 15.1.1)
- 3. Excessive Increase In Secondary Steam Flow (Section 15.1.3)
- 4. Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a Depressurization of the Main Steam System (Section 15.1.4)
- 5. Loss of External Electrical Load (Section 15.2.2)
- 6. Turbine Trip (Section 15.2.3)
- 7. Inadvertent Closure of Main Steam Isolation Valves (Section 15.2.4)
- 9. Loss of Nonemergency AC Power to the Station Auxiliaries (Section 15.2.6)
- 10. Loss of Normal Feedwater Flow (Section 15.2.7)
- 11. Partial Loss of Forced Reactor Coolant Flow (Section 15.3.1)
- 12. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition (Section 15.4.1)
- 13. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power (Section 15.4.2)
- 14. Rod Cluster Control Assembly Misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full or part length assembly) (Section 15.4.3)
- 15. Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant (Section 15.4.6)
- 16. Inadvertent Operation of the Emergency Core Cooling System During Power Operation (Section 15.5.1)
- 17. Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory (Section 15.5.2)
- 18. Inadvertent Opening of a Pressurizer Safety or Relief Valve (Section 15.6.1)
- 19. Failure of Small Lines Carrying Primary Coolant Outside Containment (Section 15.6.2) 0.1.3 Condition III - Infrequent Faults definition, Condition III events are faults which may occur very infrequently during the life of plant. They will be accommodated with the failure of only a small fraction of the fuel rods ough sufficient fuel damage might occur to preclude resumption of the operation for a siderable outage time. The release of radioactivity will not be sufficient to interrupt or restrict lic use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, erate a Condition IV fault or result in a consequential loss of function of the reactor coolant em or containment barriers. For the purposes of this report, the following faults are included his category and are shown on Figures 15.0 15.0-31:
- 1. Steam System Piping Failure (minor) (Section 15.1.5)
- 3. Rod Cluster Control Assembly Misalignment (single rod cluster control assembly withdrawal at full power) (Section 15.4.3)
- 4. Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (Section 15.4.7)
- 5. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (Section 15.6.5)
- 6. Radioactive Gas Waste System Leak or Failure (Section 11.3.3)
- 7. Radioactive Liquid Waste System Leak or Failure (Section 11.2.3)
- 8. Postulated Radioactive Releases Due to Liquid Tank Failures (Section 11.2.3)
- 9. Spent Fuel Cask Drop Accidents (Section 15.7.5)
.1.4 Condition IV - Limiting Faults dition IV events are faults which are not expected to take place, but are postulated because r consequences would include the potential of the release of significant amounts of radioactive erial. They are the most drastic which must be designed against and represent limiting design
- s. Condition IV faults are not to cause a fission product release to the environment resulting in ndue risk to public health and safety in excess of guideline values of 10 CFR 50.67. A single dition IV fault is not to cause a consequential loss of required functions of systems needed to e with the fault including those of the emergency core cooling system and the containment.
the purposes of this report, the following faults have been classified in this category:
- 1. Steam System Piping Failure (major) (Section 15.1.5)
- 2. Feedwater System Pipe Break (Section 15.2.8)
- 3. Reactor Coolant Pump Shaft Seizure (Locked Rotor) (Section 15.3.3)
- 4. Reactor Coolant Pump Shaft Break (Section 15.3.4)
- 5. Spectrum of Rod Cluster Control Assembly Ejection Accidents (Section 15.4.8)
- 6. Steam Generator Tube Failure (Section 15.6.3)
- 7. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (large break)
(Section 15.6.5)
.2 OPTIMIZATION OF CONTROL SYSTEMS ontrol system setpoint study (refer to Section 7.7.2) was performed in order to simulate ormance of the reactor control and protection systems. In this study, emphasis was placed on development of a control system which automatically maintains prescribed conditions in the t even under a conservative set of reactivity parameters with respect to both system stability transient performance.
each mode of plant operation, a group of optimum controller setpoints is determined. In areas re the resultant setpoints are different, compromises based on the optimum overall ormance are made and verified. A consistent set of control system parameters is derived sfying plant operational requirements throughout the core life and for various levels of power ration.
study comprised of an analysis of the following control systems: rod cluster control assembly, m dump, steam generator level, pressurizer pressure and pressurizer level.
.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES
.3.1 Design Plant Conditions le 15.0-1 lists the principal power rating values which are assumed in analyses performed in report.
thermal power values used for each transient analyzed are given in Table 15.0-2.
values of other pertinent plant parameters utilized in the accident analyses are given in le 15.0-3. As part of the transition to Dominion Energy Methods, the DNBR analysis basis revised using the VIRE-D thermal-hydraulic code and the CHF correlations identified in tion 4.4. In Reference 15.0-17, the NRC approved the use of Dominion Energy Methods for lstone Unit 3. VIPRE-D along with the Statistical DNBR Evaluation Methodology (VEP-NE-
) has been applied to all Condition I and II statistical DNB events as well as the Loss of Flow dent (Section 15.3.4). VIPRD-D has also been used for all deterministic DNB events (e.g.,
withdrawal from subcritical in Section 15.4.1). Statepoints for applicable DNB events were lyzed with VIPRE-D at core power of 3712 MWt for full-power, statistically-treated events.
DNBR calculations were performed using the CHF correlations identified in Section 4.4, as licable. Some DNB events are bounded by other events and were not explicitly analyzed. All B events show acceptable DNB performance for the RFA-2 fuel.
0.3.2 Initial Conditions most accidents analyzed to demonstrate that the DNB design is met, statistical methods are loyed in defining the initial conditions (see Section 4.4). The other accidents obtain initial
- 1. Core power +/- 2.0 percent allowance for calorimetric error.
- 2. Average reactor coolant temperature +/- 4.0°F allowance. The calculated uncertainties for Tavg rod control include instrument allowance, rod control deadband, and cold leg streaming. The calculated values are +/- 3.0°F random, +/- 1.0 °F bias. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty (+0.1°F) as a result of an error in the Hysteresis of Weed Resistance Temperature Detectors.
- 3. Pressurizer pressure +/- 50 psi allowance. The calculated uncertainties for pressurizer pressure control include instrumentation allowance, control system overshoot and transmitter bias. The calculated values are +/- 31.8 psi random, +/- 15 psi bias.
le 15.0-2 summarizes the initial conditions and computer codes used in the accident analyses.
.3.3 Power Distribution transient response of the reactor system is dependent on the initial power distribution. The lear design of the reactor core minimizes adverse power distribution through the placement of trol rods and operating instructions. Power distribution may be characterized by the radial or (FH) and the total peaking factor (Fq). The peaking factor limits are given in the Technical cifications.
transients which may be DNB limited, the radial peaking factor is of importance. The radial king factor increases with decreasing power level due to rod insertion. This increase in FH is uded in the core limits illustrated on Figure 15.0-1. All transients that may be DNB limited assumed to begin with a FH consistent with the initial power level defined in the Technical cifications.
axial power shape used in the DNB calculation is the 1.78 chopped cosine as discussed in tion 4.4. The radial and axial power distributions described above are input to the VIPRE-D e as described in Section 4.4.
transients which may be overpower limited, the total peaking factor (Fq) is of importance. All sients that may be overpower limited are assumed to begin with plant conditions including
overpower transients which are slow with respect to the fuel rod thermal time constant, for mple the chemical and volume control system malfunction that results in a decrease in the on concentration in the reactor coolant incident which lasts many minutes, and the excessive ease in secondary steam flow incident which may reach equilibrium without causing a reactor
, the fuel rod thermal evaluations are performed as discussed in Section 4.4. For overpower sients which are fast with respect to the fuel rod thermal time constant, e.g., the uncontrolled cluster control assembly bank withdrawal from subcritical or low power startup and rod ter control assembly ejection incidents which result in a large power rise over a few seconds, tailed fuel heat transfer calculation must be performed. Although the fuel rod thermal time stant is a function of system conditions, fuel burnup and rod power, a typical value at inning-of-life for high power rods is approximately 5 seconds.
.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES transient response of the reactor system is dependent on reactivity feedback effects, in icular the moderator temperature coefficient and the Doppler power coefficient. These tivity coefficients and their values are discussed in detail in Chapter 4.
he analysis of certain events, conservatism requires the use of large reactivity coefficient es whereas in the analysis of other events, conservatism requires the use of small reactivity fficient values. Some analyses such as loss of reactor coolant from cracks or ruptures in the tor coolant system do not depend on reactivity feedback effects. The values used are given in le 15.0-2. Reference is made in that table to Figure 15.0-2, which shows the upper and lower nd Doppler power coefficients as a function of power, used in the transient analysis. The ification for use of conservatively large versus small reactivity coefficient values are treated n event-by-event basis. In some cases, conservative combinations of parameters are used to nd the effects of core life. For example, in a load increase transient, it is conservative to use a ll Doppler defect and a small moderator coefficient.
0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS negative reactivity insertion following a reactor trip is a function of the acceleration of the cluster control assemblies and the variation in rod worth as a function of rod position. With ect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry pproximately 85 percent of the rod cluster travel. The rod cluster control assembly position us time assumed in accident analyses is shown on Figure 15.0-3. The rod cluster control mbly insertion time to dashpot entry is taken as 2.7 seconds, unless otherwise noted in the ussion. The use of such a long insertion time provides the most conservative results for all dents and is intended to be applicable to all types of rod cluster control assemblies which may sed throughout plant life. Drop time testing requirements are specified in the plant Technical cifications.
ribution which is skewed to the lower region of the core can arise from an unbalanced xenon ribution. This curve is used to compute the negative reactivity insertion versus time following actor trip which is input to all point kinetics core models used in transient analyses. The om skewed power distribution itself is not an input into the point kinetics core model.
re is inherent conservatism in the use of Figure 15.0-4 in that it is based on skewed flux ribution which would exist relatively infrequently. For cases other than those associated with alanced xenon distributions, significant negative reactivity would have been inserted due to more favorable axial distribution existing prior to trip.
normalized rod cluster control assembly negative reactivity insertion versus time is shown on ure 15.0-5. The curve shown on this figure was obtained from Figures 15.0-3 and 15.0-4. A l negative reactivity insertion of 4 percent following a trip is assumed in the transient analyses ept where specifically noted otherwise. This assumption is conservative with respect to the ulated trip reactivity worth available as shown in Table 4.3-3. For Figures 15.0-3 and 15.0-4, rod cluster control assembly drop time is normalized to 2.7 seconds, unless otherwise noted a particular event, in order to provide a bounding analysis for all rod cluster control assemblies e used in the Millstone 3 cores, as previously stated.
.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES actor trip signal acts to open two trip breakers connected in series feeding power to the trol rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms elease the rod cluster control assemblies which then fall by gravity into the core. There are ous instrumentation delays associated with each trip function, including delays in signal ation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total y to trip is defined as the time delay from the time that trip conditions are reached to the time rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the e delay assumed for each trip function are given in Table 15.0-4.
overtemperature and overpower trip functions referred to in Table 15.0-4 are graphically strated in Figure 15.0-1. This figure presents the allowable reactor coolant loops average perature and T for the flow and power distribution, as described in Section 4.4, as a function rimary coolant pressure. The boundaries of operation defined by the overpower T trip and overtemperature T trip are represented as protection lines on this diagram. The protection s are drawn to include all adverse instrumentation and set point errors so that, under nominal ditions, trip would occur well within the area bounded by these lines. The utility of this ram is that the limit imposed by any given DNBR can be represented as a line. The DNB lines esent the locus of conditions for which DNBR equals the limit value. All points below and to left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram ws that DNB is prevented for all cases if the area enclosed with the maximum protection lines ot traversed by the applicable DNBR line at any point.
pressure (fixed set point); and overpower and overtemperature T (variable set points).
limit value, which was used as the DNBR limit for all accidents, is conservative compared to actual design DNBR value required to meet the DNB design basis as discussed in Section 4.4.
difference between the limiting trip point assumed for the analysis and the nominal trip point esents an allowance for instrumentation channel error and setpoint error. Nominal trip oints are specified in the plant Technical Specifications. During plant startup tests, it was onstrated that actual instrument time delays are equal to or less than the assumed values.
itionally, protection system channels are calibrated and instrument response times determined odically in accordance with the plant Technical Specifications.
.7 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS NSSS is designed to afford proper protection against the possible effects of natural nomena, postulated environmental conditions and dynamic effects of the postulated accidents.
ddition, the design incorporates features which minimize the probability and effects of fires explosions. Chapter 17 discusses the quality assurance program which has been implemented ssure that the NSSS satisfactorily performs its assigned safety functions. The incorporation of e features in the NSSS, coupled with the reliability of the design, ensures that the normally rating systems and components listed in Table 15.0-6 are available for mitigation of the events ussed in Chapter 15. In determining which systems are necessary to mitigate the effects of e postulated events, the classification system of ANSI-N18.2-1973 is utilized. The design of stems important to safety (including protection systems) is consistent with IEEE Standard
-1972 and Regulatory Guide 1.53 in the application of the single failure criterion.
he analysis of the Chapter 15 events, control system action is considered only if that action lts in more severe accident results. No credit is taken for control system operation if that ration mitigates the results of an accident. For some accidents, the analysis is performed both h and without control system operation to determine the worst case.
0.8 FISSION PRODUCT INVENTORIES 0.8.1 Inventory in the Core fission product inventory in the reactor core is consistent with the requirements of Regulatory de 1.183. The computer code ORIGEN-ARP was used to generate the inventory assuming a power level of 3723 MWt. Core activities are shown in Table 15.0-7.
fission product inventory in the fuel clad gap is based on the release fraction requirements for CA and non-LOCA design basis accidents as described in Tables 2 and 3 of Regulatory Guide 3.
.8.3 Reactor Coolant Activity ctor coolant activity is based upon the uprated power level of 3723 MWt (102% of rated er level of 3650 MWt), an 18-month fuel cycle and other conservative assumptions. Iodine vity is based on the Technical Specification limit of 1 Ci/gm DEQ I-131. Nobel gas activity ased on the Technical Specification limit of 81.2 Ci/gm DEQ Xe-133. This level of activity esents 0.29% failed fuel. Gross gamma activity, which includes non-iodine isotopes luding noble gases and other fission products), reflects these limits and 0.29% failed fuel.
se activities are listed in Table 15.0-10.
.9 RESIDUAL DECAY HEAT
.9.1 Total Residual Heat idual heat in a subcritical core is calculated for the small break loss-of-coolant accident per the uirements of Appendix K of 10 CFR 50.46 (10 CFR 50.46 and Appendix K of 10 CFR 50), as cribed in WCAP-10054, 1985. These requirements include assuming infinite irradiation time ore the core goes subcritical to determine fission product decay energy. For all other accidents, ss noted otherwise, the same models are used except that fission product decay energy is ed on core average exposure at the end of the equilibrium cycle.
0.9.2 Decay Heat Modeling for Small Break Loss-of-Coolant Accident ing a loss-of-coolant accident the core is rapidly shut down by void formation or rod cluster trol assembly insertion, or both, and a large fraction of the heat generation to be considered es from fission product decay gamma rays. This heat is not distributed in the same manner as dy state fission power. Local peaking effects which are important for the neutron dependent of the heat generation do not apply to the gamma ray contribution. The steady state factor of percent which represents the fraction of heat generated within the clad and pellet drops to 95 ent for the hot rod in a loss-of-coolant accident.
0.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident decay heat model within Westinghouse COBRA/TRAC is described in detail in Section 8 of AP-16009-P-A. The model has been benchmarked against the ANSI/ANS 5.1-1979 Standard.
tinghouse COBRA/TRAC solves for the composite decay heat of the reactor using the fission fractions derived from specific physics calculations for the fuel lattice design. The decay heat deling for the LBLOCA methodology has been approved for use in WCAP-16009-P-A.
maries of some of the principal computer codes used in transient analyses are given below.
er codes, in particular very specialized codes in which the modeling has been developed to ulate one given accident, such as those used in the analysis of the reactor coolant system pipe ure (Section 15.6), are summarized in their respective accident analyses sections. The codes d in the analyses of each transient have been listed in Table 15.0-2.
.10.1 FACTRAN FACTRAN computer program calculates the transient temperature distribution in a cross ion of a metal clad, UO2 fuel rod and the transient heat flux at the surface of the clad using as ut the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, density). The code uses a fuel model which exhibits the following features simultaneously:
- 1. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents
- 2. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation
- 3. The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, Zircaloy-water reaction and partial melting of the materials CTRAN is further discussed in WCAP-7908-A.
.10.2 LOFTRAN LOFTRAN program is used for studies of transient response of a PWR system to specified urbations in process parameters. LOFTRAN simulates a multi-loop system by a model taining reactor vessel, hot and cold leg piping, steam generator (tube and shell sides) and the surizer. The pressurizer heaters, spray, relief and safety valves are also considered in the gram. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron and s are included.
secondary side of the steam generator utilizes a homogeneous, saturated mixture for the mal transients and a water level correlation for indication and control. The reactor protection em is simulated to include reactor trips on high neutron flux, overtemperature T, overpower high and low pressure, low flow, and high pressurizer level. Control systems are also ulated including rod control, steam dump, feedwater control and pressurizer pressure control.
emergency core cooling system, including the accumulators, is also modeled.
FTRAN is a versatile program which is suited to both accident evaluation and control studies ell as parameter sizing.
FTRAN is further discussed in WCAP-7907-P-A and WCAP-7907-A.
.10.3 Casmo5 mo5 is a multigroup two-dimensional transport theory code for burnup calculations on PWR mblies or simple pin cells. The code handles a geometry consisting of cylindrical fuel rods of ying composition in a square pitch array with allowance for absorber-loaded fuel rods, Integral l Burnable Absorber (IFBA), burnable absorber rods, cluster control rods, in-core instrument nnels, and water gaps. See Section 4.3.3 for more details.
.10.4 Simulate5 ulate5 is a multi-group analytical nodal code for the steady-state analysis of both PWRs and Rs, capable of two dimensional and three dimensional calculations. Simulate5 is emplyed as reference core physics model for all safety analysis calculations, power distributions, peaking ors, critical boron concentrations, control rod worths and reactivity coefficients. It has the ability of calculating discrete pin powers from the nodal information as well. See Section 4.3.3 more details.
.10.5 TWINKLE TWINKLE program is a multidimensional spatial neutron kinetics code, which was patterned r steady codes presently used for reactor core design. The code uses an implicit finite-erence method to solve the two-group transient neutron diffusion equations in one, two and e dimensions. The code uses six delayed neutron groups and contains a detailed multiregion
-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback cts. The code handles up to 8,000 spatial points, and performs its own steady state alization. Aside from basic cross section data and thermal-hydraulic parameters, the code epts as input basic driving functions such as inlet temperature, pressure, flow, boron centration, control rod motion, and others. Various edits are provided, e.g., channelwise er, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.
TWINKLE Code is used to predict the kinetic behavior of a reactor for transients which se a major perturbation in the spatial neutron flux distribution.
INKLE is further described in WCAP-7979-P-A and WCAP-8028-A.
.10.6 VIPRE VIPRE computer program performs thermal-hydraulic calculations. This code calculates lant density, mass velocity, enthalpy, void fractions, static pressure and DNBR distributions g flow channels within a reactor core.
TRAN is used for studies of transient response of a PWR system to specified perturbations in cess parameters. This code simulates a multi-loop system by a lumped parameter model taining the reactor vessel, hot-leg and cold-leg piping, RCPs, steam generators (tube and shell s), main steam lines, and the pressurizer. The pressurizer heaters, spray, relief valves, and ty valves can also be modeled. RETRAN includes a point neutron kinetics model and tivity effects of the moderator, fuel, boron, and control rods. The secondary side of the steam erator uses either a detailed nodalization (WCAP-14882-P-A) or a single node VEP-FRD A) for the thermal transients. The RTS simulated in the code includes reactor trips on high tron flux, high neutron flux rate, OTT, OPT, low reactor coolant flow, low reactor coolant p speed, high-pressurizer and low-pressurizer pressure, high pressurizer level, and low-low m generator water level. Control systems are also simulated including rod control and surizer pressure control. Parts of the safety injection system, including the accumulators, are modeled.
0.11 REFERENCES FOR SECTION 15.0
-1 Belle, J. 1961. Uranium Dioxide Properties and Nuclear Applications. Naval Reactors, Division of Reactor Development United States Atomic Energy Commission.
-2 Booth, A.H. 1957. A Suggested Method for Calculating the Diffusion of Radioactive Rate Gas Fission Products from UO Fuel Elements. DCI-27.
-3 10 CFR 50.46 and Appendix K of 10 CFR 50. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors. Federal Register, Volume 39, Number 3, 1974.
-4 DiNunno, J.J. et al., 1962. Calculation of Distance Factors for Power and Test Reactor Sites. TID-14844.
-5 Meek, M.E. and Rider, B.F. 1968. Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum of 14 Mev Neutron Energies.
APED-5398.
-6 Stone & Webster Engineering Corporation Topical Report RP-8A. Radiation Shielding Design and Analysis Approach for Light Water Reactor Power Plants.
-7 Toner, D.F. and Scott, J.S. 1961. Fission - Product Release from UO2. Nuclear Safety 3, No. 2, 15-20
-8 WCAP-3269-26, 1963. Barry, R.F. LEOPARD - A Spectrum Dependent Nonspatial Depletion Code for the IBM-7094.
-9 WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R.F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
Transients in a UO2 Fuel Rod.
-11 WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), 1984, Burnett, T.W.T., et al., LOFTRAN Code Description.
-12 WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.H., Jr. and Barry, R.F. TWINKLE - A Multidimensional Neutron Kinetics Computer Code.
-13 WCAP-10054-P-A (Proprietary) 1985. Lee, N. et al., Westinghouse Small Break ECCS Evaluation Model using NOTRUMP Code.
-14 WCAP-16009-P-A (Proprietary) and WCAP-16009-NP-A (Nonproprietary), 2005.
Nissley, M. E., Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM).
-15 WCAP-14565-P-A (Proprietary) and WCAP-15306-NP-A (Nonproprietary), 1999.
Sung Y. X. et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
-16 WCAP-14882-P-A (Proprietary) and WCAP-15234-NP-A (Nonproprietary), 1999.
Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
-17 Letter from R. V. Guzman (USNRC) to D. A. Heacock (Dominion), Millstone Power Station, Unit NO. 3 - Issuance of Amendment Adopting Dominion Core Design and Safety Analysis Methods and Addressing the Issues Identified in Three Westinghouse Communication Documents (CAC NO. MF6251), July 28, 2016. Dominion Serial No.16-317, ADAMS Accession No. ML16131A728.
-18 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
-19 VEP-FRD-41-P-A, Revision 0, Minor Revision 3 (Proprietary) and VEP-FRD-41-A, Revision 0, Minor Revision 3 (Nonproprietary), 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
(MWt)
SS thermal power output (0 MWt Pump Heat) 3650 SS thermal power output (0 MWt Pump Heat) 3723 a SS thermal power output (16 b MWt nominal Pump Heat) 3666 SS thermal power output (16 (b) MWt nominal Pump Heat) 3739 (a)
- a. Includes 2.0% power uncertainty
- b. Four loop pump heat
Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (
Computer Temperature Moderator Density Power Outpu Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MW Increase in heat removal 15.1 by the secondary system Feedwater system 0.50 (Full Power); lower (c) malfunctions that result in RETRAN, Function of moderator (Full Power); see
- Section 15.1.2 and 0 & 3,666 an increase in feedwater VIPRE density (Section 15.1.2, flow Figure 15.1-11) for HZP Figure 15.1-14 for HZP Excessive increase in See N/A See Section 15.1.3 See Section 15.1.3 3,666 secondary steam flow Section 15.1.3 Inadvertent opening of a Results bounded steam generator relief or by steam system - N/A safety valve piping failure Function of moderator Refer to Steam system piping RETRAN,
- density (Section 15.1.5, Section 15.1.5, 0 (Subcritica failure VIPRE-D Figure 15.1-11) Figure 15.1-14
Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (
Computer Temperature Moderator Density Power Outpu Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MW Decrease in heat removal 15.2 by the secondary system 3,712 (core),
Loss of external electrical RETRAN, (c) 0.0 lower 3,739 (pressure load and/or turbine trip VIPRE-D case)
Results bounded Loss of non-emergency by loss of AC power to the station - N/A normal auxiliaries feedwater Loss of normal feedwater RETRAN 0.0 0.45 upper (c) 3,739 (b) flow Feedwater system pipe RETRAN 0.0 0.45 upper and lower(c) 3,739 (b) break Decrease in reactor 15.3 coolant system flow rate Partial and complete loss RETRAN, 3,666 of forced reactor coolant 0.0 upper (c)
VIPRE-D 3,712 flow Reactor coolant pump shaft seizure (locked RETRAN, 0.0 upper (c) 3,739 rotor) pressure, VIPRE temperature transient
Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (
Computer Temperature Moderator Density Power Outpu Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MW Reactor coolant pump RETRAN, 3,666 shaft seizure (locked 0.0 upper (c)
VIPRE-D 3,712 rotor)--rods in DNB Reactivity and power 15.4 distribution anomalies Uncontrolled rod cluster Least Negative control assembly bank Doppler RETRAN, withdrawal from a 5.0 - Temperature 0 VIPRE-D subcritical or lower power Coefficient -
startup condition 2.0 pcm/°F
-0.9 pcm/°F (least 5.0 (part negative) and -
Uncontrolled rod cluster power), 0.0 RETRAN, 3.2 pcm/°F (most 387.2, 2243, an control assembly bank (full power, -
VIPRE-D negative Doppler 3728 withdrawal at power -64.5 (most Temperature negative)
Coefficients Rod cluster control LOFTRAN, 3,666 assembly misalignment Simulate5 3,712 (core)
Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (
Computer Temperature Moderator Density Power Outpu Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MW Chemical and volume RETRAN control system (MODE 1) malfunction that results in 0.0 N/A -2.05 (pcm)/°F 3,712 (core) a decrease in the boron N/A concentration in the (MODES 2-6) reactor coolant Inadvertent loading and operation of a fuel LEOPARD,
- N/A N/A assembly in an improper TURTLE position Coefficient for all Refer to cases is consistent Spectrum of rod cluster TWINKLE, Section 15.4.8 with least negative control assembly ejection - 0 & 3,650 FACTRAN min., max. doppler defect accidents feedback values listed in Table 15.4-3 Increase in reactor 15.5 coolant inventory Inadvertent operation of the ECCS during power RETRAN - - 3,739 operation
Reactivity Coefficients Assumed Initial NSSS Moderator Thermal (a) (
Computer Temperature Moderator Density Power Outpu Faults Codes Utilized (pcm/°F) (k/gm/cc) Doppler Assumed (MW CVCS malfunction that results in an increase in RETRAN - - - 3,739 (b) the reactor coolant inventory.
Decrease in reactor 15.6 coolant inventory Inadvertent opening of a Figure 15.0-6 most pressurizer safety or relief RETRAN 0.0 lower (c) 3,666 negative valve Steam generator tube Figure 15.0-6 most LOFTTR2 0.0 upper (c) 3,739 failure negative Loss-of-coolant accidents resulting from the Refer to Refer to spectrum of postulated ASTRUM, Section 15.6.5, - Section 15.6.6, 3,650, 3,723 piping breaks within the NOTRUMP References References reactor coolant pressure boundary NOTES:
(a) Refer to Table 15.0-1.
(b) A maximum pump heat of 20 MWt was modeled in the cases with offsite power available.
(c) Refer to Figure 15.0-2.
UTILIZED IN THE ACCIDENT ANALYSIS uivalent Steam Generator Tube 0% 10%
gging (all loops)
SS Thermal Power (MWt) Table 15.0-2 P Vessel Average Temperature (°F) 589.5 571.5 589.5 571.5 ssurizer Pressure (psia) 2,250 2,250 2,250 2,250 tal Reactor Coolant Flow Thermal Design Flow (gpm) 363,200 363,200 363,200 363,200 Minimum Measure Flow (gpm) 379,200 379,200 379,200 379,200 sumed HFP Feedwater Temperature Maximum (°F) 445.3 445.3 445.3 445.3 Minimum (°F) 390.0 390.0 390.0 390.0 am Flow from NSSS (106 lb/hr)
At Maximum Feedwater Temperature 16.30 16.20 16.29 16.19 At Minimum Feedwater Temperature 15.12 15.03 15.10 15.02 am Pressure at SG Outlet (psia) 962 815 942 797 ximum Steam Moisture Content (%) 0.25 0.25 0.25 0.25 erage Core Heat Flux (Btu/hr-ft2) 203,099 203,099 203,099 203,099
ANALYSES Limiting Trip Point Assumed Time Delay Trip Function in Analysis (a) (Seconds) wer range high neutron flux, high setting 116.5% 0.5 wer range high neutron flux, low setting 35% 0.5 wer range high positive neutron flux rate (b) 6.5% 3.0 ertemperature T Variable; see Figure 15.0-1 7.0 (c) erpower T Variable; see Figure 15.0-1 7.0 (c) gh pressurizer pressure 2410 psig 2.0 w pressurizer pressure 1845 psig 2.0 w reactor coolant flow (from loop flow 85% loop flow 1.0 ectors) actor coolant pump underspeed 92% nominal 0.6 rbine trip Not applicable 1.5 (d) w-Low steam generator water level 0% of narrow range span 2.0 gh-high steam generator level trip of the 100% of narrow range level span 2.5 (e) dwater pumps and closure of feedwater tem valves, and turbine trip 7.0 (f) ssurizer water level high 100% of span 2.0 Tabulated values conservatively bound technical specification values with uncertainties.
Refer to Section 15.6.3 for SGTR trip point assumptions.
Credited in the analysis of Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power event (Section 15.4.2)
Total time delay from time the temperature difference in the coolant loop exceeds the trip setpoint until the RCCAs are free to fall. Delay includes the response characteristics of the RTD/thermowell/scoop configuration, electronic delays, trip breaker opening delays, and gripper opening delays.
Direct reactor trip following turbine trip not credited to meet the acceptance criteria.
From time setpoint is reached to turbine trip.
From time setpoint is reached to feedwater isolation.
TABLE 15.0-5 DELETED BY PKG FSC 07-MP3-049 TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT REQUIRED FOR THE MITIGATION OF TRANSIENT AND ACCIDENT CONDITIONS 15.1 Increase in Heat Removal by the Secondary System Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Power range high flux, High-High steam generator reactor trip caused by level-produced feedwater turbine trip on high-high isolation and turbine trip, SI Feedwater system steam generator level, initiated by low steam line Feedwater isolation valves ---
malfunctions manual, overtemperature pressure or low pressurizer T, overpower T, turbine pressure will produce trip feedwater isolation, manual Power range high flux, Pressurizer self-actuated Excessive increase in overtemperature T, N/A safety valves, steam ---
secondary steam flow overpower T, manual, low generator safety valves pressurizer pressure Low pressurizer pressure, low compensated steam line Inadvertent opening of Low pressurizer pressure, pressure, high negative Feedwater isolation valves, Auxiliary feedwat a steam generator relief manual, SIS, power range steam pressure rate, steam steam line iso valves system, ECCS or safety valve high flux trip, overpower T generator low-low water level, manual Low pressurizer pressure, SIS, low pressurizer low compensated steam line pressure, power range high pressure, high negative Steam system piping Feedwater isolation valves, Auxiliary feedwat flux trip, overpower T, steam pressure rate, hi-1 failure steam line iso valves system, ECCS steam generator low-low containment pressure, steam water level, manual generator low-low water level, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen High pressurizer pressure, Loss of external overtemperature T, Pressurizer safety valves, electrical load/turbine overpower T, steam N/A steam generator safety ---
trip generator low-low level, valves manual Loss of non-emergency Steam generator low-low Steam generator low-low Steam generator safety Auxiliary feedwat AC power to the station level, turbine trip, low RCS level, manual, loss of offsite valves system auxiliaries flow, manual power Steam generator low-low Loss of normal level, overtemperature T, Steam generator low-low Steam generator safety Auxiliary feedwat feedwater flow high pressurizer pressure, level, manual valves system manual Hi-1 containment pressure, Steam line isolation valves, Steam generator low-low steam generator low-low feedline isolation, Feedwater system pipe level, high pressurizer water level, low Auxiliary feedwat pressurizer self-actuated break pressure, overtemperature compensated steam line system, ECCS safety valves, steam T, SIS, manual pressure, low pressurizer generator safety valves pressure, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Partial loss of forced Steam generator safety Low flow, manual N/A ---
reactor coolant flow valves Complete loss of forced Low flow, RCP Steam generator safety N/A ---
reactor coolant flow underspeed, manual valves Reactor coolant pump Pressurizer safety valves, shaft seizure (locked Low flow, manual N/A steam generator safety ---
rotor) valves 15.4 Reactivity and Power Distribution Anomalies Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Power range high flux (low Uncontrolled rod cluster and high setpoints), source control assembly bank range high flux, withdrawal from a intermediate range high N/A --- ---
subcritical or low power flux, power range neutron startup condition See flux high positive flux rate, Note 1 manual Power range high flux, Power range high positive neutron flux rate, high Uncontrolled rod cluster Pressurizer safety valves, pressurizer water level control assembly bank N/A steam generator safety ---
overtemperature T, withdrawal at power valves overpower T high pressurizer pressure, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Overtemperature T, Rod cluster control overpower T, low N/A --- ---
assembly misalignment pressurizer pressure, manual Chemical and volume Source range high flux, control system power range high flux (high Low insertion limit malfunction that results and low setpoint), N/A annunciators shutdown ---
in a decrease in boron overtemperature T, margin monitors concentration in the manual reactor coolant Spectrum of rod cluster Power range high flux (high control assembly and low setpoint), high N/A --- ---
ejection accidents positive flux rate, manual 15.5 Increase in Reactor Coolant Inventory Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Pressurizer power operated Inadvertent operation of relief valves, low Manual, safety injection the ECCS during power N/A pressurizer pressure cold ---
trip operation leg injection permissive signal CVCS malfunction that results in an increase in Pressurizer power operated Manual N/A ---
the reactor coolant relief valves inventory
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Inadvertent opening of a Pressurizer low pressure, pressurizer safety or overtemperature T, N/A --- ---
relief valve manual Service water system, component cooling water system, Steam Generator Water Level Control (SGWLC), steam Emergency core Low pressurizer pressure, Low pressurizer pressure, Steam generator tube generator safety and/or cooling system, Overtemperature T, steam generator low-low failure relief valves, main steam auxiliary feedwat manual water level isolation valves, system emergency diesel generator, pressurizer power operated relief valves or pressurizer spray Loss-of-coolant Service water system, accidents resulting from Emergency core component cooling water the spectrum of Low pressurizer pressure, Hi- cooling system, Low pressurizer pressure, system, steam generator postulated piping breaks 1 & Hi-3 containment auxiliary feedwat manual safety and/or relief valves, within the reactor pressure system, containm emergency diesel coolant pressure heat removal syst generator boundary
- 1. Administrative controls have been implemented to preclude an uncontrolled rod/bank withdrawal from a subcritical condition wh plant conditions are not bounded by safety analysis assumptions.
NOTE:
N/A ESF actuation functions are not applicable for these accidents.
Nuclide Curies 139 1.70E+08 140 1.79E+08 141 9.47E+07 84 1.70E+07 141 1.64E+08 143 1.50E+08 144 1.29E+08 242 4.83E+06 244 5.56E+05 134 1.98E+07 136 6.29E+06 137 1.25E+07 138 1.69E+08 31 9.89+07 32 1.45E+08 33 2.03+E08 34 2.13E+08 35 1.89E+08 85 1.05E+06 85m 2.27E+07 87 4.14E+07 88 6.11E+07 140 1.86E+08 141 1.61E+08 142 1.52E+08 99 1.84E+08 95 1.67E+08 147 6.61E+07 239 2.04E+09
Nuclide Curies 143 1.47E+08 238 4.06E+05 239 3.30E+04 240 4.62E+04 241 1.49E+07 86 2.19E+05 88 6.47E+07 89 5.47E+07 105 1.03E+08 103 1.60E+08 105 1.11E+08 106 5.83E+07 127 8.73E+06 128m 1.35E+07 129 3.11E+07 131 5.06E+07 89 9.10E+07 90 9.05E+06 91 1.12E+08 92 1.15E+08 99m 1.64E+08 127 8.60E+06 127m 1.44E+06 129 3.03E+07 129m 6.17E+06 131 7.65E+07 131m 1.97E+07 132 1.42E+08 133 6.29E+07 133m 7.54E+07
Nuclide Curies 134 1.39E+08 133 2.03E+08 135 5.60E+07 135m 3.66E+07 138 8.46E+07 90 9.46E+06 91 1.19E+08 92 1.23E+08 93 9.40E+07 95 1.66E+08 97 1.57E+08
FSAR EAB TEDE (1) LPZ TEDE (1) Control Room Postulated Accident Section (rem) (rem) TEDE (rem)
SLB 15.1.5 Concurrent Iodine Spike 4.0E-01 2.2E-01 3.6E+00 Pre-accident Iodine Spike 9.6E-02 4.4E-02 1.6E+00 cked Rotor Accident 15.3.3 2.4E+00 4.4E-01 3.9E+00 d Ejection Accident 15.4.8 Containment 5.1E-01 2.5E-01 1.5E+00 Secondary Side 1.2E-01 1.6E-02 5.1E-02 all Line Break outside (2) 15.6.2 2.5E+00 (3) ntainment TR 15.6.3 Concurrent Iodine Spike 1.0E+00 2.0E-01 1.7E+00 Pre-accident Iodine Spike 2.2E+00 2.0E-01 3.3E+00 CA 15.6.5 5.4E+00 1.1E+00 3.4E+00 A 15.7.4 Spent Fuel Assembly 2.7E+00 1.5E-01 4.8E+00 Insert Component (4) (4) 4.3E+00 ent Fuel Cask Drop 15.7.5 (3) (3) (3) dioactive Liquid Waste 5.7E-04 (WB) (2) (3) stem Leak of Failure 11.2.3 tmospheric Release) 4.4E-01 (THY) 2.2E-01 (WB) (2) (3) seous Waste System Failure 11.3.3 0.0E+00 (THY)
TES:
(1) - except as noted (2) - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of release or less; a thirty day dose is not applicable (3) - not applicable, see listed FSAR section for details (4) - Bounded by the consequences of the FHA - Spent Fuel Assembly
Fuel Temperature Percent Volume of Core Percent of Power Within Range (°F) Within Temperature Range Temperature Range 3800 - 3600 0.005 0.01 3600 - 3400 0.03 0.08 3400 - 3200 0.15 0.33 3200 - 3000 0.46 0.96 3000 - 2800 1.10 2.16 2800 - 2600 2.23 4.11 2600 - 2400 3.64 6.31 2400 - 2200 4.93 8.18 2200 - 2000 6.03 9.67
< 2000 81.43 68.19
CONCENTRATIONS RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Kr 85m 3.20E-01 Kr 87 2.48E-01 Kr 88 6.50E-01 Xe 131m 5.66E-02 Xe 133m 2.24E-01 Xe 133 7.42E+00 Xe 135m 2.7E-01 Xe 135 1.61E+00 Xe 138 1.91E-01 Br 83 2.06E-02 Br 84 1.02E-02 4.69E-07 Cs 134 6.76E+00 7.44E-03 Cs 134m 1.38E-02 Cs 136 1.03E+00 1.11E-03 Cs 137 4.73E+00 5.34E-03 Cs 138 2.94E-01 8.67E-06 Rb 86 4.26E-02 4.60E-05 Rb 88 6.78E-01 2.00E-05 Rb 89 4.23E-02 1.68E-06 Ba 137m 4.45E+00 1.31E-04 Ba 139 2.28E-02 6.74E-06 Ba 140 1.10E-03 6.59E-07 Ce 144 1.30E-04 7.84E-08 Co 58 1.70E-02 1.06E-05 Co 60 2.10E-03 1.31E-06 Fe 55 1.70E-03 1.05E-06 Fe 59 1.10E-03 6.62E-07 La 140 3.69E-04 1.98E-07 La 142 7.13E-05 Mn 54 3.30E-04 2.02E-07 Mo 99 1.54E+00 8.83E-04
RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Mo 101 6.15E-03 2.44E-07 Nb 95 1.69E-04 9.99E-08 Np 239 1.98E-02 1.10E-05 Ru 106 5.90E-05 3.66E-08 Sr 89 8.83E-04 5.41E-07 Sr 90 5.74E-05 3.53E-08 Sr 91 3.81E-04 1.47E-07 Sr 92 2.76E-04 Tc 99m 7.99E-01 2.36E-04 Tc 101 5.99E-03 2.37E-07 Te 127m 9.08E-04 5.65E-07 Te 129 3.95E-03 Te 129m 3.87E-03 2.39E-06 Te 131 3.69E-03 Te 131m 9.77E-03 5.02E-06 Te 132 8.11E-02 4.64E-05 Te 133 2.51E-03 9.94E-08 Te 133m 5.58E-03 4.19E-07 Te 134 8.52E-03 6.04E-07 Y 91 4.18E-03 2.54E-06 Y 91m 2.27E-04 Zr 95 1.67E-04 1.03E-07 I 131 7.81E-01 8.04E-02 I 132 3.20E-01 1.44E-02 I 133 1.19E+00 1.09E-01 I 134 1.81E-01 4.19E-03 I 135 7.00E-01 5.00E-02
TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS B X/Qs (sec m-3) (1)
Ground-level release-containment 5.42 x 10-4 Ground-level release-ventilation vent 4.30 x 10-4 Elevated release Millstone Stack 1.00 x 10-4 X/Qs (sec m-3) und-level release (applies to ventilation vent and containment) 0-8 hr 2.91 x 10-5 8-24 hr 1.99 x 10-5 1-4 days 8.66 x 10-6 4-30 days 2.63 x 10-6 vated release Millstone stack 0-4 hr 2.69 x 10-5 4-8 hr 1.07 x 10-5 8-24 hr 6.72 x 10-6 1-4 days 2.46 x 10-6 4-30 days 5.83 x 10-7
Millstone 3 lstone Unit 3 Control room X/Qs (sec m-3) (see Note (2))
- a. Ground-level release-containment 0-2 hr 5.34 x 10-4 2-8 hr 3.23 x 10-4 8-24 hr 1.38 x 10-4 1-4 days 8.78 x 10-5 Millstone 3
- b. Elevated release Millstone stack (3) 0-4 hr 1.39 x 10-4 4-8 hr 3.23 x 10-5 8-24 hr 1.56 x 10-5 1-4 days 3.20 x 10-6 4-30 days 3.30 x 10-7
- c. Ground-level release-ventilation vent 0-2 hr 2.82 x 10-3 2-8 hr 1.65 x 10-3 8-24 hr 6.67 x 10-4 1-4 days 4.83 x 10-4 4-30 days 3.80 x 10-4
- d. Unit 3 MSVB (includes MSPRVs and MSSVs) 0-2 hr 1.46 x 10-3 2-8 hr 8.76 x 10-4 8-24 hr 3.42 x 10-4 1-4 days 2.71 x 10-4 4-30 days 1.96 x 10-4
- e. Unit 3 ESFB 0-2 hr 3.18 x 10-4 2-8 hr 2.26 x 10-4 8-24 hr 9.06 x 10-5 1-4 days 6.42 x 10-5 4-30 days 4.59 x 10-5
- f. Unit 3 RWST 0-2 hr 2.61 x 10-4 2-8 hr 1.59 x 10-4 Millstone 3 8-24 hr 6.45 x 10-5 1-4 days 4.83 x 10-5 4-30 days 3.63 x 10-5
- g. Unit 3 Turbine Building 0-2 hr 5.40 x 10-3 2-8 hr 3.51 x 10-3 8-24 hr 1.38 x 10-3 1-4 days 1.01 x 10-3 4-30 days 8.49 x 10-4 TES:
- 1. 0-2 hr EAB X/Qs are applied for the worst two hour EAB dose determination.
- 2. Control room X/Qs do not include occupancy factor.
- 3. Fumigation conditions assumed for 0-4 hour period.
PRE-ACCIDENT IODINE SPIKE Isotope Concentration (Ci/gram) (1)
I 131 46.8 I 132 19.2 I 133 71.2 I 134 10.9 I 135 42.0 TES:
- 1. Based on 60 Ci/gram I-131 dose equivalent.
CONCURRENT IODINE SPIKE Isotope Release Rate (Ci/sec) (1)
I 131 3.03 I 132 3.93 I 133 5.61 I 134 4.73 I 135 4.72 TE:
Equivalent to 500 times equilibrium iodine appearance rate based upon Technical Specification conditions (i.e., 1 Ci/gram I-131 dose equivalent). SGTR analysis values are listed in Table 15.6.3-6 and are 335 times equilibrium iodine appearance rates.
PROTECTION FIGURE 15.0-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
ision 3406/30/21 MPS-3 FSAR 15.0-46
TIME Deleted by FSARCR PKG FSC 07-MP3-049 BREVIATIONS USED:
WS - AUXILIARY FEEDWATER SYSTEM WS - COMPONENT COOLING WATER SYSTEM CONTAINMENT ISOLATION
- COLD LEG
- CONTAINMENT SPRAY CS - CHEMICAL AND VOLUME CONTROL SYSTEM CS - EMERGENCY CORE COOLING SYSTEM AS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM
- HOT LEG
- HIGH PRESSURE INJECTION
- LOW PRESSURE INJECTION
- REACTOR COOLANT SYSTEM REACTOR TRIP
- RECTOR TRIP SYSTEM
- STEAM GENERATOR SAFETY INJECTION
- SAFETY INJECTION SYSTEM S - SERVICE WATER SYSTEM TES:
For Trip Initiation and Safety System Actuation, multiple signals are shown but only a single signal is required. The other signals are backups.
No timing sequence is implied by position of various branches. Refer to Event Timing Sequences presented in tabular form in pertinent Accident Analysis section of Chapter 15 of the FSAR.
GRAM SYMBOLS:
- Event Title
- Branch Point for Different Plant Conditions
- Safety System
- Safety Action SF - System Required to Meet Single-Failure Criteria P - Manual Action Required During System Operation
ision 3406/30/21 MPS-3 FSAR 15.0-52
ision 3406/30/21 MPS-3 FSAR 15.0-54 ision 3406/30/21 MPS-3 FSAR 15.0-55 FIGURE 15.0-11 LOSS OF EXTERNAL LOAD/TURBINE TRIP
ision 3406/30/21 MPS-3 FSAR 15.0-56 ision 3406/30/21 MPS-3 FSAR 15.0-57 ision 3406/30/21 MPS-3 FSAR 15.0-58 ision 3406/30/21 MPS-3 FSAR 15.0-59 ision 3406/30/21 MPS-3 FSAR 15.0-60
AT FULL POWER
ision 3406/30/21 MPS-3 FSAR 15.0-65 INADVERTENT ECCS OPERATION AT POWER FULL POWER LOW PRESSURIZER PRESSURE 2/4 RTS MANUAL SIS
- S F S F REACTOR TRIP TURBINE BREAKERS TRIP S F CONTROL RODS GRAVITY INSERTION S F CONTROL ROD REACTIVITY CONTROL
- NOT CREDITED IN THE SAFETY ANALYSIS
ision 3406/30/21 MPS-3 FSAR 15.0-67 ision 3406/30/21 MPS-3 FSAR DOUBLE ENDED RUPTURE OF ONE STEAM GENERATOR TUBE MANUAL 2/4 LOW PRESSURIZER PRESSURE ESFAS 2/4 LOW PRESSURIZER (SI SIGNAL)
RTS MANUAL PRESSURE OPERATOR (CIA)
SI SIGNAL SF OT'T STEAM GENERATOR MAIN DIESEL ECCS CONTAINMENT RELIEF AND SAFETY REACTOR TRIP FEEDWATER GENERATOR INJECTION ISOLATION BREAKERS VALVES FLOW ISOLATION SWP SF SF (P)
CONTROL ROD AFWS SI TERMINATION RELIEF OF GRAVITY CONTAINMENT SECONDARY INSERTION LEAKAGE SIDE SF CONTROL PRESSURE PASSIVE (P) OPERATOR (P)**
CONTROL OF OPERATION OF AFW ON 50 RESIDUAL HEAT LEVEL REMOVAL SYSTEM FOOTOTES: 1. SEQUENCE OF EVENTS SHOWN IS FOR A CONDITION CONTROL SG LEVEL (P)
- OF NO OFFSITE POWER BEING AVAILABLE ROD INDICATION IDENTIFICATION OF COINCIDENCE WITH S.G. TUBE RUPTURE.
REACTIVITY RUPTURED STEAM CONTROL GENERATOR CORE COOLING 2. SEE TABLE 2.5-1 FOR INDICATORS AND RECORDERS AVAIL ABLE TO THE OPERATOR FOLLOWING EVENT.
MPS-3 FSAR MAIN STEAM 3. OPERATOR ACTIONS INCLUDES OPERATION OF SG ISOLATION VALVE ATMOSPHERIC BYPASS VALVES TO DUMP STEAM (RUPTURED STEAM AND REDUCE RC'S SUBCOOLING, PRESSURIZER (P) GENERATOR) RELIEF VALVE TO REDUCE RC'S PRESSURE AND SI TERMINAL TO STOP PRIMARY-TO-SECONDARY BREAK FLOW.
SG ATMOSPHERIC DUMP BYPASS VALVES (INTACT SG'S)
(P)
- ADDITIONAL IDENTIFICATION BY MAIN STEAMLINE RADIATION MONITORS OR SAMPLING S.G. SHELL SIDE FLUID REQUIRED PRESSURIZER IF NOT IDENTIFIED BY S.G. LEVEL INDICATION RELIEF VALVE (P)
- OPERATOR INITIATES OPERATION OF RESIDUAL HEAT REMOVAL SYSTEM AT APPROPRIATE REACTOR COOLANT SYSTEMS CONDITIONS ISOLATION OF RUPTURED STEAM GENERATOR 15.0-68
ision 3406/30/21 MPS-3 FSAR 15.0-69 CVCS LETDOWN LINE RUPTURE REACTOR COOLANT ACTIVITY RELEASE TO SAFEGUARDS BLDG ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE SAFEGUARDS BLDG DUCT RADIATION MONITOR OPERATOR P CLOSES LETDOWN ISOLATION VALVE AFTER RECEIPT OF THE ALARM WITHIN 30 MINUTES
GWPS GAS DECAY TANK RUPTURE RELEASE TO BUILDING ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE VENTILATION VENT RADIATION MONITOR OPERATOR P
TERMINATES PROCESS GAS INFLUENT ISOLATON TIME 2 HRS
FLOOR DRAIN TANK FAILURE (30,000 GAL)
RELEASE TO RELEASE TO GROUND BUILDING ATMOSPHERE UNFILTERED RELEASE ENTERS
- TO GROUNDWATER ATMOSPHERE
- SEE SECTION 2.4.13
FUEL HANDLING ACCIDENT IN FUEL BUILDING GASES RELEASED FROM FUEL POOL WATER SF FILTERED BY PRIMARY PLANT VENTILATION SYSTEM IODINE ADSORBER TO ATMOSPHERE RADIOLOGICAL CONTROL
FUEL HANDLING ACCIDENT INSIDE CONTAINMENT ACTIVITY RELEASED FROM REFUELING CAVITY FILTERED BY CONTAINMENT AIR CLEANUP UNITS TO ATMOSPHERE RADIOLOGICAL CONTROL
SPENT FUEL CASK DROP (FROM HT 30 FT)
NO RELEASE:
NO CASK DAMAGE
umber of events have been postulated which could result in an increase in heat removal from reactor coolant system (RCS) by the secondary system. Detailed analyses are presented for eral such events which have been identified as limiting cases.
cussions of the following RCS cooldown events are presented in this section.
- 3. Excessive increase in secondary steam flow.
- 4. Inadvertent opening of a steam generator relief or safety valve.
- 5. Steam system piping failure.
above are considered to be American Nuclear Society (ANS) Condition II events, with the eption of steam system piping failures, which are considered to be ANS Condition III (minor)
Condition IV (major) events. Section 15.0.1 contains a discussion of ANS classifications and licable acceptance criteria.
.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE
.1.1 Identification of Causes and Accident Description uctions in feedwater temperature cause an increase in core power by decreasing reactor lant temperature. Such transients are attenuated by the thermal capacity of the secondary plant of the RCS. The overpower/overtemperature protection (neutron overpower, overtemperature overpower T trips) prevents any power increase which could lead to a departure from leate boiling ratio (DNBR) less than the limit.
duction in feedwater temperature may be caused by the accidental opening of a feedwater ass valve which diverts flow around a portion of the feedwater heaters and trip of the heater n pumps as well as loss of extraction steam to the high pressure feedwater heater. For this nt, there is a sudden reduction in feedwater inlet temperature to the steam generators. At er, this increased subcooling creates a greater load demand on the RCS.
h the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS perature and thus a reactivity insertion due to the effects of the negative moderator coefficient eactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, he no-load transient is less severe than the full power case.
l corresponding to the new steam generator T.
ecrease in normal feedwater temperature is classified as an ANS Condition II event, fault of derate frequency. See Section 15.0.1 for a discussion of Condition II events.
protection available to mitigate the consequences of a decrease in feedwater temperature is same as that for an excessive steam flow increase, as discussed in Section 15.0.8 and listed in le 15.0-6.
.1.2 Analysis of Effects and Consequences hod of Analysis s transient is analyzed by computing conditions at the feedwater pump inlet following opening he heater bypass valve. These feedwater conditions are then used to recalculate a heat balance ugh the high pressure heaters. This heat balance gives the new feedwater conditions at the m generator inlet.
following assumptions are made.
- 1. Plant initial power level corresponding to guaranteed nuclear steam supply system (NSSS) thermal output.
- 2. Low pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the low pressure heaters.
- 3. Heater drain pumps trip; this increases the effect of the cold bypass flow.
- 4. Loss of extraction steam to the high pressure feedwater heater.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
ults ning of a low pressure heater bypass valve and trip of the heater drain pumps as well as loss of action steam to high pressure feedwater heater causes a reduction in feedwater temperature ch increases the thermal load on the primary system. The calculated maximum reduction in water temperature is less than 65°F, resulting in an increase in heat load on the primary em of less than 10 percent of full power. The increased thermal load, due to opening of the pressure heater bypass valve and trip of the heater drain pumps as well as loss of extraction m to the high pressure feedwater heater, would result in a transient very similar (but of uced magnitude) to that presented in Section 15.1.3 for an excessive increase in secondary m flow, which evaluates the consequences of a 10 percent step load increase. Therefore, the sient results of this analysis are not presented.
decrease in feedwater temperature transient is less severe than the increase in secondary m flow event (Section 15.1.3). Based on results presented in Section 15.1.3, the applicable eptance criteria for the decrease in feedwater temperature event have been met.
1.1.4 Radiological Consequences ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW
.2.1 Identification of Causes and Accident Description ition of excessive feedwater causes an increase in core power by decreasing reactor coolant perature. Such transients are attenuated by the thermal capacity of the secondary plant and of RCS. The overtemperature T trip, the overpower T trip, and the power range high neutron trip prevent any power increase which could lead to a DNBR less than the limit.
example of excessive feedwater flow would be a full opening of a feedwater control valve due feedwater control system malfunction or an operator error. At power, this excess flow causes eater load demand on the RCS due to increased subcooling in the steam generator. With the t at no-load conditions, the addition of an excess of feedwater may cause a decrease in RCS perature and thus a reactivity insertion due to the effects of the negative moderator coefficient eactivity.
tinuous addition of excessive feedwater is prevented by the steam generator high-high level
, which closes the feedwater valves. Feedwater isolation may also occur as a result of a safety ction signal initiated by low steam line pressure or low pressurizer pressure.
increase in normal feedwater flow is classified as an ANS Condition II event, fault of derate frequency. See Section 15.0.1 for a discussion of ANS Condition II events.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.8 and listed in Table 15.0-6.
1.2.2 Analysis of Effects and Consequences hod of Analysis excessive heat removal due to a feedwater system malfunction transient is analyzed by using detailed digital computer RETRAN code (WCAP-14882-P-A). This code simulates a tiloop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, surizer spray, steam generator, and steam generator safety valves. The code computes
ditions at the time of minimum DNBR. The results met the applicable limit as specified in tion 4.4.
system is analyzed to demonstrate plant behavior in the event that excessive feedwater ition, due to a control system malfunction or operator error which allows a feedwater control e to open fully, occurs. Six cases are analyzed as follows:
- 1. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor just critical at zero load conditions. For these two cases, a negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position is assumed. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
- 2. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor in automatic control at full power with automatic and manual rod control.
feedwater system malfunction event is analyzed with the following assumptions.
- 1. For the single loop feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction, resulting in a step increase to 234 percent of nominal feedwater flow to one steam generator.
- 2. For the multiple loop feedwater control malfunction at full power, a malfunction is assumed such that there is a step increase to 234 percent of nominal feedwater flow to all four steam generators.
- 3. For the feedwater control valve accident at zero load condition, a feedwater control valve malfunction occurs which results in an increase in flow to one steam generator to 250 percent of the nominal full load value for one steam generator.
- 4. For the multiple loop feedwater control malfunction at zero load condition, a malfunction is assumed such that there is a step increase to 250 percent of nominal feedwater flow to all four steam generators.
- 5. For the zero load condition, feedwater temperature is at a conservatively low value of 87°F.
- 6. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
isolation valves, trips the main feedwater pumps, and trips the turbine. Feedwater isolation may also occur as a result of a safety injection signal initiated by low steam line pressure or low pressurizer pressure.
ial operating conditions are assumed at values consistent with steady state operation.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
mal reactor control systems are not required to function. The reactor protection system may ction to trip the reactor due to overpower or turbine trip on high-high steam generator water l conditions. No single active failure will prevent operation of the reactor protection system.
iscussion of anticipated transients without trip (ATWT) considerations is presented in AP-8330 (1974).
ults he case of an accidental full opening of one feedwater control valve with the reactor at zero er and the above mentioned assumptions, DNB is precluded, thus assuring adequate heat sfer between the fuel clad and the reactor coolant. The hot zero power cases have been rmined to be non-limiting with respect to both DNB and peak fuel centerline temperature.
limiting full power case (multiple loop, maximum reactivity feedback coefficients, manual control) gives the largest reactivity feedback and results in the greatest power increase.
uming the reactor to be in the automatic rod control mode results in a slightly less severe sient. The rod control system is not required to function for an excessive feedwater flow nt.
nsient results (Figures 15.1-1 and 15.1-2) show the core heat flux, pressurizer pressure, Tavg DNBR, as well as the increase in nuclear power associated with the increased thermal load on reactor. The DNBR does not drop below the safety analysis limit.
ce the power level rises during the excessive feedwater flow incident, the fuel temperatures rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response to the fuel rod thermal time constant, hence the peak value does not exceed 116.5 percent of ominal value (i.e., the assumed high neutron flux trip set point). The peak fuel temperature thus remain well below the fuel melting temperature.
transient results show that DNB does not occur at any time during the excessive feedwater incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not uced. The fuel cladding temperature therefore does not rise significantly above its initial value ng the transient.
calculated sequence of events for this accident is shown in Table 15.1-1.
results of the analysis show that the DNBRs encountered for excessive feedwater addition nts are at all times above the limiting values. Therefore, the DNBR design basis as described ection 4.4 is met.
.2.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW 1.3.1 Identification of Causes and Accident Description excessive increase in secondary system steam flow (excessive load increase incident) is ned as a rapid increase in steam flow that causes a power mismatch between the reactor core er and the steam generator load demand. The reactor control system is designed to ommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the ge of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a tor trip actuated by the reactor protection system. Steam flow increases greater than 10 ent are analyzed in Sections 15.1.4 and 15.1.5.
s accident could result from either an administrative violation such as excessive loading by the rator or an equipment malfunction in the steam dump control or turbine speed control.
ing power operation, steam dump to the condenser is controlled by reactor coolant condition als, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller function does not cause steam dump; an interlock is provided which blocks the opening of the es unless a large turbine load decrease or a reactor trip has occurred.
tection against an excessive load increase accident is provided by the following reactor ection system signals:
- 1. overpower T
- 2. overtemperature T
- 3. power range high neutron flux
- 4. low pressurizer pressure.
excessive load increase incident is considered to be an ANS Condition II event, a fault of derate frequency. See Section 15.0.1 for a discussion of Condition II events.
hod of Analysis en the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an licit analysis was not performed as part of the Stretch Power Uprate Program. Instead, an luation of this event was performed. The evaluation model consists of the generation of state nts based on generic conservative data. The state points are in the form of changes in perature, pressure, power and flow that are applied to the plants initial conditions. These ditions are then compared to the core thermal limits to ensure that DNBR limit is not violated.
core thermal limits are based on a VIPRE-D analysis, using the safety limits in Section 4.4.
e points for the following cases were evaluated:
- 1. Reactor control in manual with minimum moderator reactivity feedback.
- 2. Reactor control in manual with maximum moderator reactivity feedback.
- 3. Reactor control in automatic with minimum moderator reactivity feedback.
- 4. Reactor control in automatic with maximum moderator reactivity feedback.
cases which assume automatic rod control are analyzed to ensure that the worst case is ented. The automatic function is not required.
.3.3 Results and Conclusions as been demonstrated that for a 10 percent step load increase, the DNBR remains above the ty analysis limit; the design basis for DNBR as described in Section 4.4 is met. The plant hes a stabilized condition rapidly following the load increase.
1.3.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE CAUSING A DEPRESSURIZATION OF THE MAIN STEAM SYSTEM
.4.1 Identification of Causes and Accident Description most severe core conditions resulting from an accidental depressurization of the main steam em are associated with an inadvertent opening, with failure to close, of the largest of any le steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main m line are given in Section 15.1.5.
S causes a reduction of coolant temperature and pressure. In the presence of a negative derator temperature coefficient (or positive moderator density coefficient), the cooldown lts in an insertion of positive reactivity.
analysis is performed to demonstrate that the following criterion is satisfied:
uming a stuck rod cluster control assembly, with offsite power available, and assuming a le failure in the engineered safety features system there will be no consequential damage to core or reactor coolant system after reactor trip for a steam release equivalent to the spurious ning, with failure to close, of the largest of any single steam dump, relief, or safety valve.
idental depressurization of the secondary system is classified as an ANS Condition II event.
Section 15.0.1 for a discussion of Condition II events.
following systems provide the necessary protection against an accidental depressurization of main steam system due to the opening of a steam generator relief or safety valve.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three low steam line pressure signals in a steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which closes the main feedwater valves following reactor trip, a safety injection signal rapidly closes all feedwater control valves and back up feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast-acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- b. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
.4.2 Analysis of Effects and Consequences hod of Analysis consequences of an inadvertent opening of a steam generator relief or safety valve are nded by the zero power steam system piping failure discussed in Section 15.1.5. The opening steam generator relief or safety valve causes a less severe steam generator blowdown and sequent RCS cooldown than the steam system piping failure event. This would result in a er peak power level if a return to power were to occur as predicted for the zero power steam em piping failure. The minimum DNBR for the zero power steam system piping failure, ch remains above the safety analysis limit, would be lower than that for the opening of a steam erator relief or safety valve.
ults and Conclusions ce the minimum DNBR for the zero power steam system piping failure (Section 15.1.5) ains above the safety analysis limit, there would be no fuel failure predicted for an inadvertent ning of a steam generator relief or safety valve.
steam generator atmospheric dump bypass valves are Safety Class 2 (QA Category I) motor rated valves and are manually controlled only with no automatic control circuitry. As such, function of these valves would not be postulated. However, even if an inadvertent opening of of these valves were to be assumed, the event will be bounded by the events described in tion 15.1.5 where it is demonstrated that no DNB occurs and no system design limits are eeded. Thus, the conclusions provided in Section 15.1.4.3 also apply to these valves.
1.4.3 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
1.5 STEAM SYSTEM PIPING FAILURE 1.5.1 Identification of Causes and Accident Description steam release arising from a rupture of a main steam line would result in an initial increase in m flow which decreases during the accident as the steam pressure falls. The energy removal m the RCS causes a reduction of coolant temperature and pressure. In the presence of a ative moderator temperature coefficient (or positive moderator density coefficient), the ldown results in an insertion of positive reactivity. If the most reactive rod cluster control mbly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an eased possibility that the core could become critical and return to power. A return to power
analysis of a main steam line rupture is performed to demonstrate that the following criterion atisfied.
uming the most limiting single failure of a stuck RCCA with or without offsite power, and ming the most limiting single failure in the engineered safety features, the core remains in e and intact. Radiation doses do not exceed the guidelines of 10 CFR 50.67.
hough DNB and possible clad perforation following a steam pipe rupture are not necessarily cceptable, the following analysis shows that the DNB design basis is met for any rupture ming the most reactive RCCA stuck in its fully withdrawn position. The DNB design basis is ussed in Section 4.4.
ajor steam line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a ussion of Condition IV events.
cts of minor secondary system pipe breaks are bounded by the analysis presented in this ion. Minor secondary system pipe breaks are classified as Condition III events, as described in tion 15.0.1.3.
major rupture of a steam line is the most limiting cooldown transient and is analyzed at zero er with no decay heat. Decay heat would retard the cooldown, thereby reducing the return to er. A detailed analysis of this transient with the most limiting break size, a double ended ure, is presented here.
following functions provide the protection for a steam line rupture.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three hi-1 containment pressure signals;
- c. two out of three low steam line pressure signals in one steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower (neutron flux and T) and low pressurizer pressure reactor trips, and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Isolation of the main feedwater lines, via closure of the redundant main feedwater isolation valves
safety injection signal rapidly closes all feedwater control valves and backup feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. 2 out of 3 hi-2 containment pressure signals;
- b. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- c. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
t-acting isolation valves (main steam isolation valves) are provided in each steam line; these es are assumed to close within 12 seconds of the generation of the steam line isolation signal owing a large break in the steam line. For breaks downstream of the isolation valves, closure ll valves would completely terminate the blowdown. For breaks upstream of the isolation es, one steam generator is assumed to blow down. A description of steam line isolation is uded in Chapter 10.
m flow is measured by monitoring dynamic head in nozzles located in the throat of the steam erator. The effective throat area of the nozzles is 1.388 square feet, which is considerably less the main steam pipe area; thus, the nozzles also serve to limit the maximum steam flow for a k at any location.
le 15.1-2 lists the equipment required in the recovery from a high energy line rupture. Not all ipment is required for any one particular break, since the requirements vary depending upon tulated break locations and details of balance of plant design and pipe rupture criteria as ussed elsewhere in this application. Design criteria and methods of protection of safety related ipment form the dynamic effects of postulated piping ruptures are provided in Section 3.6.
.5.2 Analysis of Effects and Consequences hod of Analysis analysis of the steam pipe rupture has been performed to determine:
- 1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN code (VEP-FRD-41-P-A) has been used.
- 2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE-D (DOM-NAF-2-P-
analysis has been performed with four reactor coolant loops in operation.
following conditions were assumed to exist at the time of a main steam line break accident.
- 1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.
- 2. A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked at limiting statepoints for the cases analyzed. The statepoints were selected on the basis of core parameters at specific points in the transient analysis that resulted in minimum DNBR. This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity used in the RETRAN kinetics analysis was greater than the reactivity value calculated by the core physics code for all statepoints. This verifies conservatism of the method; i.e.,
underprediction of negative reactivity feedback from power generation in the RETRAN simulation.
- 3. Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the safety injection system.
The most restrictive single failure corresponds to the flow delivered by one intermediate head safety injection pump delivering its full flow to the cold leg header.
injection signal (SIS). The SIS begins the appropriate delays for instrumentation, logic, signal transport, pump startup and emergency diesel generator startup if applicable. The pumps will not discharge to the reactor coolant cold leg until a low RCS pressure condition exists (Permissive-19) to open the last isolation valve to the cold leg. The delivery of safety injection flow is not determined by P-19 in the analysis.
The Technical Specification minimum RWST boric acid concentration is assumed for the safety injection flow. No credit has been taken for the borated water which must be swept from the lines downstream of the RWST prior to the delivery of safety injection flow to the reactor coolant loops. Due to this modeling, boron does not reach the core before steam generator dryout.
The accumulators are also modeled in the steam line break accident analysis and are assumed to contain the minimum Technical Specification boric acid concentration. The system pressure does not drop low enough to actuate the accumulators in the analysis.
- 4. Since the steam generators are provided with integral flow restrictors at the main steam nozzles with a 1.388 square foot throat area, any rupture in a steam line with a break area greater than 1.388 square feet, regardless of location, would have the same effect on the NSSS as the 1.388 square foot break. The analysis of the steam pipe rupture modes a 1.4 square foot steam generator outlet nozzle. The following cases have been considered in determining the core power and RCS transients.
- a. Complete severance of a pipe, with the plant initially at no-load conditions, full reactor coolant flow with offsite power available.
- b. Case (a) with loss of offsite power simultaneous with the steam line break.
Loss of offsite power results in reactor coolant pump coastdown.
- 5. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life.
The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break. This void, in conjunction with the large negative moderator coefficient, partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.
The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.
reactor is tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analysis are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as cooldown and reactivity insertions proceed in the analysis which assumes no-load conditions at time zero.
- 6. In computing the steam flow during a steam line break, the Moody Curve (Moody 1965) for fL/D = 0 is used.
ults calculated sequence of events for both cases analyzed is shown in Table 15.1-1. The results ented are a conservative indication of the events which would occur assuming a steam line ure since it is postulated that all of the conditions described above occur simultaneously.
e Power and Reactor Coolant System Transient ures 15.1-15 through 15.1-17 show the RCS transient and core heat flux following a main m line rupture (complete severance of a pipe) at initial no-load conditions (case a). Offsite er is assumed available so that full reactor coolant flow exists. The transient shows an ontrolled steam release from only one steam generator.
uld the core be critical at or near zero power when the rupture occurs, the initiation of safety ction by low steam line pressure trips the reactor. Sustained steam release from more than one m generator is prevented by automatic trip of the fast acting isolation valves in the steam lines igh containment pressure signals or by low steam line pressure signals. Specifically, the ase is limited to approximately 13 seconds for the other steam generators while the one erator blows down. The main steam isolation valves are designed to be fully closed in less 10 seconds from receipt of a closure signal.
shown on Figure 15.1-15, the core attains criticality with the RCCAs inserted (with the design tdown assuming one stuck RCCA) before the faulted steam generator dries out. As a result of steam generator dry out, the RCS temperatures rise (and stabilize) resulting in a reduction in reactivity of the core in the presence of a negative moderator temperature coefficient (or itive moderator density coefficient) and effectively turning around the transient. A peak core er less than the nominal full power value is attained.
calculation modeled a minimum boric acid concentration in the accumulators and RWST.
wever, the accumulators do not actuate and the liquid volume from the RWST to cold leg
variation of mass flow rate in the RCS due to water density changes is included in the ulation as is the variation of flow rate in the safety injection system due to changes in the RCS sure. The safety injection system flow calculation includes the line losses in the system as l as the pump head curve.
ed on the results of a generic study (WCAP-9227), the case with loss of offsite power (case b) ss severe than that described above. The loss of the main coolant pumps reduce the flow in the tor coolant system. The loss of forced circulation makes the transient less severe than the case h forced circulation. This is due to: 1) the core and steam generator are more decoupled, hence time to go critical is much longer, 2) without forced coolant, the rate of heat transfer is reduced he steam generator, thereby reducing the core cooldown rate, and 3) local density feedback cts minimize the power level following the assumed steam break. All of these effects result in case with forced coolant flow being much more severe than the case without offsite power for potential of clad damage. Results from the case b RETRAN analysis align with the WCAP-7 observations.
ould be noted that following a steam line break, only one steam generator blows down pletely. Thus, the remaining steam generators in operation are still available for dissipation of ay heat after the initial transient is over. In the case of loss of offsite power, this heat is oved to the atmosphere via the steam line safety valves, and power-operated relief valves.
gin to Critical Heat Flux NB analysis was performed for the limiting case with offsite power available and the non-ting case that models a loss of offsite power. It was found that the DNB design basis, as stated ection 4.4, was met for both cases.
.5.3 Conclusions analysis has shown that the criteria stated earlier in Section 15.1.5.1 are satisfied.
hough DNB and possible clad perforation following a steam pipe rupture are not necessarily cceptable and not precluded by the criteria, the above analysis shows that no DNB occurs for rupture assuming the most reactive RCCA stuck in its fully withdrawn position. The ological consequences of this limiting event are within the acceptable criteria of CFR 50.67.
1.5.4 Radiological Consequences main steam line break is postulated to occur in a main steam line outside the containment.
plant is assumed to have operated with Technical Specification fuel defects. A 1 gpm primary econdary leakage is assumed to occur such that 0.35 gpm leakage takes place in the affected m generator and 0.65 gpm leakage takes place evenly in the other steam generators.
vity associated with the damaged fuel rods is uniformly mixed with the primary coolant and is efore available for release to the atmosphere via primary to secondary leakage.
iodine partition factor is assumed to be 1.0 for the steam release from the affected steam erator. An iodine partition factor of 0.01 is used for the releases from the unaffected steam erators. Offsite power is also assumed to be lost, thus making the condensers unavailable for m dump. The steam released from all steam generators is assumed to be released directly to environment at ground level.
o cases are analyzed and reported for four loop plant operating conditions. The first case mes a concurrent iodine spike condition. The second case includes a pre-accident iodine spike dition when the steam line break occurs.
radiological consequences of a main steam line break (both cases) are reported in Table 15.0-he assumptions used to perform this evaluation are summarized in Table 15.1-3 and le 15.6-12. The use of these assumptions together with the atmospheric dispersion values d in Table 15.0-11, are used to compute the doses to the Control Room, EAB and LPZ as orted in Table 15.0-8.
evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The ological consequences of the main steam line break are within the TEDE limits defined by CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and for the concurrent spike
.6 REFERENCES FOR SECTION 15.1
-1 Moody, F. S. 1965. Transactions of the ASME, Journal of Heat Transfer. Figure 3, page 134.
-2 WCAP-14882-P-A, 1999. RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
-3 Letter from A.C. Thadani (NRC) to W.J. Johnson (Westinghouse), January 31, 1989, Acceptance for Referencing of Licensing Topical Report, WCAP-9226-P/9227-NP, Reactor Core Response to Excessive Secondary Steam Releases.
-4 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
-5 WCAP-9227, 1978, Reactor Core Response to Excessive Secondary Steam Release.
-6 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec) edwater system Main feedwater control valve fails fully open 0.0 lfunctions that result in an High-high steam generator water level signal 28.0 rease in feedwater flow generated (100% NRS)
Turbine trip occurs due to high-high steam 30.4 generator level Reactor trip occurs 32.4 Minimum DNBR occurs 32.5 Feedwater isolation valves close automatically 34.9 am system piping failure:
Complete severance of a Steam line ruptures 0.1 e, no-load conditions, full Feedwater isolation complete 9.7 ctor coolant flow with site power available Steam line isolation complete 12.9 ase a) Pressurizer empties (1) 14.2 Criticality attained 36.2 Safety Injection flow initiation (2) 36.6 Peak heat flux/minimum DNBR reached 112.3 Faulted steam generator dries out 292 Complete severance of a Steam line ruptures 0.1 e, no-load conditions, Reactor coolant pumps trip 0.2 ctor coolant pump stdown due to a loss of Feedwater isolation complete 9.7 site power (Case b) Steam line isolation complete 12.9 Pressurizer empties (1) 16.4 Criticality attained 41.1 Safety Injection flow initiation (2) 49.6 Peak heat flux/minimum DNBR reached 171.1 Cooldown terminates/core begins to heat 290 TES:
Defined by the end of the rapid draindown.
Boron does not reach the core before event termination.
ision 3406/30/21
-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown r trip and safeguards actuation Auxiliary feedwater system Steam generator atmospheric relief valves (can be manually ls including sensors circuitry, and including pumps, water supply, operated locally).
sing equipment (the protection and system valves and piping Control for defeating automatic safety injection actuation s used to trip the reactor on low (this system must be available during a cooldown and depressurization.
coolant pump shaft speed, and to supply water to operable trip may be excluded). steam generators no later than 10 minutes after the incident).
injection system including the Capability for obtaining a Residual heat removal system including pumps, heat
, the refueling water storage tank, reactor coolant system sample. exchanger, and systems valves and piping necessary to cool e systems valves and piping. and maintain the reactor coolant system in a cold shutdown condition.
generators and emergency power ution equipment.
r plant component cooling water water system.
MPS-3 FSAR h spray system containment lation system.
ary feedwater system including
, water supplies, piping and valves.
eedwater control valves (trip closed
).
s feedwater control valves (trip feature).
15.1-19 y and secondary safety valves.
ision 3406/30/21
-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown s and/or equipment required to trip in feedwater pumps.
eedwater isolation valves (trip feature).
team line stop valves (trip closed
).
generator blowdown isolation (automatic closure feature).
es (Class IE).
l room ventilation.
l room equipment must not be ed to an extent where any ent will be spuriously actuated or the equipment contained elsewhere list cannot be operated.
MPS-3 FSAR ency lighting.
ccident monitoring system.*
- See Section 7.5 for a discussion of the post-accident monitoring system.
15.1-20
Analysis Input Parameters Reactor thermal power level plus 2% uncertainty (MWt) 3,723 Primary coolant concentrations Table 15.0-10 Primary to secondary leak rate (gpm) 1.0 Secondary coolant concentrations Table 15.0-10 Iodine partition factor in affected steam generator 1.0 throughout accident Iodine partition factors in unaffected steam generators 0.01 throughout accident Duration of release (hours) 36.25 (intact S/Gs) 65.75 (affected S/G)
Initial steam and water release from affected steam 165,000 generator over the first 16.5 seconds of the accident (lb)
Long-term (65.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />) steam release from the affected 11,511 steam generator (lb)
Steam release from unaffected steam generators (lbm/min)
- a. 0-2 hours 3.58E+03
- b. 2-11hours 2.37E+3
- c. 11-24 hours 2.37E+3
- d. 24-36.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> 2.73E+2 Offsite power Lost Initial steam generator contents (lb/SG) 165,000 Iodine spike factor Pre-accident iodine concentrations shown in Table 15.0-12. Concurrent iodine appearance rates in Table 15.0-13.
Atmospheric Dispersion Factors (1) See Table 15.0-11.
TE:
EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
TABLE 15.1-4 DELETED BY FSARCR PKG FSC 04-MP3-017
FIGURE 15.1-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
Deleted by FSARCR PKG FSC 02-MP3-017
This figure shows the typical effect of a change in moderator temperature (at constant pressure) on core reactivity; however, the figure should not be relied upon for an absolute value of the moderator feedback.
FIGURE 15.1-12 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
FIGURE 15.1-13 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
This figure shows the typical effect of a change in moderator temperature (at constant pressure) on core reactivity; however, the figure should not be relied upon for an absolute value of the moderator feedback.
umber of transients and accidents have been postulated which could result in a reduction of capacity of the secondary system to remove heat generated in the reactor coolant system S). Detailed analyses are presented in this section for several such events which have been tified as more limiting than the others.
cussions of the following RCS coolant heatup events are presented in Section 15.2.
- 1. Steam pressure regulator malfunction or failure that results in decreasing steam flow.
- 2. Loss of external electrical load.
- 3. Turbine trip.
- 4. Inadvertent closure of main steam isolation valves.
- 5. Loss of condenser vacuum and other events resulting in turbine trip.
- 6. Loss of nonemergency AC power to the station auxiliaries.
- 7. Loss of normal feedwater flow.
- 8. Feedwater system pipe break.
above items are considered to be American Nuclear Society (ANS) Condition II events, with exception of a feedwater system pipe break, which is considered to be an ANS Condition IV nt. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance eria.
2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW re are no steam pressure regulators in Millstone 3 whose failure or malfunction could cause a m flow transient.
.2 LOSS OF EXTERNAL ELECTRICAL LOAD
.2.1 Identification of Causes and Accident Description ajor load loss on the plant can result from loss of external electrical load due to some trical system disturbance. Offsite alternating current (AC) power remains available to operate t components such as the reactor coolant pumps; as a result, the onsite emergency diesel erators are not required to function for this event. Following the loss of generator load, an ediate fast closure of the turbine control valves occurs. This causes a sudden reduction in
perature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS sure rise.
a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal ld be generated. The plant would be expected to trip from the reactor protection system if a ty limit were approached. A continued steam load of approximately 5 percent would exist r total loss of external electrical load because of the steam demand of plant auxiliaries.
he event that a safety limit is approached, protection would be provided by the high pressurizer sure, overtemperature T and steam generator low-low level trips. Following a complete loss oad, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an rfrequency of less than 6 Hz. Any increased frequency to the reactor coolant pump motors lts in slightly increased flow rate and subsequent additional margin to safety limits. For tulated loss of load and subsequent turbine generator overspeed, turbine trip and the opening he generator breaker terminate the overfrequency condition seen by other safety-related pump ors, reactor protection system equipment, or other safeguards loads. Safeguards loads are plied from offsite power or, alternatively, from emergency diesel generators. Reactor ection system equipment is supplied from the 120 V AC instrument power supply system, ch in turn is supplied from the inverters; the inverters are supplied from a Class IE 125 V ct current (DC) bus energized from batteries or by a rectified Class IE AC voltage from guards buses.
he event the steam dump valves fail to open following a large loss of load, the steam generator ty valves may lift and the reactor may be tripped by the high pressurizer pressure signal, or the rtemperature T signal. In the event of feedwater flow also being lost, the reactor may be ped by a steam generator low-low level signal. The steam generator shell side pressure and tor coolant temperatures increase rapidly. However, the pressurizer safety valves and steam erator safety valves are sized to protect the RCS and steam generator against overpressure for oad losses without assuming the operation of the steam dump system, pressurizer spray, surizer power-operated relief valves, automatic rod cluster control assembly control or direct tor trip on turbine trip.
steam generator safety valve capacity is sized sufficiently to remove the steam flow from the m generator without exceeding 110 percent of the steam system design pressure. The surizer safety valve capacity is sized based on a complete loss of heat sink with the plant ally operating at the maximum calculated turbine load along with operation of the steam erator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to ntain the RCS pressure within 110 percent of the RCS design pressure.
ore complete discussion of overpressure protection can be found in WCAP-7769.
ss of external load is classified as an ANS Condition II event, fault of moderate frequency.
Section 15.0.1 for a discussion of Condition II events.
ented for the loss of external load.
primary side transient is caused by a decrease in heat transfer capability from primary to ondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic uction of feedwater flow (should feed flow not be reduced, a larger heat sink would be ilable and the transient would be less severe). Termination of steam flow to the turbine owing a loss of external load occurs due to automatic fast closure of the turbine control valves ot less than 0.3 seconds. Following a turbine trip event, termination of a steam flow occurs via ine stop valve closure, which occurs in not less than 0.1 seconds. Therefore, the transient in ary pressure, temperature, and water volume is less severe for the loss of external load than the turbine trip due to a slightly slower loss of heat transfer capability.
protection available to mitigate the consequences of a loss of external load is the same as that a turbine trip, as listed in Table 15.0-6.
.2.2 Analysis of Effects and Consequences er to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this uping of events. The results of the turbine trip event analysis are more severe than those ected for the loss of external load, as discussed in Section 15.2.2.1.
mal reactor control systems and engineered safety systems are not required to function during ss of external load.
reactor protection system may be required to function following a complete loss of external to terminate core heat input and prevent departure from nucleate boiling (DNB). Depending he magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves be required to open to maintain system pressures below allowable limits. No single active ure will prevent operation of any system required to function. See WCAP 8330 for a ussion of anticipated transients without trip (ATWT) considerations.
2.2.3 Conclusions ed on results obtained for the turbine trip event (Section 15.2.3) and considerations described ection 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.
.2.4 Radiological Consequences ce no fuel damage is postulated for this transient, a specific radiological calculation was not ormed.
.3.1 Identification of Causes and Accident Description a turbine trip event, the reactor would be tripped directly (unless below the Power Range tron Flux Reactor Trip System interlock P-9) from a signal derived from the turbine stop rgency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly (with inimum delay time of 0.1 seconds) on loss of trip fluid pressure actuated by a turbine trip al. Turbine trip initiation signals include:
generator trip low condenser vacuum loss of lubricating oil turbine thrust bearing failure turbine overspeed moisture separator water level high manual trip n initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop es detect the turbine trip and cause reactor trip if core power is above the Power Range tron Flux Reactor Trip System interlock P-9. Steam dump would be initiated following a tor trip. The loss of steam flow results in an almost immediate rise in secondary system perature and pressure with a resultant primary system transient as described in tion 15.2.2.1 for the loss of external load event. A slightly more severe transient occurs for the ine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.
automatic steam dump system would normally accommodate the excess steam generation.
ctor coolant temperatures and pressure do not significantly increase if the steam dump system pressurizer pressure control system are functioning properly. If the turbine condenser was not ilable, the excess steam generation would be dumped to the atmosphere and main feedwater would be lost, causing steam generator water level to fall. For this situation feedwater flow ld be maintained by the auxiliary feedwater system to ensure adequate residual and decay t removal capability. Should the steam dump system fail to operate, the steam generator safety es may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the sient.
rbine trip is classified as an ANS Condition II event, fault of moderate frequency. See tion 15.0.1 for a discussion of Condition II events.
analysis are presented in Section 15.2.3.2.
plant systems and equipment available to mitigate the consequences of a turbine trip are ussed in Section 15.0.8 and listed in Table 15.0-6.
.3.2 Analysis of Effects and Consequences hod of Analysis his analysis, the behavior of the unit is evaluated for a complete loss of steam load from 100 ent of full load power without direct reactor trip primarily to show the adequacy of the sure relieving devices and also to demonstrate core protection margins; that is, the turbine is med to trip without actuating all the sensors for reactor trip on the turbine stop valves. The mption delays reactor trip until conditions in the RCS result in a trip due to other signals.
s, the analysis assumes a worst transient. In addition, no credit is taken for steam dump. Main water flow is terminated at the same time of turbine trip, with no credit taken for auxiliary water to mitigate the consequences of the transient.
turbine trip transients are analyzed by employing the detailed digital computer program TRAN (WCAP-14882-P-A). The program simulates the neutron kinetics, RCS, pressurizer, surizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety es. The program computes pertinent plant variables including temperatures, pressures, and er level.
ial operating conditions are assumed at values consistent with steady state four loop operation.
nt characteristics and initial conditions are discussed in Section 15.0.3, and any deviations m Section 15.0.3 are noted below.
or assumptions are summarized as follows:
- 1. Initial operating conditions The initial reactor power and RCS pressure and temperatures are assumed at their nominal values consistent with steady state full-power operation. Uncertainties, including allowances for calibration and instrument errors in initial conditions, are included in the DNBR limit as discussed in Section 15.0.3.2. Cases with four loops in operation are considered.
- 2. Moderator and Doppler coefficients of reactivity The turbine trip is analyzed for minimum reactivity feedback. This involves modeling the most positive value for the moderator temperature coefficient, along with least negative Doppler power coefficients (Figure 15.0-2).
From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
- 4. Steam release No credit is taken for the operation of the steam dump system or steam generator atmospheric relief valves. The steam generator pressure rises to the safety valve set point where steam release through safety valves limits secondary steam pressure to less than 110 percent of the steam system design temperature.
- 5. Pressurizer spray and power operated relief valves
- a. Full credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the DNB and main steam system overpressurization cases. Safety valves are also available.
- b. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the RCS overpressurization case. Safety valves are operable.
- 6. Feedwater flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition is reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on low-low steam generator water level. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
- 7. Reactor trip is actuated by the first reactor protection system trip set point reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, overtemperature T, and low-low steam generator water level.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
ept as discussed above, normal reactor control system and engineered safety systems are not uired to function.
reactor protection system may be required to function following a turbine trip. Pressurizer ty valves and/or steam generator safety valves may be required to open to maintain system
ults transient responses for a turbine trip from 100 percent of full power operation are shown for e cases: RCS overpressurization DNBR, and main steam system overpressurization (Figures
-1 through 15.2-6). The calculated sequence of events for the accident is shown in le 15.2-1.
ures 15.2-1 and 15.2-2 show the turbine trip transient responses for the RCS rpressurization case modeling minimum reactivity feedback and assuming no credit for surizer sprays or power operated relief valves (PORVs). No credit is taken for the steam
- p. The reactor is tripped by the high pressurizer pressure trip signal. The pressurizer safety es lift and maintain primary system pressure below 110 percent of the design value. The m generator safety valves limit the secondary steam conditions to saturation at the safety e set point.
ures 15.2-3 and 15.2-4 show the turbine trip transient responses for the DNBR case modeling imum reactivity feedback and pressurizer sprays and PORVs. The reactor is tripped by the h pressurizer pressure trip signal. The DNBR decreases slightly below its initial value during very beginning of the transient. Pressurizer relief and safety valves and spray prevent primary em overpressurization; steam generator safety valves prevent overpressurization in the ondary side.
ures 15.2-5 and 15.2-6 show the turbine trip transient responses for the MSS rpressurization case modeling minimum reactivity feedback and pressurizer pressure control, ys and PORVs. No credit is taken for the steam dump. The reactor is tripped by the high surizer pressure trip signal. The pressurizer PORVs, safety valves and sprays lift to maintain mary system pressure and the steam generator safety valves actuate to maintain secondary side sure below 110% of the design value.
AP-7769 presents additional results of analysis for a complete loss of heat sink (i.e., turbine
) including loss of main feedwater. This analysis shows the overpressure protection that is rded by the pressurizer and steam generator safety valves.
2.3.3 Conclusions ults of the analysis, including those in WCAP-7769 show that the plant design is such that a ine trip without a direct or immediate reactor trip presents no hazard to the integrity of the S or the main steam system. Pressure relieving devices incorporated in the two systems are quate to limit the maximum pressures to within the design limits.
integrity of the core is maintained by operation of the reactor protection system, i.e., the BR will be maintained above the safety analysis limit. DNB statepoint analysis was performed h VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of
ity of the nuclear steam supply system to safely withstand a full load rejection.
.3.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological calculation was not ormed.
.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES dvertent closure of the main steam isolation valves would result in a turbine trip. Turbine trips discussed in Section 15.2.3.
.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP s of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating nts are described in Section 15.2.3. A loss of condenser vacuum would preclude the use of m dump to the condenser; however, since steam dump is assumed not to be available in the ine trip analysis, no additional adverse effects would result if the turbine trip were caused by of condenser vacuum. Therefore, the analysis results and conclusions contained in tion 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible ses of a turbine trip, as listed in Section 15.2.3.1, are covered by Section 15.2.3. Possible rfrequency effects due to a turbine overspeed, as discussed in Section 15.2.2.1, are not a cern for this type of event.
2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES 2.6.1 Identification of Causes and Accident Description omplete loss of nonemergency AC power may result in the loss of all power to the station iliaries; i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be sed by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, y a loss of the onsite AC distribution system.
s transient is different than the turbine trip event analyzed in Section 15.2.3 because for this the decrease in heat removal by the secondary is accompanied by a flow coastdown which her reduces the capacity of the primary coolant to remove heat from the core. The reactor s:
- 1. due to turbine trip;
- 2. upon reaching one of the trip set points in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or
owing a loss of AC power with turbine and reactor trips, the sequence described below urs.
- 1. Plant vital instruments are supplied from emergency DC power sources.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves may be automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
- 3. As the no-load temperature is approached, the steam generator atmospheric relief valves (or the self actuated safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
- 4. The emergency diesel generators, started on loss of voltage on the plant emergency buses, begin to supply plant vital loads.
auxiliary feedwater system is started automatically as follows.
o motor-driven auxiliary feedwater pumps are started on any of the following:
- 1. two of four low-low water level signals in any one steam generator;
- 2. safety injection signal;
- 3. loss of offsite power;
- 4. manual actuation; or
- 5. AMSAC actuation signal.
turbine driven auxiliary feedwater pump is started on any of the following:
- 1. two of four low-low water level signals in any two of four steam generators;
- 2. manual actuation; or
- 3. AMSAC actuation signal.
er to Section 10.4.9 for a description of the auxiliary feedwater system.
hin 60 and 90 seconds, respectively, even if a loss of all AC power occurs simultaneously with of normal feedwater. The turbine exhausts the secondary steam to the atmosphere. The iliary pumps take suction from the demineralized water storage tank (DWST) for delivery to steam generators.
n the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and removal of residual heat is maintained by natural circulation in the reactor coolant loops. A of nonemergency AC power to the station auxiliaries is classified as an ANS Condition II nt, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
h respect to maximum calculated primary and secondary side pressure, the loss of AC event, escribed above, is bounded by the turbine trip initiated decrease in secondary heat removal hout loss of AC power, which was analyzed in Section 15.2.3. The DNB transient for this nt is bounded by the complete loss of flow transient analyzed in Section 15.3.2. A loss of AC er to the station auxiliaries as postulated above could also result in a loss of normal feedwater e condensate pumps lose power to operate. A loss of normal feedwater is the most limiting dition II event in the decrease in secondary heat removal category, and is analyzed with loss C power in Section 15.2.7. Therefore, detailed analytical results for a loss of AC power sient are not presented here. The results of the analysis in Section 15.2.7 address the loss of water aspect of the loss of AC power event.
owing the reactor coolant pump coastdown caused by the loss of AC power, the natural ulation capability of the RCS removes residual and decay heat from the core, aided by iliary feedwater in the secondary system. The analyses is presented in Section 15.2.7 show the natural circulation flow in the RCS following a loss of AC power event is sufficient to ove residual heat from the core.
plant systems and equipment available to mitigate the consequences of a loss of AC power nt are discussed in Section 15.0.8 and listed in Table 15.0-6.
.6.2 Analysis of Effects and Consequences hod of Analysis stated above, the DNB consequences of this event are bounded by the complete loss of flow nt. With respect to overpressurization of the primary and secondary sides, this event is nded by the turbine trip analysis described in Section 15.2.3. The loss of feedwater aspects are ered by the analyses presented in Section 15.2.7 (specifically those cases that assume loss of ite power). Based on this, transient analysis results of this event are not presented in this ion. However, in support of the flow coastdown test performed at initial plant startup, analyses ilar to those discussed in Section 15.2.7 have been performed for this plant to determine the ilibrium natural circulation flow rate as a function of the residual reactor power expected er these conditions. To do this, steady state cases were run at a number of power levels sistent with the decay heat generation rates expected. Equilibrium conditions were established
data presented in Table 15.2-2 is not used as input in any FSAR Chapter 15 analysis for lstone Unit 3. However, the acceptability of the natural circulation model for use in Millstone t 3 transient analyses was confirmed at initial startup by showing that the actual natural ulation flow rate, determined from the startup tests, met or exceeded these values. In the licable transient analyses, the natural circulation flow rate is calculated by the LOFTRAN puter code based on transient conditions.
ults results of the loss of nonemergency AC power are not produced here because this event is nded by other events. The transient response of the RCS following a loss of AC power is less ere than for the loss of normal feedwater with a loss of offsite power event analyzed in tion 15.2.7. The results show that the natural circulation flow available is sufficient to provide quate core decay heat removal following reactor trip and reactor coolant pump coastdown.
first few seconds of the loss of AC power transient closely resembles a simulation of the plete loss of flow incident, i.e., core damage due to rapidly increasing core temperatures is vented by promptly tripping the reactor. This aspect of the loss of AC power event is bounded he complete loss of flow event analyzed in Section 15.3.2 that demonstrates that the DNB gn basis is met. With respect to overpressurization of the primary and secondary sides, this nt is bounded by the turbine event (Section 15.2.3). After the reactor trip, stored and residual ay heat must be removed to prevent damage to either the RCS or the core.
natural circulation flow as a function of residual reactor power is presented in Table 15.2-2.
2.6.3 Conclusions lysis of the natural circulation capability of the RCS has demonstrated that sufficient heat oval capability exists following reactor coolant pump coastdown to prevent fuel or clad age.
loss of AC power transient is less severe than the loss of normal feedwater with a loss of ite power event as analyzed in Section 15.2.7. It is also less severe than the turbine trip event lyzed in Section 15.2.3, which demonstrates that primary and secondary side pressures remain w 110% of design value. Finally, this event is less severe than the complete loss of flow event lyzed in Section 15.3.2, which demonstrates that the DNBR acceptance limit is met.
.6.4 Radiological Consequences ce no fuel damage is postulated to occur for this transient, a specific radiological calculation not performed.
.7.1 Identification of Causes and Accident Description ss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) lts in a reduction in capability of the secondary system to remove the heat generated in the tor core. If an alternative supply of feedwater were not supplied to the plant, core residual t following reactor trip would heat the primary system water to the point where water relief m the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the t is tripped well before the steam generator heat transfer capability is reduced, the primary em variables never approach a DNB condition.
o cases are presented for a loss of normal feedwater event with four loops operating initially.
first is the case where offsite AC power is maintained, and the second is the case where ite AC power is lost which results in reactor coolant pump coastdown as described in tion 15.2.6.
case with offsite AC power available is limiting because of the additional heat from the tor coolant pumps which must be removed by the auxiliary feedwater system.
following events occur upon loss of normal feedwater.
- 1. Plant vital instruments are supplied from emergency DC power sources for the cases with a loss of offsite power.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power-operated relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
following provide the necessary protection against a loss of normal feedwater.
- 1. Reactor trip on low-low water level in any steam generator.
- 2. High pressurizer pressure.
- 3. Reactor trip on over temperature T.
Auxiliary Feedwater System is started automatically as discussed in Section 15.2.6.1.
ll analysis of the system transient is presented below to show that following a loss of normal water, the auxiliary feedwater system is capable of removing the stored and residual heat, preventing either overpressurization of the RCS or loss of water from the reactor core, and rning the plant to a safe condition.
.7.2 Analysis of Effects and Consequences hod of Analysis etailed analysis using the RETRAN Code (WCAP-14882-P-A) is performed in order to ain the plant transient following a loss of normal feedwater. The simulation describes the plant mal kinetics, RCS including the natural circulation, pressurizer, steam generators and water system. The digital program computes pertinent variables including the steam erator level, pressurizer water level, and reactor coolant average temperature.
umptions made in the analysis are as follows:
- 1. The plant is initially operating at 102 percent of the NSSS-rated thermal power.
- 2. The core residual heat generation is based on the 1979 version of ANS 5.1 (ANSI/
ANS-5.1-1979) assuming long-term operation at the initial power level.
- 3. For the case with a loss of offsite power, a heat transfer coefficient in the steam generator associated with RCS natural circulation is used.
- 4. Reactor trip occurs on steam generator low-low water level.
- 5. The worst single failure in the auxiliary feedwater system occurs; i.e., failure of the turbine-driven auxiliary feedwater pump.
- 6. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow, via both motor-driven AFW pumps, to all four steam generators. The cases analyzed model AFW flow as a function of steam generator pressure. A 60-second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and the motor-driven auxiliary feedwater pumps.
- 7. Secondary system steam relief is achieved through the self- actuated safety valves.
Note that steam relief is, in fact through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater. However, for the sake of analysis these have been assumed unavailable.
- 8. The pressurizer heaters and sprays are assumed to be available as their operation maximizes the pressurizer insurge and minimizes the margin to a water-solid condition in the pressurizer.
temperatures (Tavg), and because the pressurizer level program varies over the range, several analyses were performed to establish the most limiting initial Tavg to model in each of the two cases (i.e., with and without offsite power). For the case with offsite power available, a Tavg of 587°F minus 4°F for uncertainty was limiting. For the case without offsite power, a Tavg of 571.5°F minus 4°F for uncertainty was limiting. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty as a result of an error in the Hysteresis of Weed Resistance Temperature Detectors.
- 10. Reactivity parameters were assumed to represent a zero moderator temperature coefficient.
- 11. The initial pressurizer pressure is 50 psi higher than nominal.
loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor ection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing g term decay heat and preventing excessive heatup of the RCS with possible resultant RCS rpressurization or loss of RCS water.
such, the assumptions used in this analysis are designed to minimize the energy removal ability of the system and to maximize the possibility of water relief from the coolant system by imizing the coolant system expansion, as noted in the assumptions listed above.
such assumption is the loss of external (offsite) AC power. This assumption results in coolant decay down to natural circulation conditions and a corresponding reduction in the steam erator heat transfer coefficient. Following a loss of offsite AC power, the first few seconds of a of normal feedwater transient is virtually identical to the transient response (including DNBR neutron flux versus time) presented in Section 15.3.2 for the complete loss of forced reactor lant flow.
C power is maintained for this incident the reactor coolant flow remains at its normal value the reactor would trip via the low-low steam generator level trip with no change in DNBR w the value at the start of the transient. The auxiliary feedwater system has sufficient acity, even assuming the worst single failure, to preclude filling the pressurizer.
nt characteristics and initial conditions are further discussed in Section 15.0.3. Plant systems equipment which are available to mitigate the effects of a loss of normal feedwater accident discussed in Section 15.0.8 and listed in Table 15.0-6. Normal reactor control systems are not uired to function during this transient. The reactor protection system is required to function owing a loss of normal feedwater as analyzed here. The auxiliary feedwater system is required eliver a minimum auxiliary feedwater flow rate. No single active failure will prevent ration of any system required to function. A discussion of ATWT considerations is presented CAP 8330.
ures 15.2-9 through 15.2-12 show the significant plant parameter transients following a loss of mal feedwater with four loops in operation initially with offsite power.
ures 15.2.9A through 15.2-12A are for four loops in operation initially with a loss of offsite er.
owing the reactor and turbine trip from full load, the water level in the steam generators falls to the reduction of steam generator void fraction and because steam flow through the safety es continues to dissipate the stored and generated heat. One minute following the initiation of low-low steam generator water level trip, both motor-driven auxiliary feedwater pumps are matically started, reducing the rate of water level decrease.
capacity of the auxiliary feedwater pumps is such that the water level in the steam generator g fed does not recede below the lowest level at which sufficient heat transfer area is available issipate core residual heat without water relief from the RCS relief or safety valves. From ures 15.2-11, 15.2-12, 15.2-11A, and 15.2-12A, it can be seen that at no time is the tubesheet overed in the steam generators receiving auxiliary feedwater flow and that at no time is there er relief from the pressurizer.
calculated sequence of events for this accident is listed in Table 15.2-1. As shown on the res presented, the plant approaches a stabilized condition following reactor trip and auxiliary water addition. Standard plant shutdown procedures may be followed to further cool down plant.
.7.3 Conclusions ults of the analysis show that a loss of normal feedwater does not adversely affect the core, the S, or the steam system since the auxiliary feedwater capacity is such that reactor coolant water ot relieved from the pressurizer relief or safety valves, and the water level in all steam erators receiving auxiliary feedwater is maintained above the tubesheets.
results of the cases that assume loss of offsite power also show that the natural circulation available is sufficient to provide adequate core decay heat removal following reactor trip and tor coolant pump coastdown.
2.7.4 Radiological Consequences ce no fuel damage is postulated to occur for this transient, a specific radiological calculation not performed.
.8.1 Identification of Causes and Accident Description ajor feedwater line rupture is defined as a break in a feedwater line large enough to prevent addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory he steam generators. If the break is postulated in a feedline between the check valve and the m generator, fluid from the steam generator may also be discharged through the break. (A k upstream of the feedline check valve would affect the nuclear steam supply system only as ss of feedwater. This case is covered by the evaluation in Section 15.2.7).
ending upon the size of the break and the plant operating conditions at the time of the break, break could cause either a RCS cooldown (by excessive energy discharge through the break)
RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in tion 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.
edwater line rupture reduces the ability to remove heat generated by the core from the RCS the following reasons.
- 1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.
- 2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.
- 3. The break may be large enough to prevent the addition of any main feedwater after trip.
auxiliary feedwater system is provided to assure that adequate feedwater will be available h that:
- 1. no substantial overpressurization of the RCS shall occur, and
- 2. decay heat is removed in order to maintain sufficient liquid in the RCS to keep the reactor core covered.
er to Section 10.4.9 for a description of the auxiliary feedwater system interfaces.
ajor feedwater line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for scussion of Condition IV events.
ain feedwater line rupture is the most limiting event in the decrease in secondary heat oval category. Therefore, a full transient analysis is presented here.
severity of the feedwater line rupture transient depends on a number of system parameters uding break size, initial reactor power, and credit taken for the functioning of various control
ure of the largest feedwater line, occurring at full power with and without loss of offsite er. These cases are analyzed below.
following provides the necessary protection for a main feedwater rupture.
- 1. A reactor trip on any of the following conditions:
- a. high pressurizer pressure;
- b. overtemperature T;
- c. low-low steam generator water level in any steam generator; or
- d. safety injection signals from any of the following:
- 1. low steam line pressure,
- 2. high containment pressure (hi-1), or
- 3. low pressurizer pressure (Refer to Chapter 7 for a description of the actuation system).
- 2. An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal. (Refer to Section 10.4.9 for a description of the auxiliary feedwater system).
.8.2 Analysis of Effects and Consequences hod of Analysis etailed analysis using the RETRAN Code (WCAP-14882-P-A) is performed in order to rmine the plant transient following a feedwater line rupture. The code describes the plant mal kinetics, RCS including natural circulation, pressurizer, steam generators, and feedwater em, and computes pertinent variables including the pressurizer pressure, pressurizer water l, and reactor coolant average temperature.
cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.
or assumptions made in the analyses are as follows.
- 1. The plant is initially operating at 102 percent of NSSS-rated thermal power.
- 2. Initial reactor coolant average temperature is 5.0°F above the nominal value, and the initial pressurizer pressure is 50 psi above its nominal value.
- 4. Initial pressurizer level is at the nominal programmed value plus 7.6 percent (error); initial steam generator water level is at the nominal value plus 12.0 percent (error) for the steam generator with the ruptured feedline and minus 12.0 percent (error) for the steam generator in the intact feedlines.
- 5. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).
- 6. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.
- 7. The feedline break discharge quality is calculated by the RETRAN code as a function of pressure and temperature.
- 8. Reactor trip is assumed to be actuated by low-low water level in the affected steam generator.
- 9. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow to the three intact steam generators.
The cases model AFW flow as a function of steam generator pressure.
A 60 second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and both motor-driven auxiliary feedwater pumps.
The failure of the turbine-driven AFW pump is to be assumed the most limiting single active failure for this event. A delay of up to 90 seconds in the startup time of the turbine-drive AFW pump has been evaluated and found to be acceptable for this event.
- 10. Credit has been taken for limited coolant to metal heat transfer in the RCS during the heatup, consistent with NRC approved Thick Metal Mass Heat Transfer Model that is documented in WCAP-14882-SI-P-A.
- 11. No credit is taken for charging or letdown.
- 12. Steam generator heat transfer across the tube is adjusted as the shell side liquid inventory decreases.
- 14. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:
- a. high pressurizer pressure
- b. overtemperature T
- c. high pressurizer level
- d. high containment pressure 9 second delay in initiation of the SI system is assumed. An evaluation has been completed demonstrates acceptable results are obtained with an increase in that delay time to econds. However, the specific results reported continue to reflect the 49 second delay.
ceipt of two of four low-low steam generator water level signals in at least one steam generator ts the motor-driven auxiliary feedwater pumps, which then deliver auxiliary feedwater flow to steam generators. The turbine-driven auxiliary feedwater pump is initiated if the two of four
-low steam generator water level signals are reached in any two of four steam generators.
ilarly, receipt of a low steam line pressure signal in at least one steam line initiates a steam isolation signal which closes the main steam line isolation valves in all steam lines. This al or a low pressurizer pressure signal gives a safety injection signal which initiates flow of ated water into the RCS. The amount of safety injection flow is a function of RCS pressure.
ergency operating procedures following a secondary system line rupture call for the following ons to be taken by the reactor operator.
- 1. Isolate feedwater flow spilling out the feedline break and align auxiliary feedwater system so level in intact steam generators recovers.
- 2. Stop high head safety injection pumps if water level in the pressurizer is recovering, and the RCS is in subcooled condition and pressure is stable or increasing and is above the high head injection pumps shut off pressure, and a secondary heat sink exists.
ating feedwater flow through the break allows additional auxiliary feedwater flow to be rted to the intact steam generators (see Assumption 9, above).
sequent to meeting the SI termination criteria noted above, the high head safety injection ps are turned off and plant operating procedures followed in cooling the plant to hot tdown conditions. Plant characteristics and initial conditions are further discussed in tion 15.0.3.
engineered safety systems assumed to function are the auxiliary feedwater system and the ty injection system. For the auxiliary feedwater system, passive flow limiting devices itating venturis) limit flow to the faulted steam generator and permits all intact steam erators to receive auxiliary feedwater following the break.
the feedwater line break with loss of offsite power case, following the trip of the reactor lant pumps, there is a flow coastdown until flow in the loops reaches the natural circulation
- e. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss C power transient, to be sufficient to remove core decay heat following reactor trip. Pump stdown characteristics are demonstrated in Sections 15.3.1 and 15.3.2 for single and multiple tor coolant pump trips, respectively.
etailed description and analysis of the safety injection system is provided in Section 6.3. The iliary feedwater system is described in Section 10.4.9.
ults culated plant parameters following a major feedwater line rupture are shown on Figures 15.2-hrough 15.2-24. Results for the cases with offsite power available are presented on ures 15.2-13 through 15.2-18. Results for the cases where offsite power is lost are presented Figures 15.2-19 through 15.2-24. The calculated sequence of events for all cases presented listed in Table 15.2-1.
system response following the feedwater line rupture is similar for all cases analyzed. Results ented on Figures 15.2-14 and 15.2-18 (with offsite power), and on Figures 15.2-20 and
-24 (without offsite power) show that the RCS and main steam system pressure remain below percent of the respective design pressures. Pressurizer pressure remains fairly constant until tor trip occurs on low-low steam generator water level. Pressure then decreases, due to the of heat input, until the safety injection system is actuated on either low steam line pressure in ruptured loop, or low pressurizer pressure. Coolant expansion occurs due to reduced heat sfer capability in the steam generators; the pressurizer safety valves (PSVs) open to maintain ary pressure at an acceptable value. The PORVs which are qualified for water relief and ld be available to maintain primary pressure below the pressurizer safety valve setpoint are servatively assumed inoperable. The pressurizer fills at approximately 25 minutes. Addition he safety injection flow aids in cooling down the primary and helps to ensure that sufficient d exists to keep the core covered with water.
ures 15.2-13 and 15.2-19 show that, following reactor trip, the core remains subcritical except a brief return to criticality for the case with offsite power. This is due to the cooldown caused he steam generator blowdown. This condition is terminated when boron from the safety ction system reaches the core at approximately 170 seconds.
lysis value throughout the transient. Release of radioactivity due to the steam generator wdown is less than that calculated for the steam line rupture, analyzed in Section 15.1.5.
S pressure is maintained at the PSV set point until final RCS cooldown begins. At this time, heat removal capability of the Steam Generators, being fed by the auxiliary feedwater, eeds NSS heat generation. The reactor core remains covered with water throughout the sient, since no bulk boiling occurs in the reactor coolant loops.
major difference between the with and without offsite power cases analyzed can be seen in plots of hot and cold leg temperatures, Figures 15.2-16 and 15.2-17 (with offsite power), and Figures 15.2-22 and 15.2-23 (without offsite power). It is apparent from the initial portion of transient (150 to 200 seconds), that the case without offsite power results in a less severe ldown and subsequently higher temperatures in the hot leg. For longer times, however, the with offsite power results in a more severe rise in temperature. The core remains covered h water at all times since no boiling occurs in the reactor coolant loops.
.8.3 Conclusions ults of the analyses show that for the postulated feedwater line rupture, the assumed auxiliary water system capacity is adequate to remove decay heat, to prevent overpressurizing the S, and to prevent uncovering the reactor core. Radioactivity doses from the postulated water line rupture are less than those previously presented for the postulated steam line break.
applicable acceptance criteria are therefore met.
.8.4 Radiological Consequences feedwater line break with the most significant consequences would be one that occurred de the containment between a steam generator and the feedwater check valve. In this case, the tents of the steam generator and the PORV discharge from the Pressurizer Relief Tank would eleased to the containment. Since no fuel failures are postulated, the radioactivity released is than that from the steam line break. Furthermore, automatic isolation of the containment ld further reduce any radiological consequences from this postulated event.
2.9 REFERENCES
FOR SECTION 15.2
-1 WCAP-7769, Rev. 1, June 1972, Mangan, M.A. et al., Overpressure Protection for Westinghouse Pressurized Water Reactors.
-2 WCAP-7908, 1972, Hargrove, H.G. FACTRAN-A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod.
-3 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
-5 ANSI/ANS-5.1-1979, August 1979, American National Standard for Decay Heat Power in Light Water Reactors.
-6 WCAP-11397-P-A, 1989, Friedland, A. J., Revised Thermal Design Procedure.
-7 WCAP-14882-SI-P-A, October 2005, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactors Non-LOCA Safety Analyses, Supplement 1 -
Thick Metal Mass Heat Transfer Model and NUTRUMP-Based Steam Generator Mass Calculation Method.
-8 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec) rbine trip RCS Turbine trip, loss of main feed flow 0.0 Overpressurization High pressurizer pressure reactor trip point 6.2 case (minimum reached feedback, without pressure control) Rods begin to drop 8.2 Peak pressurizer pressure occurs 9.9 Initiation of steam release from steam generator 13.4 safety valves DNBR case Turbine trip, loss of main feed flow 0.0 (minimum feedback, High pressurizer pressure reactor trip point 8.1 with pressure control) reached Initiation of steam release from steam generator 8.5 safety valves Rods begin to drop 10.1 Minimum DNBR occurs 11.3 MSS Turbine trip, loss of main feed flow 0.0 Overpressurization Initiation of steam release from steam generator 5.4 case (minimum safety valves feedback, with pressure control) High pressurizer pressure reactor trip point 8.9 reached Rods begin to drop 10.9 Peak secondary side pressure occurs 15.9
Accident Event Time (sec) ss of normal feedwater Main feedwater flow stops 0.0 w and loss of offsite Low steam generator water level trip 39.5 wer Rods begin to drop 41.5 Reactor coolant pumps begin to coastdown 43.5 Four steam generators begin to receive auxiliary 99.5 feedwater from two motor-driven auxiliary feedwater pumps Peak water level in pressurizer occurs 2,922 Core decay heat decreases to auxiliary feedwater ~ 2,980 heat removal capacity ss of normal feedwater Main feedwater flow stops 0.0 w with offsite power Low steam generator water level trip 34.0 Rods begin to drop 36.0 Four steam generators begin to receive auxiliary 94.0 feedwater from two motor-driven auxiliary feedwater pumps.
Long term peak water level in pressurizer occurs 2,210 Core decay heat plus pump heat decreases to ~ 2,280 auxiliary feedwater heat removal capacity edwater system pipe ak With offsite power Main feedline rupture occurs 0.0 available Low-low steam generator level reactor trip 5.5 setpoint reached in affected steam generator Rods begin to drop 7.5 Three intact steam generators begin to receive 65.5 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Low pressurizer pressure safety injection 82.3 setpoint reached Safety injection flow starts 131.3
Accident Event Time (sec)
Low steam line pressure setpoint reached in 169.2 affected steam generator All main steam line isolation valves close 181.2 Pressurizer safety valve setpoint reached 496.0 Steam generator safety valve setpoint reached in 668.6 intact steam generators Without offsite power Main feedline rupture occurs 0.0 Low-low steam generator level reactor trip 5.5 setpoint reached in affected steam generator Rods begin to drop 7.5 Power lost to the reactor coolant pumps 9.5 Low steam line pressure setpoint reached in 52.6 affected steam generator All main steam line isolation valves close 64.6 Three intact steam generators begin to receive 65.5 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Safety injection flow starts 101.6 Pressurizer safety relief valve setpoint reached 242.1 Steam generator safety valve setpoint reached in 436.2 intact steam generators
Power (percent) Natural Circulation Flow (percent) 5.0 4.76 4.0 4.40 3.0 3.97 2.0 3.45 1.0 2.72 e: The data presented in this table was utilized in initial plant startup testing and it is retained for historical information only. This data was not used in any of the FSAR Chapter 15 analysis for Millstone Unit 3.
FIGURE 15.2-1A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-2A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
1.2 Nuclear Power (Fraction of Nominal) 1 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 Pressurizer Water Volume (ft^3) 1600 1500 1400 1300 1200 1100 0 20 40 60 80 Time (seconds)
FIGURE 15.2-3A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
610 605 Vessel Average Temperature (Deg. F) 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 590 585 Vessel Inlet Temperature (Deg. F) 580 575 570 565 560 555 0 20 40 60 80 Time (seconds) 4 3.5 DNBR 3
2.5 2
0 20 40 60 80 Time (seconds) s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.2-4A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
1.2 1
Nuclear Power (Fraction of Nominal) 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 1600 Pressurizer Water Volume (ft^3) 1500 1400 1300 1200 1100 1000 0 20 40 60 80 Time (seconds)
FIGURE 15.2-5A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
615 Vessel Average Temperature (Deg. F) 610 605 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 690 Vessel Inlet Temperature (Deg. F) 685 580 575 570 565 560 0 20 40 60 80 Time (seconds) 1350 Steam Generator Pressure (psia) 1300 1250 1200 1150 1100 1050 1000 0 20 40 60 80 Time (seconds)
FIGURE 15.2-6A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-7A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-8A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE IGURE 15.2-9A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE GURE 15.2-10A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE GURE 15.2-11A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE GURE 15.2-12A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
FIGURE 15.2-13A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-14A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-15A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-16A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-17A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-18A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-19A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-20A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-21A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-22A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-23A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-24A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
umber of faults are postulated which could result in a decrease in reactor coolant system flow
. These events are discussed in this section. Detailed analyses are presented for the most ting of these events.
cussions of the following flow decrease events are presented in Section 15.3.
- 1. Partial loss of forced reactor coolant flow.
- 2. Complete loss of forced reactor coolant flow.
- 3. Reactor coolant pump shaft seizure (locked rotor).
- 4. Reactor coolant pump shaft break.
1 above is considered to be an ANS Condition II event, Item 2 an ANS Condition III event, Items 3 and 4 ANS Condition IV events. Section 15.0.1 contains a discussion of ANS sifications.
.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW
.1.1 Identification of Causes and Accident Description artial loss-of-coolant flow accident can result from a mechanical or electrical failure in a tor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a tor coolant pump bus. If the reactor is at power at the time of the accident, the immediate ct of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could lt in DNB with subsequent fuel damage if the reactor is not tripped promptly.
mal power for the pumps is supplied through individual buses connected to the generator.
en a turbine or generator trip occurs, the buses continue to receive power from an offsite rce and the pumps continue to supply coolant flow to the core.
s event is classified as an ANS Condition II incident (an incident of moderate frequency) as ned in Section 15.0.1.
necessary protection against a partial loss-of-coolant flow accident is provided by the low ary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out hree low flow signals. Above Permissive 8, low flow in any loop actuates a reactor trip.
ween approximately 10 percent power (Permissive 7) and the power level corresponding to missive 8, low flow in any two loops actuates a reactor trip.
hod of Analysis case has been analyzed for the loss of one pump with four loops in operation.
s transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A) e is used to calculate the loop and core flow during the transient, the time of reactor trip based he calculated flows, the nuclear power transient, and the primary system pressure and perature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux DNBR during the transient based on the nuclear power core inlet enthalpy and flow and core pressure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, iscussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR.
results met the applicable limit as specified in Section 4.4.
ial Conditions ial reactor power, pressure, and reactor coolant system (RCS) temperature are assumed to be at r nominal values. Uncertainties in initial conditions are included in the limit DNBR. Plant racteristics and initial conditions are further discussed in Section 15.0.3.
ctivity Coefficients onservatively large absolute value of Doppler-only power coefficient is used (Figure 15.0-2).
s is equivalent to a total integrated Doppler reactivity from 0 to 100 percent power of 0.016 most positive moderator temperature coefficient (MTC) at full power (0 pcm/°F) is assumed e this maximizes the core power at the time minimum DNBR is reached. The 0 pcm/°F MTC full power assumptions are conservative compared to other power level and MTC binations.
w Coastdown flow coastdown analysis is based on a momentum balance around each reactor coolant loop across the reactor core. This momentum balance is combined with the continuity equations, a p momentum balance, and the pump characteristics and is based on high estimates of system sure losses.
nt systems and equipment which are necessary to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
ures 15.3-1 through 15.3-4 show the transient response for the loss of one reactor coolant
- p. Figure 15.3-4 shows the DNBR to be always greater than the limit value.
ce DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly ve their respective initial values.
calculated sequence of events table for the case analyzed is shown in Table 15.3-1 The cted reactor coolant pump continues to coastdown, and the core flow reaches a new ilibrium value corresponding to the number of pumps still in operation. With the reactor ped, a stable plant condition is eventually obtained. Normal plant shutdown may then proceed.
3.1.3 Conclusions analysis shows that the DNBR does not decrease below the limit value at any time during the sient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.
.1.4 Radiological Consequences artial loss of reactor coolant flow from full load would result in a reactor and turbine trip.
uming in addition that the condenser is not available, atmospheric steam dump may be uired.
ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 3.2.1 Identification of Causes and Accident Description omplete loss of forced reactor coolant flow may result from a simultaneous loss of electrical plies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the ediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This ease could result in DNB with subsequent fuel damage if the reactor were not tripped mptly.
mal power for the reactor coolant pumps is supplied through buses from a transformer nected to the generator. When a turbine or generator trip occurs, the buses continue to receive er from an offsite source, and the pumps continue to supply coolant flow to the core.
s event is classified as an ANS Condition III incident (an infrequent incident), as defined in tion 15.0.1.
following signals provide the necessary protection against a complete loss of flow accident:
- 2. low reactor coolant loop flow reactor trip on reactor coolant pump underspeed is provided to protect against conditions ch can cause a loss of voltage to all reactor coolant pumps, i.e., loss of nonemergency AC er. This function is blocked below approximately 10 percent power (Permissive P-7).
reactor trip on reactor coolant pump underspeed is also provided to trip the reactor for an erfrequency condition, resulting from frequency disturbances on the power grid. If the imum grid frequency decay rate is less than approximately 5 Hertz/second, this trip protects core from underfrequency events (Section 7.2). This effect is fully described in WCAP-8424, ision 1 (1975). A specific analysis of a frequency decay event was performed as described in tion 15.3.2.3.
reactor trip on low primary coolant loop flow is provided to protect against loss of flow ditions which affect only one reactor coolant loop. This function is generated by two out of e low flow signals per reactor coolant loop. Above Permissive P-8, low flow in any loop ates a reactor trip. Between approximately 10 percent power (Permissive P-7) and the power l corresponding to Permissive P-8, low flow in any two loops actuates a reactor trip.
3.2.2 Analysis of Effects and Consequences case has been analyzed for the loss of four pumps with four loops in operation.
s transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A) e is used to calculate the loop and core flow during the transient, the time of reactor trip based he calculated flows, the nuclear power transient, and the primary system pressure and perature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux DNBR transient based on the nuclear power core inlet enthalpy and flow and core exit sure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, as ussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR. The lts met the applicable limit as specified in Section 4.4.
method of analysis and the assumptions made regarding initial operating conditions and tivity coefficients are identical to those discussed in Section 15.3.1, except that following the of power supply to all pumps at power, a reactor trip is actuated by reactor coolant pump erspeed.
ults ures 15.3-5 through 15.3-8 show the transient response for the loss of power to all reactor lant pumps. The reactor is assumed to be tripped on an underspeed signal. Figure 15.3-8 ws the DNBR to be always greater than the limit value.
ve their respective initial values.
calculated sequence of events is shown in Table 15.3-1. The reactor coolant pumps continue oastdown, and natural circulation flow is eventually established, as demonstrated in tion 15.2.6. With the reactor tripped, a stable plant condition would be attained. Normal plant tdown may then proceed.
.2.3 Underfrequency ss of forced primary coolant flow can result from a reduction in reactor coolant pump motor ply frequency. Therefore, the complete loss of flow accident was also analyzed where the ating event is a frequency decay. The same signals which provide the necessary protection inst a complete loss of flow provide for protection against an underfrequency event. The lysis is the same as that for the complete loss of flow with the exception of the simulation of frequency decay. That is, rather than the reactor coolant pumps coasting down freely, the rease in electrical frequency (5 Hz/sec) decelerates the reactor coolant pumps faster than a loss ower.
ults ures 15.3-13 through 15.3-16 show the transient response for the frequency decay to all tor coolant pumps. The minimum DNBR is greater than the limit value, as shown on ure 15.3-16. The calculated sequence of events table is shown in Table 15.3-1A.
.2.4 Conclusions analyses performed have demonstrated that for the complete loss of forced reactor coolant
, the DNBR does not decrease below the limit value at any time during the transient. Thus, no or clad damage is predicted, and all applicable acceptance criteria are met.
3.2.5 Radiological Consequences omplete loss of reactor coolant flow from full load results in a reactor and turbine trip.
uming in addition that the condenser is not available, atmospheric steam dump would be uired. The quantity of steam released would be the same as for a loss of offsite power incident.
ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
.3.1 Identification of Causes and Accident Description accident postulated is an instantaneous seizure of a reactor coolant pump rotor. Flow through affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a flow signal.
owing initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the m generators is reduced, first because the reduced flow results in a decreased tube side film fficient and then because the reactor coolant in the tubes cools down while the shell side perature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion he coolant in the reactor core, combined with reduced heat transfer in the steam generators, ses an insurge into the pressurizer and a pressure increase throughout the reactor coolant em. The insurge into the pressurizer compresses the steam volume, actuates the automatic y system, opens the power-operated relief valves, and opens the pressurizer safety valves, in sequence. The two power-operated relief valves are designed for reliable operation and would xpected to function properly during the accident. However, for conservatism, their pressure ucing effect, as well as the pressure reducing effect of the spray, are not included in the lysis.
s event is classified as an ANS Condition IV incident (a limiting fault) as defined in tion 15.0.1.
3.3.2 Analysis of Effects and Consequences hod of Analysis o digital-computer codes are used to analyze this transient. The RETRAN Code CAP-14882-P-A) is used to calculate the resulting loop and core flow transients following the p seizure, the time of reactor trip based on the loop flow transients, the nuclear power owing reactor trip, and to determine the peak pressure. The thermal behavior of the fuel ted at the core hot spot is investigated using the VIPRE Code (Section 4.4), which uses the flow and the nuclear power calculated by RETRAN. The VIPRE Code includes a film ing heat transfer coefficient.
o case were analyzed:
- 1. Peak clad temperature (PCT) reactor coolant system (RCS) over pressurization, four loops in operation, one locked rotor.
- 2. Rods-in-DNB, four loops in operation, one locked rotor.
he beginning of the PCT/RCS over pressurization (i.e., at the time the shaft in one of the tor coolant pumps is assumed to seize) the plant is assumed to be in operation under the most
nt characteristics and initial conditions are further discussed in Section 15.0.3. The accident as luated bounds with and without offsite power available, with the loss of one protection train.
bound the scenario of a loss of offsite power, power to the unaffected pumps is assumed to be simultaneously with a reactor trip.
the peak pressure evaluation, the initial pressure is conservatively estimated as 50 psi above inal pressure (2,250 psia) to allow for errors in the pressurizer pressure measurement and trol channels. This is done to obtain the highest possible rise in the coolant pressure during the sient. Figure 15.3-10 shows the typical pressure response at the point of maximum pressure in cold leg as well as the lower plenum of the reactor vessel.
cond case was run with VIPRE-D to confirm that the number of rods-in-DNB is less than that med in the radiological analysis. Initial core power was assumed to be at its nominal value sistent with steady-state, full power operation. The reactor coolant system (RCS) pressure and rage coolant temperature were assumed to be at their nominal values. Minimum measured is also assumed. Uncertainties in initial conditions were accounted for in the DNBR limit e as described in the Statistical DNBR Evaluation Methodology (VEP-NE-2-A). Results of rods-in-DNB analysis using VIPRE-D demonstrated DNBR remains above the applicable t as specified in Section 4.4.
luation of the Pressure Transient er pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is med to begin one second after the flow in the affected loop reaches 85 percent of nominal
. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer y, steam dump, or controlled feedwater flow after plant trip. Although these operations are ected to occur and would result in a lower peak pressure, an additional degree of conservatism rovided by ignoring their effect.
pressurizer safety valves start to open at 2,575 psia and are fully open at 2,652 psia.
luation of DNB in the Core during the Accident this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the sequences, with respect to fuel rod thermal transients, is performed with VIPRE-01 (WCAP-65-P-A). Results obtained for analysis of this hot spot condition represent the upper limit h respect to clad temperature and zirconium water reaction.
he evaluation, the rod power at the hot spot is conservatively assumed to exceed 2.6 times the rage rod power (i.e., FQ = 2.6) at the initial core power level.
film boiling coefficient is calculated in the VIPRE-01 Code (WCAP-14565-P-A) using the hop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film perature (average between wall and bulk temperatures). The program calculates the film fficient at every time step, based upon the actual heat transfer conditions at the time. The tron flux, system pressure, bulk density, and mass flow rate as a function of time are used as gram input.
l Clad Gap Coefficient magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap fficient) has a pronounced influence on the thermal results. The larger the value of the gap fficient, the more heat is transferred between pellet and clad. Based on investigations on the ct of the gap coefficient upon the maximum clad temperature during the transient, the gap fficient in the VIPRE-01 (WCAP-14565-P-A) analysis was assumed to increase from a steady e value consistent with initial fuel temperature to 10,000 Btu/hr-ft2 -°F at the initiation of the sient. Thus, the large amount of energy stored in the fuel because of the small initial value is ased to the clad at the initiation of the transient.
onium Steam Reaction zirconium steam reaction can become significant above 1,800°F (clad temperature). The er-Just parabolic rate equation shown below is used to define the rate of the zirconium steam tion.
d(w2)/dt = 33.3 x 106exp((-45500/1.986T))
re:
w = amount reacted (mg/cm2) t = time (sec)
T = temperature (K) reaction heat is 1,510 cal/gm.
effect of zirconium-steam reaction is included in the calculation VIPRE-01 (WCAP-14565-
) of the hot spot clad temperature transient.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
transient results for the peak clad temperature and over pressurization cases are shown on ures 15.3-9 through 15.3-12. The results of these calculations are also summarized in le 15.3-2. The peak RCS pressure reached during the transient is less than that which would se stresses to exceed the faulted condition stress limits (approximately 3,200 psig). Also, the k clad surface temperature is considerably less than 2,700°F. It should be noted that the clad perature was conservatively calculated assuming that DNB occurs at the initiation of the sient.
3.3.3 Conclusions
- 1. Since the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.
- 2. Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2,700°F, the core remains in place and intact with no loss of core cooling capability.
3.3.4 Radiological Consequences postulated that if a locked rotor accident occurs, the activity in the gap of the fuel rods ering clad damage is released to the reactor coolant. The released activity leaks to the ondary side of the steam generator at a leak rate of 1 gpm. Seven percent of the fuel rods in the are postulated to have clad damage for four-loop operation. Secondary coolant activities are med to be at Technical Specification concentration. A main steam pressure relief valve is tulated to stick open, thereby allowing one steam generator to empty. All the initial secondary fluid, plus the feedwater flow and the primary coolant leakage to that steam generator for the 20 minutes, is assumed to be released to the atmosphere. The affected steam generator is ated, by operator action, to close the isolation valve upstream of the relief valve within 20 utes. A partition factor of 0.01 for iodine occurs between the water and steam phases in the ffected steam generators during the course of the accident. The iodine partition factor for the cted steam generator is assumed to be 1.0. The release to the environment continues for 35.75 rs, after which RHR is used for cooldown and steaming is not required.
site power is assumed to be lost, thereby making the condenser unavailable for steam dump.
radiological consequences of a postulated locked rotor accident are reported in Table 15.0-8.
assumptions used to perform this evaluation are summarized in Tables 15.3-3 and 15.6-12 the control room.
evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The ological consequences of the locked rotor accident are within the TEDE limits defined by CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, and 2.5 rem to the EAB and LPZ.
.4.1 Identification of Causes and Accident Description accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as ussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, ugh the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor ure event. Reactor trip is initiated on a low flow signal in the affected loop.
owing initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the m generators is reduced, first because the reduced flow results in a decreased tube side film fficient and then because the reactor coolant in the tubes cools down while the shell side perature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion he coolant in the reactor core, combined with reduced heat transfer in the steam generators ses an insurge into the pressurizer and a pressure increase throughout the reactor coolant em. The insurge into the pressurizer compresses the steam volume, actuates the automatic y system, opens the power-operated relief valves, and opens the pressurizer safety valves, in sequence. The two power-operated relief valves are designed for reliable operation and would xpected to function properly during the accident. However, for conservatism, their pressure ucing effect, as well as the pressure reducing effect of the spray, is not included in the analysis.
s event is classified as an ANS Condition IV incident (a limiting fault) as defined in tion 15.0.1.
locked rotor analysis described in Section 15.3.3 conservatively bounds both the locked rotor shaft break transients.
.4.2 Conclusions radiological consequences of a reactor coolant pump shaft break are no worse than those ulated for the locked rotor incident (Section 15.3.3). With a failed shaft, the impeller could ceivably be free to spin in a reverse direction as opposed to being fixed in position, as assumed he locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a ht decrease in the end point (steady state) core flow. For both the shaft break and locked rotor dents, reactor trip occurs very early in the transient. In addition, the locked rotor analysis servatively assumes that DNB occurs at the beginning of the transient.
3.5 REFERENCES
FOR SECTION 15.3
-1 WCAP-14882-P-A, April 1999, D. S. Huegel, et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
-2 WCAP-14565-P-A, 1999, Y. X. Sung, et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
Frequency Transients in Westinghouse PWRs.
-4 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
A DECREASE IN REACTOR COOLANT SYSTEM FLOW Accident Event Time (sec) rtial loss of forced reactor olant flow ur loops operating, one pump Coastdown begins 0.0 asting down Low flow reactor trip 1.7 Rods begin to drop 2.7 Minimum DNBR occurs 3.6 mplete loss of forced reactor All operating pumps lose power and begin 0.0 olant flow coasting down Reactor coolant pump underspeed trip point 0.9 reached Rods begin to drop 1.5 Minimum DNBR occurs 3.3 actor coolant pump shaft Rotor on one pump locks 0.0 zure (locked rotor) Low flow trip point reached 0.06 ithout offsite power)
Rods begin to drop 1.06 Remaining pumps begin to coast down 1.06 Maximum clad temperature 3.7 Maximum RCS pressure occurs 4.1
Accident Event Time (sec) derfrequency Event All operating pumps lose power and begin coasting 0.00 down Reactor coolant pump underspeed trip point reached 1.0 Rods begin to drop 1.6 Minimum DNBR occurs 3.7
Without Offsite Power Four Loops Initially Operating ximum Reactor Coolant System Pressure (psia) 2658 ximum Clad Temperature (°F) Core Hot Spot 1718.3 H20 Reaction at Core Hot Spot (percent by weight) 0.22
Fuel Damage 7% Fuel Failure Radial Peaking Factor: 1.7 Primary to Secondary Leak rate: 0.35 gpm (affected SG) 0.65 gpm (intact SGs)
Release from secondary side is coincident with loss of off-site power Release Points: (1)
Off site Ground level- ventilation vent Control Room MSPRVs / MSSVs Iodine Chemical Form Released to Environment: Elemental 97%
Organic 3%
Fraction of Fission Product Inventory in Gap: Halogens 0.08 Noble Gases 0.10 Alkali Metals 0.12 Iodine Partitioning in Intact Steam Generator 100 Intact Steam Generator Tube Uncovery No tube bundle uncovery assumed.
Affected steam generator goes dry, immediately 100% flashing is assumed in affected SG Release Duration Intact Steam Generators 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> Affected Steam Generator 20 minutes (operator action)
Total Steam Flows to Atmosphere from Intact 0-2 hours: 432,000 lbm SGs 2-11hours: 1,328,000 lbm 8-11 hours: 820,800 lbm 11-24 hours: 1,918,222 lbm 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 196,515 lbm Mass Flow Rates from Intact Steam Generators 0-2 hours: 2.16E+05 lbm/hr 2-11hours: 1.48E+05 lbm/hr 11-24 hours: 1.48E+05 lbm/hr 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 1.67E+04 lbm/hr Moisture carryover in intact Steam Generators: 1%
Initial Steam Generator Liquid Mass 4.582E+07 grams / SG Control Room Parameters See Table 15.6-12 TES:
X/Qs are from Table 15.0-11. EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
ONE PUMP COASTING DOWN PUMP COASTING DOWN s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FOUR PUMPS COASTING DOWN COASTING DOWN s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.3-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
s figure shows typical Locked Rotor RCS Pressure transient results and should not be relied n for an absolute value of the RCS Pressure.
FIGURE 15.3-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
TRANSIENTS, ONE LOCKED ROTOR FIGURE 15.3-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
ROTOR FIGURE 15.3-12 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
FREQUENCY DECAY FOUR PUMPS EXPERIENCING FREQUENCY DECAY PUMPS EXPERIENCING FREQUENCY DECAY FREQUENCY DECAY s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
umber of faults have been postulated which could result in reactivity and power distribution malies. Reactivity changes could be caused by control rod motion or ejection, boron centration changes, or addition of cold water to the reactor coolant system (RCS). Power ribution changes could be caused by control rod motion, misalignment, or ejection, or by static ns such as fuel assembly mislocation. These events are discussed in this section. Detailed lyses are presented for the most limiting of these events.
cussions of the following incidents are presented in Section 15.4.
- 1. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.
- 2. Uncontrolled rod cluster control assembly bank withdrawal at power
- 3. Rod cluster control assembly misalignment.
- 4. Startup of an inactive reactor coolant pump at an incorrect temperature.
- 5. A malfunction or failure of the flow controller in a BWR loop that results in an increased reactor coolant flow rate (Not applicable to Millstone 3).
- 6. Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant.
- 7. Inadvertent loading and operation of a fuel assembly in an improper position.
- 8. Spectrum of rod cluster control assembly ejection accidents.
s 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II nts, Item 7 is an ANS Condition III event, and Item 8 is an ANS Condition IV event. Item 3 ils both Condition II and III events. Section 15.0.1 contains a discussion of ANS sifications.
4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION
.1.1 Identification of Causes and Accident Description d cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled ition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power ursion. Such a transient could be caused by a malfunction of the reactor control or rod control ems. This could occur with the reactor subcritical at hot zero power or at power. The at er case is discussed in Section 15.4.2.
imum rate of reactivity increase in the case of boron dilution is less than that assumed in this lysis (Section 15.4.6).
RCCA drive mechanisms are wired into preselected bank configurations which are not red during reactor life. These circuits prevent the RCCAs from being automatically withdrawn ther than their respective banks. Power supplied to the banks is controlled such that no more two banks can be withdrawn at the same time and in their proper withdrawal sequence. The CA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide able speed travel. The maximum reactivity insertion rate analyzed in the detailed plant lysis is that occurring with the simultaneous withdrawal of the combination of two sequential trol banks having the maximum combined worth at maximum speed.
s event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined ection 15.0.1.
neutron flux response to a continuous reactivity insertion is characterized by a very fast rise inated by the reactivity feedback effect of the negative Doppler coefficient. This self tation of the power excursion is of primary importance since it limits the power to a tolerable l during the delay time for protective action. Should a continuous RCCA withdrawal accident ur, the transient is terminated by the following automatic features of the reactor protection em.
- 1. Source range high neutron flux reactor trip Actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.
- 2. Intermediate range high neutron flux reactor trip Actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two out of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.
- 3. Power range high neutron flux reactor trip (low setpoint)
Actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two out of the four power range channels indicate a power level
- 4. Power range high neutron flux reactor trip (high setpoint)
Actuated when two out of the four power range channels indicate a power level above a preset setpoint.
- 5. Power range neutron flux high positive rate reactor trip Actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicates a rate above the preset setpoint.
In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.
.1.2 Analysis of Effects and Consequences hod of Analysis transient is analyzed by the RETRAN digital computer code. This code includes the ulation of prompt and delayed neutrons (using the six-group model), the thermal kinetics of fuel and moderator and the balance of the NSSS primary and secondary coolant system.
rmal feedback is modeled via temperature dependent coefficients of reactivity. A detailed core mal/hydraulics analysis, performed with the VIPRE-D computer code, demonstrates that ding integrity is maintained throughout the transient. The analysis conservatively accounts for ievable power distribution at low power.
nt characteristics and initial conditions are discussed in Section 15.0.3. In order to give servative results for a startup accident, the following assumptions are made.
- 1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low (least negative) values as a function of temperature are used. See Section 15.0.4 and Table 15.0-2.
- 2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A conservative positive value is used in the analysis to yield the maximum peak heat flux.
Tavg of 557°F. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect, thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.
- 4. Reactor trip is assumed to be initiated by power range high neutron flux (low setpoint). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10 percent increase is assumed for the power range flux trip setpoint, raising it from the nominal value of 25 percent to 35 percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.0.5 for RCCA insertion characteristics.
- 5. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute).
Control rod drive mechanism design is discussed in Section 4.6.
- 6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.
- 7. The initial power level was assumed to be below the power level expected for zero power (just critical) condition (10-13 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
- 8. Three reactor coolant pumps (RCPs) are assumed to be in operation.
nt systems and equipment, which are available to mitigate the effects of the accident, are ussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
ce the power range high neutron flux (low setpoint) is not required to be OPERABLE in des 3, 4 or 5, plant administrative controls have been implemented to preclude an uncontrolled bank withdrawal from occurring in these Modes when plant conditions are not bounded by assumptions described herein.
ures 15.4-1 and 15.4-3 show the transient behavior for the uncontrolled RCCA bank hdrawal incident, with the accident terminated by reactor trip at 35 percent of nominal power.
reactivity insertion rate used is greater than that calculated for the two highest worth uential control banks, both assumed to be in their highest incremental worth region.
ure 15.4-1 shows the neutron flux and core heat flux transients. The peak heat flux does not rshoot the nominal full power value.
energy release and the fuel temperature increases are relatively small. The thermal flux onse, of interest for DNB considerations, is shown on Figure 15.4-1. The beneficial effect of inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the full power inal value. There is an adequate margin to DNB during the transient since the rod surface heat remains below the design value, and there is a high degree of subcooling at all times in the
. Figure 15.4-3 shows the response of the hot spot fuel and cladding temperatures. The fuel perature increases to a value lower than the nominal full power value. The minimum DNBR, ll times, remains above the limit value.
calculated sequence of events for this accident is shown in Table 15.4-1. With the reactor ped, the plant returns to a stable condition. The plant may subsequently be cooled down her by following normal plant shutdown procedures.
.1.3 Conclusions he event of a RCCA withdrawal accident from the subcritical condition, the core and the RCS not adversely affected, since the combination of thermal power and the coolant temperature lt in a DNBR greater than the limit value. The DNBR design basis is described in Section 4.4; licable acceptance criteria have been met.
4.1.4 Radiological Consequences ce no fuel damage is postulated following an uncontrolled rod cluster control assembly bank hdrawal from a subcritical or low power startup condition event, a specific radiological release ulation was not performed.
.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER
.2.1 Identification of Causes and Accident Description ontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since heat extraction from the steam generator lags behind the core power generation until the steam erator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor lant temperature. Unless terminated by manual or automatic action, the power mismatch and ltant coolant temperature rise could eventually result in DNB. Therefore, in order to avert
s event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined ection 15.0.1.
automatic features of the reactor protection system which prevent core damage following the tulated accident include the following:
- 1. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint, or a high positive rate setpoint.
- 2. Reactor trip is actuated if any two out of four channels exceed the high positive neutron flux rate setpoint.
- 3. Reactor trip is actuated if any two out of four channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
- 4. Reactor trip is actuated if any two out of four channels exceed an overpower T setpoint.
- 5. A high pressurizer pressure reactor trip is actuated from any two out of four pressure channels, which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
- 6. A high pressurizer water level reactor trip is actuated from any two out of three level channels when the reactor power is above approximately 10 percent (Permissive P-7).
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- 1. high neutron flux (one out of four power range);
- 2. overpower T (two out of four); and
- 3. overtemperature T (two out of four).
manner in which the combination of overpower and overtemperature T trips provide ection over the full range of RCS conditions is described in Chapter 7. Figure 15.0-1 presents wable reactor coolant loop average temperature and T for the design power distribution and as a function of primary coolant pressure. The boundaries of operation defined by the rpower T trip and the overtemperature T trip are represented as protection lines on the ram. The protection lines are drawn to include all adverse instrumentation and setpoint errors hat under nominal conditions trip would occur well within the area bounded by these lines.
safety analysis limit value. All points below and to the left of a DNB line for a given pressure e a DNBR greater than the safety analysis limit value. The diagram shows that DNB is vented for all cases if the area enclosed with the maximum protection lines is not traversed by applicable DNBR line at any point.
area of permissible operation (power, pressure, and temperature) is bounded by the bination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low sure (fixed setpoint); overpower and over temperature T (variable setpoints) and the ning of the steam generator safety valve.
.2.2 Analysis of Effects and Consequences hod of Analysis s transient is analyzed by the RETRAN Code (VEP-FRD-41-P-A). This code simulates the tron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, steam generator, and m generator safety valves. The code computes pertinent plant variables including peratures, pressures, and power level. A detailed DNB analysis is performed with the thermal hydraulic computer code VIPRE-D (DOM-NAF-2-P-A). This accident is analyzed with the istical DNBR Evaluation Methodology (VEP-NE-2-A). Plant characteristics and initial ditions are discussed in Section 15.0.3. In order to obtain conservative results for an ontrolled rod withdrawal at power accident, the following assumptions are made.
- 1. Initial reactor power and RCS temperatures are assumed to be at their nominal values consistent with steady state full power operation. The initial RCS pressure is assumed at a nominal value consistent with steady state full power operation.
- 2. Reactivity coefficients - two cases are analyzed:
- a. Minimum reactivity feedback.
A moderator temperature coefficient of 0 pcm/°F is assumed for power
> 70 percent.
A positive moderator temperature coefficient of reactivity is assumed for power 70 percent corresponding to the beginning of core life. A conservatively small (in absolute magnitude) Doppler temperature coefficient is assumed.
- b. Maximum reactivity feedback A conservatively large negative moderator temperature coefficient and a large (in absolute magnitude) negative Doppler temperature coefficient are assumed.
value of 116.5 percent nominal full power. The T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.
- 4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
- 5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.
- 6. Cases are analyzed for operation with four loops in service, assuming a spectrum of reactivity insertion rates and initial reactor power levels.
- 7. To be conservative with respect to DNB, the pressurizer spray system and relief valves are assumed operational since they limit the reactor coolant pressure increase.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident. A discussion of cipated transients without trip (ATWT) considerations is presented in Section 15.8.
ults ures 15.4-4 through 15.4-6 show the transient response for a rapid RCCA withdrawal incident ting from full power and assuming a 100 pcm/sec. withdrawal rate. Reactor trip on high tron flux occurs shortly after the start of the accident. Since this is rapid with respect to the mal time constants of the plant, small changes in Tavg result and margin to DNB is ntained. The design basis for DNBR is described in Section 4.4.
transient response for a slow RCCA withdrawal from full power assuming a 1.5 pcm/sec.
hdrawal rate is shown on Figures 15.4-7 through 15.4-9. Reactor trip on over temperature T urs after a longer period and the rise in temperature is consequently larger than for rapid CA withdrawal. Again, the minimum DNBR is greater than the safety analysis limit value.
ure 15.4-10 shows the minimum DNBR as a function of reactivity insertion rate from initial power operation for minimum and maximum reactivity feedback. It can be seen that two tor trip channels provide protection over the whole range of reactivity insertion rates. These the high neutron flux and overtemperature T channels. The minimum DNBR is never less the safety analysis limit value.
ures 15.4-11 and 15.4-12 show the minimum DNBR as a function of reactivity insertion rate RCCA withdrawal incidents starting at 60 and 10 percent power, respectively. The results are ilar to the 100 percent power case, except as the initial power is decreased, the range over
gn basis is met for all cases.
shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced res is due both to reactor core and coolant system transient response and to protection system on in initiating a reactor trip.
erring to the minimum feedback cases in Figure 15.4-10, for example, it is noted that:
- 1. For high reactivity insertions (i.e., higher than 10 pcm/sec), reactor trip is initiated by the high neutron flux trip relatively early in the transient. The neutron flux level in the core rises rapidly for these insertion rates while the core heat flux and coolant system pressure lag behind due to the thermal capacity of the fuel and coolant. Thus, the reactor is tripped prior to a significant increase in heat flux of coolant temperature with resultant high minimum DNBRs for these cases.
- 2. As reactivity insertion is decreased, reactor trip on high neutron flux occurs later in the transient allowing for greater increases in core heat flux and coolant temperatures. As a result, for reactivity insertions between 10 pcm/sec and 2 pcm/
sec, the minimum DNBRs decrease rapidly, but always remain above the safety analysis limit value.
- 3. Reactor trip on over temperature T (OTT) occurs for very low reactivity insertion rates (i.e., below 2 pcm/sec). These cases experience the largest increase in coolant temperature and are, therefore, typically limiting with respect to DNBR.
However, the minimum DNBR for these cases also remains above the safety analysis limit value.
ce the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures during the transient until after reactor trip occurs. For high reactivity insertion rates, the rpower transient is fast with respect to the fuel rod thermal time constant, and the core heat lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed
.5 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the l core power distribution, the peak fuel center-line temperature still remains below the fuel ting temperature.
slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the tron flux. The overpower transient is terminated by the over temperature T reactor trip before NB condition is reached. The peak heat flux again is maintained below 116.5 percent of its inal value. Taking into account the effect of the RCCA withdrawal on the axial core power ribution, the peak fuel center-line temperature remains below the fuel melting temperature.
reactor is tripped sufficiently fast during the RCCA withdrawal at power transient to ensure the ability of the primary coolant to remove heat from the fuel rods in not reduced. Thus, the cladding temperature does not rise significantly above its initial value during the transient.
sequently be cooled down further by following normal plant shutdown procedures.
.2.3 Conclusions high neutron flux and over temperature T trip channels provide adequate protection over the re range of possible reactivity insertion rates.
.2.4 Radiological Consequences reactor trip causes a turbine trip and heat is removed from the secondary system through the m generator power relief valves or safety valves. Since no fuel damage is postulated to occur owing an uncontrolled rod cluster control assembly bank withdrawal at power event, a specific ological release calculation was not performed.
.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT
.3.1 Identification of Causes and Accident Description CA misalignment accidents include:
- 1. a dropped full length assembly;
- 2. a dropped full length assembly bank;
- 3. Statically misaligned full length assembly (Table 15.4-2); and
- 4. withdrawal of a single full length assembly.
h RCCA has a position indicator channel which displays position of the assembly. The lays of assembly positions are grouped for the operators convenience. Fully inserted mblies are further indicated by a rod at bottom signal, which actuates an indicating light and unciator in the control room. Group demand position is also indicated.
length RCCAs are always moved in preselected banks, and the banks are always moved in same preselected sequence. Each bank of RCCAs is divided into two groups. The rods prising a group operate in parallel through multiplexing thyristors. The two groups in a bank ve sequentially such that the first group is always within one step of the second group in the
- k. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism.
ce the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a group are driven in parallel, any single failure which would cause rod withdrawal would ct a minimum of one group. Mechanical failures are in the direction of insertion, or obility.
tion 15.0.1. The single RCCA withdrawal incident is classified as an ANS Condition III event, iscussed below.
single electrical or mechanical failure in the rod control system could cause the accidental hdrawal of a single RCCA from the inserted bank at full power operation. The operator could berately withdraw a single RCCA in the control bank since this feature is necessary in order to ieve an assembly should one be accidentally dropped. The event analyzed must result from tiple wiring failures or multiple deliberate operator actions and subsequent and repeated rator disregard of event indication. It is the position of Westinghouse that the probability of h a combination of conditions is so low that the limiting consequences may include slight fuel age.
s, consistent with the philosophy and format of ANSI N18.2, the event is classified as a dition III event. By definition Condition III occurrences include incidents, any one of which occur during the lifetime of a particular plant, and shall not cause more than a small tion of fuel elements in the reactor to be damaged...
s selection of criterion is not in violation of General Design Criterion (GDC) 25 which states, e protection system shall be designed to assure that specified acceptable fuel design limits are exceeded for any single malfunction of the reactivity control systems, such as accidental hdrawal (not ejection or dropout) of control rods. (Emphasis has been added). It has been wn that failures resulting in RCCA bank withdrawal do not violate specified fuel design limits.
reover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is cluded that criterion established for the withdrawal of a single RCCA at power is appropriate in accordance with GDC 25.
ropped assembly bank is detected by:
- 1. sudden drop in the core power level as seen by the nuclear instrumentation system;
- 2. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
- 3. rod at bottom signal;
- 4. rod deviation alarm;
- 5. rod position indication.
Misaligned assemblies are detected by:
- 1. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
- 3. rod position indicators.
resolution of the rod position indicator is +/- 4 steps (+/- 2.5 inches). The computer or rod ition indication system deviation alarms alert the operator to a control rod deviation greater 12 steps (+/- 7.5 inches) with respect to the group position or any other rod in a group.
iation of any rod control bank assembly from its group by twice this distance (24 steps or 15 es) will not cause power distribution worse than the design limits.
ne or more rod position indicator channels should be out of service, detailed operating ructions shall be followed to assure the alignment of the nonindicated assemblies. The rator is also required to take action as required by the Technical Specifications.
he extremely unlikely event of simultaneous electrical failures which could result in single CA withdrawal, rod deviation would be displayed on the plant annunciator, and the rod ition indicators would indicate the relative positions of the assemblies in the bank. Withdrawal single RCCA by operator action, whether deliberate or by a combination of errors, would lt in activation of the same alarm and the same visual indications. Withdrawal of a single CA results in both positive reactivity insertion tending to increase in core power, and an ease in local power density in the core area associated with the RCCA. Automatic protection this event is provided by the overtemperature T reactor trip, although due to the increase in l power density it is not possible in all cases to provide assurance that the core safety limits not violated.
nt systems and equipment which are available to mitigate the effects of the various control rod operations are discussed in Section 15.0.8 and listed in Table 15.0-6. (Note that automatic ection for the dropped assembly and dropped assembly bank events is provided by the rtemperature T, overpower T and low pressurizer pressure functions. However, the analysis ws that their actuation is not required.) No single active failure in any of these systems or ipment will adversely affect the consequences of the accident.
.3.2 Analysis of Effects and Consequences
- 1. Dropped assembly, dropped assembly bank, and statically misaligned assembly.
Method of Analysis
- a. One or more dropped assemblies from the same group.
For evaluation of the dropped assembly event, the transient system response is calculated using the LOFTRAN code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.
power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using dropped rod limit lines developed with VIPRE-D.
The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in WCAP-11395-A, Methodology for the Analysis of the Dropped Rod Event.
- b. Statically misaligned RCCA Steady state power distribution are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then compared to peaking factor limits developed using the VIPRE-D code, which are based on meeting the DNB design criterion.
Results
- a. One or more dropped RCCAs Single or multiple RCCAs within the same group result in a negative reactivity insertion (maximum absolute value for RCCA worth used in the analysis is a conservatively large 1000 pcm). The core is not adversely affected initially following a dropped RCCA(s) event since power is decreasing rapidly. Power may be re-established either by reactivity feedback or control bank withdrawal. The automatic rod withdrawal feature of the rod control system has been disabled. Therefore, following a dropped rod event the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, and a power overshoot is not predicted.
Figures 15.4-13 and 15.4-14 are generic curves for a typical transient response to a dropped RCCA (or RCCAs) without automatic rod withdrawal. In all cases, the minimum DNBR remains above the limit values.
Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.
- b. Dropped RCCA bank A dropped RCCA bank typically results in a reactivity insertion with an absolute value greater than 500 pcm. The core is not adversely affected during the insertion period, since power is decreasing rapidly. The transient
the plant.
- c. Statically misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is inserted to rod insertion limits with one D bank rod fully withdrawn, or any one RCCA fully inserted. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one control rod fully inserted, or any one D bank control rod fully withdrawn without the DNBR failing below the limiting value.
The insertion limits in the Technical Specifications may vary depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor (Section 4.4) allows. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.
For the RCCA misalignment with bank D inserted to its full power insertion limit and one other RCCA fully inserted, DNBR does not fall below the limit value. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case was analyzed assuming at nominal full power, nominal RCS pressure, nominal RCS average temperature, and minimum measured RCS flow, with the increased radial peaking factor associated with the misaligned RCCA.
Calculations have not been specifically performed for RCCAs missing from other control banks which are permitted to be either fully or partially inserted at part power conditions. However, it has been determined on a generic basis that the increase in radial peaking factor necessary to reach the DNBR limit at reduced power conditions is greater than the credible increase in radial peaking factors associated with reduced thermal power levels and deeper permitted control bank insertion. Therefore, the full power case discussed above with bank D at the insertion limit is more limiting than any credible part power RCCA misalignment scenario involving rods at the rod insertion limit.
with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, but with the increased radial peaking factor associated with the misaligned RCCA.
DNB does not occur for the RCCA misalignment incident, and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.
Following the identification of an RCCA misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.
- 2. Single RCCA Withdrawal Method of Analysis Core power distributions simulating a single RCCA withdrawal event are calculated using the computer code Simulate5. The case of the worst rod withdrawal from control bank D inserted at the insertion limit, with the reactor initially at full power, is identified and analyzed. The purpose of this calculation is to confirm that the number of fuel rods that experience DNB is less than the safety analysis limit of 5 percent. The Simulate5 calculated peaking factors are compared to the design peaking factor used to set the over temperature T trip. Over temperature T trip setpoints are established to prevent exceeding DNBR limits. If the calculated peaking factors are above the design peaking factor limit, including appropriate calculational uncertainty, a fuel census is generated for the most limiting case to determine the percentage of rods in the core which exceed the design peaking factor. All rods which exceed the design peaking factor are assumed to undergo DNB prior to reaching the power and coolant conditions that would trip the plant on over temperature T.
The Simulate5 calculations are performed at the time in core life which has the highest peak FH. Power distributions are generated for unique combinations of control bank D inserted to the full power insertion limit, with one control bank D RCCA fully withdrawn. Xenon reconstruction is used to skew the axial flux difference to the upper allowable limit. The most limiting configuration is determined by the case that produces the highest peaking factors under these conditions.
- a. Since the automatic rod withdrawal capability has been disabled, only the manual case for the single rod withdrawal event is considered. Continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the over temperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the safety analysis limit value is 5 percent.
For the above event a reactor trip results, although not sufficiently fast in all instances to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures may be followed to further cooldown the plant.
.3.3 Conclusions cases of dropped single RCCAs or dropped banks, the DNBR remains greater than the limit e; therefore, the DNB design basis is met.
all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limit with any le RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than limit value. Thus, the DNB design basis as described is Section 4.4 is met.
the case of the accidental withdrawal of a single RCCA, with the reactor initially operating at power with bank D at the insertion limit, an upper bound of the number of fuel rods eriencing DNB is 5 percent of the total fuel rods in the core.
.3.4 Radiological Consequences pecific radiological release calculation was not performed following a rod cluster control mbly misoperation. The cases of dropped single RCCAs or dropped banks, and the case of ically misaligned RCCA, do not result in a fuel failure. The case of accidental withdrawal of a le RCCA results in a limited fuel damage which is bounded by the reactor coolant pump shaft ure event discussed in Section 15.3.3.
s accident is precluded by technical specifications and administrative procedures.
.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE s section is not applicable to Millstone 3.
.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT
.6.1 Identification of Causes and Accident Description accident scenario considered here is the inadvertent opening of the primary water makeup trol valve and failure of the blend system, either by controller or mechanical failure. The ition of unborated water to the RCS results in a positive reactivity insertion and an erosion of ilable shutdown margin. For at power and start-up conditions, technical specification Modes 1 2, the dilution accident erodes the shutdown margin made available through reactor trip. For tdown mode initial conditions, technical specification Modes 3, 4, 5, and 6, the dilution dent erodes the shutdown margin inherent in the borated RCS inventory and that which may rovided by control rods (control and shutdown banks) made available through reactor trip.
accident is mitigated by the manual isolation of the dilution flow path and the initiation of ated flow to the RCS. Unchecked, the reactivity addition due to an inadvertent boron dilution lead to the loss of shutdown margin. In Modes 1 and 2 (power and start-up), this would result n increase in power level and/or loss of the capability to maintain subcriticality following the of the control rods. In the shutdown modes, the reactivity insertion may cause criticality and plete loss of shutdown margin if all control rods are inserted or may cause complete loss of tdown margin and criticality following reactor trip if rods were available for insertion.
the at power modes, the analysis is performed to identify the amount of time available for rator mitigation of an inadvertent boron dilution prior to complete loss of shutdown margin.
calculated time is presented as that required for operator or automatic action to effectively gate the accident prior to complete loss of shutdown margin. For the shutdown modes, lyses are performed to define minimum shutdown margin requirements. These shutdown gin requirements ensure that minimum time requirements are met for the time from alarm/
cation to loss of shutdown margin. The analyses for all modes are performed employing servative assumptions.
r to complete loss of shutdown margin, RCS and core transient parameters are predicted to be hin the bounds of those calculated for other FSAR non-LOCAs. Therefore, the FSAR boron tion accident is not limiting with respect to the critical non-LOCA acceptance criteria such as
iting Dilution Flow Path limiting dilution flow path is identified as the lowest resistance flow path for an unintentional tion. The boron dilution analysis excludes deliberate dilution operations from considerations.
ing intentional boron dilution operations, the plant operators are keenly aware of and tinuously monitor the dilution process in progress for any sign of deviation or malfunction, h that the possibility of an undetected malfunction is considered remote. This is a standard mption in the boron dilution analysis methodology. Thus the limiting boron dilution flow path s not include either the normal dilute or the alternate dilute flow paths (these paths are used y for deliberate dilution operations). The limiting boron dilution flow path is the makeup flow of the PGS used in normal boration/blend operations.
most probable limiting dilution event is the misoperation of the CVCS reactor makeup trol system (RMCS). The specific accident scenario identified is the inadvertent operation of primary makeup control valve (FCV-111A) and failure of the blend system (either by troller or mechanical failure) which permits the primary makeup water system to inject ctly to the charging pump suction (at the VCT outlet) without being blended with boric acid at maximum rate permitted by the piping system (FT-111 fails forcing FCV-111A in the full-n position). The limiting dilution flow rate for this scenario has been concluded to be 150 gpm Mode 1 through Mode 6. For conservatism, all the analyses for the boron dilution event med 150 gpm dilution flow rate.
these limiting flow rates to be valid, valve V305 must be under strict administrative cedures during Modes 1-6 as required by plant technical specifications.
ety Functions and Mitigating Systems inadvertent boron dilution event due to a CVCS malfunction will be manually terminated.
nual actions taken by the operator are as follows:
Identification of the accident Isolation of the dilution flow path Initiation of RCS boration Manual reactor trip (if necessary) expected sources of dilution may be terminated by closing isolation valves in the CVCS. The shutdown margin (SDM) may be regained by the opening of isolation valves to the RWST, allowing the addition of borated water from the RWST to the RCS.
status of the RCS makeup is continuously available to the operator by the following:
- 2. CVCS and reactor makeup water system (RMWS) status lights for the following pumps:
- a. Charging pumps
- b. Boric acid transfer pumps
- c. Primary grade water supply pumps
- 3. Deviation alarms, if the boric or blended flow rates deviate from the preset values
- 4. Source range neutron flux when the reactor is subcritical
- a. Indicated source range neutron flux count rates
- b. Audible source range neutron flux count rate
- c. Source range neutron flux doubling alarm
- 5. When the reactor is critical
- a. Axial flux difference alarm (reactor power 50 percent RTP)
- b. Control rod insertion limit low and low-low alarms
- c. Overtemperature T alarm (at power)
- d. Overtemperature T turbine runback (at power)
- e. Overtemperature T reactor trip
- f. Power range neutron flux high, both high and low set point reactor trips.
ety Analysis Criteria & Regulatory Requirements s event is classified as an ANS Condition II incident and as such can, at worst, result in a tor trip with the plant capable of complete recovery and resumption of plant operation within requirements of the technical specifications. Condition II criteria are met if analyses results onstrate the following:
- 1. Minimum DNBR is greater than or equal to the design limit
- 2. Fuel centerline temperature is less than 4700°F
se specific criteria satisfy the relevant requirements of 10 CFR Part 50, Appendix A, GDC 10 15, and Section III, Article NB-7000 of the ASME Boiler and Pressure Vessel Code. The lysis assumptions used for this event satisfy the requirements of 10 CFR Part 50, Appendix A, C 26, by assuring that appropriate margin for malfunctions, such as stuck rods, are accounted discussed previously, the analysis for this event determines the amount of time available for rator mitigation of the boron dilution event prior to the complete loss of shutdown margin. If calculated time is accepted as being sufficient, it can be assumed that manual actions will ctively prevent the complete loss of minimum allowable shutdown margin. Because shutdown gin is not lost, the condition of the plant at any point in the transient is within the bounds of e calculated for other FSAR Condition II transients. If the above Condition II criteria are wn to be met for the balance of the FSAR Condition II transients and the calculated amount of e is accepted as sufficient for the successful mitigation of the dilution event, it can be cluded that the above criteria are met for the FSAR boron dilution accident.
ce the sequences of events that may occur depend on plant conditions at the time of the vertent dilution, a broad range of initial operating conditions must be considered. The rating modes to be considered are refueling (Mode 6), cold shutdown (Mode 5), hot shutdown de 4), hot standby (Mode 3), start-up (Mode 2), and power (Mode 1 both automatic and ual rod control). In all cases, the minimum time intervals available to the operator before a of shutdown margin occurs are calculated from the time an alarm alerts the operator to a tion, not from the time the dilution begins. The minimum available operator action times for various modes must be greater than or equal to the following:
de 6 Refueling 30 minutes de 5 Cold Shutdown 15 minutes de 4 Hot Shutdown 15 minutes de 3 Hot Standby 15 minutes de 2 Start-up 15 minutes de 1 Power Operation 15 minutes
.6.2 Analysis of Effects and Consequences hod of Analysis servative analysis assumptions for each mode of operation were used; i.e., high RCS critical on concentrations, high boron worths, minimum shutdown margins, and minimum RCS umes. These assumptions result in conservative determinations of the time available for rator or system response after detection of a dilution transient in progress. For Operating
es are greater than the above specified minimum requirements.
Operating Modes 3, 4, and 5, the boron dilution event is analyzed to generate minimum tdown margin requirements as a function of the critical boron concentration. The solution nique employed assumes the presence of the flux multiplication alarm and quantifies the unt of time available from the triggering of the alarm to the loss of shutdown margin.
each shutdown mode considered, the dilution event is analyzed assuming a conservatively ll dilution volume and the 150 gpm dilution flow rate previously defined. Combinations of al and critical boron concentrations are determined that produce a predicted time to critical corresponds to the minimum safety analysis acceptance criteria. For Modes 3, 4, and 5, the lting shutdown margin versus critical boron concentration curves guarantee the operator a imum of 15 minutes from alarm to criticality following initiation of the assumed boron tion. The analysis assumes that a doubling of the count rate, as detected by the Shutdown gin Monitor (SMM) (see Section 7.6.10), is required to initiate an alarm and a 10-second y time in the actual alarm actuation is also included. Acceptable values of minimum count and alarm ratio for the SMM are specified in the plant Core Operating Limits Report (COLR) ssure that the 15 minute operator action time and count rate doubling criteria are maintained.
ution During Refueling (Mode 6) analysis is not performed for an uncontrolled boron dilution accident during refueling. In this de, the event is prevented by the Technical Specifications for all potentially unborated water s to the CVCS to preclude the addition of unborated water to the reactor vessel via the CVCS.
ution During Cold Shutdown (Mode 5) plant is maintained in the cold shutdown mode when RCS temperatures of less than or equal 00°F are required. Occasionally, reduced RCS Inventory may be necessary. Mode 5 can also transition mode to either refueling (Mode 6) or hot shutdown (Mode 4). The water level can ropped to the midplane of the hot leg for maintenance work that requires the steam generators e drained. Throughout the cycle, the plant may enter Mode 5 if reduced temperatures are uired in containment or as the result of a technical specification action statement. The plant is ntained in Mode 5 at the beginning of cycle for start-up testing of certain systems. During this de of operation, the control banks are fully inserted. The following conditions are assumed for ncontrolled boron dilution during cold shutdown.
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum water volume (3885 ft3) in the RCS is used. This is a conservative estimate of the active volume of the RCS while on one train of residual heat removal (RHR). This active volume does not include the reactor vessel upper head volume.
inistrative controls which isolate the RCS from the potential source of unborated water.
ertheless, analysis has been performed, and shutdown margin versus critical boron centration plots provided for a Mode 5 drained case. The minimum water volume for this nario in the RCS is 3624 ft3.
ution During Hot Shutdown (Mode 4) ode 4, the plant is being taken from a short term mode of operation, cold shutdown (Mode 5),
long term mode of operation, hot standby (Mode 3). Typically, the plant is maintained in the shutdown mode to achieve plant heatup before entering Mode 3. The plant is maintained in de 4 at the beginning of cycle for start-up testing of certain systems. Throughout the cycle, the t will enter Mode 4 if reduced temperatures are required in containment or as a result of a nical specification action statement. During this mode of operation, the control banks are y inserted. In Mode 4 the primary coolant forced flow which provides mixing can be provided ither the RHR system or a reactor coolant pump, depending on system pressure. The owing conditions are assumed for an uncontrolled boron dilution during hot shutdown:
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failure of control valves.
- 2. In this mode for Millstone 3, RCS flow is conservatively assumed to be provided by the RHR system. With no RCP in operation during hot shutdown (with the required RHR pumps in operation), a conservatively low RCS water volume (3885 ft3) is used. This active volume does not include the reactor vessel upper head volume.
- 3. Perfect mixing in the RCS is assumed.
ution During Hot Standby (Mode 3) ing this mode, rod control is in manual and the rods can be either withdrawn or inserted. In de 3, all reactor coolant pumps may not be in operation. In an effort to balance the heat loss ugh the RCS and the heat removal of the steam generators, one or more of the pumps may be t off to decrease heat input into the system. In the approach to Mode 2, the operator must ually withdraw the control rods and may initiate a limited dilution according to shutdown gin requirements not simultaneously. If the shutdown or control banks are withdrawn, the tion scenario is similar to the Mode 2 analysis where the failure to block the source range trip lts in a reactor trip and immediate shutdown of the reactor. The dilution scenario is more ting if the control rods are not withdrawn and the reactor is shut down by boron to the nical specifications minimum requirement for Mode 3. The following conditions are med for an uncontrolled boron dilution during hot standby:
- 2. A minimum water volume (8760 ft3) in the RCS is used. This volume corresponds to the active volume of the RCS with one RCP in operation, excluding the pressurizer and the surge line. The volume specified here is conservative in that no consideration is given to mixing in the upper head region.
- 3. This mode is explicitly analyzed for four-loop operation.
ution During Start-up (Mode 2) his mode, the plant is being taken from one long term mode of operation, hot standby, to ther, power operation. The plant is maintained in the start-up mode only for the purpose of t-up testing at the beginning of each cycle. Assumed conditions at start-up require the reactor ave available at least 1.30 percent k shutdown margin. The following conditions are assumed an uncontrolled boron dilution during start-up:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This active RCS volume for Mode 2 includes the reactor vessel plus the active loops. Nonmixing regions (i.e., the pressurizer and surge line) are not included.
s mode of operation is a transitory operational mode in which the operator intentionally dilutes withdraws control rods to take the plant critical. During this mode, the plant is in manual trol with the operator required to maintain a very high awareness of the plant status. For a mal approach to criticality, the operator must manually initiate a limited dilution and sequently manually withdraw the control rods, a process that takes several hours. The nical specifications require that the shutdown margin shall be determined, prior to roaching criticality, to be above the minimum requirement by verifying that the predicted ition of the rods is within the rod insertion limits, thus assuring that the reactor does not go cal with the control rods below the insertion limits. Once critical, the power escalation must ufficiently slow to allow the operator to manually block the source range reactor trip minally at 105 cps) after receiving P-6 from the intermediate range. Too fast a power escalation e to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time anually block the source range reactor trip. Failure to perform this manual action results in a tor trip and immediate shutdown of the reactor.
wever, in the event of an unplanned approach to criticality or dilution during power escalation le in the start-up mode, the plant status is such that minimal impact will result. The plant will wly escalate in power to a reactor trip on the power range neutron flux low set point. After tor trip, the operator has more than 15 minutes to determine the cause of dilution, isolate the
ution During Power Operation (Mode 1) de 1 is divided into two cases. The first case is with the reactor in the manual Tavg/rod control de; the second case is with the reactor in automatic rod control. With the reactor in manual rod trol, dilution will result in a positive reactivity insertion and the power and temperature rise cause the reactor to reach the over temperature T trip set point resulting in a reactor trip. In case, the boron dilution transient up to the time of trip is essentially equivalent to an ontrolled RCCA bank withdrawal at power. With the reactor in automatic rod control, the er and temperature increase from boron dilution results in insertion of the control rods and a rease in the available shutdown margin. As the dilution and rod insertion continue, the rod rtion limit alarms (low and low-low settings) and axial flux difference alarm alert the operator a dilution event is in progress and that the technical specification requirement for shutdown gin may be challenged.
effective reactivity addition rate primarily is a function of the dilution rate, boron centration, and boron worth. The following conditions are assumed for an uncontrolled boron tion during full power:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This corresponds to a conservative estimate of the active RCS volume excluding the pressurizer and surge line.
- 3. A 1.3 percent minimum shutdown margin is assumed in the analysis.
h the reactor in manual control, a boron dilution event will result in an increase in the power temperature followed by a reactor trip on the over temperature T trip set point if no operator on is taken. Following reactor trip, the operator has greater than 15 minutes to terminate the sient. In this case, the boron dilution accident up to the time of reactor trip is essentially tical to the RCCA withdrawal at power accident. In addition, prior to the over temperature T
, an over temperature T alarm and turbine runback would be actuated. There is adequate time ilable after a reactor trip for the operator to determine the cause of dilution, isolate the orated water source, and initiate boration before the reactor can return to criticality. Mode 1 lts are summarized in Table 15.4-1.
h the reactor in automatic control, the power and temperature increase from boron dilution lts in insertion of the RCCAs and a decrease in the shutdown margin. The rod insertion limit ms (low and low-low settings) provide the operator with greater than 15 minutes after reactor to determine the cause of the dilution, isolate the unborated water source, and initiate boration ore the total shutdown margin is lost.
operating Modes 1 through 5, the results presented above show that adequate time is available the operator to manually terminate the source of dilution flow, assuming the specified tdown margin requirements are met. Following termination of the dilution flow, the operator initiate boration to recover the shutdown margin.
analysis is presented for Mode 6 operation since dilution during refueling is precluded by the hnical Specifications requirements.
4.6.4 Radiological Consequences ce no fuel failure is postulated for this transient, a specific radiological release calculation was performed.
.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY IN AN IMPROPER POSITION
.7.1 Identification of Causes and Accident Description l and core loading errors, such as those which can arise from the inadvertent loading of one or e fuel assemblies into improper positions, loading a fuel rod during manufacture with one or e pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture h pellets of the wrong enrichment, lead to increased heat fluxes if the error results in placing in core positions calling for fuel of lesser enrichment. Also included among possible core ing errors is the inadvertent loading of one or more fuel assemblies without burnable poison s when burnable poison rods are specified.
or in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which more peaked than those calculated with the correct enrichments. There is a 5 percent ertainty margin included in the design value of power peaking factor assumed in the analysis ondition I and Condition II transients. The incore system of movable flux detectors which is d to verify power shapes at the start of life, is capable of revealing any assembly enrichment r or loading error which causes power shapes to be peaked in excess of the design value.
educe the probability of core loading errors, each fuel assembly is marked with an tification number and loaded in accordance with a core loading diagram. During core loading, identification number is checked before each assembly is moved into the core. Serial numbers during fuel movement are subsequently recorded on the loading diagram as a further check roper placing after the loading is completed.
power distribution misplaced fuel assemblies with significant different burnup would raise king factors and would be readily observable with incore flux monitors. In addition to the flux nitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the
. There is a high probability that these thermocouples would also indicate any abnormally
s event is classified as an ANS Condition III incident (an infrequent fault) as defined in tion 15.0.1.
.7.2 Analysis of Effects and Consequences hod of Analysis dy state power distribution in the x-y plane of the core is calculated using the TURTLE Code CAP-7213-A and WCAP-7758-A) based on macroscopic cross section calculated by the OPARD Code (WCAP-3269-26). A discrete representation is used wherein each individual rod is described by a mesh interval. The power distribution in the x-y plane for a correctly ed core assembly is also given in Chapter 4 based on enrichments given in that section.
each core loading error case analyzed, the typical percent deviations from detector readings a normally loaded core are shown at all incore detector locations (Figures 15.4-21 through 4-25, inclusive).
ults following core loading error cases have been analyzed.
e A:
e in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case sidered was the interchange to two adjacent assemblies near the periphery of the core ure 15.4-21).
e B:
e in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly.
o analyses have been performed for this case (Figures 15.4-22 and 15.4-23).
ase B-1, the interchange is assumed to take place with the burnable poison rods transferred h the Region 2 assembly mistakenly loaded into Region 1.
ase B-2, the interchange is assumed to take place closer to core center and with burnable on rods located in the correct Region 2 Position, but in a Region 1 assembly mistakenly ed in the Region 2 position.
e C:
ichment error: Case in which a Region 2 fuel assembly is loaded in the core central position ure 15.4-24).
e in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core phery (Figure 15.4-25).
.7.3 Conclusions l assembly enrichment errors would be prevented by administrative procedures implemented abrication.
he event that a single pin or pellet has a higher enrichment than the nominal value, the sequences in terms of reduced DNBR and increased fuel and clad temperatures are limited to incorrectly loaded pin or pins and perhaps the immediately adjacent pins.
l assembly loading errors are prevented by administrative procedures implemented during loading. In the unlikely event that a loading error occurs, analyses in this section confirm that lting power distribution effects are either readily detected by the incore movable detector em or cause a sufficiently small perturbation to be acceptable within the uncertainties allowed ween nominal and design power shapes.
.7.4 Radiological Consequences re are no radiological consequences associated with inadvertent loading and operation of a assembly in an improper position since activity is retained within the fuel rods and reactor lant system.
.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS
.8.1 Identification of Causes and Accident Description s accident is defined as the mechanical failure of a control rod mechanism pressure housing, lting in the ejection of a RCCA and drive shaft. The consequence of this mechanical failure is pid positive reactivity insertion together with an adverse core power distribution, possibly ing to localized fuel rod damage.
.8.1.1 Design Precautions and Protection tain features in the Millstone 3 pressurized water reactor are intended to preclude the sibility of a rod ejection accident, or to limit the consequences if the accident were to occur.
se include a sound, conservative mechanical design of the rod housings, together with a ough quality control (testing) program during assembly, and a nuclear design which lessens potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high er levels.
mechanical design is discussed in Section 4.6. Mechanical design and quality control cedures intended to preclude the possibility of a RCCA drive mechanism housing failure are d below.
- 1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4,100 psi.
- 2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.
- 3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design basis earthquake can be accepted within the allowable primary stress range specified by the American Society of Mechanical Engineers (ASME) Code,Section III, for Class 1 components.
- 4. The latch mechanism housing and rod travel housing are each a single length of forged Typed 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.
gnificant margin of strength in the elastic range together with the large energy absorption ability in the plastic range gives additional assurance that gross failure of the housing will not ur. The joints between the latch mechanism housing and head adapter, and between the latch hanism housing and rod travel housing, are threaded joints reinforced by canopy type rod ds. Administrative regulations require periodic inspections of these (and other) welds.
lear Design n if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant zing chemical shim is such that the severity of an ejected RCCA is inherently limited. In eral, the reactor is operated with the RCCAs inserted only far enough to control design flux pe. Reactivity changes caused by core depletion and xenon transients are compensated by on changes. Further, the location and grouping of control RCCA banks are selected during the lear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ted from its normal position during full power operation, only a minor reactivity excursion, at st, could be expected to occur. However, it may be occasionally desirable to operate with er than normal insertions. For this reason, a rod insertion limit is defined as a function of er level. Operation with the RCCAs withdrawn above this limit guarantees adequate tdown capability and acceptable power distribution. The position of all RCCAs is tinuously indicated in the control room. An alarm occurs if a bank of RCCAs approaches its rtion limit or if one RCCA deviates from its bank. Operating instructions require boration at level alarm and immediate boration at the low-low alarm.
reactor protection in the event of a rod ejection accident has been described in WCAP-7588.
protection for this accident is provided by high neutron flux trip (high and low setting) and h rate of neutron flux increase trip. These protection functions are described in detail in tion 7.2.
cts on Adjacent Housings regarding the remote possibility of the occurrence of a RCCA mechanism housing failure, stigations have shown that failure of a housing due to either longitudinal or circumferential king would not cause damage to adjacent housings. The full length control rod drive hanism is described in Section 3.9N.4.
cts of Rod Travel Housing Longitudinal Failures longitudinal failure of the rod travel housing should occur, the region of the position indicator mbly opposite the break would be stressed by the reactor coolant pressure of 2,250 psia. The t probable leakage path would be provided by the radial deformation of the position indicator assembly, resulting in the growth of axial flow passages between the rod travel housing and hollow tube along which the coil assemblies are mounted.
ilure of the position indicator coil assembly should occur, the resulting free radial jet from the ed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings e on the periphery, they might bend outward from their bases. The housing material is quite tile; plastic hinging without cracking would be expected. Housing adjacent to a failed housing, ocations other than the periphery, would not be bent because of the rigidity of multiple cent housings.
ct of Rod Travel Housing Circumferential Failures rcumferential failure of a rod travel housing should occur, the broken off section of the sing would be ejected vertically because the driving force is vertical and the position indicator assembly and the drive shaft would tend to guide the broken-off piece upwards during its el. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When projectile reached the missile shield it would partially penetrate the shield and dissipate its tic energy. The water jet from the break would continue to push the broken-off piece against missile shield.
e broken-off piece of the rod travel housing were short enough to clear the break when fully ted, it would rebound after impact with the missile shield. The top end plates of the position cator coil assemblies would prevent the broken piece from directly hitting the rod travel sing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, low kinetic energy of the rebounding projectile would not be expected to cause significant age.
m the above discussion, the probability of damage to an adjacent housing must be considered ote. However, even if damage is postulated, it would not be expected to lead to a more severe sient, since RCCAs are inserted in the core in symmetric patterns, and control rods ediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage n adjacent housing could, at worst, cause that RCCA not to fail on receiving a trip signal; ever, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ted rod.
mary considerations given above lead to the conclusion that failure of a control rod housing, due er to longitudinal or circumferential cracking, would not cause damage to adjacent housings would increase severity of the initial accident.
.8.1.2 Limiting Criteria s event is classified as an ANS Condition IV incident. See Section 15.0.1 for a discussion of S classifications. Due to the extremely low probability of a RCCA ejection accident, some damage could be considered an acceptable consequence.
mprehensive studies of the threshold of fuel failure and of the threshold of significant version of the fuel thermal energy to mechanical energy have been carried out as part of the RT project by the Idaho Nuclear Corporation (Taxelius 1970). Extensive tests of UO2 onium clad fuel rods representative of those in pressurized water reactor type cores have onstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a htly different design have exhibited failures as low as 225 cal/gm. These results differ ificantly from the TREAT (Liimataninen and Testa 1966) results, which indicated a failure shold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10 ent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to hanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated s and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure
) even for irradiated rods, did not occur below 300 cal/gm.
iew of the above experimental results, criteria are applied to ensure that there is little or no sibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These eria are as follows.
- 1. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.
- 2. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
above.
.8.2 Analysis of Effects and Consequences hod of Analysis calculation of the RCCA ejection transient is performed in two stages, first an average core nnel calculation and then a hot region calculation. The average core calculation is performed g spatial neutron kinetics methods to determine the average power generation with time uding the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.
halpy and temperature transients in the hot spot are then determined by multiplying the rage core energy generation by the hot channel factor and performing a fuel rod transient heat sfer calculation. The power distribution calculated without feedback is pessimistically med to persist throughout the transient.
etailed discussion of the method of analysis can be found in WCAP-7588, Rev. 1-A.
rage Core Analysis spatial kinetics computer code, TWINKLE (WCAP-7979-A and WCAP-8028-A) is used for average core transient analysis. This code uses cross sections generated by LEOPARD CAP-3269-26) to solve the two group neutron diffusion theory kinetic equation in one, two, or e spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2,000 ial points. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat sfer model for calculation of pointwise Doppler and moderator feedback effects. In this lysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic esentation of the spatial effects of axial moderator feedback and RCCA movement. However, e the radial dimension is missing, it is still necessary to employ very conservative methods cribed below) of calculating the ejected rod worth and hot channel factor. Further description WINKLE appears in Section 15.0.11.
Spot Analysis he hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel or. During the transient, the heat flux hot channel factor is linearly increased to the transient e in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that hot spot before and after ejection are coincident. This is very conservative since the peak after tion occurs in or adjacent to the assembly with the ejected rod, and prior to ejection the power his region is necessarily depressed.
hot spot analysis is performed using the detailed fuel and clad transient heat transfer puter code, FACTRAN (WCAP-7908-A). This computer code calculates the transient perature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the ace of the rod, using as input the nuclear power versus time and the local coolant conditions.
CTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer ore DNB, and the Bishop-Sandburg-Tong correlation (Bishop, Sandburg, and Tong 1965) to rmine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is servatively used assuming zero bulk fluid quality. The DNBR is not calculated; instead the e is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer fficient can be calculated by the code; however, it is adjusted in order to force the full power dy state temperature distribution to agree with the fuel heat transfer design codes. Further cription of FACTRAN appears in Section 15.0.11.
tem Overpressure Analysis ause safety limits for fuel damage specified earlier are not exceeded, there is little likelihood uel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of ventional heat transfer from the fuel and prompt heat generation in the coolant.
pressure surge was calculated generally (WCAP-7588, Rev. 1-A) by first performing the fuel t transfer calculation to determine the average and hot spot heat flux versus time. Using this t flux data, a THINC (Section 4.4) calculation was conducted to determine the volume surge.
ally, the volume surge was simulated in a plant transient computer code. This code calculates pressure transient taking into account fluid transport in the RCS and heat transfer to the steam erators. No credit is taken for the possible pressure reduction caused by the assumed failure of control rod pressure housing.
.8.2.1 Calculation of Basic Parameters ut parameters for the analysis are conservatively selected on the basis of values calculated for type of core. The more important parameters are discussed below. Table 15.4-3 presents the meters used in this analysis.
cted Rod Worths and Hot Channel Factors values for ejected rod worths and hot channel factors are calculated using either three ensional static methods or by a synthesis method employing one dimensional and two ensional calculations. The computer codes as described in Table 4.1-2 are used in the analysis.
credit is taken for the flux flattening effects of reactivity feedback. The calculation is ormed for the maximum allowed bank insertion at a given power level, as determined by the insertion limits. Adverse xenon distributions are considered in the calculation to provide st case results.
ropriate margins are added to the ejected rod worth and hot channel factors to account for any ulational uncertainties, including an allowance for nuclear power peaking due to sification.
sured in the zero and full power configurations and compared to values used in the analysis. It been found that the ejected rod worth and power peaking factors are consistently rpredicted in the analysis.
ctivity Feedback Weighting Factors largest temperature rises, and hence the largest reactivity feedbacks occur in channels where power is higher than average. Since the weight of a region is dependent of flux, these regions e high weights. This means that the reactivity feedback is larger than that indicated by a ple channel analysis. Physics calculations have been carried out for temperature changes with at temperature distribution, and with a large number of axial and radial temperature ributions. Reactivity changes were compared and effective weighting multipliers which when lied to single channel feedbacks correct them to effective whole core feedbacks for the ropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is loyed, axial weighting is not necessary if the initial condition is made to match the ejected rod figuration. In addition, no weighting is applied to the moderator feedback. A conservative al weighting factor is applied to the transient fuel temperature to obtain an effective fuel perature as a function of time accounting for the missing spatial dimension. These weighting ors have also been shown to be conservative compared to three dimensional analysis CAP-7588, Rev. 1-A).
derator and Doppler Coefficient critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the lear code in order to obtain moderator density coefficient curves which are conservative pared to actual design conditions for the plant. As discussed above, no weighting factor is lied to these results.
Doppler reactivity defect is determined as a function of power level using a one dimensional dy state computer code with a Doppler weighting factor of 1.0. The Doppler defect used is n in Table 15.4-3. The Doppler weighting factor increases under accident conditions, as ussed above.
ayed Neutron Fraction, culations of the effective delayed neutron fraction (eff) typically yield values no less than percent at beginning-of-life and 0.40 percent at end-of-life. The accident is sensitive to eff if ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow future cycles, pessimistic estimates of eff of 0.50 percent at beginning of cycle and 0.40 ent at end of cycle were used in the analysis.
trip reactivity insertion assumed is given in Table 15.4-3 and includes the effect of one stuck CA adjacent to the ejected rod. These values are reduced by the ejected rod reactivity. The tdown reactivity was simulated by dropping a rod of the required worth into the core. The start od motion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay udes the delays for the instrument channel to produce a signal, for the trip breaker to open and the coil to release the rods. A curve of trip rod insertion versus time was used which assumed insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of h a conservative insertion rate means that there is over 1 second after the trip point is reached ore significant shutdown reactivity is inserted into the core. This conservatism is important for full power accidents.
minimum design shutdown margin available for this plant at hot zero power (HZP) may be hed only at end-of-life in the equilibrium cycle. This value includes an allowance for the st stuck rod, and adverse xenon distribution, conservative Doppler and moderator defects, and llowance for calculation uncertainties. The available margin is such that even after accounting the effect of two stuck RCCAs (one of which is the worst ejected rod), the reactor will be critical when the core return to HZP conditions following a reactor trip from an RCCA tion accident.
address the effects of the loss of primary system integrity as a result of the failed control rod sing, depressurization calculations have been performed for a typical four-loop plant, ming the maximum possible size break (2.75 inch diameter) located in the reactor pressure sel head. The results show a rapid pressure drop and a decrease in system water mass due to break. The safety injection system is actuated on low pressurizer pressure within 1 minute r the break. The RCS pressure continues to drop and reaches saturation (1,200 psi) in about 2 minutes. Due to the large thermal inertia of primary and secondary system, there has been no ificant decrease in the RCS temperature below no-load by this time, and the depressurization lf has caused an increase in shutdown margin by about 0.2 percent k due to the pressure fficient. The cooldown transient could not absorb the available shutdown margin until more 10 minutes after the break. The addition of borated (2,000 ppm) safety injection flow starting inute after the break is sufficient to ensure that the core remains subcritical during the ldown.
ctor Protection discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high tron flux trip (high and low setting) and high rate of neutron increase trip. These protection ctions are part of the reactor trip system. No single failure of the reactor trip system will negate protection functions required for the rod ejection accident, or adversely affect the sequences of the accident.
ults es are presented for both beginning and end-of-life at zero and full power.
Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.25 percent k and 6.0, respectively. The peak hot spot fuel center temperature reached melting at 4900°F. However, it was restricted to less than 10 percent of the pellet.
- 2. Beginning of cycle, zero power For this condition, control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.78 percent k and a hot channel factor of 11.5. The peak fuel center temperature was 4096°F.
- 3. End of cycle, full power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.25 percent k and 7.0, respectively. The peak hot spot fuel center temperature reached melting at 4800°F. However, melting was restricted to less than 10 percent of the pellet.
- 4. End of cycle, zero power The ejected rod worth and hot channel factor for this case were obtained assuming control bank D to be fully inserted with banks C and B at their insertion limits. The results were 0.85 percent k and 26.0, respectively. The peak fuel center temperature was 4115°F. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor.
ummary of the parameters used for the above analysis is given in Table 15.4-3. The nuclear er and hot spot fuel and clad temperature transients for the worst cases (beginning of life, full er, and end of life zero power) are presented on Figures 15.4-26 through 15.4-29.
calculated sequence of events for the worst case rod ejection accidents are presented in le 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear er excursion is terminated. As discussed previously in Section 15.4.8.2.2, the reactor remains critical following reactor trip.
ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel
- d. The effects and consequences of loss-of-coolant accidents are discussed in Section 15.6.5.
owing the RCCA ejection, the operator would follow the same emergency instructions as for other loss-of-coolant accident to recover from the event.
assumed that fission products are released from the gaps of all rods entering DNB. In all cases sidered, less than 10 percent of the rods entered DNB based on a detailed three dimensional NC analysis (WCAP-7588, Rev. 1-A). Although limited fuel melting at the hot spot was dicted for the beginning-of-life and the full power cases, in practice melting is not expected e the analysis conservatively assumed that the hot spots before and after ejection were cident.
ssure Surge etailed calculation of the pressure surge for an ejection worth of one dollar at inning-of-life, hot full power, indicates that the peak pressure does not exceed that which ld cause stress to exceed the faulted condition stress limits (WCAP-7588, Rev. 1-A). Since severity of the present analysis does not exceed the worst case analysis, the accident for this t does not result in an excessive pressure rise or further damage to the RCS.
ice Deformations rge temperature gradient exists in the region of the hot spot. Since the fuel rods are free to ve in the vertical direction, differential expansion between separate rods cannot produce ortion. However, the temperature gradients across individual rods may produce a differential ansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations e indicated that this bowing would result in a negative reactivity effect at the hot spot since tinghouse cores are under-moderated, and bowing tends to increase the under-moderation at hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be erved. In practice, no significant bowing is anticipated, since the structural rigidity of the core ore than sufficient to withstand the forces produced. Boiling in the hot spot region would duce a net flow away from that region. However, the heat from the fuel is released to the water tively slowly, and it is considered inconceivable that cross flow is sufficient to produce ificant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is othetically postulated, the large void fraction in the hot spot region would produce a reduction he total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net ct would therefore be a negative feedback. It can be concluded that no conceivable hanism exists for a net positive feedback resulting from lattice deformation. In fact, a small ative feedback may result. The effect is conservatively ignored in the analysis.
4.8.3 Conclusions n on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not eeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since peak pressure does not exceed that which would cause stresses to exceed the faulted condition ss limits, it is concluded that there is no danger of further consequential damage to the RCS.
analyses have demonstrated that less than 10 percent of the fuel rods entered DNB.
.8.4 Radiological Consequences radiological consequences of a postulated rod ejection accident incorporate the fuel failure des described in Regulatory Guide 1.183.
valuate the radiological consequences of a control rod ejection accident, it is assumed that 10 ent of the fuel rods experience clad damage, thereby releasing their respective gap activities he reactor coolant. The gap activity is assumed to be released instantaneously into the tainment atmosphere via the break in the reactor vessel head. In addition, it is further tulated that 0.25 percent of the core fuel experiences melting resulting in 100 percent of the le gases and 25 percent of iodines in the fraction of melted fuel to be available for release from containment. The releases to the environment from the secondary system are coincident with of offsite power and are assumed to continue for 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> until the RHR system is capable emoving all decay heat. The activity available for release from the secondary system due to mary to secondary leakage is based on 1) RCS at Technical Specification levels of reactor lant activity commensurate with 1 mCi/gm Dose Equivalent Iodine-131 (DEQ I-131), 2) 10%
he core gap activity (with associated release fractions of 10% noble gases and iodines) and
% of the activity from fuel melt (with associated release fractions of 100% noble gases and of iodines) and 3) S/G secondary system liquid activity at technical specification levels.
releases from containment are assumed to continue for 30 days after initiation of the accident.
inent parameters used to describe the releases are presented in Tables 15.4-4 and Table 15.6-IS signal is generated within 2 minutes following the accident which initiates secondary tainment. Assumptions regarding the time for the secondary containment to achieve negative sure are the same as that which was used for the LOCA analysis. The bypass leakage is ased unfiltered to the environment at ground level. The leakage which is not bypass leakage is med to be processed by the secondary containment filtration system. A more detailed cription of containment leakage is found in Section 15.6.5.4.
releases, together with the atmospheric dispersion factors listed in Table 15.0-11 and control m parameters in Table 15.6-12, are used to compute the doses to the Control Room, EAB and radiological consequences of a postulated rod ejection accident are analyzed with the rmation contained in Regulatory Guide 1.183 and the Standard Review Plan 15.0.1. The ulated dose results described in Table 15.0-8 for the rod ejection accident are presented arately for the releases from the containment building and the releases via the secondary em.
CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, and 6.3 rem to the EAB and LPZ.
.9 REFERENCES FOR SECTION 15.4
-1 Bishop, A. A.; Sandburg, R. O.; and Tong, L. S., 1965. Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux. ASME 65-HT-31.
-2 Liimataninen, R. C. and Testa, F. J. 1966. Studies in TREAT of Zircaloy-2-Clad, UO2 Core Simulated Fuel Elements. ANL-7225, January - June 1966, p. 177.
-3 WCAP-3269-26, 1963. Barry, R. F. LEOPARD - A Spectrum Dependent Non- spatial Depletion Code for the IBM-7094.
-4 WCAP-7213-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R. F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
-5 WCAP-7588, Revision 1-A, 1975. Risher, D. H., Jr. An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods.
-6 WCAP-7907-P-A (Proprietary), WCAP 7907-A (Nonproprietary), April 1984, Burnett, T. W. T., et al., LOFTRAN Code Description.
-7 WCAP-7908-A, 1989. Hargrove, H. G. FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod.
-8 WCAP-7979-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.
H., Jr. and Barry, R. F. TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code.
-9 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
-10 Taxelius, T. G. (Ed) 1970. Annual Report- Spert Project, October, 1968, September, 1969. Idaho Nuclear Corporation IN-1370.
-11 WCAP-11394-P-A (Proprietary), WCAP-11395-A (Nonproprietary), January 1990.
Haessler, R. L., et al., Methodology for the Analysis of the Dropped Rod Event.
-12 WCAP-14882-P-A (Proprietary), WCAP-15234-A (Nonproprietary), 1999. Huegel, D.S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
-13 WCAP-14565-P-A (Proprietary), WCAP-15306-NP-A (Nonprorietary), October 1999.
Sung Y., et al., VIPRE Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
-15 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, September 2014, Reactor Core Thermal Hydraulics Using the VIPRE-D Computer Code.
REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec) controlled RCCA bank Initiation of uncontrolled rod withdrawal from 0.00 hdrawal from a subcritical or 10-9 of nominal power
-power startup condition Power range high neutron flux low setpoint 10.85 reached Peak nuclear power occurs 10.98 Rods begin to fall into core 11.35 Minimum DNBR occurs 13.50 Peak heat flux occurs 13.50 Peak average clad temperature occurs 14.05 Peak average fuel temperature occurs 14.15 controlled RCCA bank hdrawal at power Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power high reactivity insertion rate (100 pcm/sec)
Power range high neutron flux high trip point 1.13 reached Rods begin to fall into core 1.63 Minimum DNBR occurs 2.6 Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power small reactivity insertion rate (1.5 pcm/sec)
Overtemperature T, reactor trip point reached 85.35 Rods begin to fall into core 86.85 Minimum DNBR occurs 87.3 CS malfunction that results a decrease in the boron ncentration in the reactor olant Dilution during start-up Reactor trip on power range high neutron flux, 0.00 low setpoint Time to criticality for unmitigated event > 900
Accident Event Time (sec)
Dilution during full-power operation
- a. Automatic reactor Dilution begins 0.00 control Time to criticality for unmitigated event > 900
- b. Manual reactor control Dilution begins 0.00 Reactor trip signal on OTDT is generated 124 (power range high neutron flux) and operator initiates corrective action Time to criticality for unmitigated event 1024 d cluster control assembly ction accident Beginning-of-life full Initiation of rod ejection 0.00 power Power range high neutron flux setpoint reached 0.04 Peak nuclear power occurs 0.14 Rods begin to fall into core 0.54 Peak fuel average temperature occurs 2.23 Peak clad temperature occurs 2.31 Peak heat flux occurs 2.32 End-of-life, zero power Initiation of rod ejection 0.00 Power range high neutron flux low setpoint 0.18 reached Peak nuclear power occurs 0.21 Rods begin to fall into core 0.68 Peak clad temperature occurs 1.54 Peak heat flux occurs 1.54 Peak average fuel temperature occurs 1.80
CONTROL ASSEMBLY EJECTION ACCIDENT Time in Life Beginning Beginning End End wer level (percent) 102 0 102 0 cted rod worth (percent K) 0.25 0.78 0.25 0.85 layed neutron fraction (percent) 0.50 0.50 0.40 0.40 edback reactivity weighting 1.355 2.081 1.486 3.765 p reactivity (percent K) 4.0 2.0 4.0 2.0 before rod ejection 2.60 -- 2.60 --
after rod ejection 6.0 11.5 7.0 26.0 ppler Defect (pcm, 0 to 10% power) -900 -900 -900 -900 mber of operational pumps 4 2 4 2
- x. fuel pellet average temperature (°F) 4028 3575 3988 3690
- x. fuel center temperature (°F) 4966 4096 4874 4115 x fuel stored energy (cal/gm) 176 152 174 158
ACCIDENT ANALYSIS Analysis Input Parameters Core thermal power 2% uncertainty (MWt) 3,723 Containment free volume (ft3) 2.35x106 Primary coolant concentrations Table 15.0-10 Primary to secondary leak rate (gpm) 1.0 Secondary coolant concentration Table 15.0-10 Failed fuel as a result of the accident (%) 10.0 Core activity Table 15.0-7 Quantity of fuel in the core which melts as a result of the accident (%) 0.25 Quantity of radionuclides from the melted fuel available for release from the containment (%):
- a. Iodine 25.0
- b. Noble gases 100 Quantity of radionuclides from the melted fuel available for release from the secondary side via primary-to-secondary leakage (%):
- a. Iodines 50.0
- b. Noble gases 100 Iodine partition factor in steam generator prior to and during accident 0.01 Offsite power Lost Steam release (lbm)
- a. 0 - 1200 seconds 2.000 E+05
- b. 2 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 3.246 E+06
- c. 24 - 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> 1.974 E+05 Containment leak rate (% per day)
- a. 0-24 hours 0.30
- b.24-720 hours 0.15 Bypass leakage (fraction of containment leakage) 0.06 Time between accident and equalization of primary and secondary 1200 pressures (sec)
Time to initiate SIS (min) 2
Analysis Input Parameters Time estimated for SLCRS to become effective (min) 2 Duration of leakage from containment (hr) 720.0 Iodine removal filter efficiency (%) 95.0 Steam generator liquid contents (lbm/SG) 100,933 RCS mass (lbm) 4.45 E+05 Credit for Sprays No Control Room Parameters Table 15.6-12 Containment Release Points Same as LOCA, see Table 15.6-9 Secondary Side Release Points EAB / LPZ Ground Level -
ventilation vent Control Room MSPRVs / MSSVs
- use MSVB X/Qs
Time (sec) Flow (lbm) 0.0 0.0 5.0 4,826.2 10.0 9,473.1 20.0 18,285.4 40.0 34,282.3 100.0 65,591.4 202.0 78,065.5 300.0 88,254.2 405.0 98,641.3 500.0 107,619.0 750.0 129,291.3 1,000.0 148,214.9 2,000.0 259,376.7 3,000.0 438,923.8 5,000.0 819,305.3 7,000.0 1,124,734.1 10,000.0 1,528,285.8 TE:
e between accident and equalization of primary and secondary system pressures = 140 sec.
TABLE 15.4-6 DELETED BY FSARCR PKG FSC 04-MP3-017 UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION 10.00 Nuclear Power (Fraction of Nominal) 1.00 0.10 0.01 0.00 0 10 20 30 40 50 60 70 80 Time (sec) 0.60 Core Average Heat Flux (Fraction of Nominal) 0.50 0.40 0.30 0.20 0.10 0.00 0 10 20 30 40 50 60 70 80 Time (sec)
UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION Fuel Pellet Centerline 1955.00 Temperature Fuel Average Temperature 1755.00 Hot Spot Fuel Temperature (º F) 1555.00 1355.00 1155.00 955.00 755.00 555.00 0.00 10.00 20.00 30.00 40.00 Time (sec) 1550.00 1450.00 1350.00 1250.00 Clad Inner Temperature (º F) 1150.00 1050.00 950.00 850.00 750.00 650.00 550.00 0.00 20.00 40.00 60.00 80.00 Time (sec)
WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 1.4 1.2 Nuclear Power [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 2 4 6 8 10 Time [seconds]
1.2 Core Heat Flux [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-4 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 2330.0 2310.0 Pressurizer Pressure [psia]
2290.0 2270.0 2250.0 2230.0 2210.0 0 2 4 6 8 10 Time [seconds]
1190.0 1180.0 Pressurizer Water Volume [Cubic Feet]
1170.0 1160.0 1150.0 1140.0 1130.0 1120.0 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-5 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 595.0 590.0 Vessel Average Temperature [deg-F]
585.0 580.0 575.0 570.0 565.0 0 2 4 6 8 10 Time [seconds]
10.0 9.0 8.0 7.0 6.0 DNBR 5.0 4.0 3.0 2.0 1.0 0.0 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-6 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 1.2 Nuclear Power [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
1.2 Core Heat Flux [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-7 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 2400.0 2350.0 2300.0 Pressurizer Pressure [psia]
2250.0 2200.0 2150.0 2100.0 2050.0 2000.0 0 20 40 60 80 100 Time [seconds]
1500.0 1450.0 Pressurizer Water Volume [Cubic Feet]
1400.0 1350.0 1300.0 1250.0 1200.0 1150.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-8 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 605.0 600.0 Vessel Average Temperature [deg-F]
595.0 590.0 585.0 580.0 0 20 40 60 80 100 Time [seconds]
7.0 6.0 5.0 4.0 DNBR 3.0 2.0 1.0 0.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM 100% RTP 2.1 100% Pow w/Min Feedback 100% Pow w/Max Feedback 2
1.9 Minimum DNBR OTDT 1.8 HNF 1.7 1.6 1.5 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
FIGURE 15.4-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM 60% RTP 2.6 60% Pow w/Min Feedback 60% Pow w/Max Feedback 2.4 2.2 Minimum DNBR OTDT HNF 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
FIGURE 15.4-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM 10% RTP 3
10% Pow w/Min Feedback 2.8 10% Pow w/Max Feedbak 2.6 Minimum DNBR 2.4 OTDT HNF 2.2 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
CONTROL CONTROL FIGURE 15.4-16 NOT USED FIGURE 15.4-17 NOT USED FIGURE 15.4-18 NOT USED FIGURE 15.4-19 NOT USED FIGURE 15.4-20 NOT USED
BURNABLE POISON RODS BEING RETAINED BY THE REGION 2 ASSEMBLY BURNABLE POISON RODS BEING RETAINED BY THE REGION 1 ASSEMBLY THE CORE CENTRAL POSITION NEAR CORE PERIPHERY
FIGURE 15.4-26 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
BOL HFP RCCA EJECTION FIGURE 15.4-27 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
RCPS RUNNING)
EOL HZP RCCA EJECTION (TWO RCPS RUNNING)
FOLLOWING A ROD EJECTION ACCIDENT cussion and analysis of the following events are presented in this section.
- 1. Inadvertent operation of the emergency core cooling system during power operation.
- 2. Chemical and volume control system malfunction that increases reactor coolant inventory.
- 3. A number of BWR transients (not applicable to Millstone 3).
se events, considered to be ANS Condition II, cause an increase in reactor coolant inventory.
tion 15.0.1 contains a discussion of ANS classifications.
.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION s event is analyzed for POWER OPERATION only. Analysis for shutdown modes is not uired.
.1.1 Identification of Causes and Accident Description rious emergency core cooling system (ECCS) operation at power could be caused by operator r or a false electrical actuation signal. A spurious signal may originate from any of the safety ction actuation channels as described in Section 7.3.
n receipt of the inadvertent safety injection actuation signal (SI), the reactor will trip with sequent turbine trip, letdown will be isolated, and the centrifugal charging pumps will align to suction from the refueling water storage tank (RWST) to inject into the RCS cold legs and RCP seals. The opening of the charging pump cold leg injection valves will be controlled by Cold Leg Injection Permissive (P-19). The Cold Leg Injection Permissive is activated when of four pressurizer pressure channels indicate less than 1900 psia.
n inadvertent SI signal is initiated from nominal hot full power conditions and no other sient is in progress, the RCS pressure will remain above the P-19 setpoint. Therefore, the Cold Injection Permissive will prevent charging pump flow through the ECCS col leg injection es during spurious ECCS operation at power. Since RCS pressure will also be above the toff head of the Safety Injection and Residual Heat Removal pumps, the only source of water ition to the RCS is the charging pump injection into the RCP seals. With letdown isolated, the injection will result in an increase in Reactor Coolant System inventory.
n inadvertent SI signal is initiated from hot full power conditions that include the most adverse bination of instrument and control system uncertainties, it is possible for RCS pressure to rease to the P-19 setpoint during the event. P-19 prevents charging pump flow through the CS cold leg injection valves up until P-19 is satisfied. During this time, the only source of
injection path will result in an increase in RCS inventory.
.1.2 Analysis of Effects and Consequences hod of Analysis dvertent operation of the ECCS is analyzed using the RETRAN computer code (VEP-FRD-P-A). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety es, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
code computes pertinent plant variables including temperatures, pressures, and power level.
dvertent operation of the ECCS at power is classified as a Condition II event, a fault of derate frequency. The criteria established for Condition II events include the following.
- a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,
- b. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and,
- c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.
ed on historical precedence and a detailed understanding of the transient conditions associated h this event, conditions do not approach the core thermal DNB limits as the core power, RCS sure and RCS temperatures remain relatively unchanged. Therefore, the DNBR typically eases and does not approach the DNBR safety analysis limit following event initiation. For reason, it is not necessary to calculate a minimum DNBR value for this event.
ce operator action to terminate ECCS flow may not occur before the pressurizer becomes er solid, water relief from the pressurizer through the power-operated relief valves (PORVs) or pressurizer safety relief valves (PSRVs) could occur for this event. Therefore, to conclude that erion (c) is met, the evaluation of this event must demonstrate the integrity of these valves r being subjected to water discharge. The ability to isolate the RCS and maintain the integrity he RCS pressure boundary must be demonstrated so that this Condition II event does not lead more serious plant condition.
erican Nuclear Society standard 51.1/N18.2-1973 describes example 15 of a Condition II nt as a minor reactor coolant system leak which would not prevent orderly reactor shutdown cooldown assuming makeup is provided by normal makeup systems only. In said standard, mal makeup systems are defined as those systems normally used to maintain reactor coolant ntory under respective conditions of startup, hot standby, power operation, or cooldown, g onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS
so met.
ensure orderly reactor shutdown can occur, the RCS pressure boundary must ultimately be atable once the source of the ECCS flow is terminated. To ensure the RCS pressure boundary be isolated, the PSRVs must function as designed and the PORVs and/or block valves must be ilable to the operator (after the operator action time) to provide isolation functions.
assess the capability of the PSRVs to function properly following the discharge of subcooled er, the fluid conditions associated with the water being discharged through these valves must etermined and the integrity of the valves shown to be acceptable for these conditions.
wever, with one or more PORVs available, the PSRV setpoint will not be reached and any sequent water discharge from the RCS would be through the PORV(s). In the latter case, ation of the RCS following operator action to terminate ECCS flow is obtainable by use of the RV block valve(s).
address criterion (c), an analysis is performed to demonstrate that the PSRVs will not be ated with the pressurizer in a water solid condition. For the potential condition of the plant rating with all the PORVs blocked, action must be taken to either terminate the ECCS flow to rt a water solid condition or to confirm that at least one PORV is unblocked and available for er relief prior to reaching the PSRV setpoint. This avoids any concerns regarding subcooled er relief through the plant PSRVs. Should water relief through the pressurizer power-operated ef valves (PORVs) occur, the PORV block valves would be available to isolate the RCS.
thermore, the acceptability of water discharge through the PORV(s) and associated piping has n confirmed via plant-specific analyses.
refore, the inadvertent ECCS actuation at power event is analyzed to demonstrate that the grity of the PSRVs is maintained by demonstrating that they will not be actuated with the surizer in a water solid condition. To ensure that this criterion is met, the time allowed for rator action is established as the shortest time to pressurizer overfill.
analysis assumptions for the most limiting case are as follows:
Initial Operating Conditions The most limiting results are obtained at hot full power (+2% uncertainty). Sensitivity to core power variations near full power is minimal. Uncertainties applied to initial average coolant temperature, initial pressurizer pressure and initial pressurizer level are +4°F, -
29.6 psi, and -7.6% respectively. Low initial fuel temperature is targeted.
Reactivity Feedback and Kinetics Parameters Since the reactor trips on receipt of the SI actuation signal, reactivity feedback and core kinetics parameters do not play a significant role in this analysis Trip reactivity is sufficient to sustain the reactor in a subcritical state throughout the event.
Pressurizer heaters are assumed to fail so that P-19 is satisfied during the initial depressurization allowing injection through the cold leg injection path thereafter. In addition, pressurizer spray is allowed to operate as designed in order to slow the increase in RCS pressure and allow higher RCS injection flow rates.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item F below for additional information pertaining to PORV operation during this event.
Reactor Trip Reactor trip is assumed to occur upon receipt of the SI actuation signal including appropriate time delay.
Decay Heat Core residual heat is based on ANSI/ANS-5.1-1979 minus uncertainty. Minimizing decay heat in this manner results in a quicker cooldown and depressurization and the earliest time to satisfy P-19. This allows RCS injection through the cold leg injection path to begin earlier and results in the shortest time to pressurizer overfill.
Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate ECCS flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
Pressurizer Safety Valves The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
Secondary Heat Removal Condenser steam dumps are assumed to be operable in the limiting case. This maximizes the initial cooldown and depressurization allowing the P-19 to be satisfied. The condenser steam dumps control RCS temperature to a lower value than the atmospheric relief valves or main steam safety valves. This gives lower RCS pressure and higher injection flowrates which result in the shortest time to pressurizer overfill.
The motor driven auxiliary feedwater pumps are assumed to start upon receipt of the SI actuations signal. Main feedwater is assumed to be isolated on receipt of the SI actuation signal.
Cold Leg Injection Permissive (P-19) Setpoint Uncertainty in the P-19 setpoint of 20.4 psi is added to the nominal setpoint. This is conservative for maximizing the mass addition to the RCS during the event.
Charging System Flow Prior to satisfying P-19, minimum charging flow through the RCP seals is assumed. After satisfying P-19, RCS injection though the cold leg injection pathway is assumed at the maximum flowrate for two charging pumps.
ults resentative transient response for the Inadvertent Operation of ECCS case is shown in ures 15.5-1 and 15.5-2. Table 15.5-1 shows a representative analysis sequence of events.
CS actuation is followed by reactor trip. A rapid cooldown of the RCS follows due to the on of the condenser steam dump system. Coolant contraction results in a short-term reduction ressurizer pressure and water level. As the RCS temperature reduction slows, the coolant traction ceases and ECCS injection flow (which increases after P-19 is satisfied) causes the sure and level transients to turn around. Pressurizer water level then increases throughout the ainder of the transient. The analysis shows that with credit for the cold leg injection missive, the operators have at least 23 minutes to complete actions to prevent the pressurizer m filling and thereby prevent water relief through the PSRVs. The time available for operator on is expected to be enough for the operators either to terminate the RCS mass addition or to re that at least one PORV is available. With at least one PORV available, the analysis shows water discharge through the PSRV is precluded. Once a PORV is available for water harge, operator action to terminate the ECCS flow can be performed according to existing cedures.
5.1.3 Conclusions transient response to the Inadvertent Operation of ECCS shows that the reactor power, lant temperature and pressure decrease rapidly after the reactor trip. The primary temperature tinues to decrease gradually due to injection of cold water and decay heat removal by the denser dump system while pressure increase due to the continued mass addition. RCS ditions do not approach the DNBR safety limit following the initiation of this event.
key acceptance criterion for this event is that it may not propagate to cause a more serious t (i.e., a Condition III or IV event). To satisfy this criterion, operator action is required to
- 1. Make at least one PORV available prior to pressurizer overfill (i.e., 23 minutes of event initiation),
and
- 2. Terminate excess RCS injection (i.e., terminate ECCS, restore normal charging and restore letdown within 73 minutes of event initiation.
.1.4 Radiological Consequences re are only minimal radiological consequences associated with inadvertent ECCS operation.
reactor trip causes a turbine trip and heat is removed from the secondary system through the ndenser dump system), steam generator pressure relief valves or safety valves. Since no fuel age is postulated to occur following an inadvertent operation of the ECCS during power ration, a specific calculation for radiological releases from the secondary system was not ormed.
er relief from the pressurizer PORVs may result in overpressurization of the pressurizer relief (PRT), breaching the rupture disk and spilling contaminated fluid into containment. The ological releases (offsite doses) resulting from breaking the PRT rupture disk have been found e within acceptable limits.
5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY
.2.1 Identification of Causes and Accident Description eases in reactor coolant inventory caused by a malfunction of the chemical and volume trol system may be postulated to result from operator error or a control signal malfunction.
nsients examined in this section are characterized by increasing pressurizer level, increasing surizer pressure, and a constant boron concentration. The transients described in this section analyzed to demonstrate that there is adequate time for the operator to take corrective action to ure that the integrity of the PSRVs is maintained (i.e., the PSRVs do not actuate) with the surizer in a water-solid condition. An increase in reactor coolant inventory, which results m the addition of cold, unborated water to the RCS, is analyzed in Section 15.4.6, Chemical Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the ctor Coolant.
most limiting case would result if charging was in automatic control and the pressurizer level nnel used for charging control failed in a low direction. This would cause maximum charging to be delivered to the RCS and letdown flow to be isolated. The worst single failure for this nt would be a second pressurizer level channel failing in an as-is condition or a low condition.
s will defeat the reactor trip on two-out-of-three high pressurizer level channels. To ensure that
.2.2 Analysis of Effects and Consequences hod of Analysis CVCS malfunction is analyzed using the RETRAN computer code (WCAP-14882-P-A, 9). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety es, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
code computes pertinent plant variables including temperatures, pressures, and power level.
analysis assumptions are as follows:
Initial Operating Conditions Initial conditions with maximum uncertainties on power (+2%), vessel average temperature (-4.0°F), and pressurizer pressure (-50 psi) are assumed.
Pressurizer Pressure Control The Pressurizer heaters are assumed operable to maximize the fluid expansion in the pressurizer. Pressurizer spray is assumed available in order to minimize RCS pressure which allows for more flow to be injected. In addition, modeling spray increases the rate of the pressurizer level increase due to the density effects between the spray fluid (which is taken from the cold leg) and the pressurizer inventory.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item D below for additional information pertaining to PORV operation during this event.
Reactor Trip No reactor trip is assumed Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate charging flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
Main Steam Safety Valves Secondary side pressure is controlled via the Main Steam Safety Valves. Steam generator PORVs and steam dump valves are conservatively assumed to be inoperable.
Auxiliary Feedwater Auxiliary feedwater is not credited.
Charging System Flow Maximum charging flow as a function of RCS pressure is assumed to be delivered to the RCS. Cases are examined with one and two charging pumps operating. The charging flow is assumed to have the same boron concentration as the RCS.
5.2.3 Results transient response for the limiting CVCS malfunction cases are shown in Figures 15.5-3 and
-4. Table 15.5-2 shows the calculated sequence of events. In all cases analyzed, core power RCS temperatures remain relatively constant.
pressurizer level increases throughout the transient as a result of the injected flow. The surizer backup heaters are actuated on a high pressurizer water level deviation signal. In the with one pump operating, the pressurizer reaches a water solid condition at approximately minutes following event initiation, with the PSRVs opening (if the PORVs are unavailable) 9.3 minutes. In the case with two pumps operating, the pressurizer reaches a water solid dition at approximately 8.4 minutes following event initiation, with the PSRVs opening (if the RVs are unavailable) at 10.0 minutes. If available, one PORV has sufficient capacity to lude actuation of the PSRVs.
he same time the failure of the pressurizer level channel occurs, a number of main control rd alarms will be generated, including the following:
Pressurizer Level Deviation Pressurizer Level Low Heater Off and Letdown Secure Pressurizer Heater Backup Group Auto Trip Pressurizer Heater Control Group Auto Trip
nnel, restore letdown, and switch charging control to one of the two operable channels and inate the event. This type of malfunction is routinely included in the operator simulator ning and this operator training provides assurance that the operator action to terminate the rfill will occur within the required time frame.
.2.4 Conclusions results show none of the transient conditions during the event approach the core thermal B limits. With respect to not creating a more serious plant condition, water relief out of the Vs due to a water solid pressurizer would occur at a time which is longer than the time uired for the operators to respond to event and to terminate the RCS inventory addition or to lock at least one pressurizer PORV. The sequence of events presented in Table 15.5-1 shows operators have sufficient time to take corrective action.
.3 A NUMBER OF BWR TRANSIENTS s section is not applicable to Millstone 3.
.4 REFERENCES FOR SECTION 15.5
-1 WCAP-14882-P-A (Proprietary), April 1999 and WCAP-15234-A (Nonproprietary)
May 1999, Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
-2 DELETED
-3 ANSI/ANS-5.1-1979, August 1979, American National Standard for Decay Heat Power in Light Water Reactors.
-4 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
OF ECCS Event Time (sec) tiating event: inadvertent SI signal 0.02 actor trip on SI signal 0.24 in Feedwater Isolation 1.82 rbine trip 2.64 rt MDAFW pumps 5.04 9 Satisfied, Cold Leg Injection Begins 68.7 ssurizer water solid 1416.0 V opens 1476.8
TABLE 15.5-2 TIME SEQUENCE OF EVENTS - CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY Case Event Time (sec)
CVCS malfunction, One pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 117.3 Pressurizer reaches water-solid condition 761.0 Pressurizer safety valve setpoint reached 1156.2 CVCS malfunction, Two pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 78.6 Pressurizer reaches water-solid condition 503.0 Pressurizer safety valve setpoint reached 601.4
INVENTORY, NUCLEAR POWER AND VESSEL AVERAGE TEMPERATURE VERSUS TIME 2450 2400 2350 2300 2250 Pressure [psia]
2200 2150 2100 2050 2000 1950 1900 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
NVENTORY, PRESSURIZER PRESSURE AND PRESSURIZER WATER VOLUME VERSUS TIME 115 105 95 85 Pressurizer Level [%]
75 65 55 45 35 25 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
INVENTORY, NUCLEAR POWER AND VESSEL AVERAGE TEMPERATURE VERSUS TIME
VERSUS TIME nts which result in a decrease in reactor coolant inventory as discussed in this section are as ows.
- 1. Inadvertent opening of a pressurizer safety or relief valve.
- 2. Break in instrument line or other lines from reactor coolant pressure boundary (RCPB) that penetrate containment.
- 3. Steam generator tube failure.
- 4. Spectrum of boiling water reactor (BWR) steam system piping failures outside of containment (not applicable to Millstone 3).
- 5. Loss-of-coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the RCPB.
- 6. A number of BWR transients (not applicable to Millstone 3).
.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE
.1.1 Identification of Causes and Accident Description accidental depressurization of the reactor coolant system (RCS) could occur as a result of an vertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve roximately twice the steam flow rate of a relief valve, and therefore allows a much more rapid ressurization upon opening, the most severe core conditions are associated with an inadvertent ning of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS sure which could reach the hot leg saturation pressure without reactor protection system rvention. The pressure continues to decrease throughout the transient. The effect of the sure decrease would be to increase power via the moderator density feedback. However, the t (if in the automatic mode) functions to maintain the power essentially constant throughout initial stage of the transient. The average coolant temperature remains approximately the same the pressurizer pressure decreases until reactor trip (and beyond) because of the stuck open ty valve.
reactor may be tripped by the following reactor protection system signals:
- 1. Overtemperature T
- 2. Pressurizer low pressure inadvertent opening of a pressurizer relief valve is classified as an American Nuclear Society S) Condition II event, a fault of moderate frequency. Although a stuck open safety valve is sified as an ANS Condition IV event, it is modeled here to bound the stuck open relief valve
.1.2 Analysis of Effects and Consequences hod of Analysis accidental depressurization transient is analyzed by employing the detailed digital computer e RETRAN (WCAP-14882-P-A, 1999). The code simulates the neutron kinetics, RCS, surizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam erator safety valves. The code computes pertinent plant variables, including temperatures, sures, and power level.
ial operating conditions are assumed at values consistent with steady state operations. Plant racteristics and initial conditions are discussed in Section 15.0.3. To give conservative results alculating the departure from nucleate boiling ratio (DNBR) during the transient, the owing assumptions are made.
- 1. Plant characteristics and initial conditions are discussed in Section 15.0.3.
Uncertainties in initial conditions are included in the calculation of the limit value DNBR. Consistent with this approach, nominal values are assumed for the initial reactor power, pressure, and RCS temperature along with the minimum measured RCS flow.
- 2. A zero moderator temperature coefficient of reactivity is assumed. The spatial affect of voids due to local or subcooled boiling is not credited in the analysis with respect to reactivity feedback or core power shape.
- 3. A least negative Doppler-only power coefficient is assumed (see Figure 15.0-2) so that the resultant amount of negative feedback is conservatively low in order to augment any power increase due to moderator reactor feedback.
- 4. Cases are analyzed considering four loops in operation.
nt systems and equipment which are necessary to mitigate the effects of RCS depressurization sed by an inadvertent safety valve opening are discussed in Section 15.0.8 and listed in le 15.0-6.
trol systems are assumed to function only if their operation yields more severe accident lts. For an Accidental Depressurization of the Reactor Coolant System event, the automatic control system is assumed to be functional. The rod control system is designed to maintain g at the nominal full power Tavg. This delays reactor trip, which results in a more limiting sient.
system response to an inadvertent opening of a pressurizer safety valve is shown on ures 15.6-1 and 15.6-2. Figure 15.6-1 illustrates the nuclear power transient following the ressurization. Nuclear power remains essentially unchanged until reactor trip occurs on rtemperature T. The pressure decay transient and average temperature transient following the dent are given on Figure 15.6-2. Pressure drops more rapidly while core heat generation is uced via the trip and then slows once saturation temperature is reached in the hot leg. The arture from nucleate boiling ratio (DNBR) decreases initially but increases rapidly following trip (Figure 15.6-1). The DNBR remains above the limit value throughout the transient. A B statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based he system conditions at the time of the minimum DNBR. The results met the applicable limit pecified in Section 4.4.
calculated sequence of events for the inadvertent opening of a pressurizer safety valve dent is shown in Table 15.6-1.
6.1.3 Conclusions results of the analysis show that the pressurizer low pressure and the overtemperature T tor protection system signals provide adequate protection against the RCS depressurization nt. The DNBR remains above the limit value throughout the transient; thus, the DNB design s as described in Section 4.4 is met.
.1.4 Radiological Consequences inadvertent opening of a pressurizer safety or relief valve releases primary coolant to the surizer relief tank. Since no fuel damage is predicted for this event, a specific radiological ase calculation was not performed.
6.2 FAILURE OF SMALL LINES CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT re are no instrument lines connected to the RCS that penetrate the containment. There are, ever, the sample lines from the hot legs of reactor coolant loops 1 and 3, from the cold legs of h reactor coolant loop, from the steam space of the pressurizer, the Post Accident Sampling tem (PASS) lines, and the chemical and volume control system (CHS) letdown and RCP seal rn lines penetrating the containment. The hot leg, cold leg, and pressurizer vapor space sample s are provided with normally open automatic isolation valves on both sides of the containment
- l. The PASS lines are provided with a normally closed automatic isolation valve inside tainment and a locked closed remote-manual isolation valve outside containment. The CHS own and RCP seal return lines are provided with normally open automatic containment ation valves on both sides of the containment wall. In all cases the containment isolation es are designed in accordance with the requirements of General Design Criterion 55.
most severe pipe rupture with regard to radioactivity release during normal plant operation urs in the CHS. This would be a complete severance of the 3-inch letdown line just outside
would result in a loss of reactor coolant at the rate of approximately 152 gpm (referenced at a sity of 62 lb/ft3) which would not cause engineered safety features system actuation.
a radiation and leakage detection instrumentation provide the means for detection of a own line rupture. Frequent operation of the CHS reactor makeup control system and other S instrumentation also aids the operator in diagnosing a letdown line rupture. The time uired for the operator to identify the accident and manually isolate the rupture is expected to be hin 30 minutes of the rupture. Once the rupture is identified, the operator would isolate the own line rupture by closing the letdown orifice isolation valves or the letdown line tainment isolation valves. The letdown containment isolation valves are credited to close and ate the leak. All valves are provided with control switches at the main control board. There are ingle failures that would prevent isolation of the letdown line rupture.
iological Consequences plant is assumed to be operating at the technical specification primary coolant activity.
complete severance of the letdown line results in a LOCA at the rate of approximately 152 which may not result in the activation of the engineered safety features (ESF) systems for the ation of the release. This implies that the supplementary leak collection and release system CRS) and auxiliary building filters are not in operation and the releases to the environment m the severed line are assumed to be at ground level. The time needed to identify and isolate rupture is conservatively assumed to be 30 minutes.
fraction of iodine release to the environment is derived from a calculated fraction of roximately 0.40 of the primary coolant flashing during pipe leakage. This is based on a direct ase of primary coolant at primary coolant temperature, which conservatively bounds potential dent sequences.
to transients in the core at the time of the accident, it is assumed that an iodine spike occurs currently with the letdown line rupture.
radiological consequences of the postulated small line break are reported in Table 15.0-8. The mptions used to perform this evaluation are summarized in Table 15.6-2. The assumptions d in Table 15.6-2 together with the atmospheric dispersion values listed in Table 15.0-11 (for tainment releases) are used to compute the doses to the EAB (0-2 hr). The resulting doses to exclusion area boundary (EAB) are within the TEDE limits defined by Regulatory Guide 3 for accidents involving a coincident iodine spike.
6.3 STEAM GENERATOR TUBE FAILURE o different analyses are performed for steam generator tube failure to determine the off site ation doses and the margin to steam generator overfill, respectively. To maximize doses or m generator overfill, each analysis uses a different methodology and set of assumptions.
.3.1 Identification of Causes and Accident Description accident examined is the complete severance of a single steam generator tube. This event is sidered an ANS Condition IV event, a limiting fault (Section 15.0.1). The accident is assumed ake place at full power with the reactor coolant contaminated with fission products esponding to the continuous operation with a limited amount of defective fuel rods. The dent leads to an increase in contamination of the secondary system due to leakage of oactive coolant from the RCS. In the event of a coincident loss of off site power, or failure of condenser steam dump system, discharge of activity to the atmosphere takes place via the m generator safety and/or atmospheric dump valves.
mplete severance of the steam generator tube rupture is considered a somewhat conservative mption since the Inconel-600 tube material is highly ductile. The more probable mode of tube ure would be one or more minor leaks of undetermined origin. Activity in the secondary em is subject to continual surveillance and an accumulation of minor leaks which exceed the ts established in the Technical Specifications is not permitted during unit operation.
operator is expected to determine that a steam generator tube rupture has occurred, to identify isolate the ruptured steam generator, and to complete the required recovery actions to stabilize plant and terminate the primary to secondary break flow. These actions should be performed restricted time scale in order to minimize contamination of the secondary system and ensure ination of radioactive release to the atmosphere from the faulted unit. Consideration of the cations provided at the control board, together with the magnitude of the break flow, leads to conclusion that the recovery procedure can be carried out on a time scale which ensures that k flow to the secondary system is terminated before water in the ruptured steam generator s into the main steam pipe. Sufficient indications and controls are provided to enable the rator to carry out these functions satisfactorily.
ormal operation of the various plant control systems is assumed, the following sequence of nts is initiated by a tube rupture.
- 1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, steam flow/feedwater flow mismatch occurs as feedwater flow to the ruptured steam generator is reduced as a result of primary coolant break flow to that unit.
- 2. The main steamline radiation monitors, the condenser air ejector radiation monitor, or the steam generator blowdown liquid monitor may alarm, indicating a sharp increase in radioactivity in the secondary system. At this point, steam generator blowdown is manually isolated.
- 3. The decrease in RCS pressure due to the continued loss of reactor coolant inventory leads to a reactor trip signal on low pressurizer pressure or overtemperature T. The resultant plant cooldown following reactor trip leads to a
injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater (AFW) addition via automatic initiation of the motor-driven AFW pumps.
- 4. The reactor trip automatically trips the turbine, and if off site power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of off site power, the steam dump valves automatically close to protect the condenser. The steam generator pressure rapidly increases, resulting in steam discharge to the atmosphere through the steam generator safety and/or atmospheric dump valves.
- 5. Following reactor trip and safety injection actuation, the continued action of the auxiliary feedwater supply and borated safety injection flow provides a heat sink which absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of off site power, steam relief to the atmosphere.
- 6. Safety injection flow results in increasing RCS pressure and pressurizer water level, and the RCS pressure trends toward the equilibrium value where the safety injection flow rate equals the break flow rate.
he event of a steam generator tube rupture (SGTR), the plant operators must diagnose the TR and perform the required recovery actions to stabilize the plant and terminate the primary econdary leakage. The operator actions for SGTR recovery are provided in the Emergency rating Procedures. The major operator actions include identification and isolation of the ured steam generator, cooldown and depressurization of the RCS to restore inventory, and ination of SI to stop primary to secondary leakage. These operator actions are described w.
- 1. Identify the ruptured steam generator.
High secondary side activity, as indicated by the main steamline radiation monitors, the condenser air ejector radiation monitor, or steam generator blowdown radiation monitors, typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level or a high radiation indication from a main steamline or a steam generator sample. For an SGTR that results in a reactor trip at high power, the steam generator water level will decrease significantly for all of the steam generators. The AFW flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will increase more rapidly in that steam generator.
This response, as indicated by the steam generator water level instrumentation,
- 2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.
Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.
- 3. Cool down the RCS using the intact steam generators.
After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators.
This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If off site power is available, the normal steam dump system to the condenser can be used to perform this cooldown.
However, if off site power is lost, the RCS is cooled using the atmospheric dump bypass valves on the intact steam generators.
- 4. Depressurize the RCS to restore reactor coolant inventory.
When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped. Since leakage from the primary side will continue after SI flow is stopped until RCS and ruptured steam generator pressures equalize, an excess amount of inventory is needed to ensure that pressurizer level remains on span.
The excess amount required depends on RCS pressure and reduces to zero when RCS pressure equals the pressure in the ruptured steam generator.
The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if off site power is lost or the RCPs are not running for some other reason, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.
- 5. Terminate SI to stop primary to secondary leakage.
longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressure equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.
owing SI termination, the plant conditions will be stabilized, the primary to secondary break will be terminated, and all immediate safety concerns will have been addressed. At this time, ries of operator actions are performed to prepare the plant for cooldown to cold shutdown ditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold tdown conditions and to depressurize the ruptured steam generator.
.3.2 Analysis of Effects and Consequences
.3.2.1 Margin to Steam Generator Overfill SGTR results in the leakage of contaminated reactor coolant into the secondary system and sequent release of a portion of the activity to the atmosphere, and an analysis is typically ormed to assure that the off site radiation doses resulting from an SGTR are within the wable guidelines. However, one of the major concerns for an SGTR is the possibility of steam erator overfill since this could potentially result in a significant increase in the off site ation doses. Therefore, to ensure that steam generator overfill will not occur for a design basis TR for Millstone Unit 3, an analysis was performed to demonstrate margin to steam generator rfill assuming the limiting single failure relative to overfill.
steam generator tube rupture analysis was performed for Millstone Unit 3 using the hodology developed in WCAP-10698. This analysis methodology was developed by the TR Subgroup of the Westinghouse Owners Group and was approved by the NRC in a Safety luation Report dated March 30, 1987. The LOFTTR2 program, an updated version of the FTTR1 program, was used to perform the SGTR analysis for Millstone Unit 3. The LOFTTR1 gram was developed as part of the revised SGTR analysis methodology and was used for the TR evaluations in WCAP-10698. However, the LOFTTR1 program was subsequently dified to accommodate steam generator overfill and the revised program, designated as FTTR2, was used for the evaluation of the consequences of overfill in WCAP-11002. The FTTR2 program is identical to the LOFTTR1 program, with the exception that the LOFTTR2 gram has the additional capability to represent the transition from two regions (steam and er) on the secondary side to a single water region if overfill occurs, and the transition back to regions again depending upon the calculated secondary conditions. Since the LOFTTR2 gram has been validated against the LOFTTR1 program, the LOFTTR2 program is also ropriate for performing licensing basis SGTR analyses.
nt response to the SGTR event was modeled using the LOFTTR2 computer code with servative assumptions of break size and location, condenser availability and initial secondary er mass in the ruptured steam generator. The analysis methodology includes the simulation of
ners Group Emergency Response Guidelines (ERGs). The operator action times used for the lysis are based on the results of simulator studies of the SGTR recovery operations which were ormed by the Millstone Unit 3 operations personnel using the plant training simulator. Thus, SGTR analysis is based on the application of the actual plant procedures and operator training.
limiting single failure was assumed to be the failure of the main steam pressure relief valve PRV) bypass valves on two of the intact steam generators to open on demand when the rator initiates cooling of the RCS using the intact steam generators. This is consistent with the hodology in WCAP-10698. The LOFTTR2 analysis to determine the margin to overfill was ormed for the time period from the tube rupture until the primary and secondary pressures are alized and the break flow is terminated. The water volume in the secondary side of the ured steam generator was calculated as a function of time to demonstrate that overfill does not ur. The results of this analysis demonstrate that there is margin to steam generator overfill for sign basis SGTR for Millstone Unit 3.
.3.2.2 Radiological Consequences analysis was also performed to determine the off site radiological consequences of an SGTR g the methodology in WCAP-10698 and Supplement 1 to WCAP-10698, assuming the ting single failure relative to off site doses without steam generator overfill. Since steam erator overfill does not occur, the results of this analysis represent the limiting consequences an SGTR for Millstone Unit 3. A thermal and hydraulic analysis was performed to determine plant response for a design basis SGTR, and to determine the integrated primary to secondary k flow and the mass releases from the ruptured and intact steam generators to the atmosphere.
s information was then used to calculate the resulting radiological consequences.
.3.2.2.1 Thermal and Hydraulic Analysis plant response following an SGTR was analyzed with the LOFTTR2 program for the time od from the tube rupture until the primary and secondary pressures are equalized and the k flow is terminated. The reactor protection system and the automatic actuation of the ineered safeguards systems were modeled in the analysis. The major operator actions which required to terminate the break flow for an SGTR were also simulated in the analysis.
lysis Assumptions accident modeled is a double-ended break of one steam generator tube located at the top of tube sheet on the outlet (cold leg) side of the steam generator. It was assumed that the reactor perating at full power at the time of the accident and the secondary mass was conservatively med to be 10% more than the mass corresponding to full power operation at the nominal m generator water level plus a penalty to account for the mass added due to a turbine runback.
as also assumed that a loss of off site power occurs at the time of reactor trip and the highest th control assembly was assumed to be stuck in its fully withdrawn position at reactor trip.
NSSS power = 3666 MWt* 1.02 (uncertainty) = 3739 MWt Average RCS temperature = 571.5°F (581.5°F with a 10°F coastdown)
RCS pressure = 2250 psia - 50 psi (uncertainty) = 2200 psia Thermal design flow = 363,200 gpm Pressurizer level = 45.4%
SG tube plugging = 0%
Auxiliary feed flow = 1200 gpm at 1140 psia Auxiliary feed flow delay time = 60 seconds Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia Pressurizer power operated relief valve flow = 210,000 lbm/hr/valve at 2500 psia limiting single failure was assumed to be the failure of the MSPRV on the ruptured steam erator. Failure of this MSPRV in the open position will cause an uncontrolled depressurization he ruptured steam generator which will increase primary to secondary leakage and the mass ase to the atmosphere. It was assumed that the ruptured steam generator MSPRV fails open n the ruptured steam generator is isolated, and that the MSPRV is isolated by closing the ciated isolation valve.
major operator actions required for the recovery from an SGTR are discussed in tion 15.6.3.1, and these operator actions were simulated in the analysis. The operator action es used for the analysis are based on the results of the Millstone Unit 3 plant training simulator ies, and the times are presented in Table 15.6.3-1. It is noted that the MSPRV on the ruptured m generator was assumed to fail open at the time the ruptured steam generator was isolated.
ore proceeding with the recovery operations, the failed open MSPRV on the ruptured steam erator was assumed to be isolated by closing the associated isolation valve. It was assumed the ruptured steam generator MSPRV is isolated 20 minutes after the valve was assumed to open. After the ruptured steam generator was isolated, an additional 8-minute delay ble 15.6.3-1) was assumed before the operator initiates the RCS cooldown.
re are several operator actions credited to recover from a steam generator tube rupture. The ons assumed in the analysis bound the performance of the operators using the EOPs. The eptability of the EOP performance can be demonstrated by examining the impact on total dose ased or margin to overfill.
LOFTTR2 analysis results are described below. The sequence of events for this transient is ented in Table 15.6.3-2.
owing the tube rupture, reactor coolant flows from the primary into the secondary side of the ured steam generator since the primary pressure is greater than the stream generator pressure.
esponse to this loss of reactor coolant, pressurizer level decreases as shown in Figure 15.6.3-1.
RCS pressure also decreases as shown in Figure 15.6.3-2, as the steam bubble in the surizer expands. As the RCS pressure decreases due to the continued primary to secondary age, automatic reactor trip occurs on an overtemperature T trip signal at 135 seconds.
er reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves e, and steam flow to the turbine is terminated. The steam dump system is designed to actuate owing reactor trip to limit the increase in secondary pressure, but the steam dump valves ain closed due to the loss of condenser vacuum resulting from the assumed loss of off site er at the time of reactor trip. Thus, the energy transfer from the primary system causes the ondary side pressure to increase rapidly after reactor trip until the MSPRV (and safety valves if r setpoints are reached) lift to dissipate the energy, as shown in Figure 15.6.3-3. The main water flow will be terminated, and AFW flow will be automatically initiated following tor trip and the loss of off site power.
RCS pressure and pressurizer level continue to decrease after reactor trip as energy transfer to secondary shrinks the reactor coolant and the tube rupture break flow continues to deplete ary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI signal pproximately 143 seconds. After SI actuation, the SI flow rate initially exceeds the tube ure break flow rate, and the RCS pressure and pressurizer level begin to increase and roach the equilibrium values where the SI flow rate equals the break flow rate.
ce off site power is assumed lost at reactor trip, the RCPs trip and a gradual transition to ral circulation flow occurs. Immediately following reactor trip, the temperature differential ss the core decreases as core power decays (see Figures 15.6.3-4 and 15.6.3-5); however, the perature differential subsequently increases as natural circulation flow develops. The increase he temperature differential slows the rate of the pressurizer level and pressure decrease as wn in Figures 15.6.3-1 and 15.6.3-2, respectively. The cold leg temperatures initially trend ard the steam generator temperature as the fluid residence time in the tube region increases.
RCS hot leg temperatures slowly decrease until the time when the ruptured steam generator ospheric relief valve is assumed to fail open.
s event is not limiting with respect to DNB. The SGTR results in a relatively slow ressurization with reactor trip occurring on over temperature delta-T or low pressurizer sure. Based on this, SGTR is not explicitly analyzed for DNB.
or Operator Actions
- 1. Identify and Isolate the Ruptured Steam Generator
seconds.
The ruptured steam generator MSPRV is also assumed to fail open at this time.
However, the actual time used in the analysis is 2 seconds longer because of the computer program numerical requirements for simulating the operator actions. The failure of the MSPRV causes the ruptured steam generator to rapidly depressurize as shown in Figure 15.6.3-3. The depressurization of the ruptured steam generator increases the break flow (Figure 15.6.3-6), and the energy transfer from primary to secondary results in a decrease in the ruptured loop temperatures as shown in Figure 15.6.3-4. The intact steam generator loop temperatures also decrease, as shown in Figure 15.6.3-5, until the failed open MSPRV is isolated. The decrease in the RCS temperatures results in an initial decrease in the pressurizer level and RCS pressure. However, the increased SI flow subsequently causes the pressurizer level and RCS pressure to stabilize and begin to increase as shown in Figures 15.6.3-1 and 15.6.3-2, respectively. It was assumed that the time required for the operator to identify that the ruptured steam generator MSPRV is open and to close the associated block valve is 20 minutes. Thus, the MSPRV was isolated at 2702 seconds which terminates the depressurization of the ruptured steam generator, and the ruptured steam generator pressure begins to increase after that time.
- 2. Cool Down the RCS to Establish Subcooling Margin After the ruptured MSPRV isolation is closed, an 8-minute operator action time was imposed prior to initiation of cooldown. Since off site power is lost, the RCS was cooled by dumping steam to the atmosphere using the MSPRV bypass valves on the three intact steam generators. The cooldown was continued until RCS subcooling at the ruptured steam generator pressure is 20°F plus an allowance of 32°F for subcooling uncertainty. The depressurization of the ruptured steam generator due to the failed open MSPRV affects the RCS cooldown target temperature since the target temperature is dependent upon the pressure in the ruptured steam generator. Although the ruptured steam generator pressure is increasing when the cooldown is initiated, the pressure is substantially below the MSPRV setpoint. The lower pressure in the ruptured steam generator results in a lower RCS cooldown temperature, which extends the time required for cooldown.
The RCS cooldown was initiated at 3182 seconds by opening the MSPRV bypass valves on the three intact steam generators, and was completed at 3690 seconds.
The reduction in the intact steam generator pressure required to accomplish the cooldown is shown in Figure 15.6.3-3, and the effect of the cooldown on the intact loop temperatures is shown in Figure 15.6.3-5. The RCS pressure also decreases initially during the cooldown due to shrinkage of the reactor coolant as shown in Figure 15.6.3-2, and then begins to increase again as the SI flow increases. It is noted that the ruptured steam generator pressure continues to increase during the cooldown until the pressure approaches the MSPRV setpoint again.
After the RCS cooldown was completed, a 3-minute operator action time was assumed prior to depressurization. The RCS depressurization was initiated at 3872 seconds to assure adequate coolant inventory prior to terminating SI flow. With the RCPs stopped, normal pressurizer spray is not available, and thus the RCS was depressurized by opening a pressurizer PORV. The depressurization was continued until any of the following conditions are satisfied: RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than the allowance of 16% for pressurizer level uncertainty, or pressurizer level is greater than 73%, or RCS subcooling is less than the 32°F allowance for subcooling uncertainty. The RCS depressurization reduces the break flow as shown in Figure 15.6.3-6 and increases SI flow to refill the pressurizer as shown in Figure 15.6.3-1. For this case, the depressurization was terminated when the RCS pressure is reduced to the ruptured steam generator pressure (Figure 15.6.3-7) and the pressurizer level is above 16% (Figure 15.6.3-1). When the pressurizer PORV is closed, the level continues to increase and subsequently reaches a maximum of approximately 60% when SI flow is terminated.
- 4. Terminate SI to Stop Primary to Secondary Leakage The previous actions have established adequate RCS subcooling, verified a secondary side heat sink, and restored the reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, the SI flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage. The SI flow is terminated at this time if RCS subcooling is greater than the 32°F allowance for subcooling uncertainty, minimum AFW flow is available or at least one intact steam generator level is in the narrow range, the RCS pressure is increasing, and the pressurizer level is greater than the 16%
allowance for uncertainty. To assure that the RCS pressure is increasing, SI was not terminated in the analysis until the RCS pressure increases by at least 50 psi.
After depressurization was completed, an operator action time of 6 minutes was assumed prior to SI termination. Since the above requirements are satisfied, SI termination was performed at this time. After SI termination, the RCS pressure begins to decrease as shown in Figure 15.6.3-2, and the differential pressure between the RCS and ruptured steam generator decreases as shown in Figure 15.6.3-7. The intact MSPRV bypass valves are also opened to dump steam to maintain the prescribed RCS temperature to ensure that subcooling is maintained. When the MSPRV bypass valves are opened, the increased energy transfer from primary to secondary also aids in the depressurization of the RCS to the ruptured steam generator pressure. As shown in Figure 15.6.3-6, the primary to secondary leakage continues after the SI flow is terminated until the RCS and ruptured steam generator pressures equalize.
850 ft3 when the break flow is terminated. The mass of water in the ruptured steam generator so shown as a function of time in Figure 15.6.3-9.
ss Releases mass releases due to an SGTR from the steam generators to the environment were determined use in evaluating Control Room, EAB and LPZ doses.
postulated break allows primary liquid to leak to the secondary side of one of the steam erators (denoted as the affected generator) with an assumed release to the environment ugh the MSPRVs. The MSPRV on the affected steam generator is assumed to open to control m generator pressure at the beginning of the event, and then fail fully open after operator on was taken to close the MSPRV. The affected steam generator discharges steam to the ironment for 2702 seconds (0.7506 hours0.0869 days <br />2.085 hours <br />0.0124 weeks <br />0.00286 months <br />) until the generator is isolated a second time by ure of the MSPRV isolation valve. Break flow into the affected steam generator continues l 6412 seconds, at which time the RCS is at a lower pressure. Additional releases from the cted steam generator are modeled from 2 to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> to complete depressurization of the m generator early in the event to maximize dose consequences. Table 15.6.3-3 provides the s releases associated with the thermal and hydraulic analysis. The mass release rates to the osphere from the LOFTTR2 analysis are presented in Figures 15.6.3-10 and 15.6.3-11 for the cted and intact steam generators respectively. Flashed break flow is presented in ure 15.6.3-12.
intact generators discharge steam for a period of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> until the primary system has cooled iciently (to 350°F) to initiate Residual Heat Removal (RHR) system cooling of the RCS.
ing the entire steaming process, a primary to secondary leak rate of 1 gpm total to the intact m generators is assumed.
.3.2.2.2 Radiation Dose Analysis evaluation of the radiological consequences of a steam generator tube rupture event assumes the reactor has been operating at the maximum allowable Technical Specification iodine limit primary coolant activity and with a primary to secondary leakage of 1 gpm total for sufficient e to establish equilibrium concentrations of radionuclides in the reactor coolant and in the ondary coolant. Radionuclides from the primary coolant enter the steam generator via the ured tube and are released to the atmosphere through the atmospheric dump valves and ospheric dump bypass valves (and safety valves). It was assumed that a loss of off site power urs at the time of SGTR. This is a conservative assumption that causes the condenser to be vailable and the release to the environment to begin at the time of SGTR.
quantity of radioactivity released to the environment, due to an SGTR, depends upon primary secondary coolant activity, iodine spiking effects, primary to secondary break flow, break flashing fractions, attenuation of iodine carried by the flashed portion of the break flow, itioning of iodine between the steam generator liquid and steam phases and the mass of fluid ased from the generators. All of these parameters were conservatively evaluated in a manner
- 1. Design Basis Analytical Assumptions The major assumptions and parameters used in the analysis are itemized in Tables 15.6.3-4 and 15.6-12 (for the Control Room).
- 2. Source Term Calculations The radionuclide concentrations in the primary and secondary system, prior to and following the SGTR, are determined as follows:
- a. The iodine concentrations in the reactor coolant will be based upon accident initiated and pre-accident iodine spikes.
- i. Accident Initiated Spike - The initial primary coolant iodine concentration is 1.0 Ci/g of Dose Equivalent (D.E.) I-131.
Following the primary system depressurization associated with the SGTR, an iodine spike is initiated in the primary system which increases the iodine release rate from the fuel to the coolant to a value 335 times greater than the release rate corresponding to the initial primary system iodine concentration.
ii. Pre-accident Spike - A reactor transient has occurred prior to the SGTR and has raised the primary coolant iodine concentration from 1.0 to 60 Ci/gram of D.E. I-131.
- b. The initial secondary coolant iodine concentration is 0.1 Ci/gram of D.E.
- c. The gross activity concentrations in the reactor coolant are based on the Technical Specification limit of 1Ci/gm D.E. I-131 (equivalent to 0.29%
failed fuel).
- 3. Dose Calculations The radioactivity transport model utilized in this analysis is consistent with Regulatory Guide 1.183. The model considers break flow flashing, droplet size, bubble scrubbing, steaming, and partitioning. The model assumes that a fraction of the iodine carried by the break flow becomes airborne immediately due to flashing and atomization. Removal credit can be taken for scrubbing of iodine contained in the atomized coolant droplets as they rise from the rupture site to the secondary water surface. However, the benefit associated with the scrubbing of the steam bubbles has been shown to be relatively insignificant and has been neglected in this analysis. The fraction of primary coolant iodine which is not assumed to
coefficient. This analysis conservatively assumes an iodine partition coefficient of 0.01 between the steam generator liquid and steam phases. Droplet removal by the dryers is conservatively assumed to be negligible.
The transport of gross activity in this analysis is consistent with Regulatory Guide 1.183. Noble gases are released from the primary system without mitigation or holdup. Particulate activity in the flashed break flow is released from the primary to the steam generator steam volume without mitigation. Particulate activity in the steam generator liquid volume is released through moisture carryover during steaming and is credited with a factor of 100 reduction due to assumed moisture carryover.
The following assumptions and parameters were used to calculate the activity released to the atmosphere and the doses following an SGTR.
- a. The mass of reactor coolant discharged into the secondary system through the rupture and the mass of steam released from the ruptured and intact steam generators to the atmosphere assumed in the radiation dose analysis are presented in Table 15.6.3-3. A loss of off site power is assumed to occur at the time of SGTR. This is a conservative assumption that causes the condenser to be unavailable and the release to the environment to begin at the time of the SGTR. Additionally, the steam release period is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry. This is followed by a 11.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> period of simultaneous steaming and RHR operation to address safety grade cold shutdown requirements.
- b. The amount of rupture flow that flashes to steam and is immediately released to the environment is presented in Figure 15.6.3-12. The amount of flashed break flow was conservatively calculated assuming that 100 percent of the break flow comes from the hot leg side of the steam generator, whereas the break flow actually comes from both the hot leg and the cold leg sides of the steam generator.
- c. The total primary to secondary leak rate is assumed to be 1.0 gal/min. All of the 1.0 gal/min leak rate is assumed to be to the three intact steam generators, since the effect of leakage to the ruptured steam generator is negligible compared to the activity in the primary to secondary break flow from the tube rupture.
- d. The iodine partition coefficient between the liquid and steam of the ruptured and intact steam generators is assumed to be 0.01.
or for cloud depletion by ground deposition during transport to the Control Room, EAB or LPZ.
- f. Short-term atmospheric dispersion factors (X/Qs) for accident analysis are provided in Table 15.0-11.
- g. Moisture carryover in intact steam generators is assumed to be 1%.
- 4. Dose Calculation Models The dose calculation model used for control room, EAB and LPZ TEDE evaluation is based upon a modified version of the RADTRAD computer code discussed in Regulatory Guide 1.183. Dose conversion factors used in this model are from Federal Guidance Reports 11 and 12.
- 8. The radiological consequences of the steam generator tube rupture are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and LPZ for the concurrent spike.
6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT (NOT APPLICABLE TO MILLSTONE 3).
.5 LOSS-OF-COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY
.5.1 Identification of Causes and Frequency Classification OCA is the result of a pipe rupture of the RCPB (Section 5.2). For the analyses reported here, ajor pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or ter than 1.0 square feet (ft2). This event is considered an ANS Condition IV event, a limiting t, in that it is not expected to occur during the lifetime of the plant but is postulated as a servative design basis (Section 15.0.1).
inor pipe break (small break), as considered here, is defined as a rupture of the reactor coolant sure boundary with a total cross-sectional area less than 1.0 ft2 in which the normally rating charging system flow is not sufficient to sustain pressurizer level and pressure. This is
Acceptance Criteria for the LOCA are described in 10 CFR 50.46 (10 CFR 50.46 and endix K of 10 CFR 50 1974) as follows.
- 1. The calculated peak fuel element clad temperature is below the requirement of 2,200°F.
- 2. The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1 percent of the total amount of Zircaloy in the reactor.
- 3. The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limit of 17 percent is not exceeded during or after quenching.
- 4. The core remains amenable to cooling during and after the break.
- 5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.
se criteria were established to provide significant margin in emergency core cooling system CS) performance following a LOCA. Input parameters used in the ECCS analysis are cribed in Table 15.6-3 for large break LOCA and Table 15.6-15 for small break LOCA.
.5.2 Best Estimate Large Break Loss of Coolant Analysis (BE-LBLOCA)
.5.2.1 General en the Final Acceptance Criteria (FAC) governing the loss-of-coolant accident (LOCA) for ht Water Reactors was issued in Appendix K of 10 CFR 50.46, both the Nuclear Regulatory mmission (NRC) and the industry recognized that the stipulations of Appendix K were highly servative. That is, using the then accepted analysis methods, the performance of the ergency Core Cooling System (ECCS) would be conservatively underestimated, resulting in dicted Peak Clad Temperatures (PCTs) much higher than expected. At that time, however, the ree of conservatism in the analysis could not be quantified. As a result, the NRC began a large e confirmatory research program with the following objectives:
- 1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those areas in which a purposely prescriptive approach was used in the Appendix K rule could be quantified with additional data so that a less prescriptive future approach might be allowed.
- 2. Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The
respect to the Appendix K limits could be quantified.
ce that time, the NRC and the nuclear industry have sponsored reactor safety research grams directed at meeting the above two objectives. The overall results have quantified the servatism in the Appendix K rule for LOCA analyses and confirmed that some relaxation of rule can be made without a loss in safety to the public. It was also found that some plants were g restricted in operating flexibility by the overly conservative Appendix K requirements. In gnition of the Appendix K conservatism that was being quantified by the research programs, NRC adopted an interim approach for evaluation methods. This interim approach is described ECY-83-472. The SECY-83-472 approach retained those features of Appendix K that were l requirements, but permitted applicants to use best-estimate thermal-hydraulic models in r ECCS evaluation model. Thus, SECY-83-472 represented an important step in basing nsing decisions on realistic calculations, as opposed to those calculations prescribed by endix K.
998, the NRC Staff amended the requirements of 10 CFR 50.46 and Appendix K, ECCS luation Models, to permit the use of a realistic evaluation model to analyze the performance he ECCS during a hypothetical LOCA. This decision was based on an improved erstanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.
er the amended rules, best-estimate thermal-hydraulic models may be used in place of models h Appendix K features. The rule change also requires, as part of the LOCA analysis, an ssment of the uncertainty of the best-estimate calculations. It further requires that this analysis ertainty be included when comparing the results of the calculations to the prescribed eptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate codes is vided in Regulatory Guide 1.157.
demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method ed the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology REG/CR-5249). This method outlined an approach for defining an qualifying a best-estimate mal-hydraulic code and quantifying the uncertainties in a LOCA analysis.
OCA evaluation methodology for three-loop and four-loop Pressurized Water Reactor (PWR) ts based on the revised 10 CFR 50.46 rules was developed by Westinghouse with the support PRI and Consolidated Edison and has been approved by the NRC (WCAP-12945-P-A).
st recently, Westinghouse developed an alternative uncertainty methodology called ASTRUM, ch stands for Automated Statistical TReatment of Uncertainty Method (WCAP-16009-P-A).
s method is still based on the CQD methodology and follows the steps in the CSAU hodology (NUREG/CR-5249). However, the uncertainty analysis (Element 3 in the CSAU) is aced by a technique based on order statistics. The ASTRUM methodology replaces the onse surface technique with a statistical sampling method where the uncertainty parameters simultaneously sampled for each case. The ASTRUM methodology has received NRC roval for referencing in licensing calculations in WCAP-16009-P-A.
). In particular, the statistical theory predicts that 124 calculations are required to ultaneously bound the 95th percentile values of three parameters with a 95 percent confidence l.
s analysis is in accordance with the applicability limits and usage conditions defined in tion 13-3 of WCAP-16009-P-A, as applicable to the ASTRUM methodology. Section 13-3 of AP-16009-P-A was found to acceptably disposition each of the identified conditions and tations related to WCOBRA/TRAC and the CQD uncertainty approach per Section 4.0 of the TRUM Final Safety Evaluation Report appended to this topical report.
.5.2.2 Method of Analysis methods used in the application of WCOBRA/TRAC to the large break LOCA with TRUM are described in WCAP-12945-P-A and WCAP-16009-P-A. A detailed assessment of computer code WCOBRA/TRAC was made through comparisons to experimental data. These ssments were used to develop quantitative estimates of the codes ability to predict key sical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional ertainties which are identified and quantified in the plant specific analysis. WCOBRA/TRAC D7A was used for the execution of ASTRUM for Millstone Unit 3 (WCAP-16009-P-A).
OBRA/TRAC combines two-fluid, three-field, multi dimensional fluid equations used in the sel with one dimensional drift-flux equations used in the loops to allow a complete and iled simulation of a PWR. The best-estimate computer code contains the following features:
- 1. Ability to model transient three dimensional flows in different geometries inside the vessel.
- 2. Ability to model thermal and mechanical non equilibrium between phases.
- 3. Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes.
- 4. Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.
pical calculation using WCOBRA/TRAC begins with the establishment of a steady state al condition with all loops intact. The input parameters and initial conditions for this steady e calculation are discussed in the next section.
owing the establishment of an acceptable steady state condition, the transient calculation is ated by introducing a break into one of the loops. The evolution of the transient through wdown, refill, and reflood proceeds continuously, using the same computer code COBRATRAC) and the same modeling assumptions. Containment pressure is modeled with BREAK component using a time dependent pressure table. Containment pressure is calculated
final step of the best-estimate methodology, in which all uncertainties of the LOCA meters are accounted for to estimate a PCT, local maximum oxidation (LMO), and core wide dation (CWO), at 95 percent probability, is described in the following sections.
- 1. Plant Model Development:
In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used in order to provide an accurate simulation of the transient.
However, specific guidelines are followed to ensure that the model is consistent with models used in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences, such as in the upper plenum of the reactor vessel or the ECCS injection configuration.
- 2. Determination of Plant Operating Conditions:
In this step, the expected or desired operating range of the plant to which the analysis applies is established. The parameters considered are based on a key LOCA parameters list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen for input as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the initial transient. Next, several confirmatory runs are made, which may vary a subset of the key LOCA parameters over their expected operating range in one-at-a-time sensitivities. Because certain parameters are not included in the uncertainty analysis, these parameters are set at their bounding condition. This analysis is commonly referred to as the confirmatory analysis. The most limiting input conditions, based on those confirmatory runs, are then combined into the model that will represent the limiting state for the plant, which is the starting point for the assessment of uncertainties.
- 3. Assessment of Uncertainty:
The ASTRUM methodology is based on order statistics. The technical basis of the order statistics is described in Section 11 of WCAP-16009-P-A. The determination of the PCT uncertainty, LMO uncertainty, and CWO uncertainty relies on a statistical sampling technique. According to the statistical theory, 124 WCOBRA/
TRAC calculations are necessary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, CWO).
The uncertainty contributors are sampled randomly from their respective distributions for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are randomly sampled for each time in the cycle, break type
Results from the 124 calculations are tallied by ranking the PCT from highest to lowest. A similar procedure is repeated for LMO and CWO. The highest rank PCT, LMO, and CWO will bound 95 percent of their populations with 95 percent confidence level.
- 4. Plant Operating Range:
The plant operating range over which the uncertainty evaluation applies is defined.
Depending on the results obtained in the above uncertainty evaluation, this range may be the desired range or may be narrower for some parameters to gain additional margin.
.5.2.3 Analysis Assumptions expected PCT and its uncertainty developed are valid for a range of plant operating ditions. The range of variation of the operating parameters has been accounted for in the ertainty evaluation. Table 15.6-3 summarizes the operating ranges for Millstone Unit 3 as ned for the proposed operating conditions, which are supported by Best-Estimate LBLOCA lysis. Tables 15.6-4 and 15.6-7 summarize the LBLOCA containment data used for ulating containment pressure. If operation is maintained within these ranges, the LBLOCA lts developed in this report using WCOBRA/TRAC are considered to be valid. Note that e of these parameters vary over their range during normal operation (accumulator pressure) other ranges are fixed for a given operational condition (Tavg).
.5.2.4 Design Basis Accident Millstone Unit 3 PCT limiting transient is a double-ended cold leg guillotine break which lyzes conditions that fall within those listed in Table 15.6-3. Traditionally, cold leg breaks e been limiting for large break LOCA. This location is the one where flow stagnation in the appears most likely to occur. Scoping studies with WCOBRA/TRAC have confirmed that the leg remains the limiting break location (WCAP-12945-P-A).
large break LOCA transient can be divided into convenient time periods in which specific nomena occur, such as various hot assembly heatup and cooldown transients. For a typical e break, the blowdown period can be divided into the critical heat flux (CHF) phase, the ard core flow phase, and the downward core flow phase. These are followed by the refill, ood, and long term cooling periods. Specific important transient phenomena and heat flux mes are discussed below, with the transient results shown in Figures 15.6-8 to 15.6-21. (The T limiting case was chosen to show a conservative representation of the response to a large k LOCA.)
- 1. Critical Heat Flux Phase:
initial temperatures (core, upper plenum, upper head, and hot legs) begin to flash to steam, the core flow reverses and the fuel rods begin to go through departure from nucleate boiling (DNB). The fuel cladding rapidly heats up (Figure 15.6-8) while the core power shuts down due to voiding in the core. This phase is terminated when the water in the lower plenum and downcomer begins to flash (Figures 15.6-14 and 15.6-19, respectively). The mixture swells and intact loop pumps, still rotating in single-phase liquid, push this two-phase mixture into the core.
- 2. Upward Core Flow Phase:
Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be enhanced if the pumps are not degraded, or if the break discharge rate is low due to saturated fluid conditions at the break. If pump degradation is high or the break flow is large, the cooling effect due to upward flow may not be significant. Figure 15.6-11 shows the void fraction for one intact loop pump and the broken loop pump. The figure shows that the intact loop remains in single-phase liquid flow for several seconds, resulting in enhanced upward core flow cooling. This phase ends as the lower plenum mass is depleted, the loop flow becomes two-phase, and the pump head degrades.
- 3. Downward Core Flow Phase The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump flow becomes two-phase. The break flow begins to dominate and pulls flow down through the core, up the downcomer to the broken loop cold leg, and out the break. While liquid and entrained liquid flow provide core cooling, the top third of core vapor flow (Figure 15.6-12) best illustrates this phase of core cooling. Once the system has depressurized to the accumulator pressure (Figure 15.6-13), the accumulators begin to inject cold borated water into the intact cold legs (Figure 15.6-16). During this period, due to steam upflow in the downcomer, a portion of the injected ECCS water is calculated to be bypassed around the downcomer and out the break. As the system pressure continues to fall, the break flow, and consequently the downward core flow, are reduced. The core begins to heat up as the system pressure approaches the containment pressure and the vessel begins to fill with ECCS water (Figure 15.6-15).
- 4. Refill Period:
As the refill period begins, the core begins a period of heatup and the vessel begins to fill with ECCS water (Figures 15.6-16 and 15.6-17). This period is characterized by a rapid increase in cladding temperatures at all elevations due to the lack of liquid and steam flow in the core region. This period continues until the
- 5. Reflood Period:
During the early reflood phase, the accumulators begin to empty and nitrogen enters the system. This forces water into the core, which then boils, causing system re-pressurization, and the lower core region begins to quench (Figure 15.6-18).
During this time, core cooling may increase due to vapor generation and liquid entrainment. During the reflood period, the core flow is oscillatory as cold water periodically re-wets and quenches the hot fuel cladding, which generates steam and causes system re-pressurization. The steam and entrained water must pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out of the break. This flow path resistance is overcome by the downcomer water elevation head, which provides the gravity driven reflood force. From the later stage of blowdown to the beginning of reflood, the accumulators rapidly discharge borated cooling water into the RCS, filling the lower plenum and contributing to the filling of the downcomer. The pumped ECCS water aids in the filling of the downcomer and subsequently supplies water to maintain a full downcomer and complete the reflood period. As the quench front progresses up the core, the PCT location moves higher into the top of core region.
As the vessel continues to fill, the PCT location is cooled the early reflood period is terminated.
A second cladding heatup transient may occur due to boiling in the downcomer.
The mixing of ECCS water with hot water and steam from the core, in addition to the continued heat transfer from the hot vessel and vessel metal, reduces the subcooling of ECCS water in the lower plenum and downcomer. The saturation temperature is dictated by the containment pressure. If the liquid temperature in the downcomer reaches saturation, subsequent heat transfer from the vessel and other structures will cause boiling and level swell in the downcomer. The downcomer liquid will spill out of the broken cold leg and reduce the driving head, which can reduce the reflood rate, causing a late reflood heatup at the upper core elevations. Figure 15.6-19 shows only a slight reduction in downcomer level and indicates that a late reflood heatup does not occur.
.5.2.5 Post Analysis of Record Evaluations ddition to the analyses presented in this section, evaluations and reanalyses may be performed eeded to address computer code errors and emergent issues, or to support plant changes. The es or changes are evaluated, and the impact on the peak cladding temperature (PCT) is rmined. The resultant increases or decreases in PCT is applied to the analysis of record PCT.
PCT, including all penalties and benefits, is presented in Table 15.6-8 for the large break CA. The current PCT is demonstrated to be less than the 10 CFR 46(b) requirement of 2200°F.
enda to the analysis of record (AOR) provided in the UFSAR until the overall changes ome significant as defined in 10 CFR 50.46. If the assessed changes or errors in the evaluation del results in significant changes in calculated PCT, a schedule for formal reanalysis or other on as needed to show compliance will be addressed in the report to the NRC.
ally, the criteria of 10 CFR 50.46 requires that holders and users of the evaluation models blish a number of definitions and processes for assessing changes in the models or their use.
tinghouse, in consultation with the PWR Owners Group (PWROG) has developed an roach for compliance with the reporting requirements. This approach is documented in AP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting ference 15.6-34). The NRC is provided with annual and 30 day reports, as applicable, for lstone Power Station.
.5.2.6 Conclusions ust be demonstrated that there is a high level of probability that the limits set forth in CFR 50.46 are met. The demonstration that these limits are met is as follows:
(b)(1) The limiting PCT corresponds to a bounding estimate of the 95th percentile PCT at 95 percent confidence level. The resulting PCT for the limiting case in the AOR is listed in Table 15.6-5. With the addition of post-AOR supplemental PCT adjustments, the licensing basis PCT is listed in Table 15.6-8, which is less than the 10 CFR 50.46 criterion (b)(1) of 2200°F.
(b)(2) The maximum cladding oxidation corresponds to a bounding estimate of the 95th percentile LMO at the 95 percent confidence level. Since the resulting LMO for the limiting case is 3.5 percent, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(2), (i.e., Local Maximum Oxidation of the cladding less than 17 percent), is demonstrated. The results are shown in Table 15.6-5.
(b)(3) The limiting core wide oxidation corresponds to a bounding estimate of the 95th percentile CWO at the 95 percent confidence level. The limiting Hot Assembly Rod (HAR) total maximum oxidation is 0.12 percent. A detailed CWO calculation takes advantage of the core power census that includes many lower power assemblies. Because there is a significant margin to the regulatory limit, the CWO value can be conservatively chosen as that calculated for the limiting HAR. A detailed CWO calculation is therefore not needed because the outcome will always be less than 0.12 percent. Since the resulting CWO is 0.12 percent, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(3), (i.e., Core Wide Oxidation less than 1 percent), is demonstrated. The results are shown in Table 15.6-5.
(b)(4) 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains amenable to cooling. This criterion has historically been satisfied by adherence to criteria (b)(1) and (b)(2), and by assuring that fuel deformation due to combined LOCA and seismic loads is
The approved methodology (WCAP-12945-P-A) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the 44 assemblies in the low power channel. This situation has not been calculated to occur for Millstone Unit 3. Therefore, acceptance criterion (b)(4) is satisfied.
(b)(5) 10 CFR 50.46 acceptance criterion (b)(5) requires that long term cooling be provided following the successful initial operation of the ECCS. Long term cooling is dependent on the demonstration of continued delivery of cooling water to the core. The actions, automatic or manual, that are currently in place at these plants to maintain long term cooling remain unchanged with the application of ASTRUM methodology (WCAP-16009-P-A).
ed on the analysis results, it is concluded that Millstone Unit 3 continues to maintain a margin afety to the limits prescribed by 10 CFR 50.46.
.5.3 Small Break LOCA
.5.3.1 Description of Small Break LOCA Transient OCA can result from a rupture of the reactor coolant system (RCS) or of any line connected to system up to the first isolation valve. Ruptures of small cross section will cause expulsion of coolant at a rate that can be accommodated by the charging pumps. Breaks of greater size (up ft2 area) are defined as small breaks and are analyzed with the NOTRUMP computer code. A ure in the reactor coolant system results in the discharge to the containment of reactor coolant associated energy. The result of this discharge is a decrease in coolant pressure in the reactor lant system and an increase in containment temperature and pressure.
reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is hed. A safety injection system (SIS) signal is actuated when the appropriate pressurizer low sure setpoint is reached, activating the high head safety injection pumps. The SIS actuation subsequent activation of the emergency core cooling system, which results from the SIS al, assumes the most limiting single failure of ECCS equipment.
ore the break occurs, the unit is assumed to be in an equilibrium condition, (i.e., the heat erated in the core is being removed via the secondary system). In the small break LOCA, the wdown phase of the small break occurs over a long time period. Thus, for a small break CA, there are three characteristic stages: (1) a gradual blowdown in which the decrease in er level is checked by the inventory replenishment associated with safety injection, (2) core very, and (3) long term recirculation. The heat transfer between the reactor coolant system the secondary system may be in either direction, depending on the relative temperature. For case of continued heat addition to the secondary side, the secondary side pressure increases the main steam safety valves may actuate to reduce the pressure. Make up to the secondary is automatically provided by the auxiliary feedwater system. Coincident with the safety ction signal, normal feedwater flow is stopped by closing the main feedwater control valves
break being the primary means of heat removal. When the reactor coolant system ressurizes to approximately 600 psia, the accumulators begin to inject borated water into the tor coolant loops. Reflecting the loss of off site power assumption, the reactor coolant pumps assumed to be tripped at the time of reactor trip, and the effects of pump coastdown are uded in the blowdown analysis.
.5.3.2 Small Break LOCA Evaluation Model NOTRUMP and LOCTA-IV computer codes are used to perform the analysis of LOCAs due mall breaks in the RCS. The NOTRUMP computer code, approved for this use by the U.S.
lear Regulatory Commission in May 1985 (WCAP-10079-P-A and WCAP-10080-A), is used calculate the transient depressurization of the RCS as well as to describe the mass and alpy of the flow through the break. This code is a one dimensional general network code rporating a number of advanced features. Among these features are the utilization of non ilibrium thermal calculation in all-fluid volumes, flow regime-dependent drift flux ulations with counter current flooding limitations, mixture level tracking logic in multiple k fluid nodes, regime-dependent heat transfer correlations. Also, safety injection into the ken loop is modeled using the COSI condensation model (WCAP-10054-P-A, Addendum 2).
NOTRUMP small break LOCA emergency core cooling system evaluation model was eloped to determine the RCS response to design basis small break LOCAs and to address the C concerns expressed in NUREG-0611, Generic Evaluation of Feedwater Transients and all Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants.
OTRUMP, the RCS is subdivided into fluid filled control volumes (fluid nodes) and metal es interconnected by flow paths and heat transfer links. The transient behavior of the system is rmined from the governing conservation equations of mass, energy, and momentum applied hese nodes. The broken loop is modeled explicitly, and the intact loops are lumped into a ond loop. A detailed description of the NOTRUMP code is provided in WCAP-10079-P-A, AP-10080-A, WCAP-10054-P-A, WCAP-10081-A, and WCAP-10054-P-A, Addendum 2.
he NOTRUMP model, the reactor core is represented as a vertical stack of heated control umes with an associated bubble rise model to permit a transient mixture height calculation.
multimode capability of the program enables an explicit and detailed spatial representation of ous system components. In particular, it enables a proper calculation of the behavior of the p seal during a LOCA.
ect RCS response boundary conditions are extracted from the NOTRUMP calculations and are d in the SBLOCTA fuel rod heat up code. SBLOCTA is a small break specific version of the CTA-IV code (WCAP-8301 and WCAP-8305). Peak cladding temperature calculations are ormed with the LOCTA-IV code using the NOTRUMP calculated core pressure, fuel rod er history, uncovered core steam flow and mixture levels as boundary conditions. LOCTA-IV dels the hot rod and the average hot assembly rod. As stated above, LOCTA-IV contains many t transfer models, however, due to the relatively low velocities experienced in the core during SBLOCTA transient, heat transfer is basically limited to forced convection to super heated
rod axial average ZrO2.
d thermal analysis are performed with the LOCTA-IV code (WCAP-8301 and WCAP-8305) ch uses as input the RCS pressure, fuel rod power history, steam flow past the uncovered part he core, and mixture height from the NOTRUMP hydraulic calculations. For all computations, NOTRUMP and LOCTA runs were terminated slightly after the time the core mixture level rned to the core following uncovery.
chematic representation of the computer code interfaces is given in Figure 15.6-6.
.5.3.3 Input Parameters and Initial Conditions le 15.6-15 lists important input parameters and initial conditions used in the small break CA analysis.
analysis presented in this section was performed with a reactor vessel upper head temperature al to the RCS cold leg temperature. The effect of using the cold leg temperature in the reactor sel upper head is described in WCAP-7907-P-A, 1984. In addition, the analysis in this section ze the upflow barrel-baffle methodology described in WCAP-9168 and WCAP-9169, 1977.
bases used to select the numerical values that are input parameters to the analysis have been servatively determined from extensive sensitivity studies (WCAP-8341 and WCAP-8342, 4; WCAP-8340 and WCAP-8356, 1974; WCAP-8565-P-A and WCAP-8566-A, 1975). In ition, the requirements of Appendix K, regarding specific model features, were met by cting models which provide a significant overall conservatism in the analysis. The mptions made pertain to the conditions of the reactor and associated safety system equipment e time that the LOCA occurs and include such items as the core peaking factors, the tainment pressure, and the performance of the ECCS. Decay heat generated throughout the sient is also conservatively calculated.
.5.3.4 Small Break Results calculated peak clad temperature resulting from the limiting small break LOCA is less than calculated for the limiting large break. Based on the results of the LOCA sensitivity studies CAP-8341 and WCAP-8342, 1974) the limiting small break was found to be less than a 10 diameter rupture of the RCS cold leg. Therefore, a range of small break analyses are ented, which establishes the limiting break size. The results of these analyses are summarized ables 15.6-14 and 15.6-16.
ed on the results of these studies, the limiting small break was determined to be a 4 inch meter rupture of the RCS cold leg with a PCT of 1193°F. In none of the cases simulated did the rupture. In addition, sensitivity studies combined with the results of the present study cate little or no uncovering will occur for break sizes that are less than 2 inches. A range of ll break analyses are presented which establishes the limiting small break at 4 inches. The lts of these analyses are summarized in Tables 15.6-14 and 15.6-16.
licable, are presented:
Reactor coolant system pressure Core mixture level Clad temperature transient at peak temperature elevation the limiting (4 inch) break analyzed, the following additional transient parameters are ented:
Core exit steam flow rate Clad surface heat transfer coefficient at peak clad temperature elevation Fluid temperature at peak clad temperature elevation.
Pumped safety injection flow rate maximum calculated PCT for all small breaks analyzed is 1193°F. These results are well w all acceptance criteria limits of 10 CFR 50.46.
PCT margin is available to accommodate permanent penalties due to 10 CFR 50.59 Safety luations and LOCA model assessments. These penalties are summarized in the 30 day and the ual 10 CFR 50.46 reporting of the PCT Margin Utilization. The reporting process and the ntion to PCT margin assure that the PCT remains below 2200°F limit of 10 CFR 50.46.
analysis assumed a limiting small break power shape consistent with a LOCA FQ(z) envelope
.60 at the core midplane elevation and 2.40 at the top of the core. The maximum local metal-er reaction is 0.08 percent, and the total core metal-water reaction is less than 1.0 percent for ases analyzed. The clad temperature transients turn around at a time when the core geometry ill amenable to cooling.
analyses described in the preceding sections demonstrate that one centrifugal charge pump one high head safety injection pump, together with the accumulators, provide sufficient core ding to keep the calculated PCT well below the required limits of 10 CFR 50.46 for breaks than 8.75 inch diameter. For the 8.75 inch diameter break, the RHR pumps, along with one trifugal charging pump, one high head safety injection pump, and the accumulators provide icient core flooding to keep the calculated PCT well below the required limits of CFR 50.46 before switchover to recirculation.
quate protection is therefore afforded by the ECCS in the event of a small break LOCA.
.5.4 Radiological Consequences OCA would increase the pressure in the primary containment building resulting in tainment isolation and initiation of the ECCS and the containment spray systems. A safety ction system (SIS) signal automatically starts operation of the supplementary leak collection release system (SLCRS) and the charging pump, component cooling water pump, and heat
ative pressure within the secondary containment enclosure, auxiliary building, engineered ty features (ESF) building, hydrogen recombiner building, and the main steam valve building ng accident conditions. The nuclide inventory assumed to be initially available for release m within the containment building is consistent with Regulatory Guide 1.183 and is described able 15.6-9.
containment pressure Hi-1 signal also initiates control room isolation (CBI), which initiates pressurized filtration mode of operation. The containment pressure Hi-1 signal also initiates trol room isolation (CBI) which initiates the pressurized filtration mode of operation.
cribed in Section 9.4, the control building will pressurize within two (2) minutes of receipt of BI signal. After the control room isolates, unfiltered inleakage of 100 cfm is assumed while surized and 350 cfm while in neutral conditions.
radiological analysis does not credit pressurization for the first 101 minutes following receipt he CBI signal. During this period, the analysis conservatively assumes unfiltered inleakage at cfm. After 101 minutes, unfiltered inleakage of 100 cfm is assumed.
ease Pathways release pathways to the environment subsequent to a loss-of-coolant DBA are leakages from containment building and ESF systems, which are collected and processed, and leakage from containment building which is assumed to bypass SLCRS.
tainment Leakage Pathway containment is assumed to leak at the design leak rate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident. After ours, since the pressure has been decreased significantly, Regulatory Guide 1.183 allows the tainment leakage to be reduced to one half the design leak rate. For the dose calculations to the trol Room and Technical Support Center, a reduced containment leak rate was assumed at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This was justified and approved as part of the Amendment that eliminated the post-CA negative pressure containment requirement. It is based on the fact that the Millstone Unit 3 tainment pressure is rapidly reduced compared to typical PWRs because of its original design negative pressure containment.
collection, processing, and release of containment leakage varies depending on the location he leak. Ventilation characteristics and release paths are different for each building comprising secondary containment.
o emergency ventilation systems collect most of the containment leakage and process it ugh HEPA and charcoal filters. The SLCRS exhausts from the containment enclosure, iliary, ESF, and the main steam valve buildings, and the compartment of the hydrogen mbiner building abutting the containment. SLCRS flow is filtered and released through the lstone stack. The charging pump, component cooling water pump, and heat exchanger area ion of the auxiliary building ventilation system (ABVS), described in Section 9.4.2, supplies exhausts a relatively high flow on the 24 foot 6 inch elevation floor of the auxiliary building.
to a higher /Q, all containment leakage is assumed to be collected and filtered by the ABVS ept for the following:
- 1. The fraction of containment leakage which is assumed to bypass the secondary containment. This is assumed to be an unfiltered ground level release to the environment.
- 2. The initial containment leakage during the 2 minute time period required for SLCRS to establish negative pressure conditions. This is assumed to be an unfiltered ground level release to the environment.
- 3. The leakage past closed dampers which isolate non-ESF ventilation systems in the auxiliary, ESF and main steam valve building. This leakage is assumed to be released unfiltered from the auxiliary building ventilation vent location due to its proximity to the control building inlet.
- 4. The ductwork leakage from the auxiliary building into the SLCRS and emergency portion of the ABVS between the filter and the exhaust fan. This leakage is released unfiltered, along with the rest of the flow for these systems through the ventilation vent.
dit is taken for iodine removal due to containment sprays during the duration of the accident.
umptions pertaining to the spray system are listed in Table 15.6-9.
System Leakage Pathway t-accident radioactive releases from the ESF system are derived from fluid leakages assumed ng recirculation of containment sump water through systems located outside the containment ding. The quantity of leakage is based on the assumption that the ESF equipment leaks at e the maximum expected operational leak rate and that a fraction of the iodine nuclides tained in the leakage fluid becomes airborne in the areas containing ESF equipment. For poses of analysis, all liquid leakage from the ESF systems are assumed to be in the auxiliary ding. The nuclides which become airborne are collected and released to the environment ugh the auxiliary building ventilation system HEPA and charcoal filtration units.
ST Back Leakage Pathway t-accident radioactive releases from the ECCS are a result of ECCS subsystems containing rculated sump fluid back leaking to the RWST. The backflow rate to the RWST, as a result of ation valve leakage, is predefined and time dependent. Due to this time dependency, the taminated sump fluid from back leakage does not arrive into the RWST until 4.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> post-CA. Since the RWST is vented to atmosphere, the release is the result of the breathing rate of RWST due to solar heating.
potential radiation dose to a control room operator is evaluated for the LOCA. The analysis is ed on the assumptions and meteorological parameters (/Q values) given in Tables 15.6-12 15.0-11, respectively.
control room is designed to be continuously occupied for the duration of the accident; i.e.,
days. The control building shielding serves to protect the operators from direct radiation due to passing cloud of radioactive effluent assumed to have leaked from the containment structure from the ESF system. The control building walls also provide shielding protection for ation emanating from buildings located onsite which may contain significant quantities of oactivity.
control room ventilation system, as described in Sections 6.4 and 9.4, is designed to maintain dose from activity inside the control room within 10 CFR 50.67 limits. The calculated TEDE resented in Table 15.0-8 and is below the 10 CFR 50.67 limit of 5 rem.
e Computation radiological dose consequences resulting from a postulated LOCA at Millstone 3 are reported able 15.0-8. Assumptions used to perform the evaluation are summarized in Table 15.6-9.
dose methodology used to determine the results of the hypothetical DBAs is described in ulatory Guide 1.183.
6.5.5 Conclusions evaluated TEDE for the Control Room, EAB and LPZ are listed in Table 15.0-8. The ological consequences of the LOCA are within the TEDE limits defined by 10 CFR 50.67 and larified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel and em to the EAB and LPZ.
6.6 BWR TRANSIENTS applicable to Millstone 3.
6.7 REFERENCES
FOR SECTION 15.6
-1 Anderson, T. M. 1979. Westinghouse Electric Corporation (Westinghouse). Letter to Stolz, J., Nuclear Regulatory Commission (NRC), Letter Number NS TMA 2030.
-2 Eicheldinger, C. 1976. (Westinghouse). Letter to Vassallo, D.B., (NRC).
-3 Eicheldinger, C. 1978. (Westinghouse). Letter to Stolz, J.F., (NRC), Letter Number NS-CE-1672.
Nuclear Power Reactors.
-5 WARD-TM-84, 1969. Porsching, T.A.; Murphy, J.H.; Redfield, J.A.; and Davis, V.C.
FLASH-4, A Fully Implicit FORTRAN-IV Program for the Digital Simulation of Transients in a Reactor Plant. WARD-TM-84, Bettis Atomic Power Laboratory.
-6 WASH-1400, NUREG-75/104, 1975. Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.
-7 WCAP-7907-P-A (proprietary), WCAP-7907-A (non proprietary), April 1984. Burnett, T. W. T. et al., LOFTRAN Code Description.
-8 WCAP 8301 (Proprietary) and WCAP 8305 (non proprietary), 1974. Bordelon, F. M. et al., LOCTA IV Program: Loss of Coolant Transient Analysis.
-9 WCAP-8327 (Proprietary) and WCAP-8326 (non proprietary) 1974. Bordelon, F.M.
and Murphy, E.T. Containment Pressure Analysis Code (COCO).
-10 WCAP-8340 (Proprietary) and WCAP-8356 (non proprietary), 1974. Salvatori, R.,
Westinghouse ECCS - Plant Sensitivity Studies.
-11 WCAP-8341 (Proprietary) and WCAP-8342 (non proprietary), 1974, Westinghouse ECCS Evaluation Model Sensitivity Studies.
-12 WCAP-8586-P-A (Proprietary) and WCAP-8566-A (non proprietary), 1975. Johnson, W.J.; Massie, H.W.; and Thompson, C.M. Westinghouse ECCS-Four Loop Plant (17 x
- 17) Sensitivity Studies.
-13 WCAP-8970 (Proprietary) and WCAP-8971 (non proprietary), 1977. Skwarek, R.J.;
Johnson, W.J.; and Meyer, P.E. Westinghouse Emergency Core Cooling System Small Break October 1975 Model.
-14 WCAP-9168 (Proprietary) and WCAP-9169 (non proprietary), 1977. Johnson, W.J. and Thompson, C.M. Westinghouse Emergency Core Cooling System Evaluation Model -
Modified October 1975 Version.
-15 ROHE, E.P. 1981. (Westinghouse). Letter to Tedesco, R.L., (NRC), Letter Number NS-ER-2538.
-16 WCAP-10079-P-A (proprietary) and WCAP-10080-A (non proprietary), 1985. Meyer, P. E., NOTRUMP, A Nodal Transient Small Break and General Network Code.
Evaluation Model Using the NOTRUMP Code.
-18 WCAP-10444-P-A, 1985. Davidson, S. L., ed., et al., VANTAGE 5 Fuel Assembly Reference Core Report.
-19 WCAP-10698-P-A (proprietary) and WCAP-10750 (non proprietary), 1987, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill.
-20 Supplement 1 to WCAP-10698-P-A, 1986, Evaluation of Off-site Radiation Doses for an SGTR Accident.
-21 WCAP-11002 (proprietary) and WCAP-11003 (non proprietary), 1986, Evaluation of Steam Generator Overfill due to a SGTR Accident.
-22 J. F. Opeka to U.S. Nuclear Regulatory Commission letter B15028, dated December 14, 1994, Millstone Nuclear Power Station, Unit No. 3, Proposed Revision to Technical Specifications, Supplemental Collection and Release System.
-23 Postma, A.K. and Tam, P.S., Iodine Behavior in a PWR Cooling System Following a Postulated Steam Generator Tube Rupture, NUREG-0409.
-24 WCAP-10054-P-A, Addendum 2, Revision 1, Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, Thompson, C. M., et al., July 1997.
-25 WCAP-11145-P-A, Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, Rupprecht, S. D., et al., October 1986.
-26 WCAP-15085, Model Changes to the Westinghouse Appendix K Small Break LOCA NOTRUMP Evaluation Model: 1988-1997, J. J. Akers, ed., July 1998.
-27 WCAP-14882-P-A, RETRAN-O2 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, Huegel, D.S. et al., April 1999.
-28 Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, January 4, 1974.
-29 SECY-83-472, Information Report from W.J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, November 17, 1983.
-30 Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, USNRC, May 1989.
of-Coolant-Accident, B. Boyack, et al., 1989
-32 WCAP-12945-P-A, Volume 1, Revision 2 and Volumes 2 through 5, Revision 1, Code Qualification Document for Best-Estimate LOCA Analysis, Bajorek, S.M., et al.,
1998.
-33 WCAP-16009-P-A, Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM), (Proprietary),
January 2005.
-34 WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting, October 1992.
-35 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
PRESSURIZER SAFETY VALVE Accident Event Time (sec) dvertent opening of a Safety valve fully opens 0.0 ssurizer safety valve Overtemperature T reactor trip signal initiated 40.4 Low pressurizer pressure reactor trip setpoint ---
reached Rods begin to drop 41.9 Minimum DNBR occurs 42.5
CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT Assumption Primary coolant activity Table 15.0-10 Fraction of iodine assumed airborne 0.4 Fraction of other isotopes assumed airborne 1.0 Time to isolate letdown line (minutes) 30 Rate of release from ruptured line (gpm) 152 Pipe break size (inches) 3 Concurrent iodine release rate shown in Iodine spike factor Table 15.0-13 Amount of reactor coolant released (lb.) 3.8 x 104 RCS mass (lbm) 4.483 x 105 Breathing rate (m3/sec) 3.5 x 10-4
ision 3406/30/21 LE 15.6-3 PLANT OPERATING RANGE ALLOWED BY THE BEST ESTIMATE LARGE BREAK LOCA ANALYSIS nt Physical Description Parameter As Analysed Value or Range Operating Range or Target Value ensions Nominal N/A surizer location On an intact loop N/A assembly location Anywhere in core (1) assembly type 17x17 RFA-2 fuel design 17x17 RFA-2 fuel design m generator tube plugging 10% 0% SGTP 10% (in any one steam generator) 17x17 RFA-2 fuel with ZIRLO or Optimized 17x17 RFA-2 fuel with ZIRLO or Optimized assembly type ZIRLO cladding, non-IFBA or IFBA ZIRLO cladding, non-IFBA or IFBA nt Initial Operating Conditions Reactor Power Parameter As Analysed Value or Range Operating Range or Target Value MPS-3 FSAR e Power 102% of 3650 MWt 3650 MWt k Heat Flux hot channel factor 2.6 2.6 k hot rod enthalpy rise hot l factor (FH) 1.65 1.65 assembly radial peaking (PHA) 1.65/1.04 1.65/1.04 assembly heat flux hot 15.6-38 l factor (FQHA) 2.6/1.04 2.6/1.04
ision 3406/30/21 l power distribution (PBOT, Figure 15.6-20 Figure 15.6-20 power region relative power 0.2 PLOW 0.6 0.2 PLOW 0.6
)
assembly burnup 75,000 MWD/MTU, lead rod (1) 62,000 MWD/MTU, lead rod (1) (2)
C 0 at hot full power (HFP) 0 at hot full power (HFP) cal cycle length 18 months 18 months imum core average burnup 10,000 MWD/MTU 10,000 MWD/MTU imum steady state depletion, 2.0 2.0 Fluid Conditions Parameter As Analysed Value or Range Operating Range or Target Value 571.5-4.0°F Tavg 589.5+4.0°F 571.5 - 589.5 (3) surizer Pressure 2250-50 psia PRCS 2250+50 psia 2250 psia (3)
MPS-3 FSAR p flow TDF 90,800 gpm/loop mmf 94,800 gpm/loop (4) er head design TCOLD TCOLD 64% of span (Tavg of 589.5°F), 45.4% of span 64% of span (Tavg of 589.5°F) (3), 45.4% of surizer level (Tavg of 571.5°F) span (Tavg of 571.5°F) (3) umulator temperature 80°F TACC 120°F 80°F TACC 120°F umulator pressure 636 psia PACC 694 psia 636 psia PACC 694 psia 15.6-39 umulator liquid volume 6618 gallon VACC 7030 gallon 6618 gallon VACC 7030 gallon
ision 3406/30/21 mulator L/D 6.264 (5) Current line configuration mum accumulator boron 2600 ppm 2600 ppm ident Boundary Conditions Parameter As Analysed Value or Range Operating Range or Target Value imum safety injection flow Table 15.6-6 Table 15.6-6 ty injection temperature 40°F SI Temperature 100°F 40°F SI Temperature 100°F 40 seconds (with offsite power), 45 seconds (with 40 seconds (with offsite power), 45 seconds ty injection delay loss of offsite power) (with loss of offsite power)
See Figure 15.6-21 and raw data in Tables 15.6- See Figure 15.6-21 and raw data in tainment modeling 4 and 15.6-7 Tables 15.6-4 and 15.6-7 imum containment air partial 8.9 psia 8.9 psia re tainment spray initiation delay 26.3 seconds 26.3 seconds irculation spray initiation Not modeled Not modeled MPS-3 FSAR le failure Loss of one ECCS train Loss of one ECCS train 4 peripheral locations will not physically be lead power assembly.
ease note that the fuel temperature and rod internal pressure data is only provided up to 62,000 MWD/MTU. In addition, the hot sembly/hot rod will not have a burnup this high in ASTRUM analysis.
ant control systems are designed to control these parameters to the stated values.
TDF plus uncertainties.
/D based on average L/D of 447.4.
15.6-40
TABLE 15.6-4 LARGE BREAK LOCA CONTAINMENT DATA USED FOR CALCULATION OF CONTAINMENT PRESSURE tainment Net Free Volume 2,350,000 ft3 Initial Conditions Minimum air initial containment partial pressure at full power operation 8.9 psia Minimum steam initial containment partial pressure at full power operation 0.00 psia Minimum initial containment temperature at full power operation 80°F RWST temperature 40.0°F Temperature outside containment -20°F Initial spray temperature 40.0°F Spray System Number of containment spray pumps operating 2 Post-accident containment spray system initiation delay 26.3 seconds Maximum spray system flow from all containment spray pumps 6500 gpm Coolers Not modeled irculation Spray Not modeled
LOCA RESULTS 10 CFR 50.46 Requirement Value Criteria 95/95 PCT (1) (°F) 1,781 < 2,200 95/95 LMO (2) (%) 3.5 < 17 95/95 CWO (3) 0.12 <1 TE:
(1) Peak Cladding Temperature (2) Local Maximum Oxidation (3) Core Wide Oxidation
BEST ESTIMATE LARGE BREAK LOCA ANALYSIS Reactor Coolant System Pressure (psia) Flow Rate (gpm) 14.7 3453.4 114.7 818.0 214.7 661.7 314.7 629.0 414.7 595.2 514.7 560.1 614.7 523.9 714.7 484.7 814.7 443.5 914.7 394.5 1014.7 339.3 1114.7 276.2 1214.7 194.4 1314.7 134.5 1414.7 118.2 1514.7 101.0 1614.7 83.3 1714.7 64.8 1814.7 43.5 1914.7 16.3 2014.7 0
CALCULATION OF CONTAINMENT PRESSURE Structural Heat Sinks Height Wall Thickness (feet) TAIR (°F) Area (ft3) (ft3) Tinitial (°F) 375 stainless steel, 2.16 concrete 80 866 10.0 80 75 stainless steel, 1.50 concrete 80 7,674 10.0 80 6 concrete 80 133,277 10.0 80 1 concrete 80 17,926 10.0 80 0 concrete 80 6,563 10.0 80 5 concrete 80 2,007 10.0 80 0 concrete, 0.25 carbon steel, 10.00 55 12, 269 10.0 80 ncrete 428 carbon steel, 4.5 concrete 55 24,675 10.0 80 428 carbon steel, 4.5 concrete -20 38,493 10.0 80 462 carbon steel, 2.56 concrete -20 34,100 10.0 80 075 stainless steel 80 1,722 10.0 80 592 carbon steel 80 552 10.0 80 2 stainless steel 80 13,230 10.0 80 548 stainless steel 80 2,063 10.0 80 231 carbon steel 80 8,966 10.0 80 825 carbon steel 80 1,282 10.0 80 182 carbon steel 80 514,279 10.0 80 0925 carbon steel 80 182,517 10.0 80 304 stainless steel 80 11,033 10.0 80 651 carbon steel 80 37,068 10.0 80 119 steel 80 21,000 10.0 80 6 concrete 80 866 10.0 80 0 concrete 80 7,674 10.0 80
ABLE 15.6-8 PEAK CLAD TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, BEST ESTIMATE LARGE BREAK LOCA (BE LBLOCA)
PCT for Analysis of Record (AOR) 1781°F Thermal Conductivity Degradation and Peaking Factor Burndown + 222°F Revised Heat Transfer Multiplier Distributions - 91°F HOTSPOT Burst Strain Error Correction +21°F BE LBLOCA PCT for Comparison to 10 CFR 50.46 1933°F
ision 3406/30/21 TABLE 15.6-9 ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS ower Level (MWt) 3,723 (includes 2% uncertainty).
ore Inventory Table 15.0-7 ontainment Leak Rate: 0.3% by weight of the containment air per 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a).
ontainment Bypass Leak Rate: 0.06 La.
ontainment leak rate Reduction: 50% after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (offsite).
econdary Containment Drawdown Time: 50% after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (control room).
egulatory Guide 1.183 RELEASE FRACTIONS AND DURATION Isotope Group Gap Early In-Vessel ble Gases 0.05 0.95 ogens 0.05 0.35 MPS-3 FSAR ali Metals 0.05 0.25 uriums 0 0.05 iums 0 0.02 ble Metals 0 0.0025 iums 0 0.0005 thanides 0 0.0002 ation (hours) 0.5 1.3 15.6-46 dine Chemical Form in Containment Atmosphere: 95% Cesium Iodide; 4.85% Elemental Iodine; 0.15% Organic Iodine.
ision 3406/30/21 dine Chemical Form in the Sump and RWST: 97% Elemental; 3% Organic.
ontainment Sump pH: at least 7.
ose Conversion Factors: FGR 11 and 12.
LRCS Filter Efficiency: 95% all Iodines and Particulates.
uxiliary Building Filter Efficiency: 95% all Iodines and Particulates.
uench Spray System Effective Period: 80 - 10,000 seconds.
ecirculation Spray System Effectiveness Time: 5500 seconds - 30 days.
ixing Rate for Unsprayed to Sprayed Regions 2 per hour.
emental Iodine Removal Coefficient: 10 per hour.
articulate Iodine Removal Coefficient for Quench Spray: DF < 50: 11.50.
articulate Iodine Removal Coefficient for Quench and Recirculation Spray: DF < 50: 13.57; DF 50: 1.36.
articulate Iodine Removal Coefficient for Recirculation Spray DF 50: 0.65.
MPS-3 FSAR ontainment Free Volume 2.35E+06 ft3.
uench Spray Volume of Containment: 1,166,200 ft3.
uench and Recirculation Spray Volume: 1,515,858 ft3.
ecirculation Spray Volume 1,102,000 ft3.
inimum Available RWST Volume: 1,072,886 gallons.
inimum Quench Spray System Auto Trip Value: 47,652 gallons.
WST Maximum Fill Volume: 1,206,644 gallons.
15.6-47
ision 3406/30/21 ercentage of Total Containment Leakage into the Secondary Containment:
ESF Building 10.59.
MSV Building 23.31.
Enclosure Building/H2 Recombiner Building 8.47.
Auxiliary Building 57.63.
econdary Containment Free Volume (ft3)
ESF Building 225,000.
MSV Building 70,000.
Enclosure Building/H2 Recombiner Building 831,000.
Auxiliary Building, all elevations 914,000
% mixing in all buildings that form the secondary containment.
nfiltered leakage via closed dampers occurs in Aux., MSV and ESF Buildings.
MPS-3 FSAR nfiltered releases occur from ventilation vent, ESF Building roof vent and MSV Building roof vent.
ll filtered releases are from the ventilation vent. This is conservative because Millstone stack releases have lower /Qs.
he Auxiliary Building is homogeneously mixed. The Auxiliary Building is treated as one compartment.
nfiltered ventilation and leakage parameters (T=0 hours to 30 days post LOCA).
Ground Level Release CFM 3HVQ-FN2 (ESF building normal exhaust) 77 3HVV-FN1A&B (MSVB exhaust) 134 15.6-48 3HVQ*ACUS1A&B (ESF building AC) 4 3HVQ*ACUS2A&B (ESF building AC) 2
ision 3406/30/21 Ventilation Vent 3GWS-FN1A&B (Process Vent Fan) 70 (Auxiliary 66 foot 6 inches).
3HVR*FN12A&B (SLCRS exhaust duct leak) 63 (Auxiliary 66 foot 6 inches).
3HVR-FN5 (Auxiliary Building normal exhaust) 553 (Auxiliary 43 foot 6 inches & 66 foot 6 inches).
3HVR-FN7 (Auxiliary Building normal exhaust) 218 (Auxiliary Building - all elevations).
3HVR-FN8A & B (Waste Disposal Building normal exhaust) 43 (Auxiliary Building 66 foot 6 inches).
3HVR-FN11 (Electrical Tunnel purge air) 28.
3HVR-FN9 (Fuel Building exhaust duct leak) 75 (Auxiliary Building 66 foot 6 inches).
3HVR*FN6A & B (Auxiliary Building filter exhaust) 17 (Auxiliary Building 66 foot 6 inches).
3HVR*AOD44 A& B (Normal exhaust isolation) 113 (Auxiliary Building 24 foot 6 inches).
3HVR*AOD32A & B (Containment purge exhaust) 118 (Auxiliary Building 24 foot 6 inches).
uration of Release from containment (hour) 720.
MPS-3 FSAR LEAKAGE ASSUMPTIONS CCS Leak Initiation and Cessation Times 2500 seconds to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />.
ABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS CCS System Leakage Outside of Containment (1): 5,000 cc/hr.
CCS Leakage Location 100% Auxiliary Building.
15.6-49 action of Core Iodine Inventory in ECCS Sump Water 0.05 during gap release, 0.35 during early in-vessel phase.
ision 3406/30/21 dine Flash Fraction from ECCS Sump 0.1.
ABLE 15.6-9 (CONTINUED) ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS lter Efficiency Elemental iodine 95(%), Methyl iodine 95(%), HEPA 95(%).
BACKLEAKAGE ASSUMPTIONS me Dependent Backleakage Volume to the RWST:
Time Volume (ft3) (cumulative) 4.25 hrs 0.00 14.91 hrs 17.11 18.46 hrs 39.88 33.74 hrs 162.41 63.13 hrs 445.21 68.83 hrs 509.27 MPS-3 FSAR 72.21 hrs 552.68 720 hrs 9904.49 dine DF 100.
WST Breathing Rate (cfm): 8.7.
accordance with Appendix A of Regulatory Guide 1.183, the analysis assumed the maximum post-LOCA equipment leakage was factor of at least 2 times the system leakage to give a total of 10,000 cc/hr.
15.6-50
TABLE 15.6-10 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6-11 DELETED BY CHANGE PKG FSC 07-MP3-054 BLE 15.6-12 ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS trol room (CR) parameters:
Control room volume (ft3) 2.38 E+05 Control building concrete wall thickness (ft) 2 Unfiltered ventilation intake rate pre CR isolation (cfm) 1,595 Filtered ventilation intake rate post CR isolation (cfm) 230 Filtered recirculation rate post CR isolation (cfm) 666 Unfiltered Inleakage rate (cfm) 350 (neutral), 100 (pressurized)
Time to place control room emergency ventilation system in service:
Pressurized control room 101 minutes Recirculation 101 minutes ke ventilation filter efficiencies (percent):
HEPA 95 Charcoal 95 (elemental), 95 (methyl) ease points (distance to Unit 3 control room intake in meters):
Millstone stack 351 Unit 2 containment surface 223 Unit 3 containment surface 69.5 Unit 3 Turbine Building ventilation vent 37.3 Unit 3 RWST 150.1 Unit 3 Turbine Building 30.0 Unit 3 MSV Building 60.3 Unit 3 ESF Building 134.8 Control room air intake height 28.7 kage values based on single damper closure
ABLE 15.6-12 (CONTINUED) ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS TIMETABLE POST-ACCIDENT FOR CONTROL ROOM ISOLATION AND PRESSURIZATION PERIODS Control Room Isolated Control Room Pressurized (1)
CA 6 seconds (2) 1.683 hours0.00791 days <br />0.19 hours <br />0.00113 weeks <br />2.598815e-4 months <br /> SLB 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> TR 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> A (4) 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> (5)
A 2 min 10 seconds (6) 1.717 hours0.0083 days <br />0.199 hours <br />0.00119 weeks <br />2.728185e-4 months <br /> A 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> TES:
Control Room is pressurized 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 41 minutes after CBI signal.
Per Regulatory Guide 1.183, the onset of gap release does not start until 30 seconds post-LOCA. Therefore the Control Room is isolated due to CBI from Containment Pressure - High 1 prior to the plume reaching it.
Control Room isolates on CBI due to ventilation intake radiation monitor alarm.
CBI generated within 4 seconds. Control Room isolates 6 seconds later.
Fuel has decayed 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at start of FHA.
CREVs filtered recirculation flow is placed in operation within 30 minutes of a drop of a spent fuel assembly.
SI signal initiated 2 minutes post-accident. CBI generated within 4 seconds. Control Room isolates 6 seconds later.
TABLE 15.6-13 DELETED BY FSARCR PKG FSC 04-MP3-017 ision 3406/30/21 COOLANT INVENTORY (SMALL BREAK)
Event (seconds) 1.5 inch 2.0 inch 3.0 inch 4.0 inch 6.0 inch 8.75 inch ent Initiated 0.0 0.0 0.0 0.0 0.0 0.0 r Trip Signal 174 180 60 32 16 10 Injection Signal 184 191 70 41 20 11 Injection Begins (1) 224 231 110 81 60 51 eal Clearing Occurs (2) 2152 1092 422 255 127 18 Core Uncovered (3) 2478 705 637 429 (3) ulator Injection Begins N/A N/A 1919 887 386 176 (4)
Core Recovered N/A 4290 2389 1550 445 N/A Low Level (5) 5210 5164 N/A N/A N/A N/A afety Injection (SI) begins 40 seconds (SI delay time) after the safety injection signal.
MPS-3 FSAR oop seal clearing is considered to occur when the broken loop seal vapor flow rate is sustained above 1 lbm/sec.
here is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case.
or the 8.75 inch case, the broken loop (BL) accumulator is spilling to containment and the accumulator injection time listed here is ly the intact loop (IL) accumulator injection time.
he analysis assumes minimum usable RWST volume (598,000 gallons)* before the RWST low level signal for switchover to cold g recirculation is reached.
Actual RWST volume is 614,000 gallons (see Section 6.3.2 and Figure 6.3-6).
15.6-56
BREAK)
Parameter Value re Power (MWt) (1) 3650 ak linear power, includes 1.02 percent factor (kW/ft) 14.75 tal peaking factor (FTQ) 2.60 wer Shape Figure 15.6-7 el Assembly array 17x17 cumulator water volume, nominal (ft3/accumulator) 900 cumulator tank volume, nominal (ft3/accumulator) 1350 cumulator gas pressure, minimum (psia) 609.4 (2) fety Injection pumped flow See Tables 15.6-17 and 15.6-18 ntainment parameters See Section 6.2 tial loop flow (lb/sec) 9413.3 ssel inlet temperature (°F) 555.6 ssel outlet temperature (°F) 623.3 actor coolant pressure 2300 (3) am pressure (psia) 936.5 am Generator tube plugging level (%) 10 Two percent is added to this power to account for calorimetric error.
This value is the minimum accumulator pressure of 636 psia minus 26.6 psi uncertainty.
This value is the nominal RCS pressure of 2250 psia plus 50 psi uncertainty.
ision 3406/30/21 4.0 inch with Event (seconds) 1.5 inch (1) 2.0 inch 3.0 inch 4.0 inch Annular Pellets 6.0 inch 8.75 inch (1) ladding Temperature, N/A 922 1128 1193 1193 527 N/A ime, seconds N/A 3340 1646 971 971 438 N/A levation, feet N/A 11.00 11.25 11.25 11.25 11.50 N/A Time, seconds (2) N/A N/A N/A N/A N/A N/A N/A Elevation, feet (2) N/A N/A N/A N/A N/A N/A N/A um Hot Rod Zro2, % N/A 0.01 0.08 0.05 0.05 0.0 N/A um Hot Rod Zro2 N/A 11.00 11.25 11.25 11.25 11.50 N/A ion, feet d Average Zro2, % N/A 0.0 0.01 0.01 0.01 0.0 N/A here is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case; therefore rod heatup MPS-3 FSAR lculations were not performed.
e of the SBLOCTA calculations exhibited rod burst (hot rod or hot assembly average rod).
15.6-58
INCH TO 6 INCH BREAKS (BROKEN LOOP SI FLOWS SPILL TO RCS PRESSURE)
Intact Loop Injection Flow Broken Loop Injection Flow RCS Pressure (psia) (gpm) (gpm) 14.7 719.8 259.0 114.7 697.7 251.1 214.7 675.1 242.9 314.7 650.4 234.1 414.7 625.0 225.0 514.7 598.9 215.6 614.7 570.9 205.6 714.7 541.4 195.1 814.7 509.9 183.7 914.7 476.0 171.6 1014.7 438.7 158.1 1114.7 393.9 142.2 1214.7 334.1 120.7 1314.7 248.8 90.3 1414.7 173.4 63.4 1514.7 162.9 59.5 1614.7 152.1 55.6 1714.7 138.9 50.8 1814.7 125.1 45.7 1914.7 111.0 40.6 2014.7 96.9 35.4 2114.7 84.0 30.7 2214.7 74.4 27.2 2314.7 64.8 23.7 2414.7 55.2 20.1 2482.7 0.0 0.0
INCH BREAK BEFORE SWITCHOVER oken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 14.7 3453.4 1340.6 34.7 2884.7 1716.9 54.7 2290.5 2079.6 74.7 1768.3 2359.1 94.7 1353.8 2533.5 114.7 818.0 2732.0 134.7 686.2 2777.1 154.7 680.1 2778.4 174.7 673.9 2779.9 194.7 667.8 2781.4 214.7 661.7 2782.9 314.7 629.0 2791.2 414.7 595.2 2799.4 514.7 560.1 2807.5 614.7 523.9 2815.8 714.7 484.7 2823.8 814.7 443.5 2831.9 914.7 394.5 2870.0 1014.7 339.3 2880.3 1114.7 276.2 2891.1 1114.7 276.2 2891.1 1214.7 194.4 2902.4 1314.7 134.5 2909.6 1414.7 118.2 2915.6 1514.7 101.0 2919.4 1614.7 83.3 2923.4 1714.7 64.8 2927.5
oken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 1814.7 43.5 2931.6 1914.7 16.3 2936.0 2014.7 0.0 2939.4 2114.7 0.0 2939.4 e that the above flows are applicable before switchover to recirculation and include RHR s.
TABLE 15.6-19 OMITTED TABLE 15.6-20 OMITTED TABLE 15.6-21 DELETED BY FSARCR 03-MP3-022 TABLE 15.6-22 DELETED BY FSARCR 03-MP3-022 GENERATOR TUBE RUPTURE ANALYSIS Action Time late AFW flow to the ruptured steam Calculated time to reach 30% narrow range level nerator in the ruptured steam generator for overfill analysis.
Calculated time to reach 8% narrow range level in the ruptured steam generator for mass release analysis (input to doses).
late ruptured steam generator 25 minutes from the time of break initiation.
erator action time to isolate failed 20 minutes.
ened Main Steam Pressure Relief Valve mass release analysis) erator action to initiate cooldown 8 minutes from complete isolation of ruptured steam generator.
actor Coolant System cooldown LOFTTR2 calculated time for Reactor Coolant System cooldown.
erator action time to initiate 3 minutes from end of cooldown.
pressurization actor Coolant System depressurization LOFTTR2 calculated time for Reactor Coolant System depressurization.
erator action time to initiate safety Maximum of 6 minutes from end of ection termination depressurization or time to satisfy safety injection termination criteria.
ssure equalization LOFTTR2 calculated time for equalization of Reactor Coolant System and ruptured steam generator pressures.
EVENTS Event Time (seconds) am Generator tube rupture 0 actor trip on OTT (1) 135 fety Injection Actuated 143 ptured Steam Generator Auxiliary Feed Water isolation level 178 ched ptured steam line isolated 1500 ptured Steam Generator Main Steam Pressure Relief Valve fails 1502 en ptured Steam Generator Main Steam Pressure Relief Valve 2702 lation valve closed actor Coolant System cooldown Initiated 3182 eak Flow stops flashing 3381 actor Coolant System cooldown Terminated 3690 actor Coolant System depressurization Initiated 3872 actor Coolant System depressurization Terminated 3952 fety Injection terminated 4312 eak Flow terminated 6412 The nominal trip setpoint specified in the Technical Specifications is modeled since earlier reactor trip is conservative for this analysis. Although the low pressurizer pressure reactor trip setpoint is not reached, the analysis modeled the Technical Specification value with positive uncertainties.
ision 3406/30/21 Time Period Time of Reactor Time at Trip to Time at Which Break Start of Event to Which Break Flow is 24 Hours Time of Reactor Flow is Terminated to 2 Hours to 11 Hours to to 35.75 Trip (1) Terminated 2 Hours 11 Hours 24 Hours (2) Hours (3) ed steam generator to 159,610 0 0 0 0 0 ser (lbm) (1) ed steam generator to 0 198,330 0 40,920 0 0 here (lbm) (1) steam generators (total for 3) 475,090 0 0 0 0 0 denser (lbm) (1) steam generators (total for 3) 0 344,190 47,960 1,678,380 2,424,000 196,555 osphere (lbm) (1) reak flow (lbm) 7,040 222,750 (4) 0 0 0 0 d break flow (lbm) 1,138.6 14,506.9 (5) 0 0 0 0 MPS-3 FSAR he thermal and hydraulic analysis assumes that a loss of offsite power occurs at time of reactor trip. Thus, the condenser is available ring the first period identified above. The radiation dose analysis assumes that a loss of offsite power occurs at the time of Steam enerator Tube Rupture; thus, the condenser is unavailable. The radiation dose analysis assumes that the entire mass release is to the mosphere.
he time period from 11 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not discussed in the thermal and hydraulic analysis. In the dose analysis, the steam release riod is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry.
he time period from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> is a period of simultaneous steaming and RHR operation to address safety grade cold utdown requirements.
15.6-68 eactor Coolant System break flow terminates after 1.78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br />.
ashed break flow terminates after 0.9392 hours0.109 days <br />2.609 hours <br />0.0155 weeks <br />0.00357 months <br />.
USED IN EVALUATING RADIOLOGICAL CONSEQUENCES Source Data A. Total steam generator tube leakage, 1.0 prior to accident, gpm B. Reactor coolant iodine activity:
- 1. Accident-Initiated Spike The initial RC iodine activities based on 1.0 Ci/gram of D.E. I-131 are presented in Table 15.0-10. The iodine appearance rates assumed for the accident-initiated spike are presented in Table 15.6.3-6.
- 2. Pre-accident Spike Primary coolant iodine activities based on 60 Ci/gram of D.E. I-131 are presented in Table 15.6.3-5.
- 3. Gross Activity The initial primary coolant gross activities based on Technical Specification limit of 1 D.E. Ci/gm I-131 (equivalent to 0.29%
failed fuel) and are presented in Table 15.0-10.
C. Secondary system initial activity (1) Dose equivalent of 0.1 Ci/gm of I-131 and gross activity are presented in Table 15.0-10.
D. Initial Steam generator mass (each), 100, 933 concurrent to iodine spike; 9722 lbm pre-accident iodine spike E. Offsite power Lost at time of SGTR F. Primary-to-secondary leakage duration 35.75 for intact SG, hrs.
G. Species of iodine released to 97 percent elemental; 3 percent organic environment H. RCS volume (ft3) 10,000 concurrent iodine spike; 11,750 concurrent iodine spike
Activity Release Data A. Ruptured steam generator
- 1. Break flow See Table 15.6.3-3
- 2. Flashed rupture flow See Table 15.6.3-3
- 3. Total steam release, lbm See Table 15.6.3-3
- 4. Iodine partition coefficient 0.01
- 5. Moisture Carryover 1 percent B. Intact steam generators
- 1. Total primary-to-secondary leakage, 1.0 gpm
- 2. Total steam release, lbm See Table 15.6.3-3
- 3. Iodine partition coefficient 0.01
- 4. Moisture Carryover 1 percent C. Atmospheric Dispersion Factors (2) See Table 15.0-11
. Control Room Data See Table 15.6-12 TES:
There is no Technical Specification limit on Secondary Side gross activity, but gross activity was included for conservatism.
EAB and LPZ factors utilize the X/Qs for the ventilation vent because of near proximity to the release point. Control Room factors use the MSVB X/Qs because of near proximity to the release point.
TABLE 15.6.3-5 DELETED BY CHANGE PKG FSC 07-MP3-054 APPEARANCE RATES Nuclide Appearance Rates (Curies/second)
I-131 2.03 I-132 2.63 I-133 3.76 I-134 3.17 I-135 3.16
TABLE 15.6.3-7 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-8 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-9 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-10 DELETED BY FSARCR PKG FSC 04-MP3-017 s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.6-1 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
FIGURE 15.6-2 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
DELETED BY FSARCR 02-MP3-017 FIGURE 15.6.3-1 PRESSURIZER LEVEL FIGURE 15.6.3-2 REACTOR COOLANT SYSTEM PRESSURE FIGURE 15.6.3-3 SECONDARY PRESSURE IGURE 15.6.3-4 RUPTURED LOOP HOT AND COLD LEG RCS TEMPERATURES FIGURE 15.6.3-5 INTACT LOOP HOT AND COLD LEG RCS TEMPERATURES FIGURE 15.6.3-6 PRIMARY TO SECONDARY BREAK FLOW RATE IGURE 15.6.3-7 DIFFERENTIAL PRESSURE BETWEEN REACTOR COOLANT SYSTEM AND RUPTURED STEAM GENERATOR
FIGURE 15.6.3-8 RUPTURED STEAM GENERATOR WATER VOLUME FIGURE 15.6.3-9 RUPTURED STEAM GENERATOR WATER MASS IGURE 15.6.3-10 RUPTURED STEAM GENERATOR MASS RELEASE RATE TO THE ATMOSPHERE
GURE 15.6.3-11 INTACT STEAM GENERATORS MASS RELEASE RATE TO THE ATMOSPHERE
FIGURE 15.6.3-12 FLASHED BREAK FLOW
MODEL PRESSURE CORE EXIT MASS FLOWRATE NOTRUMP MIXTURE LEVEL LOCTA CORE INLET ENTHALPY FUEL ROD POWER HISTORY
FIGURE 15.6-8 A DELETED BY FSARCR PKG FSC 07-MP3-054
FRACTION VAPOR FLOW
LEVEL
LIQUID LEVEL LIQUID LEVEL ENVELOPE
ELEVATION (4 INCH BREAK)
CLAD TEMPERATURE ELEVATION (4 INCH BREAK)
ELEVATION (4 INCH BREAK)
02-MP3-017 FIGURE 15.B-1 FIGURES DELETED BY FSARCR 02-MP3-017 nts which may result in a radioactive release from a subsystem or component are as follows:
- 1. Radioactive Gaseous Waste System Failure (Section 15.7.1)
- 2. Radioactive Liquid Waste System Leak or Failure (Atmospheric Release)
(Section 15.7.2)
- 3. Liquid Containing Tank Failure (Section 15.7.3)
- 4. Design Basis Fuel Handling Accidents (Section 15.7.4)
- 5. Spent Fuel Cask Drop Accidents (Section 15.7.5) s 1, 2, and 3 are classified as ANS Condition III events. Item 4 is classified as ANS Condition event. Item 5 is not assigned an ANS classification. Section 15.0.1 defines the ANS ditions.
.1 RADIOACTIVE GASEOUS WASTE SYSTEM FAILURE s section has been moved to Section 11.3.3.
.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE (ATMOSPHERIC RELEASE) s section has been moved to Section 11.2.3.1.
.3 LIQUID CONTAINING TANK FAILURE s section has been moved to Section 11.2.3.2.
.4 DESIGN BASIS FUEL HANDLING ACCIDENTS
.4.1 Identification of Causes and Accident Description s accident results from the dropping of a spent fuel assembly onto another fuel assembly in the nt fuel pool, resulting in the rupture of the cladding of all the fuel rods in the dropped assembly 19 fuel rods in the impacted assembly.
.4.2 Sequence of Events and Systems Operation method of analysis used for evaluating the potential radiological consequences of a fuel dling accident complies with Regulatory Guide 1.183, except that 67% of the damaged fuel s do not comply with footnote 11 of Regulatory Guide 1.183. For these fuel rods, the gap vity fractions used are taken from Regulatory Guide 1.25, as modified by NUREG/CR-5009.
le 15.7-8 for a list of assumptions used.
.4.2.1 Fuel Handling Accident in the Fuel Building s accident has been re-analyzed using the methods and assumptions contained in Regulatory de 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of ulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This lysis does not require re-alignment of the fuel building ventilation system, nor does it require building integrity.
fuel handling operations are conducted underwater using fuel handling equipment. The imum water depth between the top of the irradiated fuel rods in the racks and the spent fuel l surface is 23 feet.
pent fuel assembly is dropped into the fuel pool onto another fuel assembly. This results in the ure of all the rods in the dropped assembly and 19 rods in the impacted assembly. It is med that the gap activity from each ruptured fuel rod is released to the fuel pool. The ntion of noble gases in the fuel pool water is negligible. It is assumed that the radioactive erial from the fuel building is released to the environment, through the turbine building tilation vent, over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period.
fuel building ventilation system and its filters are not required while handling fuel in the fuel ding, nor is fuel building integrity required. This allows any penetration to the fuel building
., including roll-up doors) to be open during fuel movement. Suitable radiological monitoring quired per the Millstone Effluent Control Program when boundary integrity is not set to ure releases to the environment are monitored.
.4.2.2 Fuel Handling Accident in Containment s accident has been re-analyzed using the methods and assumptions contained in Regulatory de 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of ulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This lysis does not require automatic isolation of purge from radiation monitor response, nor does it uire containment integrity because it is assumed that containment penetrations such as the ipment hatch are open.
el handling accident in containment is defined as the dropping of a spent fuel assembly onto ther spent fuel assembly in the refueling cavity from the refueling machine. This results in the ure of all rods in the dropped assembly and 19 rods in the impacted assembly. It is assumed the gap activity from each ruptured fuel rod is released to the refuel pool. The retention of le gases in the refuel pool water is negligible. The refuel pool water retains a large fraction of gap activity of iodines.
.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool s event assumes a drop of an insert (non-spent fuel assembly) component into the spent fuel l, assuming control room emergency ventilation system is not operable. Analysis shows that a foot drop of a RCCA handling tool containing an Rod Cluster Control Assembly (RCCA) o a spent fuel assembly will result in a maximum of 18 fractured rods if a Westinghouse 17x17 dard spent fuel assembly was impacted. There would e no fuel failure if the RCCA impacted a tinghouse 17x17 RFA fuel assembly. The 17x17 standard fuel assemblies were removed from core over 20 years ago. The radiological consequences analysis assumes that 30 rods are tured in the event. Due to the long decay time of the 17x17 standard fuel assemblies, the ological consequences of the failure of 30 rods is not significant.
omatic isolation of the control room, filtered control room recirculation, filtered surization of the control room, and control room envelope integrity are not credited in this lysis. All other assumptions used in the fuel handling accident involving the drop of a spent assembly are valid for this analysis.
.4.3 Radiological Consequences results of the analyses are listed in Table 15.0-8. The results are within the limits as defined 0 CFR 50.67 and within the criteria identified in Regulatory Guide 1.183. The fuel gap vity is based on the halogen and noble gas inventory in the reactor core as listed in Table 15.0-nd the assumptions in Table 15.7-8. These assumptions include decay time, number of fuel s damaged, gap activity fractions, and peaking factor.
7.5 SPENT FUEL CASK DROP ACCIDENTS upgraded spent fuel shipping cask trolley is designed with special features to the structure will ensure that a single failure will not result in the loss of the capability of the system to ly retain the load. The upgraded shipping cask trolley is designed to meet the single failure of requirements of NUREG-0554 and NUREG-0612. When a cask is rigged to the crane in ordance with single failure criteria, a cask drop is not credible; therefore, there will be no ological consequences.
TABLE 15.7-1 OMITTED TABLE 15.7-2 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017 TABLE 15.7-3 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017 TABLE 15.7-4 TABLE RELOCATED TO TABLE 11.2-12 BY FSARCR 04-MP3-017 TABLE 15.7-5 TABLE RELOCATED TO TABLE 11.2-11 BY FSARCR 04-MP3-017 TABLE 15.7-6 TABLE RELOCATED TO TABLE 11.2-13 BY FSARCR 04-MP3-017 TABLE 15.7-7 TABLE RELOCATED TO TABLE 11.2-14 BY FSARCR 04-MP3-017 Fuel Building Containment Design Bases Design Bases wer level (MWt) 3,723 3,723 dial peaking factor 1.7 1.7 el damaged (Drop of a Fuel Assembly) 1 assembly plus 19 rods 1 assembly plus 19 rods el damaged (Drop of an insert component 30 rods 30 rods a fuel assembly) (1) rcentage of Fuel Rods that do not comply 67% 67%
h footnote 11 of Regulatory Guide 1.183 p activity fractions:
For Fuel Rods that do not comply with I-131: 012 I-131: 0.12 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.30 Kr-85: 0.30 All others: 0.10 All others: 0.10 For Fuel Rods that comply with I-131: 0.08 I-131: 0.08 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.10 Kr-85: 0.10 All others: 0.05 All others: 0.05 ine chemical form, when released from ol (percent):
Inorganic 57 57 Organic 43 43 me after shutdown (hours) 100 100 el Building/Containment leak rate All activity is released All activity is released within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ration of release 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ent fuel pool iodine decontamination 200 200 tor lease pathway Ventilation Vent (2) Ventilation Vent (2)
(unfiltered) (unfiltered) se conversion factors FGR 11 and 12 FGR 11 and 12 ntrol Room Habitability Assumptions (3) nsistent with Table 15.6-12 except as ed)
TES:
A bounding analysis was performed that assumed 30 rods were fractured from a drop of an insert component. The number of standard fuel rods that would be damaged in this event was determined to be 18. Westinghouse evaluations demonstrate that fuel damage only occurs if the impacted fuel assembly is Westinghouse 17x17 standard fuel.
For EAB & LPZ dose, containment-ground release X/Qs are used for conservatism.
TABLE 15.7-9 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.7-10 DELETED BY PKG FSC 07-MP3-056 TABLE 15.7-11 DELETED BY FSARCR PKG FSC 04-MP3-017 worst common mode failure which is postulated to occur is the failure to scram the reactor r an anticipated transient has occurred. A series of generic studies [1 & 2] on Anticipated nsients Without Scram (ATWS) showed acceptable consequences would result provided that turbine trips and auxiliary feedwater flow are initiated in a timely manner. A Millstone Unit 3 cific calculation at a NSSS thermal power of 3739 MWt has been performed to confirm licability of the generic studies. The effects of ATWS events are not considered as part of the gn basis for transients analyzed in Chapter 15. The final NRC ATWS rule [3] requires that tinghouse-designed plants install ATWS Mitigation System Actuation Circuitry (AMSAC) to ate turbine trip and actuate auxiliary feedwater flow independent of the Reactor Protection tem (RPS). The Millstone Unit 3 AMSAC design is described in Section 7.8.
.1 REFERENCES FOR SECTION 15.8
-1 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
-2 Anderson, T. M., ATWS Submittal, Westinghouse Letter NS-TMA-2182 to S. H. Hanauer of the NRC, December 1979.
-3 ATWS Final Rule - Code of Federal Regulations 10 CFR 50.62 and Supplementary Information Package, Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.
-4 NUREG-0460, Anticipated Transients Without Scram for Light Water Reactors, December 1978.
-5 Anderson, T. M., Rule making on Anticipated Transients Without Scram, Westinghouse Letter NS-EPR-83-2833 to S. J. Chilk of the NRC, October 3, 1983.
radiological consequences of design basis accidents evaluated using the Alternate Source m (AST) are quantified in terms of Total Effective Dose Equivalent (TEDE) at the control m, Exclusion Area Boundary (EAB) and Low Population Zone (LPZ). The dose methodology d is consistent with Regulatory Guide 1.183 and has been implemented via use of the DTRAD computer code.
radiological consequences of all other design-basis accidents are quantified in terms of oid doses and whole-body gamma doses at the exclusion area boundary (EAB), and at the low ulation zone (LPZ). The doses at the EAB are based upon releases of radionuclides over a od of two hours following the occurrence of an assumed accident; those at the LPZ are based n releases over a thirty-day period following the occurrence of this accident.
roid doses for these accidents are calculated based upon Equation 15A-1:
D thy = ( Ai ) ( Q ) ( B.R. ) ( Cthy ) (15A-1) i re:
Dthy = thyroid dose (rem)
Ai = activity of iodine isotope i released (curies)
/Q = atmospheric dispersion factor (sec/meter3)
B.R. = breathing rate (meter3/sec)
Cthy = thyroid dose conversion factor (rem/ci) (Reg. Guide 1.109, 1977)
/Q values presented in Table 15.0-11 were calculated using the methodology described in R Section 2.3.4.
ne nuclide contribution to the external whole body gamma dose for the nonrevised accidents alculated using Equation 15A-2 (derived from equations in Regulatory Guide 1.4, 1974):
D = 0.25 A i E i ( Q ) (15A-2) i re:
D = gamma dose from a semi-infinite cloud (rem)
Ei = average gamma energy per disintegration of isotope i (MeV/dis)
Ai = activity of isotope i released over the given time interval (curies)
/Q = atmospheric dispersion factor (sec/m3)
- e. Dose factors from Table B-1, Regulatory Guide 1.109 Revision 1 or FGR 12 or ICRP 30 are d to calculate potential gamma whole body. The equation from Regulatory Guide 1.109 is as ows:
4 D = 3.17X10 ( Q i ) ( X Q ) DF i
(15A-3) i re:
D = gamma whole body dose (mrem)
Qi = release rate of radionuclide i (Ci/year)
X/Q = atmospheric dispersion factor (sec/meter3)
DFi = gamma whole body dose factor for a uniform semi-infinite cloud of radionuclide i mrem-m3/pCi-year constant 3.17 x 104 is in units of pCi-year/Ci-sec.
following is a list of computer programs which are used to calculate design-basis source s and radiological consequences of the nonrevised design basis accidents in FSAR pter 15:
- 1. ACTIVITY 2 Program ACTIVITY 2 calculates the concentration of fission products in the fuel, coolant, waste gas decay tanks, ion exchangers, miscellaneous tanks, and release lines to the atmosphere for a PWR system. The program uses a library of properties of more than 100 significant fission products and may be modified to include as many as 200 isotopes. The output of ACTIVITY 2 presents the isotopic activity and energy spectrum at the selected part of the system for a given operating time.
- 2. RADIOISOTOPE Program RADIOISOTOPE calculates the activity of isotopes in a closed system by solving the appropriate decay equations. Based on the activity of any isotope in the system at an initial time, the program calculates the activity of that isotope and its offspring at any later time, provided that the decay scheme is contained in the program library. Furthermore, because gamma activity is important for dose rate
- 3. IONEXCHANGER Program IONEXCHANGER computes the buildup of isotopic activity in the resin bed of a demineralizer for constant feed flow rate and constant feed activity conditions. This program also calculates the energy releases in seven energy groups of gamma radiation accompanying decay for each of these isotopes, considering up to two parents of an isotope. A library of more than 100 isotopes is provided, and, when desired, has the ability to handle 200 different isotopes.
- 4. REM 123 REM 123 is a computer program developed to calculate the beta, gamma, and thyroid doses at the EAB and LPZ boundary. This calculation is based on the xenon releases, krypton releases, iodine releases, and X/Q values for a specified period of time. REM 123 makes use of built-in constants such as average gamma energies, thyroid dose conversion factors, and appropriate breathing rates; it performs its dose calculations in accordance with Regulatory Guides 1.3 and 1.4.
- 5. DRAGON 4 Program DRAGON 4 evaluates the activities, dose rates, and time-integrated dose in the reactor building and control room of a nuclear facility or at an adjacent site following release of halogens and noble gases from some control volume. The fission product release to the atmosphere, together with the activities and time-integrated activity concentrations of the halogens which are accumulated in the system, are also computed. Site dose calculations performed by DRAGON 4 employ the semi-infinite cloud models suggested by Regulatory Guides 1.3 and 1.4; the gamma dose in the control room is computed based upon a finite cloud model. Average gamma energies are used in all dose calculations.
- 6. QADMOD Program QADMOD calculates dose rates at specified detector locations for a number of different source points representing volumetric sources. The calculational technique employed by this program is commonly referred to as the point kernel technique. QADMOD is a modified version of the QAD P-5 program written at Los Alamos Scientific Laboratory by R.E. Malenfant. This modification includes a) the FASTER geometry routines, b) a point source option, c) a translated cylindrical source volume option, and d) an internal data library
For the revised Millstone 3 dose calculations, the dose methodology incorporated Regulatory Guide 1.183 methods. The revised Millstone 3 dose calculations used the following computer codes to calculate the TEDE doses.
- 7. RADTRAD The RADionuclide, Transport, Removal, and Dose (RADTRAD) model estimates doses at offsite locations: the exclusion area boundary (EAB) or the low population zone (LPZ), and in the control room. The code has two optional source terms to describe fission product release from the reactor coolant system: those specified in: Calculation of Distance Factors for Power and Test Reactor Sites (TID-14844) along with Regulatory Guides 1.3 and 1.4; and those specified for boiling water reactors (BWRs) and pressurized water reactors (PWRs) in Accident Source Terms for Light Water Nuclear Power Plants (NUREG-1465).
As radioactive material is transported through the containment, the user can account for sprays and natural deposition that may reduce the quantity of radioactive material. Material can flow between buildings, from buildings to the environment, or into control rooms through high-efficiency particulate air (HEPA) filters, piping, or other connectors. An accounting of the amount of radioactive material retained due to these tortuous pathways is maintained. Decay and in-growth of daughters can be calculated over time as the material is transported. The code contains over 25 model and table options to perform these tasks. Dose Conversion Factors used in RADTRAD are from Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion and Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water and Soil. The RADTRAD code was originally developed by the Accident Analysis and Consequence Assessment Department at Sandia National Laboratories (SNL) for the U. S. Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation (NRR), Division of Reactor Program Management.
- 8. ORIGEN-ARP The ORIGEN-ARP code is a neutron depletion and decay code that is used to generate the reactor core inventory. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
- 9. ARCON96 ARCON96 was developed to calculate relative concentrations in plumes from nuclear power plants at control room air intakes in the vicinity of the release point.
ARCON96 implements a straight line Gaussian dispersion model with dispersion coefficients that are modified to account for low wind meander and building wake
ranging from 2 to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> in duration. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
A.1 REFERENCES FOR APPENDIX 15A A-1 Regulatory Guide 1.109, Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
A-2 Regulatory Guide 1.4, Assumption Used for Evaluating the Potential Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
A-3 Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion, (FGR 11), 1988.
A-4 Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water, and Soil, (FGR 12), 1993.
A-5 International Commission on Radiological Protection Report No. 30, Limits of Intakes of Radionuclides by Workers, (ICRP 30), 1980.