ML23193A884
| ML23193A884 | |
| Person / Time | |
|---|---|
| Site: | Millstone  |
| Issue date: | 06/28/2023 |
| From: | Dominion Energy Nuclear Connecticut |
| To: | Office of Nuclear Reactor Regulation |
| Shared Package | |
| ML23193A862 | List:
|
| References | |
| 23-169 | |
| Download: ML23193A884 (1) | |
Text
Millstone Power Station Unit 3 Safety Analysis Report Chapter 15: Accident Analyses
Table of Contents tion Title Page INTRODUCTION .................................................................................... 15.0-1
.1 Classification of Plant Conditions ............................................................ 15.0-1
.1.1 Condition I - Normal Operation and Operational Transients ................... 15.0-2
.1.2 Condition II - Faults of Moderate Frequency ........................................... 15.0-3
.1.3 Condition III - Infrequent Faults............................................................... 15.0-4
.1.4 Condition IV - Limiting Faults ................................................................. 15.0-5
.2 Optimization of Control Systems ............................................................. 15.0-6
.3 Plant Characteristics and Initial Conditions Assumed in the Accident Analyses .................................................................................... 15.0-6
.3.1 Design Plant Conditions ........................................................................... 15.0-6
.3.2 Initial Conditions ...................................................................................... 15.0-7
.3.3 Power Distribution .................................................................................... 15.0-7
.3.4 Nuclear Fuel Thermal Conductivity Degradation .................................... 15.0-8
.4 Reactivity Coefficients Assumed in the Accident Analyses .................... 15.0-8
.5 Rod Cluster Control Assembly Insertion Characteristics ......................... 15.0-9
.6 Trip Points and Time Delays to Trip Assumed in Accident Analyses ..... 15.0-9
.7 Plant Systems and Components Available for Mitigation of Accident Effects...................................................................................... 15.0-10
.8 Fission Product Inventories .................................................................... 15.0-11
.8.1 Inventory in the Core .............................................................................. 15.0-11
.8.2 Inventory in the Fuel Clad Gap............................................................... 15.0-11 0.8.3 Reactor Coolant Activity ........................................................................ 15.0-11
.9 Residual Decay Heat............................................................................... 15.0-11
.9.1 Total Residual Heat ................................................................................ 15.0-11
.9.2 Decay Heat Modeling for Small Break Loss-of-Coolant Accident ........ 15.0-12
.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident .................................................................................................. 15.0-12
.10 Computer Codes Utilized........................................................................ 15.0-12
.10.1 FACTRAN.............................................................................................. 15.0-12
.10.2 LOFTRAN .............................................................................................. 15.0-13
tion Title Page
.10.3 Casmo5 ................................................................................................... 15.0-13
.10.4 Simulate5 ................................................................................................ 15.0-13
.10.5 TWINKLE .............................................................................................. 15.0-13
.10.6 VIPRE ..................................................................................................... 15.0-14
.10.7 RETRAN ................................................................................................ 15.0-14
.11 References for Section 15.0 .................................................................... 15.0-14 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.1-1
.1 Feedwater System Malfunctions that Result in a Decrease in Feedwater Tem-perature ..................................................................................................... 15.1-1
.1.1 Identification of Causes and Accident Description .................................. 15.1-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.1-2
.1.3 Conclusions............................................................................................... 15.1-3
.1.4 Radiological Consequences ...................................................................... 15.1-3
.2 Feedwater System Malfunctions that Result in an Increase in Feedwater Flow......................................................................................... 15.1-3
.2.1 Identification of Causes and Accident Description .................................. 15.1-3
.2.2 Analysis of Effects and Consequences ..................................................... 15.1-3
.2.3 Conclusions............................................................................................... 15.1-6
.2.4 Radiological Consequences ...................................................................... 15.1-6
.3 Excessive Increase In Secondary Steam Flow.......................................... 15.1-6
.3.1 Identification of Causes and Accident Description .................................. 15.1-6
.3.2 Analysis of Effects and Consequences ..................................................... 15.1-7
.3.3 Results and Conclusions ........................................................................... 15.1-7
.3.4 Radiological Consequences ...................................................................... 15.1-7
.4 Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a De-pressurization of the Main Steam System................................................. 15.1-7
.4.1 Identification of Causes and Accident Description .................................. 15.1-7
.4.2 Analysis of Effects and Consequences ..................................................... 15.1-9
.4.3 Radiological Consequences ...................................................................... 15.1-9
.5 Steam System Piping Failure .................................................................... 15.1-9
tion Title Page
.5.1 Identification of Causes and Accident Description .................................. 15.1-9
.5.2 Analysis of Effects and Consequences ................................................... 15.1-11
.5.3 Conclusions............................................................................................. 15.1-15
.5.4 Radiological Consequences .................................................................... 15.1-15
.6 References for Section 15.1 .................................................................... 15.1-16 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM................................................................................................... 15.2-1
.1 Steam Pressure Regulator Malfunction or Failure that Results in Decreasing Steam Flow ............................................................................................... 15.2-1
.2 Loss of External Electrical Load .............................................................. 15.2-1
.2.1 Identification of Causes and Accident Description .................................. 15.2-1
.2.2 Analysis of Effects and Consequences ..................................................... 15.2-3
.2.3 Conclusions............................................................................................... 15.2-3
.2.4 Radiological Consequences ...................................................................... 15.2-3
.3 Turbine Trip .............................................................................................. 15.2-4
.3.1 Identification of Causes and Accident Description .................................. 15.2-4
.3.2 Analysis of Effects and Consequences ..................................................... 15.2-5
.3.3 Conclusions............................................................................................... 15.2-7
.3.4 Radiological Consequences ...................................................................... 15.2-8
.4 Inadvertent Closure of Main Steam Isolation Valves ............................... 15.2-8
.5 Loss of Condenser Vacuum and Other Events Resulting in Turbine Trip 15.2-8
.6 Loss of Nonemergency AC Power to the Station Auxiliaries .................. 15.2-8
.6.1 Identification of Causes and Accident Description .................................. 15.2-8
.6.2 Analysis of Effects and Consequences ................................................... 15.2-10
.6.3 Conclusions............................................................................................. 15.2-11
.6.4 Radiological Consequences .................................................................... 15.2-11
.7 Loss of Normal Feedwater Flow ............................................................ 15.2-12
.7.1 Identification of Causes and Accident Description ................................ 15.2-12
.7.2 Analysis of Effects and Consequences ................................................... 15.2-13
.7.3 Conclusions............................................................................................. 15.2-15
tion Title Page
.7.4 Radiological Consequences .................................................................... 15.2-15
.8 Feedwater System Pipe Break ................................................................ 15.2-16
.8.1 Identification of Causes and Accident Description ................................ 15.2-16
.8.2 Analysis of Effects and Consequences ................................................... 15.2-17
.8.3 Conclusions............................................................................................. 15.2-21
.8.4 Radiological Consequences .................................................................... 15.2-21
.9 References for Section 15.2 .................................................................... 15.2-21 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ........................................................................................................ 15.3-1
.1 Partial Loss of Forced Reactor Coolant Flow........................................... 15.3-1
.1.1 Identification of Causes and Accident Description .................................. 15.3-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.3-2
.1.3 Conclusions............................................................................................... 15.3-3
.1.4 Radiological Consequences ...................................................................... 15.3-3
.2 Complete Loss of Forced Reactor Coolant Flow...................................... 15.3-3
.2.1 Identification of Causes and Accident Description .................................. 15.3-3
.2.2 Analysis of Effects and Consequences ..................................................... 15.3-4
.2.3 Underfrequency ........................................................................................ 15.3-5
.2.4 Conclusions............................................................................................... 15.3-5
.2.5 Radiological Consequences ...................................................................... 15.3-5
.3 Reactor Coolant Pump Shaft Seizure (Locked Rotor).............................. 15.3-6
.3.1 Identification of Causes and Accident Description .................................. 15.3-6
.3.2 Analysis of Effects and Consequences ..................................................... 15.3-6
.3.3 Conclusions............................................................................................... 15.3-9
.3.4 Radiological Consequences ...................................................................... 15.3-9
.4 Reactor Coolant Pump Shaft Break ........................................................ 15.3-10
.4.1 Identification of Causes and Accident Description ................................ 15.3-10
.4.2 Conclusions............................................................................................. 15.3-10
.5 References for Section 15.3 .................................................................... 15.3-10
tion Title Page REACTIVITY AND POWER DISTRIBUTION ANOMALIES ............ 15.4-1
.1 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcrit-ical or Low Power Startup Condition ....................................................... 15.4-1
.1.1 Identification of Causes and Accident Description .................................. 15.4-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.4-3
.1.3 Conclusions............................................................................................... 15.4-5
.1.4 Radiological Consequences ...................................................................... 15.4-5
.2 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power .................................................................................................... 15.4-5
.2.1 Identification of Causes and Accident Description .................................. 15.4-5
.2.2 Analysis of Effects and Consequences ..................................................... 15.4-7
.2.3 Conclusions............................................................................................. 15.4-10
.2.4 Radiological Consequences .................................................................... 15.4-10
.3 Rod Cluster Control Assembly Misalignment........................................ 15.4-10
.3.1 Identification of Causes and Accident Description ................................ 15.4-10
.3.2 Analysis of Effects and Consequences ................................................... 15.4-12
.3.3 Conclusions............................................................................................. 15.4-16
.3.4 Radiological Consequences .................................................................... 15.4-16
.4 Startup of an Inactive Reactor Coolant Pump at an Incorrect Temperature and Boron Concentration................................................... 15.4-17
.5 A Malfunction or Failure of the Flow Controller in a BWR Loop that Results in an Increased Reactor Coolant Flow Rate................................................ 15.4-17
.6 Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant................................ 15.4-17
.6.1 Identification of Causes and Accident Description ................................ 15.4-17
.6.2 Analysis of Effects and Consequences ................................................... 15.4-20
.6.3 Conclusions............................................................................................. 15.4-25
.6.4 Radiological Consequences .................................................................... 15.4-25
.7 Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position ................................................................................... 15.4-25
.7.1 Identification of Causes and Accident Description ................................ 15.4-25
.7.2 Analysis of Effects and Consequences ................................................... 15.4-26
tion Title Page
.7.3 Conclusions............................................................................................. 15.4-27
.7.4 Radiological Consequences .................................................................... 15.4-27
.8 Spectrum of Rod Cluster Control Assembly Ejection Accidents ........... 15.4-27
.8.1 Identification of Causes and Accident Description ................................ 15.4-27
.8.1.1 Design Precautions and Protection ......................................................... 15.4-27
.8.1.2 Limiting Criteria ..................................................................................... 15.4-30
.8.2 Analysis of Effects and Consequences ................................................... 15.4-31
.8.2.1 Calculation of Basic Parameters ............................................................. 15.4-32
.8.3 Conclusions............................................................................................. 15.4-36
.8.4 Radiological Consequences .................................................................... 15.4-37
.9 References for Section 15.4 .................................................................... 15.4-38 INCREASE IN REACTOR COOLANT INVENTORY.......................... 15.5-1
.1 Inadvertent Operation of the Emergency Core Cooling System During Power Operation .................................................................................................. 15.5-1
.1.1 Identification of Causes and Accident Description .................................. 15.5-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.5-2
.1.3 Conclusions............................................................................................... 15.5-5
.1.4 Radiological Consequences ...................................................................... 15.5-6
.2 Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory ..................................................................................... 15.5-6
.2.1 Identification of Causes and Accident Description .................................. 15.5-6
.2.2 Analysis of Effects and Consequences ..................................................... 15.5-7
.2.3 Results....................................................................................................... 15.5-8
.2.4 Conclusions............................................................................................... 15.5-9
.3 A Number of BWR Transients ................................................................. 15.5-9
.4 References for Section 15.5 ...................................................................... 15.5-9 DECREASE IN REACTOR COOLANT INVENTORY ........................ 15.6-1
.1 Inadvertent Opening of a Pressurizer Safety or Relief Valve................... 15.6-1
.1.1 Identification of Causes and Accident Description .................................. 15.6-1
.1.2 Analysis of Effects and Consequences ..................................................... 15.6-2
tion Title Page
.1.3 Conclusions............................................................................................... 15.6-3
.1.4 Radiological Consequences ...................................................................... 15.6-3
.2 Failure of Small Lines Carrying Primary Coolant Outside Containment. 15.6-3 6.3 Steam Generator Tube Failure .................................................................. 15.6-4
.3.1 Identification of Causes and Accident Description .................................. 15.6-5
.3.2 Analysis of Effects and Consequences ..................................................... 15.6-8
.3.2.1 Margin to Steam Generator Overfill ......................................................... 15.6-8
.3.2.2 Radiological Consequences ...................................................................... 15.6-9
.3.2.2.1 Thermal and Hydraulic Analysis .............................................................. 15.6-9
.3.2.2.2 Radiation Dose Analysis......................................................................... 15.6-14
.4 Spectrum of BWR Steam System Piping Failures Outside of Containment (Not Applicable to Millstone 3).............................................................. 15.6-17
.5 Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary.......................... 15.6-17
.5.1 Identification of Causes and Frequency Classification........................... 15.6-17
.5.2 Large Break Loss-of-Coolant Accident .................................................. 15.6-18
.5.2.1 General.................................................................................................... 15.6-19
.5.2.2 Identification of Cause and Accident Description .................................. 15.6-20
.5.2.3 Method of Analysis................................................................................. 15.6-21
.5.2.3.1 FULL SPECTRUM LOCA Evaluation Model Development ................ 15.6-21
.5.2.3.2 WCOBRA/TRAC-TF2 COMPUTER CODE ........................................ 15.6-22
.5.2.4 Description of Representative Transient................................................. 15.6-23
.5.2.5 Analysis Results...................................................................................... 15.6-24
.5.2.6 Compliance with 10 CFR 50.46 ............................................................. 15.6-25
.5.2.7 Post Analysis of Record Evaluations...................................................... 15.6-26
.5.3 Small Break LOCA................................................................................. 15.6-27
.5.3.1 Description of Small Break LOCA Transient......................................... 15.6-27
.5.3.2 Small Break LOCA Evaluation Model ................................................... 15.6-27
.5.3.3 Input Parameters and Initial Conditions ................................................. 15.6-28
.5.3.4 Small Break Results................................................................................ 15.6-29
.5.4 Radiological Consequences .................................................................... 15.6-30
tion Title Page
.5.5 Conclusions............................................................................................. 15.6-33
.6 BWR Transients...................................................................................... 15.6-33
.7 References for Section 15.6 .................................................................... 15.6-33 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT.......................................................................................... 15.7-1
.1 Radioactive Gaseous Waste System Failure............................................. 15.7-1
.2 Radioactive Liquid Waste System Leak or Failure (Atmospheric Release).............................................................................. 15.7-1
.3 Liquid Containing Tank Failure ............................................................... 15.7-1
.4 Design Basis Fuel Handling Accidents .................................................... 15.7-1
.4.1 Identification of Causes and Accident Description .................................. 15.7-1
.4.2 Sequence of Events and Systems Operation............................................. 15.7-1
.4.2.1 Fuel Handling Accident in the Fuel Building ........................................... 15.7-2
.4.2.2 Fuel Handling Accident in Containment .................................................. 15.7-2
.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool ........................................................... 15.7-3
.4.3 Radiological Consequences ...................................................................... 15.7-3
.5 Spent Fuel Cask Drop Accidents .............................................................. 15.7-3 ANTICIPATED TRANSIENTS WITHOUT SCRAM ............................ 15.8-1 8.1 References for Section 15.8 ...................................................................... 15.8-1 endix 15A Dose Methodology............................................................................. 15.A-1 A.1 References for Appendix 15A ................................................................. 15.A-5 endix 15B Deleted by FSARCR 02-MP3-017 .....................................................15.B-1
List of Tables mber Title
-1 Nuclear Steam Supply System Power Ratings
-2 Summary of Initial Conditions and Computer Codes Used
-3 Nominal Values of Pertinent Plant Parameters Utilized in the Accident Analysis
-4 Trip Point and Time Delays to Trip Assumed in Accident Analyses
-5 Deleted by PKG FSC 07-MP3-049
-6 Plant Systems and Equipment Required for the Mitigation of Transient and Accident Conditions
-7 Fission Product Inventory in Reactor Core
-8 Potential Dose Due to Accidents 0-9 Deleted
-10 Technical Specification Coolant Concentrations
-11 Atmospheric Dispersion Data Used for Design Basis Accident Analysis
-12 Reactor Coolant Iodine Concentrations Assuming Pre-Accident Iodine Spike
-13 Iodine Release Rates into Reactor Coolant Due to Concurrent Iodine Spike
-1 Time Sequence of Events for Incidents Which Cause an Increase in Heat Removal by the Secondary System
-2 Equipment Required Following a Rupture of a Main Steam Line
-3 Assumptions Used in Main Steam Line Break Analysis
-4 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Time Sequence for Events for Incidents Which Cause a Decrease in Heat Removal by the Secondary System
-2 Natural Circulation Flow
-1 Time Sequence of Events for Incidents Which Result in a Decrease in Reactor Coolant System Flow
-2 Summary of Results for Locked Rotor Transients
-3 Assumptions Used in Locked Rotor Analysis
-1 Time Sequence of Events for Incidents Which Cause Reactivity and Power Distribution Anomalies
mber Title
-2 deleted by fsarcr ucr-m3-2019-003
-3 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident
-4 Parameters Used in Rod Ejection Accident Analysis
-5 Integrated Break Flow (lbm) in Containment
-6 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Time Sequence of Events - inadvertent operation of eccs
-2 Time Sequence of Events - CVCS Malfunction that Increases Reactor Coolant Inventory
-1 Time Sequence of Events for Inadvertent Opening of a Pressurizer Safety Valve
-2 Assumptions Used in Analysis of Failure of Small Lines Carrying Primary Coolant Outside Containment
-3 Plant Operating Range Allowed by the full spectrum Large Break LOCA Analysis
-4 Containment data used for region ii (lbloca) calculation of containment pressure for millstone Unit 3
-5 containment heat sink data used for region ii (lbloca) calculation of containment pressure for millstone unit 3
-6 Minimum safety injection flows (Total in intact loops) used for region ii (lbloca) calculation for millstone unit 3
-7 millstone unit 3 region ii (lbloca) analysis results with the fsloca em
-7Apeak cladding temperature including all penalties and benefits, region ii (lbloca) for mill-e unit 3
-8 millstone unit 3 sequence of events for the region ii (lbloca) analysis pct case
-9 Assumptions Used for the Radiological Consequences of a LOCA Analysis
-10 Deleted by FSARCR PKG FSC 04-MP3-017
-11 Deleted by Change PKG FSC 07-MP3-054
-12 Assumptions Used for the Control Room Habitability Analysis
-13 Deleted by FSARCR PKG FSC 04-MP3-017
-14 Time Sequence of Events for Incidents Which Cause a Decrease in Reactor Coolant Inventory (Small Break)
mber Title
-15 Input Parameters Used in the ECCS Analysis (small Break)
-16 Small Break LOCA Results Fuel Cladding Data
-17 Small Break LOCA Safety Injection Flow Rate for 1.5 inch to 6 inch Breaks
-18 Small Break LOCA Safety Injection Flow Rate for 8.75 inch Break Before Switchover
-19 Omitted
-20 Omitted
-21 DELETED BY FSARCR 03-MP3-022
-22 DELETED BY FSARCR 03-MP3-022
.3-1 Operator Action Times for Design Basis Steam Generator Tube Rupture Analysis
.3-2 Steam Generator Tube Rupture Analysis Sequence of Events
.3-3 Steam Generator Tube R Mass Releases Total Mass Flow (Pounds)
.3-4 Steam Generator Tube Rupture Analysis Parameters Used in Evaluating Radiological Consequences
.3-5 Deleted by Change PKG FSC 07-MP3-054
.3-6 Steam Generator Tube Rupture Analysis Iodine Spike Appearance Rates
.3-7 Deleted by FSARCR PKG FSC 04-MP3-017
.3-8 Deleted by FSARCR PKG FSC 04-MP3-017
.3-9 Deleted by FSARCR PKG FSC 04-MP3-017
.3-10 Deleted by FSARCR PKG FSC 04-MP3-017
-1 Omitted
-2 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017
-3 Table Relocated to Table 11.3-13 by FSARCR 04-MP3-017
-4 Table Relocated to Table 11.2-12 by FSARCR 04-MP3-017
-5 Table Relocated to Table 11.2-11 by FSARCR 04-MP3-017
-6 Table Relocated to Table 11.2-13 by FSARCR 04-MP3-017
-7 Table Relocated to Table 11.2-14 by FSARCR 04-MP3-017 7-8 Parameters for Postulated Fuel Handling Accident
mber Title
-9 Deleted by FSARCR PKG FSC 04-MP3-017
-10 Deleted by PKG FSC 07-MP3-056
-11 Deleted by FSARCR PKG FSC 04-MP3-017
List of Figures mber Title
-1 Illustration of Overtemperature and Overpower T Protection
-1 A Deleted by FSARCR PKG FSC 02-MP3-017
-2 Doppler Power Coefficient Used in Accident Analysis
-3 RCCA Position Versus Time to Dashpot
-4 Normalized Rod Worth Versus Percent Inserted
-5 Normalized RCCA Bank Reactivity Worth Versus Drop Time
-6 Deleted by FSARCR PKG FSC 07-MP3-049
-7 Abbreviations
-8 Excessive Heat Removal Due to Feedwater Systems Malfunction
-9 Excessive Load Increase
-10 Depressurization of Main Steam System
-11 Loss of External Load/Turbine Trip
-12 Loss of Offsite Power to Station Auxiliaries
-13 Loss of Normal Feedwater
-14 Major Rupture of a Main Feedwater Line
-15 Loss of Forced Reactor Coolant Flow
-16 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal
-17 Dropped Rod Cluster Control Assembly
-18 Single Rod Cluster Control Assembly Withdrawal at Full Power 0-19 Not Used 0-20 Not Used
-21 Rupture of Control Rod Drive Mechanism Housing (Rod Ejection)
-22 Inadvertent ECCS Operation at Power
-23 Accidental Depressurization of Reactor Coolant System
-24 Steam Generator Tube Rupture
-25 Loss of Coolant Accident
List of Figures (Continued) mber Title
-26 CVCS Letdown Line Rupture 0-27 GWPS Gas Decay Tank Rupture
-28 Floor Drain Tank Failure
-29 Fuel Handling Accident in Fuel Building
-30 Fuel Handling Accident Inside Containment
-31 Spent Fuel Cask Drop Accident
-1 Feedwater Control Valve Malfunction 1-1 A Deleted by FSARCR PKG FSC 02-MP3-017
-2 Feedwater Control Valve Malfunction 1-2 A Deleted by FSARCR PKG FSC 02-MP3-017
-3 Deleted by FSARCR PKG FSC 07-MP3-050
-4 Deleted by FSARCR PKG FSC 07-MP3-050
-5 Deleted by FSARCR PKG FSC 07-MP3-050
-6 Deleted by FSARCR PKG FSC 07-MP3-050
-7 Deleted by FSARCR PKG FSC 07-MP3-050
-8 Deleted by FSARCR PKG FSC 07-MP3-050
-9 Deleted by FSARCR PKG FSC 07-MP3-050
-10 Deleted by FSARCR PKG FSC 07-MP3-050
-11 Typical(1)Keffective Versus Temperature
-12 Deleted by FSARCR PKG FSC 07-MP3-050
-12 A Deleted by FSARCR PKG FSC 02-MP3-017
-13 Deleted by FSARCR PKG FSC 07-MP3-050
-13 A Deleted by FSARCR PKG FSC 02-MP3-017
-14 TYPICAL(1)Doppler Power Feedback
-15 1.4 SQ. FT. Steamline Rupture Offsite Power Available
-15 A 1.4 SQ. FT STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-16 1.4 SQ. FT. Steamline Rupture Offsite Power Available
List of Figures (Continued) mber Title
-16 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-17 1.4 SQ. FT. Steamline Rupture Offsite Power Available
-17 A 1.4 SQ. FT. STEAMLINE RUPTURE OFFSITE POWER AVAILABLE
-1 Turbine Trip - RCS Overpressurization Case
-1A Deleted by FSARCR 02-MP3-017
-2 Turbine Trip - RCS Overpressurization Case
-2A Deleted by FSARCR 02-MP3-017
-3 Turbine Trip-DNBR Case
-3A Deleted by FSARCR 02-MP3-017
-4 Turbine Trip-DNBR Case
-4A Deleted by FSARCR 02-MP3-017
-5 Turbine Trip-MSS Over pressurization Case
-5A Deleted by FSARCR 02-MP3-017
-6 Turbine Trip-MSS Over pressurization Case
-6A Deleted by FSARCR 02-MP3-017
-7 Deleted by FSARCR PKG FSC 07-MP3-051
-7A Deleted by FSARCR 02-MP3-017
-8 Deleted by FSARCR PKG FSC 07-MP3-051
-8A Deleted by FSARCR 02-MP3-017
-9 Loss of Normal Feedwater with Offsite Power Available
-9A Loss of Normal Feedwater without Offsite Power Available
-10 Loss of Normal Feedwater with Offsite Power Available
-10A Loss of Normal Feedwater without Offsite Power Available
-11 Loss of Normal Feedwater with Offsite Power Available
-11A Loss of Normal Feedwater without Offsite Power Available
-12 Loss of Normal Feedwater with Offsite Power Available
List of Figures (Continued) mber Title
-12A Loss of Normal Feedwater without Offsite Power Available
-13 Main Feedline Rupture with Offsite Power Available
-13A Deleted by FSARCR 02-MP3-017
-14 Main Feedline Rupture with Offsite Power Available
-14A Deleted by FSARCR 02-MP3-017
-15 Main Feedline Rupture with Offsite Power Available
-15A Deleted by FSARCR 02-MP3-017
-16 Main Feedline Rupture with Offsite Power Available
-16A Deleted by FSARCR 02-MP3-017
-17 Main Feedline Rupture with Offsite Power Available
-17A Deleted by FSARCR 02-MP3-017
-18 Main Feedline Rupture with Offsite Power Available
-18A Deleted by FSARCR 02-MP3-017
-19 Main Feedline Rupture without Offsite Power Available
-19A Deleted by FSARCR 02-MP3-017
-20 Main Feedline Rupture without Offsite Power Available
-20A Deleted by FSARCR 02-MP3-017
-21 Main Feedline Rupture without Offsite Power Available
-21A Deleted by FSARCR 02-MP3-017
-22 Main Feedline Rupture without Offsite Power Available
-22A Deleted by FSARCR 02-MP3-017
-23 Main Feedline Rupture without Offsite Power Available
-23A Deleted by FSARCR 02-MP3-017
-24 Main Feedline Rupture without Offsite Power Available
-24A Deleted by FSARCR 02-MP3-017
-1 Flow Transients, One Pump Coasting Down
-2 Nuclear Power and Pressurizer Pressure Transients, One Pump Coasting Down
List of Figures (Continued) mber Title
-3 Average and Hot Channel Heat Flux Transient, One Pump Coasting Down
-4 DNBR Versus Time, One Pump Coasting Down
-5 Core Flow Coastdown, Four Pumps Coasting Down
-6 Nuclear Power & Pressurizer Pressure Transients, Four Pumps Coasting Down
-7 Average & Hot Channel Transients, Four Pumps Coasting Down
-8 DNBR versus Time, Four Pumps Coasting Down
-9 Flow Transients, One Locked Rotor
-9 A Deleted by FSARCR 02-MP3-017
-10 RCS Pressure, One Locked Rotor
-10 A Deleted by FSARCR 02-MP3-017
-11 Nuclear Power, Average and Core Average Heat Flux Transients, One Locked Rotor
-11 A Deleted by FSARCR 02-MP3-017
-12 Maximum Clad Temperature at Hot Spot, One Locked Rotor
-12 A Deleted by FSARCR 02-MP3-017
-13 Core Flow Transient, Four Pumps Experiencing Frequency Decay
-14 Nuclear Power and Pressurizer Pressure Transients, Four Pumps Experiencing Frequency Decay
-15 Average and Hot Channel Heat Flux Transients, Four Pumps Experiencing Frequency Decay
-16 DNBR versus Time, Four Pumps Experiencing Frequency Decay
-1 Neutron and Thermal Flux Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition
-2 Omitted
-3 Fuel and Clad Temperature Transients for Uncontrolled RCCA Withdrawal from a Subcritical Condition 4-4 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
-4 A Deleted by FSARCR 02-MP3-017 4-5 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity
List of Figures (Continued) mber Title Feedback (100 PCM/sec Withdrawal Rate)
-5 A Deleted by FSARCR 02-MP3-017 4-6 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (100 PCM/sec Withdrawal Rate)
-6 A Deleted by FSARCR 02-MP3-017 4-7 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-7 A Deleted by FSARCR 02-MP3-017 4-8 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-8 A Deleted by FSARCR 02-MP3-017 4-9 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1.5 PCM/sec Withdrawal Rate)
-9 A Deleted by FSARCR 02-MP3-017
-10 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from Full Power
-10 A Deleted by FSARCR 02-MP3-017 4-11 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 60% RTP
-11 A Deleted by FSARCR 02-MP3-017 4-12 Minimum DNBR versus Reactivity Insertion Rate Rod Withdrawal from 10% RTP
-13 Dropped Rod Cluster Control Assembly, Manual Control
-14 Dropped Rod Cluster Control Assembly, Manual Control 4-15 Not Used 4-16 Not Used 4-17 Not Used 4-18 Not Used 4-19 Not Used 4-20 Not Used
-21 Interchange Between Region 1 and Region 3 Assembly
List of Figures (Continued) mber Title
-22 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 2 Assembly
-23 Interchange Between Region 1 and Region 2 Assembly, Burnable Poison Rods Being Retained by the Region 1 Assembly
-24 Enrichment Error: A Region 2 Assembly Loaded into the Core Central Position
-25 Loading a Region 2 Assembly into a Region 1 Position Near Core Periphery
-26 Nuclear Power Transient eol HFP RCCA Ejection
-26 A Deleted by FSARCR 02-MP3-017
-27 Hot Spot Fuel and Clad Temperature versus Time - eol HFP RCCA Ejection
-27 A Deleted by FSARCR 02-MP3-017
-28 Nuclear Power Transient EOL HZP RCCA Ejection (Two RCPs Running)
-29 Hot Spot Fuel and Clad Temperature versus Time - EOL HZP RCCA Ejection (Two RCPs Running) 4-30 Reactor Coolant System Integrated Break Flow Following a Rod Ejection Accident
-1 Inadvertent Operation of ECCS, Pressurizer Pressure versus Time
-2 Inadvertent Operation of ECCS, Pressurizer Level versus Time
-3 CVCS Malfunction that Increases Reactor Coolant Inventory, Nuclear Power and Vessel Average Temperature versus Time 5-4 CVCS Malfunction that Increases Reactor Coolant Inventory, Pressurizer Pressure and Pressurizer Water Volume versus Time
-1 Inadvertent Opening of a Pressurizer Safety Valve
-1 A Deleted by FSARCR 02-MP3-017
-2 Inadvertent Opening of a Pressurizer Safety Valve
-2 A Deleted by FSARCR 02-MP3-017
-3 Deleted by FSARCR 02-MP3-017 6.3-1 Pressurizer Level 6.3-2 Reactor Coolant System Pressure
.3-3 Secondary Pressure
.3-4 Ruptured Loop Hot and Cold Leg RCS Temperatures
List of Figures (Continued) mber Title
.3-5 Intact Loop Hot and Cold Leg RCS Temperatures
.3-6 Primary to Secondary Break Flow Rate
.3-7 Differential Pressure Between Reactor Coolant System and Ruptured Steam Generator
.3-8 Ruptured Steam Generator Water Volume
.3-9 Ruptured Steam Generator Water Mass
.3-10 Ruptured Steam Generator Mass Release Rate to the Atmosphere
.3-11 Intact Steam Generators Mass Release Rate to the Atmosphere
.3-12 Flashed Break Flow 6-4 Delete
-5 Deleted by FSARCR PKG FSC 07-MP3-054
-6 Code Interface Description for Small Break LOCA Model
-7 Small Break Power Shape
-8 millstone unit 3 peak cladding temperature for all rods for the region ii analysis pct case
-8 A Deleted by FSARCR PKG FSC 07-MP3-054
-9 millstone unit 3 peak cladding temperature elevation (relative to bottom of active fuel) for the region ii analysis pct case
-10 millstone unit 3 break mass flow rate for the region ii analysis pct case
-11 millstone unit 3 lower plenum collapsed liquid level (relative to inside bottom of vessel) for the region ii analysis pct case
-12 millstone unit 3 vapor mass flow rate at the top cell face of the core average channel not under guide tubes for the region ii analysis pct case
-13 millstone unit 3 rcs pressure for the region ii analysis pct case
-14 millstone unit 3 accumulator injection flow per loop for the region ii analysis pct case
-15 millstone unit 3 containment pressure for the region ii analysis pct case
-16 millstone unit 3 vessel fluid mass for the region ii analysis pct case
-17 millstone unit 3 collapsed liquid level for each core channel (relative to bottom of active fuel) for the region ii analysis pct case
List of Figures (Continued) mber Title
-18 millstone unit 3 average downcomer collapsed liquid level (relative to bottom of upper tie plate) for the region ii analysis pct case
-19 millstone unit 3 safety injection flow per loop (not including accumulator injection flow) for the region ii analysis pct case
-20 millstone unit 3 normalized core power shapes for the region ii analysis pct case
-21 millstone unit 3 relative core power for the region ii analysis pct case
-22 Deleted by FSARCR PKG FSC 07-MP3-054
-23 Deleted by FSARCR PKG FSC 07-MP3-054
-24 Deleted by FSARCR PKG FSC 07-MP3-054
-25 Deleted by FSARCR PKG FSC 07-MP3-054
-26 Deleted by FSARCR PKG FSC 07-MP3-054
-27 Deleted by FSARCR PKG FSC 07-MP3-054
-28 Deleted by FSARCR PKG FSC 07-MP3-054
-29 Deleted by FSARCR PKG FSC 07-MP3-054
-30 Deleted by FSARCR PKG FSC 07-MP3-054
-31 Reactor Coolant System Pressure (4 inch Break)
-32 Core Mixture Level (4 inch Break)
-33 Clad Temperature Transient at Peak Temperature Elevation (4 inch Break)
-34 Core Exit Steam Flow Rate (4 inch Break)
-35 Clad Surface Heat Transfer Coefficient at Peak Clad Temperature Elevation (4 inch Break)
-36 Fluid Temperature at Peak Clad Temperature Elevation (4 inch Break)
-37 Reactor Coolant System Pressure (1.5 inch Break)
-38 Reactor Coolant System Pressure (2 inch Break)
-39 Reactor Coolant System Pressure (3 inch Break)
-40 Reactor Coolant System Pressure (6 inch Break)
-41 Reactor Coolant System Pressure (8.75 inch Break)
-42 Core Mixture Level (1.5 inch Break)
-43 Core Mixture Level (2 inch Break)
B-1 Figures Deleted by FSARCR 02-MP3-017 0 INTRODUCTION s chapter addresses the representative initiating events listed on pages 15-10, 15-11, and 15-12 egulatory Guide 1.70, Revision 3, as they apply to Millstone 3.
tain items in the guide warrant comment, as follows:
Items 1.3 and 2.1 - There are no pressure regulators in the nuclear steam supply system (NSSS) pressurized water reactor (PWR) design whose malfunction or failure could cause a steam flow transient.
Item 6.2 - No instrument lines from the reactor coolant system boundary in the NSSS PWR design penetrate the containment. (For the definition of the reactor coolant system boundary, refer to ANSI-N18.2, Nuclear Safety Criteria for the Design of Stationary PWR Plants, Section 5, 1973.)
Items 7.1 (radioactive gas waste system leak or failure), 7.2 (radioactive liquid waste system leak or failure) and 7.3 (postulated radioactive releases due to liquid tank failures) from Table 15-1 of Regulatory Guide 1.70 have been transferred to Chapter 11.
.1 CLASSIFICATION OF PLANT CONDITIONS ce 1970, the American Nuclear Society (ANS) classification of plant conditions has been used ch divides plant conditions into four categories in accordance with anticipated frequency of urrence and potential radiological consequences to the public. The four categories are as ows:
- 1. Condition I: Normal Operation and Operational Transients
- 2. Condition II: Faults of Moderate Frequency
- 3. Condition III: Infrequent Faults
- 4. Condition IV: Limiting Faults basic principle applied in relating design requirements to each of the conditions is that the t probable occurrences should yield the least radiological risk to the public, and those extreme ations having the potential for the greatest risk to the public shall be those least likely to occur.
ere applicable, reactor trip system and engineered safeguards functioning is assumed to the nt allowed by considerations such as the single failure criterion, in fulfilling this principle.
reby, only Seismic Category I, Class IE and IEEE qualified equipment, instrumentation, and ponents, are used in the ultimate mitigation of the consequences of faulted conditions ndition II, III, and IV events).
e diagrams.
tulated accidents with respective potential offsite rem doses are shown in Table 15.0-8.
0.1.1 Condition I - Normal Operation and Operational Transients dition I occurrences are those which are expected frequently or regularly in the course of er operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I urrences are accommodated with margin between any plant parameter and the value of that meter which would require either automatic or manual protective action. Inasmuch as dition I occurrences occur frequently or regularly, they must be considered from the point of w of affecting the consequences of fault conditions (Conditions II, III, and IV). In this regard, lysis of each fault condition described is generally based on a conservative set of initial ditions corresponding to adverse conditions which can occur during Condition I operation.
pical list of Condition I events is listed below:
- 1. Steady state and shutdown operations
- a. Power operation (5 to 100 percent of rated thermal power)
- b. Startup (K0.99, 5 percent of rated thermal power)
- c. Hot standby (subcritical, residual heat removal system isolated)
- d. Hot shutdown (subcritical, residual heat removal system in operation)
- e. Refueling
- 2. Operation with permissible deviations Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational modes. These include:
- a. Operation with components or systems out of service
- b. Leakage from fuel with clad defects
- c. Radioactivity in the reactor coolant
- 1. Fission products
- 2. Corrosion products
- d. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications
- e. Testing as allowed by the Technical Specifications
- 3. Operational transients
- a. Plant heatup and cooldown (up to 100F/hour for the reactor coolant system; 200F/hour for the pressurizer during cooldown and 100F/hour for the pressurizer during heatup)
- b. Step load changes (10 percent)
- c. Ramp load changes (up to 5 percent/minute)
- d. Load rejection up to and including design full load rejection transient
.1.2 Condition II - Faults of Moderate Frequency se faults, at worst, result in the reactor trip with the plant being capable of returning to ration. By definition (ANSI N18.2), these faults (or events) do not propagate to cause a more ous fault, i.e. Condition III or IV events. In addition, Condition II events are not expected to lt in fuel rod failures or reactor coolant system or secondary system overpressurization.
the purposes of this report, the following faults are included in this category:
- 1. Feedwater System Malfunctions that Result in a Decrease in Feedwater Temperature (Section 15.1.1)
- 3. Excessive Increase In Secondary Steam Flow (Section 15.1.3)
- 4. Inadvertent Opening of a Steam Generator Relief or Safety Valve Causing a Depressurization of the Main Steam System (Section 15.1.4)
- 5. Loss of External Electrical Load (Section 15.2.2)
- 6. Turbine Trip (Section 15.2.3)
- 7. Inadvertent Closure of Main Steam Isolation Valves (Section 15.2.4)
- 9. Loss of Nonemergency AC Power to the Station Auxiliaries (Section 15.2.6)
- 10. Loss of Normal Feedwater Flow (Section 15.2.7)
- 11. Partial Loss of Forced Reactor Coolant Flow (Section 15.3.1)
- 12. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal from a Subcritical or Low Power Startup Condition (Section 15.4.1)
- 13. Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power (Section 15.4.2)
- 14. Rod Cluster Control Assembly Misalignment (dropped full length assembly, dropped full length assembly bank, or statically misaligned full or part length assembly) (Section 15.4.3)
- 15. Chemical and Volume Control System Malfunction that Results in a Decrease in the Boron Concentration in the Reactor Coolant (Section 15.4.6)
- 16. Inadvertent Operation of the Emergency Core Cooling System During Power Operation (Section 15.5.1)
- 17. Chemical and Volume Control System Malfunction that Increases Reactor Coolant Inventory (Section 15.5.2)
- 18. Inadvertent Opening of a Pressurizer Safety or Relief Valve (Section 15.6.1)
- 19. Failure of Small Lines Carrying Primary Coolant Outside Containment (Section 15.6.2) 0.1.3 Condition III - Infrequent Faults definition, Condition III events are faults which may occur very infrequently during the life of plant. They will be accommodated with the failure of only a small fraction of the fuel rods ough sufficient fuel damage might occur to preclude resumption of the operation for a siderable outage time. The release of radioactivity will not be sufficient to interrupt or restrict lic use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, erate a Condition IV fault or result in a consequential loss of function of the reactor coolant em or containment barriers. For the purposes of this report, the following faults are included his category and are shown on Figures 15.0 15.0-31:
- 1. Steam System Piping Failure (minor) (Section 15.1.5)
- 3. Rod Cluster Control Assembly Misalignment (single rod cluster control assembly withdrawal at full power) (Section 15.4.3)
- 4. Inadvertent Loading and Operation of a Fuel Assembly in an Improper Position (Section 15.4.7)
- 5. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (Section 15.6.5)
- 6. Radioactive Gas Waste System Leak or Failure (Section 11.3.3)
- 7. Radioactive Liquid Waste System Leak or Failure (Section 11.2.3)
- 8. Postulated Radioactive Releases Due to Liquid Tank Failures (Section 11.2.3)
- 9. Spent Fuel Cask Drop Accidents (Section 15.7.5) 0.1.4 Condition IV - Limiting Faults dition IV events are faults which are not expected to take place, but are postulated because r consequences would include the potential of the release of significant amounts of radioactive erial. They are the most drastic which must be designed against and represent limiting design
- s. Condition IV faults are not to cause a fission product release to the environment resulting in ndue risk to public health and safety in excess of guideline values of 10 CFR 50.67. A single dition IV fault is not to cause a consequential loss of required functions of systems needed to e with the fault including those of the emergency core cooling system and the containment.
the purposes of this report, the following faults have been classified in this category:
- 1. Steam System Piping Failure (major) (Section 15.1.5)
- 2. Feedwater System Pipe Break (Section 15.2.8)
- 3. Reactor Coolant Pump Shaft Seizure (Locked Rotor) (Section 15.3.3)
- 4. Reactor Coolant Pump Shaft Break (Section 15.3.4)
- 5. Spectrum of Rod Cluster Control Assembly Ejection Accidents (Section 15.4.8)
- 6. Steam Generator Tube Failure (Section 15.6.3)
- 7. Loss-of-Coolant Accidents Resulting from a Spectrum of Postulated Piping Breaks within the Reactor Coolant Pressure Boundary (large break)
(Section 15.6.5)
0.2 OPTIMIZATION OF CONTROL SYSTEMS ontrol system setpoint study (refer to Section 7.7.2) was performed in order to simulate ormance of the reactor control and protection systems. In this study, emphasis was placed on development of a control system which automatically maintains prescribed conditions in the t even under a conservative set of reactivity parameters with respect to both system stability transient performance.
each mode of plant operation, a group of optimum controller setpoints is determined. In areas re the resultant setpoints are different, compromises based on the optimum overall ormance are made and verified. A consistent set of control system parameters is derived sfying plant operational requirements throughout the core life and for various levels of power ration.
study comprised of an analysis of the following control systems: rod cluster control assembly, m dump, steam generator level, pressurizer pressure and pressurizer level.
0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES 0.3.1 Design Plant Conditions le 15.0-1 lists the principal power rating values which are assumed in analyses performed in report.
thermal power values used for each transient analyzed are given in Table 15.0-2.
values of other pertinent plant parameters utilized in the accident analyses are given in le 15.0-3.
part of the transition to Dominion Energy Methods, the DNBR analysis basis was revised g the VIPRE-D thermal-hydraulic code and the CHF correlations identified in Section 4.4. In erence 15.0-17, the NRC approved the use of Dominion Energy Methods for Millstone Unit 3.
RE-D along with the Statistical DNBR Evaluation Methodology (VEP-NE-2-A) has been lied to all Condition I and II statistical DNB events as well as the Loss of Flow accident ction 15.3.4). VIPRE-D has also been used for all deterministic DNB events (e.g., rod hdrawal from subcritical in Section 15.4.1). Statepoints for applicable DNB events were lyzed with VIPRE-D at core power of 3712 MWt for full-power, statistically-treated events.
DNBR calculations were performed using the CHF correlations identified in Section 4.4, as licable. Some DNB events are bounded by other events and were not explicitly analyzed. All B events show acceptable DNB performance for the RFA-2 fuel.
most accidents analyzed to demonstrate that the DNB design is met, statistical methods are loyed in defining the initial conditions (see Section 4.4). The other accidents obtain initial ditions by adding the maximum steady state errors to rated values. The following steady state rs are considered:
- 1. Core power Deterministic safety analyses assume a core power of a least 102% of 3650 MWt, which is equivalent to 100.4% of 3709 MWt. The core rated thermal power was changed from 3650 MWt to 3709 MWt by the measurement uncertainty recapture power uprate. At rated thermal power, the power calorimetric uncertainty with functional ultrasonic flow meters is less than 0.4%.
- 2. Average reactor coolant temperature 4.0F allowance. The calculated uncertainties for Tavg rod control include instrument allowance, rod control deadband, and cold leg streaming. The calculated values are 3.0F random, 1.0 F bias. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty (+0.1°F) as a result of an error in the Hysteresis of Weed Resistance Temperature Detectors.
- 3. Pressurizer pressure 50 psi allowance. The calculated uncertainties for pressurizer pressure control include instrumentation allowance, control system overshoot and transmitter bias. The calculated values are 31.8 psi random, 15 psi bias.
le 15.0-2 summarizes the initial conditions and computer codes used in the accident analyses.
.3.3 Power Distribution transient response of the reactor system is dependent on the initial power distribution. The lear design of the reactor core minimizes adverse power distribution through the placement of trol rods and operating instructions. Power distribution may be characterized by the radial or (FH) and the total peaking factor (Fq). The peaking factor limits are given in the Technical cifications.
transients which may be DNB limited, the radial peaking factor is of importance. The radial king factor increases with decreasing power level due to rod insertion. This increase in FH is
cifications.
axial power shape used in the DNB calculation is the 1.78 chopped cosine as discussed in tion 4.4. The radial and axial power distributions described above are input to the VIPRE-D e as described in Section 4.4.
transients which may be overpower limited, the total peaking factor (Fq) is of importance. All sients that may be overpower limited are assumed to begin with plant conditions including er distributions which are consistent with reactor operation as defined in the Technical cifications.
overpower transients which are slow with respect to the fuel rod thermal time constant, for mple the chemical and volume control system malfunction that results in a decrease in the on concentration in the reactor coolant incident which lasts many minutes, and the excessive ease in secondary steam flow incident which may reach equilibrium without causing a reactor
, the fuel rod thermal evaluations are performed as discussed in Section 4.4. For overpower sients which are fast with respect to the fuel rod thermal time constant, e.g., the uncontrolled cluster control assembly bank withdrawal from subcritical or low power startup and rod ter control assembly ejection incidents which result in a large power rise over a few seconds, tailed fuel heat transfer calculation must be performed. Although the fuel rod thermal time stant is a function of system conditions, fuel burnup and rod power, a typical value at inning-of-life for high power rods is approximately 5 seconds.
0.3.4 Nuclear Fuel Thermal Conductivity Degradation assessment of the impact of using inputs and acceptance criteria derived from the latest fuel ormance models and methods described in Reference 15.0-20 was performed for the lstone Unit 3. The latest fuel performance models and methods include the effects of Thermal ductivity Degradation (TCD) and are used to generate fuel temperature, rod internal pressure P), core stored energy and additional fuel and cladding parameter inputs for LOCA and Non-CA safety analyses. Re-analyses necessary to demonstrate acceptable results have been uded in the FSAR and demonstrate that the applicable acceptance criteria continue to be met h consideration of TCD using the latest fuel performance models and methods.
0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES transient response of the reactor system is dependent on reactivity feedback effects, in icular the moderator temperature coefficient and the Doppler power coefficient. These tivity coefficients and their values are discussed in detail in Chapter 4.
he analysis of certain events, conservatism requires the use of large reactivity coefficient es whereas in the analysis of other events, conservatism requires the use of small reactivity fficient values. Some analyses such as loss of reactor coolant from cracks or ruptures in the tor coolant system do not depend on reactivity feedback effects. The values used are given in
ification for use of conservatively large versus small reactivity coefficient values are treated n event-by-event basis. In some cases, conservative combinations of parameters are used to nd the effects of core life. For example, in a load increase transient, it is conservative to use a ll Doppler defect and a small moderator coefficient.
.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS negative reactivity insertion following a reactor trip is a function of the acceleration of the cluster control assemblies and the variation in rod worth as a function of rod position. With ect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry pproximately 85 percent of the rod cluster travel. The rod cluster control assembly position us time assumed in accident analyses is shown on Figure 15.0-3. The rod cluster control mbly insertion time to dashpot entry is taken as 2.7 seconds, unless otherwise noted in the ussion. The use of such a long insertion time provides the most conservative results for all dents and is intended to be applicable to all types of rod cluster control assemblies which may sed throughout plant life. Drop time testing requirements are specified in the plant Technical cifications.
ure 15.0-4 shows the fraction of total negative reactivity insertion versus normalized rod ition for a core where the axial distribution is skewed to the lower region of the core. An axial ribution which is skewed to the lower region of the core can arise from an unbalanced xenon ribution. This curve is used to compute the negative reactivity insertion versus time following actor trip which is input to all point kinetics core models used in transient analyses. The om skewed power distribution itself is not an input into the point kinetics core model.
re is inherent conservatism in the use of Figure 15.0-4 in that it is based on skewed flux ribution which would exist relatively infrequently. For cases other than those associated with alanced xenon distributions, significant negative reactivity would have been inserted due to more favorable axial distribution existing prior to trip.
normalized rod cluster control assembly negative reactivity insertion versus time is shown on ure 15.0-5. The curve shown on this figure was obtained from Figures 15.0-3 and 15.0-4. A l negative reactivity insertion of 4 percent following a trip is assumed in the transient analyses ept where specifically noted otherwise. This assumption is conservative with respect to the ulated trip reactivity worth available as shown in Table 4.3-3. For Figures 15.0-3 and 15.0-4, rod cluster control assembly drop time is normalized to 2.7 seconds, unless otherwise noted a particular event, in order to provide a bounding analysis for all rod cluster control assemblies e used in the Millstone 3 cores, as previously stated.
.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES actor trip signal acts to open two trip breakers connected in series feeding power to the trol rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms elease the rod cluster control assemblies which then fall by gravity into the core. There are
y to trip is defined as the time delay from the time that trip conditions are reached to the time rods are free and begin to fall. Limiting trip setpoints assumed in accident analyses and the e delay assumed for each trip function are given in Table 15.0-4.
overtemperature and overpower trip functions referred to in Table 15.0-4 are graphically strated in Figure 15.0-1. This figure presents the allowable reactor coolant loops average perature and T for the flow and power distribution, as described in Section 4.4, as a function rimary coolant pressure. The boundaries of operation defined by the overpower T trip and overtemperature T trip are represented as protection lines on this diagram. The protection s are drawn to include all adverse instrumentation and set point errors so that, under nominal ditions, trip would occur well within the area bounded by these lines. The utility of this ram is that the limit imposed by any given DNBR can be represented as a line. The DNB lines esent the locus of conditions for which DNBR equals the limit value. All points below and to left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram ws that DNB is prevented for all cases if the area enclosed with the maximum protection lines ot traversed by the applicable DNBR line at any point.
area of permissible operation (power, pressure, and temperature) is bounded by the bination of reactor trips: high neutron flux (fixed set point); high pressure (fixed set point);
pressure (fixed set point); and overpower and overtemperature T (variable set points).
limit value, which was used as the DNBR limit for all accidents, is conservative compared to actual design DNBR value required to meet the DNB design basis as discussed in Section 4.4.
difference between the limiting trip point assumed for the analysis and the nominal trip point esents an allowance for instrumentation channel error and setpoint error. Nominal trip oints are specified in the plant Technical Specifications. During plant startup tests, it was onstrated that actual instrument time delays are equal to or less than the assumed values.
itionally, protection system channels are calibrated and instrument response times determined odically in accordance with the plant Technical Specifications.
0.7 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS NSSS is designed to afford proper protection against the possible effects of natural nomena, postulated environmental conditions and dynamic effects of the postulated accidents.
ddition, the design incorporates features which minimize the probability and effects of fires explosions. Chapter 17 discusses the quality assurance program which has been implemented ssure that the NSSS satisfactorily performs its assigned safety functions. The incorporation of e features in the NSSS, coupled with the reliability of the design, ensures that the normally rating systems and components listed in Table 15.0-6 are available for mitigation of the events ussed in Chapter 15. In determining which systems are necessary to mitigate the effects of e postulated events, the classification system of ANSI-N18.2-1973 is utilized. The design of
he analysis of the Chapter 15 events, control system action is considered only if that action lts in more severe accident results. No credit is taken for control system operation if that ration mitigates the results of an accident. For some accidents, the analysis is performed both h and without control system operation to determine the worst case.
.8 FISSION PRODUCT INVENTORIES
.8.1 Inventory in the Core fission product inventory in the reactor core is consistent with the requirements of Regulatory de 1.183. The computer code ORIGEN-ARP was used to generate the inventory assuming a power level of 3723 MWt. Core activities are shown in Table 15.0-7.
.8.2 Inventory in the Fuel Clad Gap fission product inventory in the fuel clad gap is based on the release fraction requirements for CA and non-LOCA design basis accidents as described in Tables 2 and 3 of Regulatory Guide 3.
.8.3 Reactor Coolant Activity ctor coolant activity is based upon the uprated power level of 3723 MWt (bounding the MUR er level of 3709 MWt), an 18-month fuel cycle and other conservative assumptions. Iodine vity is based on the Technical Specification limit of 1 Ci/gm DEQ I-131. Noble gas activity ased on the Technical Specification limit of 81.2 Ci/gm DEQ Xe-133. This level of activity esents 0.29% failed fuel. Gross gamma activity, which includes non-iodine isotopes luding noble gases and other fission products), reflects these limits and 0.29% failed fuel.
se activities are listed in Table 15.0-10.
0.9 RESIDUAL DECAY HEAT 0.9.1 Total Residual Heat idual heat in a subcritical core is calculated for the small break loss-of-coolant accident per the uirements of Appendix K of 10 CFR 50.46 (10 CFR 50.46 and Appendix K of 10 CFR 50), as cribed in WCAP-10054, 1985. These requirements include assuming infinite irradiation time ore the core goes subcritical to determine fission product decay energy. For all other accidents, ss noted otherwise, the same models are used except that fission product decay energy is ed on core average exposure at the end of the equilibrium cycle.
ing a loss-of-coolant accident the core is rapidly shut down by void formation or rod cluster trol assembly insertion, or both, and a large fraction of the heat generation to be considered es from fission product decay gamma rays. This heat is not distributed in the same manner as dy state fission power. Local peaking effects which are important for the neutron dependent of the heat generation do not apply to the gamma ray contribution. The steady state factor of percent which represents the fraction of heat generated within the clad and pellet drops to 95 ent for the hot rod in a loss-of-coolant accident.
.9.3 Decay Heat Modeling for a Best Estimate Large Break LOCA Accident decay heat model within Westinghouse WCOBRA/TRAC-TF2 is described in detail in tion 9 of WCAP-16996-P-A, Revision 1. The model has been benchmarked against the ANSI/
S 5.1-1979 Standard. Westinghouse WCOBRA/TRAC-TF2 solves for the composite decay t of the reactor using the fission rate fractions derived from specific physics calculations for fuel lattice design. The decay heat modeling for the LBLOCA methodology has been roved for use in WCAP-16996-P-A, Revision 1.
.10 COMPUTER CODES UTILIZED maries of some of the principal computer codes used in transient analyses are given below.
er codes, in particular very specialized codes in which the modeling has been developed to ulate one given accident, such as those used in the analysis of the reactor coolant system pipe ure (Section 15.6), are summarized in their respective accident analyses sections. The codes d in the analyses of each transient have been listed in Table 15.0-2.
.10.1 FACTRAN FACTRAN computer program calculates the transient temperature distribution in a cross ion of a metal clad, UO2 fuel rod and the transient heat flux at the surface of the clad using as ut the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, density). The code uses a fuel model which exhibits the following features simultaneously:
- 1. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents
- 2. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation
- 3. The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, Zircaloy-water reaction and partial melting of the materials CTRAN is further discussed in WCAP-7908-A.
LOFTRAN program is used for studies of transient response of a PWR system to specified urbations in process parameters. LOFTRAN simulates a multi-loop system by a model taining reactor vessel, hot and cold leg piping, steam generator (tube and shell sides) and the surizer. The pressurizer heaters, spray, relief and safety valves are also considered in the gram. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron and s are included.
secondary side of the steam generator utilizes a homogeneous, saturated mixture for the mal transients and a water level correlation for indication and control. The reactor protection em is simulated to include reactor trips on high neutron flux, overtemperature T, overpower high and low pressure, low flow, and high pressurizer level. Control systems are also ulated including rod control, steam dump, feedwater control and pressurizer pressure control.
emergency core cooling system, including the accumulators, is also modeled.
FTRAN is a versatile program which is suited to both accident evaluation and control studies ell as parameter sizing.
FTRAN is further discussed in WCAP-7907-P-A and WCAP-7907-A.
FTTR2, a derivative of the LOFTRAN program, is used for the steam generator tube rupture lysis. More details on the LOFTTR2 code and its application are provided in Section 15.6.3.
.10.3 Casmo5 mo5 is a multigroup two-dimensional transport theory code for burnup calculations on PWR mblies or simple pin cells. The code handles a geometry consisting of cylindrical fuel rods of ying composition in a square pitch array with allowance for absorber-loaded fuel rods, Integral l Burnable Absorber (IFBA), burnable absorber rods, cluster control rods, in-core instrument nnels, and water gaps. See Section 4.3.3 for more details.
.10.4 Simulate5 ulate5 is a multi-group analytical nodal code for the steady-state analysis of both PWRs and Rs, capable of two dimensional and three dimensional calculations. Simulate5 is employed as reference core physics model for all safety analysis calculations, power distributions, peaking ors, critical boron concentrations, control rod worths and reactivity coefficients. It has the ability of calculating discrete pin powers from the nodal information as well. See Section 4.3.3 more details.
.10.5 TWINKLE TWINKLE program is a multidimensional spatial neutron kinetics code, which was patterned r steady codes presently used for reactor core design. The code uses an implicit finite-erence method to solve the two-group transient neutron diffusion equations in one, two and
cts. The code handles up to 8,000 spatial points, and performs its own steady state alization. Aside from basic cross section data and thermal-hydraulic parameters, the code epts as input basic driving functions such as inlet temperature, pressure, flow, boron centration, control rod motion, and others. Various edits are provided, e.g., channelwise er, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.
TWINKLE Code is used to predict the kinetic behavior of a reactor for transients which se a major perturbation in the spatial neutron flux distribution.
INKLE is further described in WCAP-7979-P-A and WCAP-8028-A.
.10.6 VIPRE VIPRE computer program performs thermal-hydraulic calculations. This code calculates lant density, mass velocity, enthalpy, void fractions, static pressure and DNBR distributions g flow channels within a reactor core.
.10.7 RETRAN TRAN is used for studies of transient response of a PWR system to specified perturbations in cess parameters. This code simulates a multi-loop system by a lumped parameter model taining the reactor vessel, hot-leg and cold-leg piping, RCPs, steam generators (tube and shell s), main steam lines, and the pressurizer. The pressurizer heaters, spray, relief valves, and ty valves can also be modeled. RETRAN includes a point neutron kinetics model and tivity effects of the moderator, fuel, boron, and control rods. The secondary side of the steam erator uses either a detailed nodalization (WCAP-14882-P-A) or a single node VEP-FRD for the thermal transients. The RTS simulated in the code includes reactor trips on high tron flux, high neutron flux rate, OTT, OPT, low reactor coolant flow, low reactor coolant p speed, high-pressurizer and low-pressurizer pressure, high pressurizer level, and low-low m generator water level. Control systems are also simulated including rod control and surizer pressure control. Parts of the safety injection system, including the accumulators, are modeled.
0.11 REFERENCES FOR SECTION 15.0
-1 Belle, J. 1961. Uranium Dioxide Properties and Nuclear Applications. Naval Reactors, Division of Reactor Development United States Atomic Energy Commission.
-2 Booth, A.H. 1957. A Suggested Method for Calculating the Diffusion of Radioactive Rate Gas Fission Products from UO Fuel Elements. DCI-27.
-3 10 CFR 50.46 and Appendix K of 10 CFR 50. Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors. Federal Register, Volume 39, Number 3, 1974.
-5 Meek, M.E. and Rider, B.F. 1968. Summary of Fission Product Yields for U-235, U-238, Pu-239, and Pu-241 at Thermal Fission Spectrum of 14 Mev Neutron Energies.
APED-5398.
-6 Stone & Webster Engineering Corporation Topical Report RP-8A. Radiation Shielding Design and Analysis Approach for Light Water Reactor Power Plants.
-7 Toner, D.F. and Scott, J.S. 1961. Fission - Product Release from UO2. Nuclear Safety 3, No. 2, 15-20
-8 WCAP-3269-26, 1963. Barry, R.F. LEOPARD - A Spectrum Dependent Nonspatial Depletion Code for the IBM-7094.
-9 WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R.F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
-10 WCAP-7908-A, 1989. Hargrove, H.G. FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod.
-11 WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Nonproprietary), 1984, Burnett, T.W.T., et al., LOFTRAN Code Description.
-12 WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.H., Jr. and Barry, R.F. TWINKLE - A Multidimensional Neutron Kinetics Computer Code.
-13 WCAP-10054-P-A (Proprietary) 1985. Lee, N. et al., Westinghouse Small Break ECCS Evaluation Model using NOTRUMP Code.
-14 WCAP-16996-P-A, Revision 1, (Proprietary), 2016, Kobelak, J. R., et al., Realistic LOCA Evaluation Methodology Applied to the Full Spectrum of Break Sizes (FULL SPECTRUM LOCA Methodology).
-15 WCAP-14565-P-A (Proprietary) and WCAP-15306-NP-A (Nonproprietary), 1999.
Sung Y. X. et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
-16 WCAP-14882-P-A (Proprietary) and WCAP-15234-NP-A (Nonproprietary), 1999.
Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
-17 Letter from R. V. Guzman (USNRC) to D. A. Heacock (Dominion), Millstone Power Station, Unit NO. 3 - Issuance of Amendment Adopting Dominion Core Design and
16-317, ADAMS Accession No. ML16131A728.
-18 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
-19 VEP-FRD-41-P-A, Revision 0, Minor Revision 3 (Proprietary) and VEP-FRD-41-A, Revision 0, Minor Revision 3 (Nonproprietary), 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
-20 WCAP-17642-P-A, Revision 1 (Proprietary), 2017, Linsuain, O., et. al., Westinghouse Performance Analysis and Design Model (PAD5).
(MWt) re Thermal Power Output (0 MWt Pump Heat) - Statistical 3709a re Thermal Power Output (0 MWt Pump Heat) - Deterministic 3723b SS Thermal Power Output (16 MWt Pump Heat) (C) - 3725 tistical SS Thermal Power Output (16 MWt Pump Heat) (C) - 3739c terministic
- a. Statistical DNB events are conservatively analyzed at 3712 MWt.
- b. Includes power uncertainty bounding of operation with functional ultrasonic flow meters.
- c. 4 loop nominal pump heat
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
Increase in heat removal 15.1 by the secondary system Feedwater system Results bounded malfunctions that result in by excessive N/A a decrease in feedwater increase in temperature secondary flow Feedwater system 0.50 (Full Power); lower (c) malfunctions that result in RETRAN, Function of moderator (Full Power); see 0 Core and an increase in feedwater VIPRE-D density (Section 15.1.2, Section 15.1.2 and 3,712 Core (DNB flow Figure 15.1-11) for HZP Figure 15.1-14 for HZP Excessive increase in See 3,712 Core N/A See Section 15.1.3 See Section 15.1.3 secondary steam flow Section 15.1.3 (DNB)
Inadvertent opening of a Results bounded steam generator relief or by steam system - N/A safety valve piping failure Function of moderator Refer to Steam system piping RETRAN,
- density (Section 15.1.5, Section 15.1.5, 0 (Subcritical) failure VIPRE-D Figure 15.1-11) Figure 15.1-14
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
Decrease in heat removal 15.2 by the secondary system 3,712 Core (DNB Loss of external electrical RETRAN, (c) 0.0 lower 3,739 NSSS load and/or turbine trip VIPRE-D (pressure cases)
Results bounded Loss of non-emergency by loss of AC power to the station - N/A normal auxiliaries feedwater Loss of normal feedwater RETRAN 0.0 upper (c) 3,739 NSSS flow Most negative Doppler Feedwater system pipe RETRAN -64.5 Temperature 3,739 NSSS break Coefficient
-3.2 pcm/F Decrease in reactor 15.3 coolant system flow rate Partial and complete loss RETRAN, 3,712 Core of forced reactor coolant 0.0 upper (c)
VIPRE-D (DNB) flow
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
Reactor coolant pump shaft seizure (locked RETRAN, 0.0 upper (c) 3,739 NSSS rotor) pressure, VIPRE temperature transient Reactor coolant pump RETRAN, shaft seizure (locked 0.0 upper (c) 3,712 Core (DNB VIPRE-D rotor)--rods in DNB Results bounded Reactor coolant pump by reactor N/A shaft break coolant pump shaft seizure Reactivity and power 15.4 distribution anomalies Uncontrolled rod cluster
-1.9 pcm/°F (least control assembly bank RETRAN, negative) Doppler withdrawal from a 5.0 - 0 (subcritical)
VIPRE-D Temperature subcritical or lower power Coefficient startup condition
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
-0.9 pcm/°F (least 5.0 (part negative) and Uncontrolled rod cluster power), 0.0 RETRAN, -3.2 pcm/°F (most 371.2, 2,227, and control assembly bank (full power, -
VIPRE-D negative) Doppler 3,712 Core (DNB withdrawal at power -64.5 (most Temperature negative)
Coefficients LOFTRAN, Rod cluster control Simulate5, - - - 3,712 Core (DNB assembly misalignment VIPRE-D Chemical and volume RETRAN control system (MODE 1) 3,723 Core malfunction that results in 0.0 N/A -2.05 (pcm)/°F (MODE 1) N/A a decrease in the boron N/A (MODES 2-6) concentration in the (MODES 2-6) reactor coolant Inadvertent loading and operation of a fuel LEOPARD,
- N/A N/A assembly in an improper TURTLE position
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
Coefficient for all Refer to cases is consistent Spectrum of rod cluster TWINKLE, Section 15.4.8 with least negative 0 Core and control assembly ejection -
FACTRAN min., max. doppler defect 3,723 Core accidents feedback values listed in Table 15.4-3 Increase in reactor 15.5 coolant inventory Inadvertent operation of the ECCS during power RETRAN - - 3,739 NSSS operation CVCS malfunction that results in an increase in RETRAN - - - 3,739 (b) NSS the reactor coolant inventory.
Decrease in reactor 15.6 coolant inventory Inadvertent opening of a RETRAN, Figure 15.0-6 most 3,712 Core pressurizer safety or relief 0.0 lower (c)
VIPRE-D negative (DNB) valve Steam generator tube Figure 15.0-6 most LOFTTR2 0.0 upper (c) 3,739 NSSS failure negative
Reactivity Coefficients Assumed Initial Thermal Moderator (b) (d) Power Computer Temperature Moderator Density Output Assume Faults Codes Utilized (pcm/F) (k/gm/cc) Doppler (MWt)
Loss-of-coolant accidents resulting from the WCOBRA/
Refer to spectrum of postulated TRAC-TF2, Section 15.6.5, - 3,723 Core piping breaks within the COCO, References reactor coolant pressure NOTRUMP boundary NOTES:
(a) Appropriate Calorimetric error considered where applicable, refer to Table 15.0-1.
(b) A maximum pump heat of 20 MWt was modeled in the cases with offsite power available.
(c) Refer to Figure 15.0-2.
(d) For transients which utilize RETRAN transient analyses as input to core DNB calculations using the VIPRE-D code, only th core power modeled in the VIPRE-D analysis is provided which represents MUR power uprate conditions. Note the NSSS ther power modeled in the RETRAN analysis may vary from the VIRPRE-D core power and represent pre-MUR power uprate conditions which have been determined to remain valid.
UTILIZED IN THE ACCIDENT ANALYSIS uivalent Steam Generator Tube 0% 10%
gging (all loops)
SS Thermal Power (MWt) Table 15.0-2 P Vessel Average Temperature (F) 589.5 571.5 589.5 571.5 ssurizer Pressure (psia) 2,250 2,250 2,250 2,250 tal Reactor Coolant Flow Thermal Design Flow (gpm) 363,200 363,200 363,200 363,200 Minimum Measure Flow (gpm) 379,200 379,200 379,200 379,200 sumed HFP Feedwater Temperature Maximum (F) 447.9 447.9 447.9 447.9 Minimum (F) 390.0 390.0 390.0 390.0 am Flow from NSSS (106 lb/hr)
At Maximum Feedwater Temperature 16.68 16.58 16.66 16.75 At Minimum Feedwater Temperature 15.41 15.33 15.40 15.32 am Pressure at SG Outlet (psia) 954 808 934 790 ximum Steam Moisture Content (%) 0.25 0.25 0.25 0.25 erage Core Heat Fluxa (Btu/hr-ft2) 211,992 211,992 211,992 211,992 eat flux corresponds to the power level assumed in DNB analysis at 3712 MWt.
ANALYSES Limiting Trip Point Assumed Time Delay Trip Function in Analysis (a) (Seconds) wer range high neutron flux, high setting 116.5% 0.5 wer range high neutron flux, low setting 35% 0.5 wer range high positive neutron flux rate (b) 6.5% 3.0 ertemperature T Variable; see Figure 15.0-1 7.0 (c) erpowerT Variable; see Figure 15.0-1 7.0 (c) gh pressurizer pressure 2410 psig 2.0 w pressurizer pressure 1845 psig 2.0 w reactor coolant flow (from loop flow 85% loop flow 1.0 ectors) actor coolant pump underspeed 92% nominal 0.6 rbine trip Not applicable 1.5 (d) w-Low steam generator water level 0% of narrow range span 2.0 gh-high steam generator level trip of the 100% of narrow range level span 2.5 (e) dwater pumps and closure of feedwater tem valves, and turbine trip 7.0 (f) ssurizer water level high 100% of span 2.0 Tabulated values conservatively bound technical specification values with uncertainties.
Refer to Section 15.6.3 for SGTR trip point assumptions.
Credited in the analysis of Uncontrolled Rod Cluster Control Assembly Bank Withdrawal at Power event (Section 15.4.2)
Total time delay from time the temperature difference in the coolant loop exceeds the trip setpoint until the RCCAs are free to fall. Delay includes the response characteristics of the RTD/thermowell/scoop configuration, electronic delays, trip breaker opening delays, and gripper opening delays.
Direct reactor trip following turbine trip not credited to meet the acceptance criteria.
From time setpoint is reached to turbine trip.
From time setpoint is reached to feedwater isolation.
TABLE 15.0-5 DELETED BY PKG FSC 07-MP3-049 TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT REQUIRED FOR THE MITIGATION OF TRANSIENT AND ACCIDENT CONDITIONS 15.1 Increase in Heat Removal by the Secondary System Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Power range high flux, High-High steam generator reactor trip caused by level-produced feedwater turbine trip on high-high isolation and turbine trip, SI Feedwater system steam generator level, initiated by low steam line Feedwater isolation valves ---
malfunctions manual, overtemperature pressure or low pressurizer T, overpower T, turbine pressure will produce trip feedwater isolation, manual Power range high flux, Pressurizer self-actuated Excessive increase in overtemperature T, N/A safety valves, steam ---
secondary steam flow overpower T, manual, low generator safety valves pressurizer pressure Low pressurizer pressure, low compensated steam line Inadvertent opening of Low pressurizer pressure, pressure, high negative Feedwater isolation valves, Auxiliary feedwat a steam generator relief manual, SIS, power range steam pressure rate, steam steam line iso valves system, ECCS or safety valve high flux trip, overpower T generator low-low water level, manual Low pressurizer pressure, SIS, low pressurizer low compensated steam line pressure, power range high pressure, high negative Steam system piping Feedwater isolation valves, Auxiliary feedwat flux trip, overpower T, steam pressure rate, hi-1 failure steam line iso valves system, ECCS steam generator low-low containment pressure, steam water level, manual generator low-low water level, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen High pressurizer pressure, Loss of external overtemperature T, Pressurizer safety valves, electrical load/turbine overpower T, steam N/A steam generator safety ---
trip generator low-low level, valves manual Loss of non-emergency Steam generator low-low Steam generator low-low Steam generator safety Auxiliary feedwat AC power to the station level, turbine trip, low RCS level, manual, loss of offsite valves system auxiliaries flow, manual power Steam generator low-low Loss of normal level, overtemperature T, Steam generator low-low Steam generator safety Auxiliary feedwat feedwater flow high pressurizer pressure, level, manual valves system manual Hi-1 containment pressure, Steam line isolation valves, Steam generator low-low steam generator low-low feedline isolation, Feedwater system pipe level, high pressurizer water level, low Auxiliary feedwat pressurizer self-actuated break pressure, overtemperature compensated steam line system, ECCS safety valves, steam T, SIS, manual pressure, low pressurizer generator safety valves pressure, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Partial loss of forced Steam generator safety Low flow, manual N/A ---
reactor coolant flow valves Complete loss of forced Low flow, RCP Steam generator safety N/A ---
reactor coolant flow underspeed, manual valves Reactor coolant pump Pressurizer safety valves, shaft seizure (locked Low flow, manual N/A steam generator safety ---
rotor) valves 15.4 Reactivity and Power Distribution Anomalies Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Power range high flux (low Uncontrolled rod cluster and high setpoints), source control assembly bank range high flux, withdrawal from a intermediate range high N/A --- ---
subcritical or low power flux, power range neutron startup condition See flux high positive flux rate, Note 1 manual Power range high flux, Power range high positive neutron flux rate, high Uncontrolled rod cluster Pressurizer safety valves, pressurizer water level control assembly bank N/A steam generator safety ---
overtemperature T, withdrawal at power valves overpower T high pressurizer pressure, manual
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipmen Overtemperature T, Rod cluster control overpower T, low N/A --- ---
assembly misalignment pressurizer pressure, manual Chemical and volume Source range high flux, control system power range high flux (high Low insertion limit malfunction that results and low setpoint), N/A annunciators shutdown ---
in a decrease in boron overtemperature T, margin monitors concentration in the manual reactor coolant Spectrum of rod cluster Power range high flux (high control assembly and low setpoint), high N/A --- ---
ejection accidents positive flux rate, manual 15.5 Increase in Reactor Coolant Inventory Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Pressurizer power operated Inadvertent operation of relief valves, low Manual, safety injection the ECCS during power N/A pressurizer pressure cold ---
trip operation leg injection permissive signal CVCS malfunction that results in an increase in Pressurizer power operated Manual N/A ---
the reactor coolant relief valves inventory
Incident Reactor Trip Function EST Actuation Functions Other Equipment ESF Equipme Inadvertent opening of a Pressurizer low pressure, pressurizer safety or overtemperature T, N/A --- ---
relief valve manual Service water system, component cooling water system, Steam Generator Water Level Control (SGWLC), steam Emergency core Low pressurizer pressure, Low pressurizer pressure, Steam generator tube generator safety and/or cooling system, Overtemperature T, steam generator low-low failure relief valves, main steam auxiliary feedwat manual water level isolation valves, system emergency diesel generator, pressurizer power operated relief valves or pressurizer spray Loss-of-coolant Service water system, accidents resulting from Emergency core component cooling water the spectrum of Low pressurizer pressure, Hi- cooling system, Low pressurizer pressure, system, steam generator postulated piping breaks 1 & Hi-3 containment auxiliary feedwat manual safety and/or relief valves, within the reactor pressure system, containm emergency diesel coolant pressure heat removal syst generator boundary
- 1. Administrative controls have been implemented to preclude an uncontrolled rod/bank withdrawal from a subcritical condition wh plant conditions are not bounded by safety analysis assumptions.
NOTE:
N/A ESF actuation functions are not applicable for these accidents.
Nuclide Curies 139 1.70E+08 140 1.79E+08 141 9.47E+07 84 1.70E+07 141 1.64E+08 143 1.50E+08 144 1.29E+08 242 4.83E+06 244 5.56E+05 134 1.98E+07 136 6.29E+06 137 1.25E+07 138 1.69E+08 31 9.89+07 32 1.45E+08 33 2.03+E08 34 2.13E+08 35 1.89E+08 85 1.05E+06 85m 2.27E+07 87 4.14E+07 88 6.11E+07 140 1.86E+08 141 1.61E+08 142 1.52E+08 99 1.84E+08 95 1.67E+08 147 6.61E+07 239 2.04E+09
Nuclide Curies 143 1.47E+08 238 4.06E+05 239 3.30E+04 240 4.62E+04 241 1.49E+07 86 2.19E+05 88 6.47E+07 89 5.47E+07 105 1.03E+08 103 1.60E+08 105 1.11E+08 106 5.83E+07 127 8.73E+06 128m 1.35E+07 129 3.11E+07 131 5.06E+07 89 9.10E+07 90 9.05E+06 91 1.12E+08 92 1.15E+08 99m 1.64E+08 127 8.60E+06 127m 1.44E+06 129 3.03E+07 129m 6.17E+06 131 7.65E+07 131m 1.97E+07 132 1.42E+08 133 6.29E+07 133m 7.54E+07
Nuclide Curies 134 1.39E+08 133 2.03E+08 135 5.60E+07 135m 3.66E+07 138 8.46E+07 90 9.46E+06 91 1.19E+08 92 1.23E+08 93 9.40E+07 95 1.66E+08 97 1.57E+08
FSAR EAB TEDE (1) LPZ TEDE (1) Control Room Postulated Accident Section (rem) (rem) TEDE (rem)
SLB 15.1.5 Concurrent Iodine Spike 4.0E-01 2.2E-01 3.6E+00 Pre-accident Iodine Spike 9.6E-02 4.4E-02 1.6E+00 cked Rotor Accident 15.3.3 2.4E+00 4.4E-01 3.9E+00 d Ejection Accident 15.4.8 Containment 5.1E-01 2.5E-01 1.5E+00 Secondary Side 1.2E-01 1.6E-02 5.1E-02 all Line Break outside (2) 15.6.2 2.5E+00 (3) ntainment TR 15.6.3 Concurrent Iodine Spike 1.0E+00 2.0E-01 1.7E+00 Pre-accident Iodine Spike 2.2E+00 2.0E-01 3.3E+00 CA 15.6.5 5.4E+00 1.1E+00 3.4E+00 A 15.7.4 Spent Fuel Assembly 2.7E+00 1.5E-01 4.8E+00 Insert Component (4) (4) 4.3E+00 ent Fuel Cask Drop 15.7.5 (3) (3) (3) dioactive Liquid Waste 5.7E-04 (WB) (2) (3) stem Leak of Failure 11.2.3 tmospheric Release) 4.4E-01 (THY) 2.2E-01 (WB) (2) (3) seous Waste System Failure 11.3.3 0.0E+00 (THY)
TES:
(1) - except as noted (2) - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of release or less; a thirty day dose is not applicable (3) - not applicable, see listed FSAR section for details (4) - Bounded by the consequences of the FHA - Spent Fuel Assembly
TABLE 15.0-9 DELETED CONCENTRATIONS RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Kr 85m 3.20E-01 Kr 87 2.48E-01 Kr 88 6.50E-01 Xe 131m 5.66E-02 Xe 133m 2.24E-01 Xe 133 7.42E+00 Xe 135m 2.7E-01 Xe 135 1.61E+00 Xe 138 1.91E-01 Br 83 2.06E-02 Br 84 1.02E-02 4.69E-07 Cs 134 6.76E+00 7.44E-03 Cs 134m 1.38E-02 Cs 136 1.03E+00 1.11E-03 Cs 137 4.73E+00 5.34E-03 Cs 138 2.94E-01 8.67E-06 Rb 86 4.26E-02 4.60E-05 Rb 88 6.78E-01 2.00E-05 Rb 89 4.23E-02 1.68E-06 Ba 137m 4.45E+00 1.31E-04 Ba 139 2.28E-02 6.74E-06 Ba 140 1.10E-03 6.59E-07 Ce 144 1.30E-04 7.84E-08 Co 58 1.70E-02 1.06E-05 Co 60 2.10E-03 1.31E-06 Fe 55 1.70E-03 1.05E-06 Fe 59 1.10E-03 6.62E-07 La 140 3.69E-04 1.98E-07 La 142 7.13E-05 Mn 54 3.30E-04 2.02E-07 Mo 99 1.54E+00 8.83E-04
RCS, 1 Ci/gm DEQ I-131 Secondary Side Liquid, 0.1 Ci/gm and Gross Gamma RCS DEQ I-131 and Gross Gamma Nuclides Concentration, Ci/gm Concentration, Ci/gm Mo 101 6.15E-03 2.44E-07 Nb 95 1.69E-04 9.99E-08 Np 239 1.98E-02 1.10E-05 Ru 106 5.90E-05 3.66E-08 Sr 89 8.83E-04 5.41E-07 Sr 90 5.74E-05 3.53E-08 Sr 91 3.81E-04 1.47E-07 Sr 92 2.76E-04 Tc 99m 7.99E-01 2.36E-04 Tc 101 5.99E-03 2.37E-07 Te 127m 9.08E-04 5.65E-07 Te 129 3.95E-03 Te 129m 3.87E-03 2.39E-06 Te 131 3.69E-03 Te 131m 9.77E-03 5.02E-06 Te 132 8.11E-02 4.64E-05 Te 133 2.51E-03 9.94E-08 Te 133m 5.58E-03 4.19E-07 Te 134 8.52E-03 6.04E-07 Y 91 4.18E-03 2.54E-06 Y 91m 2.27E-04 Zr 95 1.67E-04 1.03E-07 I 131 7.81E-01 8.04E-02 I 132 3.20E-01 1.44E-02 I 133 1.19E+00 1.09E-01 I 134 1.81E-01 4.19E-03 I 135 7.00E-01 5.00E-02
TABLE 15.0-11 ATMOSPHERIC DISPERSION DATA USED FOR DESIGN BASIS ACCIDENT ANALYSIS B X/Qs (sec m-3) (1)
Ground-level release-containment 5.42 x 10-4 Ground-level release-ventilation vent 4.30 x 10-4 Elevated release Millstone Stack 1.00 x 10-4 X/Qs (sec m-3) und-level release (applies to ventilation vent and containment) 0-8 hr 2.91 x 10-5 8-24 hr 1.99 x 10-5 1-4 days 8.66 x 10-6 4-30 days 2.63 x 10-6 vated release Millstone stack 0-4 hr 2.69 x 10-5 4-8 hr 1.07 x 10-5 8-24 hr 6.72 x 10-6 1-4 days 2.46 x 10-6 4-30 days 5.83 x 10-7
Millstone 3 lstone Unit 3 Control room X/Qs (sec m-3) (see Note (2))
- a. Ground-level release-containment 0-2 hr 5.34 x 10-4 2-8 hr 3.23 x 10-4 8-24 hr 1.38 x 10-4 1-4 days 8.78 x 10-5 Millstone 3
- b. Elevated release Millstone stack (3) 0-4 hr 1.39 x 10-4 4-8 hr 3.23 x 10-5 8-24 hr 1.56 x 10-5 1-4 days 3.20 x 10-6 4-30 days 3.30 x 10-7
- c. Ground-level release-ventilation vent 0-2 hr 2.82 x 10-3 2-8 hr 1.65 x 10-3 8-24 hr 6.67 x 10-4 1-4 days 4.83 x 10-4 4-30 days 3.80 x 10-4
- d. Unit 3 MSVB (includes MSPRVs and MSSVs) 0-2 hr 1.46 x 10-3 2-8 hr 8.76 x 10-4 8-24 hr 3.42 x 10-4 1-4 days 2.71 x 10-4 4-30 days 1.96 x 10-4
- e. Unit 3 ESFB 0-2 hr 3.18 x 10-4 2-8 hr 2.26 x 10-4 8-24 hr 9.06 x 10-5 1-4 days 6.42 x 10-5 4-30 days 4.59 x 10-5
- f. Unit 3 RWST 0-2 hr 2.61 x 10-4 2-8 hr 1.59 x 10-4 Millstone 3 8-24 hr 6.45 x 10-5 1-4 days 4.83 x 10-5 4-30 days 3.63 x 10-5
- g. Unit 3 Turbine Building 0-2 hr 5.40 x 10-3 2-8 hr 3.51 x 10-3 8-24 hr 1.38 x 10-3 1-4 days 1.01 x 10-3 4-30 days 8.49 x 10-4 TES:
- 1. 0-2 hr EAB X/Qs are applied for the worst two hour EAB dose determination.
- 2. Control room X/Qs do not include occupancy factor.
- 3. Fumigation conditions assumed for 0-4 hour period.
PRE-ACCIDENT IODINE SPIKE Isotope Concentration (Ci/gram) (1)
I 131 46.8 I 132 19.2 I 133 71.2 I 134 10.9 I 135 42.0 TES:
- 1. Based on 60 Ci/gram I-131 dose equivalent.
CONCURRENT IODINE SPIKE Isotope Release Rate (Ci/sec) (1)
I 131 3.03 I 132 3.93 I 133 5.61 I 134 4.73 I 135 4.72 TE:
Equivalent to 500 times equilibrium iodine appearance rate based upon Technical Specification conditions (i.e., 1 Ci/gram I-131 dose equivalent). SGTR analysis values are listed in Table 15.6.3-6 and are 335 times equilibrium iodine appearance rates.
PROTECTION FIGURE 15.0-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
TIME Deleted by FSARCR PKG FSC 07-MP3-049 BREVIATIONS USED:
WS - AUXILIARY FEEDWATER SYSTEM WS - COMPONENT COOLING WATER SYSTEM CONTAINMENT ISOLATION
- COLD LEG
- CONTAINMENT SPRAY CS - CHEMICAL AND VOLUME CONTROL SYSTEM CS - EMERGENCY CORE COOLING SYSTEM AS - ENGINEERED SAFETY FEATURES ACTUATION SYSTEM
- HOT LEG
- HIGH PRESSURE INJECTION
- LOW PRESSURE INJECTION
- REACTOR COOLANT SYSTEM REACTOR TRIP
- RECTOR TRIP SYSTEM
- STEAM GENERATOR SAFETY INJECTION
- SAFETY INJECTION SYSTEM S - SERVICE WATER SYSTEM TES:
For Trip Initiation and Safety System Actuation, multiple signals are shown but only a single signal is required. The other signals are backups.
No timing sequence is implied by position of various branches. Refer to Event Timing Sequences presented in tabular form in pertinent Accident Analysis section of Chapter 15 of the FSAR.
GRAM SYMBOLS:
- Event Title
- Branch Point for Different Plant Conditions
- Safety System
- Safety Action SF - System Required to Meet Single-Failure Criteria P - Manual Action Required During System Operation
MALFUNCTION
INADVERTENT ECCS OPERATION AT POWER FULL POWER LOW PRESSURIZER PRESSURE 2/4 RTS MANUAL SIS
- S F S F REACTOR TRIP TURBINE BREAKERS TRIP S F CONTROL RODS GRAVITY INSERTION S F CONTROL ROD REACTIVITY CONTROL
- NOT CREDITED IN THE SAFETY ANALYSIS
MPS-3 FSAR DOUBLE ENDED RUPTURE OF ONE STEAM GENERATOR TUBE MANUAL 2/4 LOW PRESSURIZER PRESSURE ESFAS 2/4 LOW PRESSURIZER (SI SIGNAL)
RTS MANUAL PRESSURE OPERATOR (CIA)
SI SIGNAL SF OT'T STEAM GENERATOR MAIN DIESEL ECCS CONTAINMENT RELIEF AND SAFETY REACTOR TRIP FEEDWATER GENERATOR INJECTION ISOLATION BREAKERS VALVES FLOW ISOLATION SWP SF SF (P)
CONTROL ROD AFWS SI TERMINATION RELIEF OF GRAVITY CONTAINMENT SECONDARY INSERTION LEAKAGE SIDE SF CONTROL PRESSURE PASSIVE (P) OPERATOR (P)**
CONTROL OF OPERATION OF AFW ON 50 RESIDUAL HEAT LEVEL REMOVAL SYSTEM FOOTOTES: 1. SEQUENCE OF EVENTS SHOWN IS FOR A CONDITION CONTROL SG LEVEL (P)
- OF NO OFFSITE POWER BEING AVAILABLE ROD INDICATION IDENTIFICATION OF COINCIDENCE WITH S.G. TUBE RUPTURE.
REACTIVITY RUPTURED STEAM CONTROL GENERATOR CORE COOLING 2. SEE TABLE 2.5-1 FOR INDICATORS AND RECORDERS AVAIL ABLE TO THE OPERATOR FOLLOWING EVENT.
MAIN STEAM 3. OPERATOR ACTIONS INCLUDES OPERATION OF SG ISOLATION VALVE ATMOSPHERIC BYPASS VALVES TO DUMP STEAM (RUPTURED STEAM AND REDUCE RC'S SUBCOOLING, PRESSURIZER (P) GENERATOR) RELIEF VALVE TO REDUCE RC'S PRESSURE AND SI TERMINAL TO STOP PRIMARY-TO-SECONDARY BREAK FLOW.
SG ATMOSPHERIC DUMP BYPASS VALVES (INTACT SG'S)
(P)
- ADDITIONAL IDENTIFICATION BY MAIN STEAMLINE RADIATION MONITORS OR SAMPLING S.G. SHELL SIDE FLUID REQUIRED PRESSURIZER IF NOT IDENTIFIED BY S.G. LEVEL INDICATION RELIEF VALVE (P)
- OPERATOR INITIATES OPERATION OF RESIDUAL HEAT REMOVAL SYSTEM AT APPROPRIATE REACTOR COOLANT SYSTEMS CONDITIONS ISOLATION OF RUPTURED STEAM GENERATOR
CVCS LETDOWN LINE RUPTURE REACTOR COOLANT ACTIVITY RELEASE TO SAFEGUARDS BLDG ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE SAFEGUARDS BLDG DUCT RADIATION MONITOR OPERATOR P CLOSES LETDOWN ISOLATION VALVE AFTER RECEIPT OF THE ALARM WITHIN 30 MINUTES
GWPS GAS DECAY TANK RUPTURE RELEASE TO BUILDING ATMOSPHERE UNFILTERED RELEASE TO ATMOSPHERE VENTILATION VENT RADIATION MONITOR OPERATOR P
TERMINATES PROCESS GAS INFLUENT ISOLATON TIME 2 HRS
FLOOR DRAIN TANK FAILURE (30,000 GAL)
RELEASE TO RELEASE TO GROUND BUILDING ATMOSPHERE UNFILTERED RELEASE ENTERS
- TO GROUNDWATER ATMOSPHERE
- SEE SECTION 2.4.13
FUEL HANDLING ACCIDENT IN FUEL BUILDING GASES RELEASED FROM FUEL POOL WATER SF FILTERED BY PRIMARY PLANT VENTILATION SYSTEM IODINE ADSORBER TO ATMOSPHERE RADIOLOGICAL CONTROL
FUEL HANDLING ACCIDENT INSIDE CONTAINMENT ACTIVITY RELEASED FROM REFUELING CAVITY FILTERED BY CONTAINMENT AIR CLEANUP UNITS TO ATMOSPHERE RADIOLOGICAL CONTROL
SPENT FUEL CASK DROP (FROM HT 30 FT)
NO RELEASE:
NO CASK DAMAGE
umber of events have been postulated which could result in an increase in heat removal from reactor coolant system (RCS) by the secondary system. Detailed analyses are presented for eral such events which have been identified as limiting cases.
cussions of the following RCS cooldown events are presented in this section.
- 3. Excessive increase in secondary steam flow.
- 4. Inadvertent opening of a steam generator relief or safety valve.
- 5. Steam system piping failure.
above are considered to be American Nuclear Society (ANS) Condition II events, with the eption of steam system piping failures, which are considered to be ANS Condition III (minor)
Condition IV (major) events. Section 15.0.1 contains a discussion of ANS classifications and licable acceptance criteria.
.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE
.1.1 Identification of Causes and Accident Description uctions in feedwater temperature cause an increase in core power by decreasing reactor lant temperature. Such transients are attenuated by the thermal capacity of the secondary plant of the RCS. The overpower/overtemperature protection (neutron overpower, overtemperature overpower T trips) prevents any power increase which could lead to a departure from leate boiling ratio (DNBR) less than the limit.
duction in feedwater temperature may be caused by the accidental opening of a feedwater ass valve which diverts flow around a portion of the feedwater heaters and trip of the heater n pumps as well as loss of extraction steam to the high pressure feedwater heater. For this nt, there is a sudden reduction in feedwater inlet temperature to the steam generators. At er, this increased subcooling creates a greater load demand on the RCS.
h the plant at no-load conditions the addition of cold feedwater may cause a decrease in RCS perature and thus a reactivity insertion due to the effects of the negative moderator coefficient eactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, he no-load transient is less severe than the full power case.
l corresponding to the new steam generator T.
ecrease in normal feedwater temperature is classified as an ANS Condition II event, fault of derate frequency. See Section 15.0.1 for a discussion of Condition II events.
protection available to mitigate the consequences of a decrease in feedwater temperature is same as that for an excessive steam flow increase, as discussed in Section 15.0.7 and listed in le 15.0-6.
.1.2 Analysis of Effects and Consequences hod of Analysis s transient is analyzed by computing conditions at the feedwater pump inlet following opening he heater bypass valve. These feedwater conditions are then used to recalculate a heat balance ugh the high pressure heaters. This heat balance gives the new feedwater conditions at the m generator inlet.
following assumptions are made.
- 1. Plant initial power level corresponding to guaranteed nuclear steam supply system (NSSS) thermal output.
- 2. Low pressure heater bypass valve opens, resulting in condensate flow splitting between the bypass line and the low pressure heaters.
- 3. Heater drain pumps trip; this increases the effect of the cold bypass flow.
- 4. Loss of extraction steam to the high pressure feedwater heater.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
ults ning of a low pressure heater bypass valve and trip of the heater drain pumps as well as loss of action steam to high pressure feedwater heater causes a reduction in feedwater temperature ch increases the thermal load on the primary system. The calculated maximum reduction in water temperature is less than 65F, resulting in an increase in heat load on the primary em of less than 10 percent of full power. The increased thermal load, due to opening of the pressure heater bypass valve and trip of the heater drain pumps as well as loss of extraction m to the high pressure feedwater heater, would result in a transient very similar (but of uced magnitude) to that presented in Section 15.1.3 for an excessive increase in secondary m flow, which evaluates the consequences of a 10 percent step load increase. Therefore, the sient results of this analysis are not presented.
decrease in feedwater temperature transient is less severe than the increase in secondary m flow event (Section 15.1.3). Based on results presented in Section 15.1.3, the applicable eptance criteria for the decrease in feedwater temperature event have been met.
.1.4 Radiological Consequences ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW
.2.1 Identification of Causes and Accident Description ition of excessive feedwater causes an increase in core power by decreasing reactor coolant perature. Such transients are attenuated by the thermal capacity of the secondary plant and of RCS. The overtemperature T trip, the overpower T trip, and the power range high neutron trip prevent any power increase which could lead to a DNBR less than the limit.
example of excessive feedwater flow would be a full opening of a feedwater control valve due feedwater control system malfunction or an operator error. At power, this excess flow causes eater load demand on the RCS due to increased subcooling in the steam generator. With the t at no-load conditions, the addition of an excess of feedwater may cause a decrease in RCS perature and thus a reactivity insertion due to the effects of the negative moderator coefficient eactivity.
tinuous addition of excessive feedwater is prevented by the steam generator high-high level
, which closes the feedwater valves. Feedwater isolation may also occur as a result of a safety ction signal initiated by low steam line pressure or low pressurizer pressure.
increase in normal feedwater flow is classified as an ANS Condition II event, fault of derate frequency. See Section 15.0.1 for a discussion of ANS Condition II events.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6.
1.2.2 Analysis of Effects and Consequences hod of Analysis excessive heat removal due to a feedwater system malfunction transient is analyzed by using detailed digital computer RETRAN code (WCAP-14882-P-A). This code simulates a tiloop system, neutron kinetics, the pressurizer, pressurizer relief and safety valves, surizer spray, steam generator, and steam generator safety valves. The code computes
ditions at the time of minimum DNBR. The results met the applicable limit as specified in tion 4.4.
system is analyzed to demonstrate plant behavior in the event that excessive feedwater ition, due to a control system malfunction or operator error which allows a feedwater control e to open fully, occurs. Six cases are analyzed as follows:
- 1. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor just critical at zero load conditions. For these two cases, a negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position is assumed. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
- 2. Malfunction of a feedwater control valve to a single loop and multiple loops with the reactor in automatic control at full power with automatic and manual rod control.
feedwater system malfunction event is analyzed with the following assumptions.
- 1. For the single loop feedwater control valve accident at full power, one feedwater control valve is assumed to malfunction, resulting in a step increase to 234 percent of nominal feedwater flow to one steam generator.
- 2. For the multiple loop feedwater control malfunction at full power, a malfunction is assumed such that there is a step increase to 234 percent of nominal feedwater flow to all four steam generators.
- 3. For the feedwater control valve accident at zero load condition, a feedwater control valve malfunction occurs which results in an increase in flow to one steam generator to 250 percent of the nominal full load value for one steam generator.
- 4. For the multiple loop feedwater control malfunction at zero load condition, a malfunction is assumed such that there is a step increase to 250 percent of nominal feedwater flow to all four steam generators.
- 5. For the zero load condition, feedwater temperature is at a conservatively low value of 87F.
- 6. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.
isolation valves, trips the main feedwater pumps, and trips the turbine. Feedwater isolation may also occur as a result of a safety injection signal initiated by low steam line pressure or low pressurizer pressure.
ial operating conditions are assumed at values consistent with steady state operation.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
mal reactor control systems are not required to function. The reactor protection system may ction to trip the reactor due to overpower or turbine trip on high-high steam generator water l conditions. No single active failure will prevent operation of the reactor protection system.
iscussion of anticipated transients without trip (ATWT) considerations is presented in AP-8330 (1974).
ults he case of an accidental full opening of one feedwater control valve with the reactor at zero er and the above mentioned assumptions, DNB is precluded, thus assuring adequate heat sfer between the fuel clad and the reactor coolant. The hot zero power cases have been rmined to be non-limiting with respect to both DNB and peak fuel centerline temperature.
limiting full power case (multiple loop, maximum reactivity feedback coefficients, manual control) gives the largest reactivity feedback and results in the greatest power increase.
uming the reactor to be in the automatic rod control mode results in a slightly less severe sient. The rod control system is not required to function for an excessive feedwater flow nt.
nsient results (Figures 15.1-1 and 15.1-2) show the core heat flux, pressurizer pressure, Tavg DNBR, as well as the increase in nuclear power associated with the increased thermal load on reactor. The DNBR does not drop below the safety analysis limit.
ce the power level rises during the excessive feedwater flow incident, the fuel temperatures rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response to the fuel rod thermal time constant, hence the peak value does not exceed 116.5 percent of ominal value (i.e., the assumed high neutron flux trip set point). The peak fuel temperature thus remain well below the fuel melting temperature.
transient results show that DNB does not occur at any time during the excessive feedwater incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not uced. The fuel cladding temperature therefore does not rise significantly above its initial value ng the transient.
calculated sequence of events for this accident is shown in Table 15.1-1.
results of the analysis show that the DNBRs encountered for excessive feedwater addition nts are at all times above the limiting values. Therefore, the DNBR design basis as described ection 4.4 is met.
1.2.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW
.3.1 Identification of Causes and Accident Description excessive increase in secondary system steam flow (excessive load increase incident) is ned as a rapid increase in steam flow that causes a power mismatch between the reactor core er and the steam generator load demand. The reactor control system is designed to ommodate a 10 percent step load increase or a 5 percent per minute ramp load increase in the ge of 15 to 100 percent of full power. Any loading rate in excess of these values may cause a tor trip actuated by the reactor protection system. Steam flow increases greater than 10 ent are analyzed in Sections 15.1.4 and 15.1.5.
s accident could result from either an administrative violation such as excessive loading by the rator or an equipment malfunction in the steam dump control or turbine speed control.
ing power operation, steam dump to the condenser is controlled by reactor coolant condition als, i.e., high reactor coolant temperature indicates a need for steam dump. A single controller function does not cause steam dump; an interlock is provided which blocks the opening of the es unless a large turbine load decrease or a reactor trip has occurred.
tection against an excessive load increase accident is provided by the following reactor ection system signals:
- 1. overpower T
- 2. overtemperature T
- 3. power range high neutron flux
- 4. low pressurizer pressure.
excessive load increase incident is considered to be an ANS Condition II event, a fault of derate frequency. See Section 15.0.1 for a discussion of Condition II events.
hod of Analysis en the non-limiting nature of this event with respect to the DNBR safety analysis criterion, an licit analysis was not performed. Instead, an evaluation of this event was performed. The luation model consists of the generation of state points based on generic conservative data.
state points are in the form of changes in temperature, pressure, power and flow that are lied to the plants initial conditions. These conditions are then compared to the core thermal ts to ensure that DNBR limit is not violated. The core thermal limits are based on a VIPRE-D lysis, using the safety limits in Section 4.4. State points for the following cases were luated:
- 1. Reactor control in manual with minimum moderator reactivity feedback.
- 2. Reactor control in manual with maximum moderator reactivity feedback.
- 3. Reactor control in automatic with minimum moderator reactivity feedback.
- 4. Reactor control in automatic with maximum moderator reactivity feedback.
cases which assume automatic rod control are analyzed to ensure that the worst case is ented. The automatic function is not required.
.3.3 Results and Conclusions as been demonstrated that for a 10 percent step load increase, the DNBR remains above the ty analysis limit; the design basis for DNBR as described in Section 4.4 is met. The plant hes a stabilized condition rapidly following the load increase.
.3.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE CAUSING A DEPRESSURIZATION OF THE MAIN STEAM SYSTEM
.4.1 Identification of Causes and Accident Description most severe core conditions resulting from an accidental depressurization of the main steam em are associated with an inadvertent opening, with failure to close, of the largest of any le steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main m line are given in Section 15.1.5.
S causes a reduction of coolant temperature and pressure. In the presence of a negative derator temperature coefficient (or positive moderator density coefficient), the cooldown lts in an insertion of positive reactivity.
analysis is performed to demonstrate that the following criterion is satisfied:
uming a stuck rod cluster control assembly, with offsite power available, and assuming a le failure in the engineered safety features system there will be no consequential damage to core or reactor coolant system after reactor trip for a steam release equivalent to the spurious ning, with failure to close, of the largest of any single steam dump, relief, or safety valve.
idental depressurization of the secondary system is classified as an ANS Condition II event.
Section 15.0.1 for a discussion of Condition II events.
following systems provide the necessary protection against an accidental depressurization of main steam system due to the opening of a steam generator relief or safety valve.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three low steam line pressure signals in a steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown. Therefore, in addition to the normal control action which closes the main feedwater valves following reactor trip, a safety injection signal rapidly closes all feedwater control valves and back up feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast-acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- b. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
.4.2 Analysis of Effects and Consequences hod of Analysis consequences of an inadvertent opening of a steam generator relief or safety valve are nded by the zero power steam system piping failure discussed in Section 15.1.5. The opening steam generator relief or safety valve causes a less severe steam generator blowdown and sequent RCS cooldown than the steam system piping failure event. This would result in a er peak power level if a return to power were to occur as predicted for the zero power steam em piping failure. The minimum DNBR for the zero power steam system piping failure, ch remains above the safety analysis limit, would be lower than that for the opening of a steam erator relief or safety valve.
ults and Conclusions ce the minimum DNBR for the zero power steam system piping failure (Section 15.1.5) ains above the safety analysis limit, there would be no fuel failure predicted for an inadvertent ning of a steam generator relief or safety valve.
steam generator atmospheric dump bypass valves are Safety Class 2 (QA Category I) motor rated valves and are manually controlled only with no automatic control circuitry. As such, function of these valves would not be postulated. However, even if an inadvertent opening of of these valves were to be assumed, the event will be bounded by the events described in tion 15.1.5 where it is demonstrated that no DNB occurs and no system design limits are eeded. Thus, the conclusions provided in Section 15.1.4.3 also apply to these valves.
1.4.3 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological release calculation was performed.
.5 STEAM SYSTEM PIPING FAILURE
.5.1 Identification of Causes and Accident Description steam release arising from a rupture of a main steam line would result in an initial increase in m flow which decreases during the accident as the steam pressure falls. The energy removal m the RCS causes a reduction of coolant temperature and pressure. In the presence of a ative moderator temperature coefficient (or positive moderator density coefficient), the ldown results in an insertion of positive reactivity. If the most reactive rod cluster control mbly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an eased possibility that the core could become critical and return to power. A return to power
analysis of a main steam line rupture is performed to demonstrate that the following criterion atisfied.
uming the most limiting single failure of a stuck RCCA with or without offsite power, and ming the most limiting single failure in the engineered safety features, the core remains in e and intact. Radiation doses do not exceed the guidelines of 10 CFR 50.67.
hough DNB and possible clad perforation following a steam pipe rupture are not necessarily cceptable, the following analysis shows that the DNB design basis is met for any rupture ming the most reactive RCCA stuck in its fully withdrawn position. The DNB design basis is ussed in Section 4.4.
ajor steam line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a ussion of Condition IV events.
cts of minor secondary system pipe breaks are bounded by the analysis presented in this ion. Minor secondary system pipe breaks are classified as Condition III events, as described in tion 15.0.1.3.
major rupture of a steam line is the most limiting cooldown transient and is analyzed at zero er with no decay heat. Decay heat would retard the cooldown, thereby reducing the return to er. A detailed analysis of this transient with the most limiting break size, a double ended ure, is presented here.
following functions provide the protection for a steam line rupture.
- 1. Safety injection system actuation from any of the following:
- a. two out of four low pressurizer pressure signals;
- b. two out of three hi-1 containment pressure signals;
- c. two out of three low steam line pressure signals in one steam line, coincident with a low RCS pressure condition (Permissive P-19).
- 2. The overpower (neutron flux and T) and low pressurizer pressure reactor trips, and the reactor trip occurring in conjunction with receipt of the safety injection signal
- 3. Isolation of the main feedwater lines, via closure of the redundant main feedwater isolation valves
safety injection signal rapidly closes all feedwater control valves and backup feedwater isolation valves, and trips the main feedwater pumps.
- 4. Trip of the fast acting main steam isolation valves (designed to close in less than 10 seconds) on:
- a. 2 out of 3 hi-2 containment pressure signals;
- b. two out of three low steam line pressure signals in any steam line (above Permissive P-11);
- c. high negative steam pressure rate indication from two out of three signals in any steam line (below Permissive P-11).
t-acting isolation valves (main steam isolation valves) are provided in each steam line; these es are assumed to close within 12 seconds of the generation of the steam line isolation signal owing a large break in the steam line. For breaks downstream of the isolation valves, closure ll valves would completely terminate the blowdown. For breaks upstream of the isolation es, one steam generator is assumed to blow down. A description of steam line isolation is uded in Chapter 10.
m flow is measured by monitoring dynamic head in nozzles located in the throat of the steam erator. The effective throat area of the nozzles is 1.388 square feet, which is considerably less the main steam pipe area; thus, the nozzles also serve to limit the maximum steam flow for a k at any location.
le 15.1-2 lists the equipment required in the recovery from a high energy line rupture. Not all ipment is required for any one particular break, since the requirements vary depending upon tulated break locations and details of balance of plant design and pipe rupture criteria as ussed elsewhere in this application. Design criteria and methods of protection of safety related ipment form the dynamic effects of postulated piping ruptures are provided in Section 3.6.
1.5.2 Analysis of Effects and Consequences hod of Analysis analysis of the steam pipe rupture has been performed to determine:
- 1. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steam line break. The RETRAN code (VEP-FRD-41-P-A) has been used.
- 2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE-D (DOM-NAF-2-P-
analysis has been performed with four reactor coolant loops in operation.
following conditions were assumed to exist at the time of a main steam line break accident.
- 1. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during core burnup is restricted in such a way that addition of positive reactivity in a steam line break accident will not lead to a more adverse condition than the case analyzed.
- 2. A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. The variation of the coefficient with temperature and pressure has been included. Figure 15.1-11 provides the typical response of changes in moderator temperature (at constant pressure) on core reactivity. Figure 15.1-14 shows the typical response of power generation in the core on overall reactivity.
The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. To verify the conservatism of this method, the reactivity as well as the power distribution was checked at limiting statepoints for the cases analyzed. The statepoints were selected on the basis of core parameters at specific points in the transient analysis that resulted in minimum DNBR. This core analysis considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the effect of void formation was also included. It was determined that the reactivity used in the RETRAN kinetics analysis was greater than the reactivity value calculated by the core physics code for all statepoints. This verifies conservatism of the method; i.e.,
underprediction of negative reactivity feedback from power generation in the RETRAN simulation.
- 3. Minimum capability for injection of high concentration boric acid solution corresponding to the most restrictive single failure in the safety injection system.
The most restrictive single failure corresponds to the flow delivered by one intermediate head safety injection pump delivering its full flow to the cold leg header.
injection signal (SIS). The SIS begins the appropriate delays for instrumentation, logic, signal transport, pump startup and emergency diesel generator startup if applicable. The pumps will not discharge to the reactor coolant cold leg until a low RCS pressure condition exists (Permissive-19) to open the last isolation valve to the cold leg. The delivery of safety injection flow is not determined by P-19 in the analysis.
The Technical Specification minimum RWST boric acid concentration is assumed for the safety injection flow. No credit has been taken for the borated water which must be swept from the lines downstream of the RWST prior to the delivery of safety injection flow to the reactor coolant loops. Due to this modeling, boron does not reach the core before steam generator dryout.
The accumulators are also modeled in the steam line break accident analysis and are assumed to contain the minimum Technical Specification boric acid concentration. The system pressure does not drop low enough to actuate the accumulators in the analysis.
- 4. Since the steam generators are provided with integral flow restrictors at the main steam nozzles with a 1.388 square foot throat area, any rupture in a steam line with a break area greater than 1.388 square feet, regardless of location, would have the same effect on the NSSS as the 1.388 square foot break. The analysis of the steam pipe rupture models a 1.4 square foot steam generator outlet nozzle. The following cases have been considered in determining the core power and RCS transients.
- a. Complete severance of a pipe, with the plant initially at no-load conditions, full reactor coolant flow with offsite power available.
- b. Case (a) with loss of offsite power simultaneous with the steam line break.
Loss of offsite power results in reactor coolant pump coastdown.
- 5. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life.
The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steam line break. This void, in conjunction with the large negative moderator coefficient, partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.
The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.
reactor is tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at no-load, the average coolant temperature is higher than at no-load and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of RCS temperature and shutdown margin assumed in the analysis are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as cooldown and reactivity insertions proceed in the analysis which assumes no-load conditions at time zero.
- 6. In computing the steam flow during a steam line break, the Moody Curve (Moody 1965) for fL/D = 0 is used.
ults calculated sequence of events for both cases analyzed is shown in Table 15.1-1. The results ented are a conservative indication of the events which would occur assuming a steam line ure since it is postulated that all of the conditions described above occur simultaneously.
e Power and Reactor Coolant System Transient ures 15.1-15 through 15.1-17 show the RCS transient and core heat flux following a main m line rupture (complete severance of a pipe) at initial no-load conditions (case a). Offsite er is assumed available so that full reactor coolant flow exists. The transient shows an ontrolled steam release from only one steam generator.
uld the core be critical at or near zero power when the rupture occurs, the initiation of safety ction by low steam line pressure trips the reactor. Sustained steam release from more than one m generator is prevented by automatic trip of the fast acting isolation valves in the steam lines igh containment pressure signals or by low steam line pressure signals. Specifically, the ase is limited to approximately 13 seconds for the other steam generators while the one erator blows down. The main steam isolation valves are designed to be fully closed in less 10 seconds from receipt of a closure signal.
shown on Figure 15.1-15, the core attains criticality with the RCCAs inserted (with the design tdown assuming one stuck RCCA) before the faulted steam generator dries out. As a result of steam generator dry out, the RCS temperatures rise (and stabilize) resulting in a reduction in reactivity of the core in the presence of a negative moderator temperature coefficient (or itive moderator density coefficient) and effectively turning around the transient. A peak core er less than the nominal full power value is attained.
calculation modeled a minimum boric acid concentration in the accumulators and RWST.
wever, the accumulators do not actuate and the liquid volume from the RWST to cold leg
variation of mass flow rate in the RCS due to water density changes is included in the ulation as is the variation of flow rate in the safety injection system due to changes in the RCS sure. The safety injection system flow calculation includes the line losses in the system as l as the pump head curve.
ed on the results of a generic study (WCAP-9227), the case with loss of offsite power (case b) ss severe than that described above. The loss of the main coolant pumps reduce the flow in the tor coolant system. The loss of forced circulation makes the transient less severe than the case h forced circulation. This is due to: 1) the core and steam generator are more decoupled, hence time to go critical is much longer, 2) without forced coolant, the rate of heat transfer is reduced he steam generator, thereby reducing the core cooldown rate, and 3) local density feedback cts minimize the power level following the assumed steam break. All of these effects result in case with forced coolant flow being much more severe than the case without offsite power for potential of clad damage. Results from the case b RETRAN analysis align with the WCAP-7 observations.
ould be noted that following a steam line break, only one steam generator blows down pletely. Thus, the remaining steam generators in operation are still available for dissipation of ay heat after the initial transient is over. In the case of loss of offsite power, this heat is oved to the atmosphere via the steam line safety valves, and power-operated relief valves.
gin to Critical Heat Flux NB analysis was performed for the limiting case with offsite power available and the non-ting case that models a loss of offsite power. It was found that the DNB design basis, as stated ection 4.4, was met for both cases.
1.5.3 Conclusions analysis has shown that the criteria stated earlier in Section 15.1.5.1 are satisfied.
hough DNB and possible clad perforation following a steam pipe rupture are not necessarily cceptable and not precluded by the criteria, the above analysis shows that no DNB occurs for rupture assuming the most reactive RCCA stuck in its fully withdrawn position. The ological consequences of this limiting event are within the acceptable criteria of CFR 50.67.
.5.4 Radiological Consequences main steam line break is postulated to occur in a main steam line outside the containment.
plant is assumed to have operated with Technical Specification fuel defects. A 1 gpm primary econdary leakage is assumed to occur such that 0.35 gpm leakage takes place in the affected m generator and 0.65 gpm leakage takes place evenly in the other steam generators.
vity associated with the damaged fuel rods is uniformly mixed with the primary coolant and is efore available for release to the atmosphere via primary to secondary leakage.
iodine partition factor is assumed to be 1.0 for the steam release from the affected steam erator. An iodine partition factor of 0.01 is used for the releases from the unaffected steam erators. Offsite power is also assumed to be lost, thus making the condensers unavailable for m dump. The steam released from all steam generators is assumed to be released directly to environment at ground level.
o cases are analyzed and reported for four loop plant operating conditions. The first case mes a concurrent iodine spike condition. The second case includes a pre-accident iodine spike dition when the steam line break occurs.
radiological consequences of a main steam line break (both cases) are reported in Table 15.0-he assumptions used to perform this evaluation are summarized in Table 15.1-3 and le 15.6-12. The use of these assumptions together with the atmospheric dispersion values d in Table 15.0-11, are used to compute the doses to the Control Room, EAB and LPZ as orted in Table 15.0-8.
evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The ological consequences of the main steam line break are within the TEDE limits defined by CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and for the concurrent spike
1.6 REFERENCES
FOR SECTION 15.1
-1 Moody, F. S. 1965. Transactions of the ASME, Journal of Heat Transfer. Figure 3, page 134.
-2 WCAP-14882-P-A, 1999. RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
-3 Letter from A.C. Thadani (NRC) to W.J. Johnson (Westinghouse), January 31, 1989, Acceptance for Referencing of Licensing Topical Report, WCAP-9226-P/9227-NP, Reactor Core Response to Excessive Secondary Steam Releases.
-4 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
-5 WCAP-9227, 1978, Reactor Core Response to Excessive Secondary Steam Release.
-6 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec) edwater system Main feedwater control valve fails fully open 0.0 lfunctions that result in an High-high steam generator water level signal 28.0 rease in feedwater flow generated (100% NRS)
Turbine trip occurs due to high-high steam 30.4 generator level Reactor trip occurs 32.4 Minimum DNBR occurs 32.5 Feedwater isolation valves close automatically 34.9 am system piping failure:
Complete severance of a Steam line ruptures 0.1 e, no-load conditions, full Feedwater isolation complete 9.7 ctor coolant flow with site power available Steam line isolation complete 12.9 ase a) Pressurizer empties (1) 14.2 Criticality attained 36.2 Safety Injection flow initiation (2) 36.6 Peak heat flux/minimum DNBR reached 112.3 Faulted steam generator dries out 292 Complete severance of a Steam line ruptures 0.1 e, no-load conditions, Reactor coolant pumps trip 0.2 ctor coolant pump stdown due to a loss of Feedwater isolation complete 9.7 site power (Case b) Steam line isolation complete 12.9 Pressurizer empties (1) 16.4 Criticality attained 41.1 Safety Injection flow initiation (2) 49.6 Peak heat flux/minimum DNBR reached 171.1 Cooldown terminates/core begins to heat 290 TES:
Defined by the end of the rapid draindown.
Boron does not reach the core before event termination.
Short-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Reactor trip and safeguards actuation Auxiliary feedwater system Steam generator atmospheric relief valves (can be manual channels including sensors circuitry, and including pumps, water supply, operated locally).
processing equipment (the protection and system valves and piping Control for defeating automatic safety injection actuation circuits used to trip the reactor on low (this system must be available during a cooldown and depressurization.
reactor coolant pump shaft speed, and to supply water to operable turbine trip may be excluded). steam generators no later than 10 minutes after the incident).
Safety injection system including the Capability for obtaining a Residual heat removal system including pumps, heat pumps, the refueling water storage tank, reactor coolant system sample. exchanger, and systems valves and piping necessary to co and the systems valves and piping. and maintain the reactor coolant system in a cold shutdow condition.
Diesel generators and emergency power distribution equipment.
Reactor plant component cooling water service water system.
Quench spray system containment recirculation system.
Auxiliary feedwater system including pumps, water supplies, piping and valves.
Main feedwater control valves (trip closed feature).
Bypass feedwater control valves (trip closed feature).
Primary and secondary safety valves.
Short-term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Circuits and/or equipment required to trip the main feedwater pumps.
Main feedwater isolation valves (trip closed feature).
Main steam line stop valves (trip closed feature).
Steam generator blowdown isolation valves (automatic closure feature).
Batteries (Class IE).
Control room ventilation.
Control room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.
Post-accident monitoring system.*
NOTE:
- See Section 7.5 for a discussion of the post-accident monitoring system.
Analysis Input Parameters Reactor thermal power level plus uncertainty (MWt) 3,723 Primary coolant concentrations Table 15.0-10 Primary to secondary leak rate (gpm) 1.0 Secondary coolant concentrations Table 15.0-10 Iodine partition factor in affected steam generator 1.0 throughout accident Iodine partition factors in unaffected steam generators 0.01 throughout accident Duration of release (hours) 36.25 (intact S/Gs) 65.75 (affected S/G)
Initial steam and water release from affected steam 165,000 generator over the first 16.5 seconds of the accident (lb)
Long-term (65.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />) steam release from the affected 11,511 steam generator (lb)
Steam release from unaffected steam generators (lbm/min)
- a. 0-2 hours 3.58E+03
- b. 2-11hours 2.37E+3
- c. 11-24 hours 2.37E+3
- d. 24-36.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> 2.73E+2 Offsite power Lost Initial steam generator contents (lb/SG) 165,000 Iodine spike factor Pre-accident iodine concentrations shown in Table 15.0-12. Concurrent iodine appearance rates in Table 15.0-13.
Atmospheric Dispersion Factors (1) See Table 15.0-11.
TE:
EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
TABLE 15.1-4 DELETED BY FSARCR PKG FSC 04-MP3-017
FIGURE 15.1-1 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
Deleted by FSARCR PKG FSC 02-MP3-017
This figure shows the typical effect of a change in moderator temperature (at constant pressure) on core reactivity; however, the figure should not be relied upon for an absolute value of the moderator feedback.
FIGURE 15.1-12 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
FIGURE 15.1-13 A DELETED BY FSARCR PKG FSC 02-MP3-017 Deleted by FSARCR PKG FSC 02-MP3-017
This figure shows the typical effect of power generation in the core on overall reactivity; however, the figure should not be relied upon for an absolute value of the Doppler power feedback.
umber of transients and accidents have been postulated which could result in a reduction of capacity of the secondary system to remove heat generated in the reactor coolant system S). Detailed analyses are presented in this section for several such events which have been tified as more limiting than the others.
cussions of the following RCS coolant heatup events are presented in Section 15.2.
- 1. Steam pressure regulator malfunction or failure that results in decreasing steam flow.
- 2. Loss of external electrical load.
- 3. Turbine trip.
- 4. Inadvertent closure of main steam isolation valves.
- 5. Loss of condenser vacuum and other events resulting in turbine trip.
- 6. Loss of nonemergency AC power to the station auxiliaries.
- 7. Loss of normal feedwater flow.
- 8. Feedwater system pipe break.
above items are considered to be American Nuclear Society (ANS) Condition II events, with exception of a feedwater system pipe break, which is considered to be an ANS Condition IV nt. Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance eria.
.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW re are no steam pressure regulators in Millstone 3 whose failure or malfunction could cause a m flow transient.
.2 LOSS OF EXTERNAL ELECTRICAL LOAD
.2.1 Identification of Causes and Accident Description ajor load loss on the plant can result from loss of external electrical load due to some trical system disturbance. Offsite alternating current (AC) power remains available to operate t components such as the reactor coolant pumps; as a result, the onsite emergency diesel erators are not required to function for this event. Following the loss of generator load, an ediate fast closure of the turbine control valves occurs. This causes a sudden reduction in
perature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS sure rise.
a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal ld be generated. The plant would be expected to trip from the reactor protection system if a ty limit were approached. A continued steam load of approximately 5 percent would exist r total loss of external electrical load because of the steam demand of plant auxiliaries.
he event that a safety limit is approached, protection would be provided by the high pressurizer sure, overtemperature T and steam generator low-low level trips. Following a complete loss oad, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an rfrequency of less than 6 Hz. Any increased frequency to the reactor coolant pump motors lts in slightly increased flow rate and subsequent additional margin to safety limits. For tulated loss of load and subsequent turbine generator overspeed, turbine trip and the opening he generator breaker terminate the overfrequency condition seen by other safety-related pump ors, reactor protection system equipment, or other safeguards loads. Safeguards loads are plied from offsite power or, alternatively, from emergency diesel generators. Reactor ection system equipment is supplied from the 120 V AC instrument power supply system, ch in turn is supplied from the inverters; the inverters are supplied from a Class IE 125 V ct current (DC) bus energized from batteries or by a rectified Class IE AC voltage from guards buses.
he event the steam dump valves fail to open following a large loss of load, the steam generator ty valves may lift and the reactor may be tripped by the high pressurizer pressure signal, or the rtemperature T signal. In the event of feedwater flow also being lost, the reactor may be ped by a steam generator low-low level signal. The steam generator shell side pressure and tor coolant temperatures increase rapidly. However, the pressurizer safety valves and steam erator safety valves are sized to protect the RCS and steam generator against overpressure for oad losses without assuming the operation of the steam dump system, pressurizer spray, surizer power-operated relief valves, automatic rod cluster control assembly control or direct tor trip on turbine trip.
steam generator safety valve capacity is sized sufficiently to remove the steam flow from the m generator without exceeding 110 percent of the steam system design pressure. The surizer safety valve capacity is sized based on a complete loss of heat sink with the plant ally operating at the maximum calculated turbine load along with operation of the steam erator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to ntain the RCS pressure within 110 percent of the RCS design pressure.
ore complete discussion of overpressure protection can be found in WCAP-7769.
ss of external load is classified as an ANS Condition II event, fault of moderate frequency.
Section 15.0.1 for a discussion of Condition II events.
ented for the loss of external load.
primary side transient is caused by a decrease in heat transfer capability from primary to ondary due to a rapid termination of steam flow to the turbine, accompanied by an automatic uction of feedwater flow (should feed flow not be reduced, a larger heat sink would be ilable and the transient would be less severe). Termination of steam flow to the turbine owing a loss of external load occurs due to automatic fast closure of the turbine control valves ot less than 0.3 seconds. Following a turbine trip event, termination of a steam flow occurs via ine stop valve closure, which occurs in not less than 0.1 seconds. Therefore, the transient in ary pressure, temperature, and water volume is less severe for the loss of external load than the turbine trip due to a slightly slower loss of heat transfer capability.
protection available to mitigate the consequences of a loss of external load is the same as that a turbine trip, as listed in Table 15.0-6.
2.2.2 Analysis of Effects and Consequences er to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this uping of events. The results of the turbine trip event analysis are more severe than those ected for the loss of external load, as discussed in Section 15.2.2.1.
mal reactor control systems and engineered safety systems are not required to function during ss of external load.
reactor protection system may be required to function following a complete loss of external to terminate core heat input and prevent departure from nucleate boiling (DNB). Depending he magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves be required to open to maintain system pressures below allowable limits. No single active ure will prevent operation of any system required to function. See WCAP 8330 for a ussion of anticipated transients without trip (ATWT) considerations.
.2.3 Conclusions ed on results obtained for the turbine trip event (Section 15.2.3) and considerations described ection 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.
.2.4 Radiological Consequences ce no fuel damage is postulated for this transient, a specific radiological calculation was not ormed.
.3.1 Identification of Causes and Accident Description a turbine trip event, the reactor would be tripped directly (unless below the Power Range tron Flux Reactor Trip System interlock P-9) from a signal derived from the turbine stop rgency trip fluid pressure and turbine stop valves. The turbine stop valves close rapidly (with inimum delay time of 0.1 seconds) on loss of trip fluid pressure actuated by a turbine trip al. Turbine trip initiation signals include:
generator trip low condenser vacuum loss of lubricating oil turbine thrust bearing failure turbine overspeed moisture separator water level high manual trip n initiation of stop valve closure, steam flow to the turbine stops abruptly. Sensors on the stop es detect the turbine trip and cause reactor trip if core power is above the Power Range tron Flux Reactor Trip System interlock P-9. Steam dump would be initiated following a tor trip. The loss of steam flow results in an almost immediate rise in secondary system perature and pressure with a resultant primary system transient as described in tion 15.2.2.1 for the loss of external load event. A slightly more severe transient occurs for the ine trip event due to the more rapid loss of steam flow caused by the more rapid valve closure.
automatic steam dump system would normally accommodate the excess steam generation.
ctor coolant temperatures and pressure do not significantly increase if the steam dump system pressurizer pressure control system are functioning properly. If the turbine condenser was not ilable, the excess steam generation would be dumped to the atmosphere and main feedwater would be lost, causing steam generator water level to fall. For this situation feedwater flow ld be maintained by the auxiliary feedwater system to ensure adequate residual and decay t removal capability. Should the steam dump system fail to operate, the steam generator safety es may lift to provide pressure control. See Section 15.2.2.1 for a further discussion of the sient.
rbine trip is classified as an ANS Condition II event, fault of moderate frequency. See tion 15.0.1 for a discussion of Condition II events.
analysis are presented in Section 15.2.3.2.
plant systems and equipment available to mitigate the consequences of a turbine trip are ussed in Section 15.0.7 and listed in Table 15.0-6.
2.3.2 Analysis of Effects and Consequences hod of Analysis his analysis, the behavior of the unit is evaluated for a complete loss of steam load from 100 ent of full load power without direct reactor trip primarily to show the adequacy of the sure relieving devices and also to demonstrate core protection margins; that is, the turbine is med to trip without actuating all the sensors for reactor trip on the turbine stop valves. The mption delays reactor trip until conditions in the RCS result in a trip due to other signals.
s, the analysis assumes a worst transient. In addition, no credit is taken for steam dump. Main water flow is terminated at the same time of turbine trip, with no credit taken for auxiliary water to mitigate the consequences of the transient.
turbine trip transients are analyzed by employing the detailed digital computer program TRAN (WCAP-14882-P-A). The program simulates the neutron kinetics, RCS, pressurizer, surizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety es. The program computes pertinent plant variables including temperatures, pressures, and er level.
ial operating conditions are assumed at values consistent with steady state four loop operation.
nt characteristics and initial conditions are discussed in Section 15.0.3, and any deviations m Section 15.0.3 are noted below.
or assumptions are summarized as follows:
- 1. Initial operating conditions The initial reactor power and RCS pressure and temperatures are assumed at their nominal values consistent with steady state full-power operation. Uncertainties, including allowances for calibration and instrument errors in initial conditions, are included in the DNBR limit as discussed in Section 15.0.3.2. Cases with four loops in operation are considered.
- 2. Moderator and Doppler coefficients of reactivity The turbine trip is analyzed for minimum reactivity feedback. This involves modeling the most positive value for the moderator temperature coefficient, along with least negative Doppler power coefficients (Figure 15.0-2).
From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.
- 4. Steam release No credit is taken for the operation of the steam dump system or steam generator atmospheric relief valves. The steam generator pressure rises to the safety valve set point where steam release through safety valves limits secondary steam pressure to less than 110 percent of the steam system design temperature.
- 5. Pressurizer spray and power operated relief valves
- a. Full credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the DNB and main steam system overpressurization cases. Safety valves are also available.
- b. No credit is taken for the effect of pressurizer spray and power operated relief valves in reducing or limiting the coolant pressure for the RCS overpressurization case. Safety valves are operable.
- 6. Feedwater flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition is reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on low-low steam generator water level. The auxiliary feedwater flow would remove core decay heat following plant stabilization.
- 7. Reactor trip is actuated by the first reactor protection system trip set point reached with no credit taken for the direct reactor trip on the turbine trip. Trip signals are expected due to high pressurizer pressure, overtemperature T, and low-low steam generator water level.
nt characteristics and initial conditions are further discussed in Section 15.0.3.
ept as discussed above, normal reactor control system and engineered safety systems are not uired to function.
reactor protection system may be required to function following a turbine trip. Pressurizer ty valves and/or steam generator safety valves may be required to open to maintain system
ults transient responses for a turbine trip from 100 percent of full power operation are shown for e cases: RCS overpressurization DNBR, and main steam system overpressurization (Figures 2-1 through 15.2-6). The calculated sequence of events for the accident is shown in le 15.2-1.
ures 15.2-1 and 15.2-2 show the turbine trip transient responses for the RCS rpressurization case modeling minimum reactivity feedback and assuming no credit for surizer sprays or power operated relief valves (PORVs). No credit is taken for the steam
- p. The reactor is tripped by the high pressurizer pressure trip signal. The pressurizer safety es lift and maintain primary system pressure below 110 percent of the design value. The m generator safety valves limit the secondary steam conditions to saturation at the safety e set point.
ures 15.2-3 and 15.2-4 show the turbine trip transient responses for the DNBR case modeling imum reactivity feedback and pressurizer sprays and PORVs. The reactor is tripped by the h pressurizer pressure trip signal. The DNBR decreases slightly below its initial value during very beginning of the transient. Pressurizer relief and safety valves and spray prevent primary em overpressurization; steam generator safety valves prevent overpressurization in the ondary side.
ures 15.2-5 and 15.2-6 show the turbine trip transient responses for the MSS rpressurization case modeling minimum reactivity feedback and pressurizer pressure control, ys and PORVs. No credit is taken for the steam dump. The reactor is tripped by the high surizer pressure trip signal. The pressurizer PORVs, safety valves and sprays lift to maintain mary system pressure and the steam generator safety valves actuate to maintain secondary side sure below 110% of the design value.
AP-7769 presents additional results of analysis for a complete loss of heat sink (i.e., turbine
) including loss of main feedwater. This analysis shows the overpressure protection that is rded by the pressurizer and steam generator safety valves.
2.3.3 Conclusions ults of the analysis, including those in WCAP-7769 show that the plant design is such that a ine trip without a direct or immediate reactor trip presents no hazard to the integrity of the S or the main steam system. Pressure relieving devices incorporated in the two systems are quate to limit the maximum pressures to within the design limits.
integrity of the core is maintained by operation of the reactor protection system, i.e., the BR will be maintained above the safety analysis limit. DNB statepoint analysis was performed h VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of
ity of the nuclear steam supply system to safely withstand a full load rejection.
2.3.4 Radiological Consequences ce no fuel damage is postulated for this transient a specific radiological calculation was not ormed.
2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES dvertent closure of the main steam isolation valves would result in a turbine trip. Turbine trips discussed in Section 15.2.3.
.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP s of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating nts are described in Section 15.2.3. A loss of condenser vacuum would preclude the use of m dump to the condenser; however, since steam dump is assumed not to be available in the ine trip analysis, no additional adverse effects would result if the turbine trip were caused by of condenser vacuum. Therefore, the analysis results and conclusions contained in tion 15.2.3 apply to loss of condenser vacuum. In addition, analyses for the other possible ses of a turbine trip, as listed in Section 15.2.3.1, are covered by Section 15.2.3. Possible rfrequency effects due to a turbine overspeed, as discussed in Section 15.2.2.1, are not a cern for this type of event.
.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES
.6.1 Identification of Causes and Accident Description omplete loss of nonemergency AC power may result in the loss of all power to the station iliaries; i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be sed by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, y a loss of the onsite AC distribution system.
s transient is different than the turbine trip event analyzed in Section 15.2.3 because for this the decrease in heat removal by the secondary is accompanied by a flow coastdown which her reduces the capacity of the primary coolant to remove heat from the core. The reactor s:
- 1. due to turbine trip;
- 2. upon reaching one of the trip set points in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal; or
owing a loss of AC power with turbine and reactor trips, the sequence described below urs.
- 1. Plant vital instruments are supplied from emergency DC power sources.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves may be automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
- 3. As the no-load temperature is approached, the steam generator atmospheric relief valves (or the self actuated safety valves, if the power operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.
- 4. The emergency diesel generators, started on loss of voltage on the plant emergency buses, begin to supply plant vital loads.
auxiliary feedwater system is started automatically as follows.
o motor-driven auxiliary feedwater pumps are started on any of the following:
- 1. two of four low-low water level signals in any one steam generator;
- 2. safety injection signal;
- 3. loss of offsite power;
- 4. manual actuation; or
- 5. AMSAC actuation signal.
turbine driven auxiliary feedwater pump is started on any of the following:
- 1. two of four low-low water level signals in any two of four steam generators;
- 2. manual actuation; or
- 3. AMSAC actuation signal.
er to Section 10.4.9 for a description of the auxiliary feedwater system.
hin 60 and 90 seconds, respectively, even if a loss of all AC power occurs simultaneously with of normal feedwater. The turbine exhausts the secondary steam to the atmosphere. The iliary pumps take suction from the demineralized water storage tank (DWST) for delivery to steam generators.
n the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and removal of residual heat is maintained by natural circulation in the reactor coolant loops. A of nonemergency AC power to the station auxiliaries is classified as an ANS Condition II nt, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.
h respect to maximum calculated primary and secondary side pressure, the loss of AC event, escribed above, is bounded by the turbine trip initiated decrease in secondary heat removal hout loss of AC power, which was analyzed in Section 15.2.3. The DNB transient for this nt is bounded by the complete loss of flow transient analyzed in Section 15.3.2. A loss of AC er to the station auxiliaries as postulated above could also result in a loss of normal feedwater e condensate pumps lose power to operate. A loss of normal feedwater is the most limiting dition II event in the decrease in secondary heat removal category, with respect to long-term t removal and is analyzed with loss of AC power in Section 15.2.7. Therefore, detailed lytical results for a loss of AC power transient are not presented here. The results of the lysis in Section 15.2.7 address the loss of feedwater aspect of the loss of AC power event.
owing the reactor coolant pump coastdown caused by the loss of AC power, the natural ulation capability of the RCS removes residual and decay heat from the core, aided by iliary feedwater in the secondary system. The analyses is presented in Section 15.2.7 show the natural circulation flow in the RCS following a loss of AC power event is sufficient to ove residual heat from the core.
plant systems and equipment available to mitigate the consequences of a loss of AC power nt are discussed in Section 15.0.7 and listed in Table 15.0-6.
.6.2 Analysis of Effects and Consequences hod of Analysis stated above, the DNB consequences of this event are bounded by the complete loss of flow nt. With respect to overpressurization of the primary and secondary sides, this event is nded by the turbine trip analysis described in Section 15.2.3. The loss of feedwater aspects are ered by the analyses presented in Section 15.2.7 (specifically those cases that assume loss of ite power). Based on this, transient analysis results of this event are not presented in this ion. However, in support of the flow coastdown test performed at initial plant startup, analyses ilar to those discussed in Section 15.2.7 have been performed for this plant to determine the ilibrium natural circulation flow rate as a function of the residual reactor power expected er these conditions. To do this, steady state cases were run at a number of power levels sistent with the decay heat generation rates expected. Equilibrium conditions were established
data presented in Table 15.2-2 is not used as input in any FSAR Chapter 15 analysis for lstone Unit 3. However, the acceptability of the natural circulation model for use in Millstone t 3 transient analyses was confirmed at initial startup by showing that the actual natural ulation flow rate, determined from the startup tests, met or exceeded these values. In the licable transient analyses, the natural circulation flow rate is calculated by the RETRAN puter code based on transient conditions.
ults results of the loss of nonemergency AC power are not produced here because this event is nded by other events. The transient response of the RCS following a loss of AC power is less ere than for the loss of normal feedwater with a loss of offsite power event analyzed in tion 15.2.7. The results show that the natural circulation flow available is sufficient to provide quate core decay heat removal following reactor trip and reactor coolant pump coastdown.
first few seconds of the loss of AC power transient closely resembles a simulation of the plete loss of flow incident, i.e., core damage due to rapidly increasing core temperatures is vented by promptly tripping the reactor. This aspect of the loss of AC power event is bounded he complete loss of flow event analyzed in Section 15.3.2 that demonstrates that the DNB gn basis is met. With respect to overpressurization of the primary and secondary sides, this nt is bounded by the turbine event (Section 15.2.3). After the reactor trip, stored and residual ay heat must be removed to prevent damage to either the RCS or the core.
natural circulation flow as a function of residual reactor power is presented in Table 15.2-2.
2.6.3 Conclusions lysis of the natural circulation capability of the RCS has demonstrated that sufficient heat oval capability exists following reactor coolant pump coastdown to prevent fuel or clad age.
loss of AC power transient is less severe than the loss of normal feedwater with a loss of ite power event as analyzed in Section 15.2.7. It is also less severe than the turbine trip event lyzed in Section 15.2.3, which demonstrates that primary and secondary side pressures remain w 110% of design value. Finally, this event is less severe than the complete loss of flow event lyzed in Section 15.3.2, which demonstrates that the DNBR acceptance limit is met.
.6.4 Radiological Consequences ce no fuel damage is postulated to occur for this transient, a specific radiological calculation not performed.
.7.1 Identification of Causes and Accident Description ss of normal feedwater (from pump failures, valve malfunctions, or loss of offsite AC power) lts in a reduction in capability of the secondary system to remove the heat generated in the tor core. If an alternative supply of feedwater were not supplied to the plant, core residual t following reactor trip would heat the primary system water to the point where water relief m the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the t is tripped well before the steam generator heat transfer capability is reduced, the primary em variables never approach a DNB condition.
o cases are presented for a loss of normal feedwater event with four loops operating initially.
first is the case where offsite AC power is maintained, and the second is the case where ite AC power is lost which results in reactor coolant pump coastdown as described in tion 15.2.6.
case with offsite AC power available is limiting because of the additional heat from the tor coolant pumps which must be removed by the auxiliary feedwater system.
following events occur upon loss of normal feedwater.
- 1. Plant vital instruments are supplied from emergency DC power sources for the cases with a loss of offsite power.
- 2. As the steam system pressure rises following the trip, the steam generator atmospheric relief valves are automatically opened to the atmosphere. Steam dump to the condenser is assumed not to be available. If the steam flow rate through the power-operated relief valves is not available, the steam generator self actuated safety valves may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.
following provide the necessary protection against a loss of normal feedwater.
- 1. Reactor trip on low-low water level in any steam generator.
- 2. High pressurizer pressure.
- 3. Reactor trip on over temperature T.
Auxiliary Feedwater System is started automatically as discussed in Section 15.2.6.1.
ll analysis of the system transient is presented below to show that following a loss of normal water, the auxiliary feedwater system is capable of removing the stored and residual heat, preventing either overpressurization of the RCS or loss of water from the reactor core, and rning the plant to a safe condition.
.7.2 Analysis of Effects and Consequences hod of Analysis etailed analysis using the RETRAN Code (WCAP-14882-P-A) is performed in order to ain the plant transient following a loss of normal feedwater. The simulation describes the plant mal kinetics, RCS including the natural circulation, pressurizer, steam generators and water system. The digital program computes pertinent variables including the steam erator level, pressurizer water level, and reactor coolant average temperature.
umptions made in the analysis are as follows:
- 1. The plant is initially operating at the NSSS-rated thermal full power including the power uncertainty (see discussion in Section 15.0.3).
- 2. The core residual heat generation is based on the 1979 version of ANS 5.1 (ANSI/
ANS-5.1-1979) assuming long-term operation at the initial power level.
- 3. For the case with a loss of offsite power, a heat transfer coefficient in the steam generator associated with RCS natural circulation is used.
- 4. Reactor trip occurs on steam generator low-low water level.
- 5. The worst single failure in the auxiliary feedwater system occurs; i.e., failure of the turbine-driven auxiliary feedwater pump.
- 6. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow, via both motor-driven AFW pumps, to all four steam generators. The cases analyzed model AFW flow as a function of steam generator pressure. A 60-second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and the motor-driven auxiliary feedwater pumps.
- 7. Secondary system steam relief is achieved through the self- actuated safety valves.
Note that steam relief is, in fact through the power-operated relief valves or condenser dump valves for most cases of loss of normal feedwater. However, for the sake of analysis these have been assumed unavailable.
- 8. The pressurizer heaters and sprays are assumed to be available as their operation maximizes the pressurizer insurge and minimizes the margin to a water-solid condition in the pressurizer.
temperatures (Tavg), and because the pressurizer level program varies over the range, several analyses were performed to establish the most limiting initial Tavg to model in each of the two cases (i.e., with and without offsite power). For the case with offsite power available, a Tavg of 587F minus 4F for uncertainty was limiting. For the case without offsite power, a Tavg of 571.5F minus 4F for uncertainty was limiting. An evaluation confirmed that the limiting analyses described herein remain bounding after accounting for the slight increase in the reactor vessel average temperature uncertainty as a result of an error in the hysteresis of Weed resistance temperature detectors.
- 10. Reactivity parameters were assumed to represent a zero moderator temperature coefficient.
- 11. The initial pressurizer pressure is 50 psi higher than nominal.
loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor ection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing g term decay heat and preventing excessive heatup of the RCS with possible resultant RCS rpressurization or loss of RCS water.
such, the assumptions used in this analysis are designed to minimize the energy removal ability of the system and to maximize the possibility of water relief from the coolant system by imizing the coolant system expansion, as noted in the assumptions listed above.
such assumption is the loss of external (offsite) AC power. This assumption results in coolant decay down to natural circulation conditions and a corresponding reduction in the steam erator heat transfer coefficient. Following a loss of offsite AC power, the first few seconds of a of normal feedwater transient are virtually identical to the transient response (including BR and neutron flux versus time) presented in Section 15.3.2 for the complete loss of forced tor coolant flow.
C power is maintained for this incident the reactor coolant flow remains at its normal value the reactor would trip via the low-low steam generator level trip with no change in DNBR w the value at the start of the transient. The auxiliary feedwater system has sufficient acity, even assuming the worst single failure, to preclude filling the pressurizer.
nt characteristics and initial conditions are further discussed in Section 15.0.3. Plant systems equipment which are available to mitigate the effects of a loss of normal feedwater accident discussed in Section 15.0.7 and listed in Table 15.0-6. Normal reactor control systems are not uired to function during this transient. The reactor protection system is required to function owing a loss of normal feedwater as analyzed here. The auxiliary feedwater system is required eliver a minimum auxiliary feedwater flow rate. No single active failure will prevent ration of any system required to function. A discussion of ATWT considerations is presented CAP 8330.
ures 15.2-9 through 15.2-12 show the significant plant parameter transients following a loss of mal feedwater with four loops in operation initially with offsite power.
ures 15.2.9A through 15.2-12A are for four loops in operation initially with a loss of offsite er.
owing the reactor and turbine trip from full load, the water level in the steam generators falls to the reduction of steam generator void fraction and because steam flow through the safety es continues to dissipate the stored and generated heat. One minute following the initiation of low-low steam generator water level trip, both motor-driven auxiliary feedwater pumps are matically started, reducing the rate of water level decrease.
capacity of the auxiliary feedwater pumps is such that the water level in the steam generators g fed does not recede below the lowest level at which sufficient heat transfer area is available issipate core residual heat without water relief from the pressurizer relief or safety valves.
m Figures 15.2-11, 15.2-12, 15.2-11A, and 15.2-12A, it can be seen that at no time is the esheet uncovered in the steam generators receiving auxiliary feedwater flow and that at no e is there water relief from the pressurizer.
calculated sequence of events for this accident is listed in Table 15.2-1. As shown on the res presented, the plant approaches a stabilized condition following reactor trip and auxiliary water addition. Standard plant shutdown procedures may be followed to further cool down plant.
2.7.3 Conclusions ults of the analysis show that a loss of normal feedwater does not adversely affect the core, the S, or the steam system since the auxiliary feedwater capacity is such that reactor coolant water ot relieved from the pressurizer relief or safety valves, and the water level in all steam erators receiving auxiliary feedwater is maintained above the tubesheets.
results of the cases that assume loss of offsite power also show that the natural circulation available is sufficient to provide adequate core decay heat removal following reactor trip and tor coolant pump coastdown.
.7.4 Radiological Consequences ce no fuel damage is postulated to occur for this transient, a specific radiological calculation not performed.
.8.1 Identification of Causes and Accident Description ajor feedwater line rupture is defined as a break in a feedwater line large enough to prevent addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory he steam generators. If the break is postulated in a feedline between the check valve and the m generator, fluid from the steam generator may also be discharged through the break. (A k upstream of the feedline check valve would affect the nuclear steam supply system only as ss of feedwater. This case is covered by the evaluation in Section 15.2.7).
ending upon the size of the break and the plant operating conditions at the time of the break, break could cause either a RCS cooldown (by excessive energy discharge through the break)
RCS heatup. Potential RCS cooldown resulting from a secondary pipe rupture is evaluated in tion 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.
edwater line rupture reduces the ability to remove heat generated by the core from the RCS the following reasons.
- 1. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.
- 2. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.
- 3. The break may be large enough to prevent the addition of any main feedwater after trip.
auxiliary feedwater system is provided to assure that adequate feedwater will be available h that:
- 1. no substantial overpressurization of the RCS shall occur, and
- 2. decay heat is removed in order to maintain sufficient liquid in the RCS to keep the reactor core covered.
er to Section 10.4.9 for a description of the auxiliary feedwater system interfaces.
ajor feedwater line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for scussion of Condition IV events.
ain feedwater line rupture is the most limiting event in the decrease in secondary heat oval category. Therefore, a full transient analysis is presented here.
severity of the feedwater line rupture transient depends on a number of system parameters uding break size, initial reactor power, and credit taken for the functioning of various control
ure of the largest feedwater line, occurring at full power with and without loss of offsite er. These cases are analyzed below.
following provides the necessary protection for a main feedwater rupture.
- 1. A reactor trip on any of the following conditions:
- a. high pressurizer pressure;
- b. overtemperature T;
- c. low-low steam generator water level in any steam generator; or
- d. safety injection signals from any of the following:
- 1. low steam line pressure,
- 2. high containment pressure (hi-1), or
- 3. low pressurizer pressure (Refer to Chapter 7 for a description of the actuation system).
- 2. An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal. (Refer to Section 10.4.9 for a description of the auxiliary feedwater system).
.8.2 Analysis of Effects and Consequences hod of Analysis etailed analysis using the RETRAN Code (VEP-FRD-41-P-A) is performed in order to rmine the plant transient following a feedwater line rupture. The code describes the plant mal kinetics, RCS including natural circulation, pressurizer, steam generators, and feedwater em, and computes pertinent variables including the pressurizer pressure, pressurizer water l, and reactor coolant average temperature.
cases analyzed assume a double ended rupture of the largest feedwater pipe at full power.
or assumptions made in the analyses are as follows.
- 1. The plant is initially operating at the NSSS-rated thermal full power including the power uncertainty (see discussion in Section 15.0.3).
- 3. No credit is taken for pressurizer spray. Based on a sensitivity study, the pressurizer power operated relief valves (PORVs) are assumed to be unavailable.
- 4. Initial pressurizer level is at the nominal programmed value plus 7.6 percent (error); initial steam generator water level is at the nominal value plus 12.0 percent (error) for the steam generator with the ruptured feedline and minus 12.0 percent (error) for the steam generator in the intact feedlines.
- 5. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).
- 6. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.
- 7. The feedline break discharge quality is calculated by the RETRAN code as a function of pressure and temperature.
- 8. Reactor trip is assumed to be actuated by low-low water level in the affected steam generator.
- 9. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply flow to the three intact steam generators.
The cases model AFW flow as a function of steam generator pressure.
A 60 second delay was assumed following a low-low steam generator water level signal to allow time for startup of the emergency diesel generators and both motor-driven auxiliary feedwater pumps.
The failure of the turbine-driven AFW pump is to be assumed the most limiting single active failure for this event. A delay of up to 90 seconds in the startup time of the turbine-driven AFW pump has been evaluated and found to be acceptable for this event.
- 10. No credit is taken for charging or letdown.
- 11. Steam generator heat transfer across the tube is adjusted as the shell side liquid inventory decreases.
- 12. The core residual heat generation is based on the 1979 version of ANS 5.1 (ANSIANS-5.1-1979).
- a. high pressurizer pressure
- b. overtemperature T
- c. high pressurizer level
- d. high containment pressure 9 second delay in initiation of the SI system is assumed for cases with a loss of offsite power, a 36 second delay in the initiation of the SI system is assumed for cases with offsite power ilable.
ceipt of two of four low-low steam generator water level signals in at least one steam generator ts the motor-driven auxiliary feedwater pumps, which then deliver auxiliary feedwater flow to steam generators. The turbine-driven auxiliary feedwater pump is initiated if the two of four
-low steam generator water level signals are reached in any two of four steam generators.
ilarly, receipt of a low steam line pressure signal in at least one steam line initiates a steam isolation signal which closes the main steam line isolation valves in all steam lines. This al or a low pressurizer pressure signal, in conjunction with the Cold Leg Injection Permissive IP), gives a safety injection signal which initiates flow of borated water into the RCS. Upon ipt of the safety injection signal, the charging pumps are started and lined up to take suction m the RWST and when a low RCS pressure condition exists (P-19 CLIP), will discharge to the tor coolant cold leg.The amount of safety injection flow is a function of RCS pressure.
ergency operating procedures following a secondary system line rupture call for the following ons to be taken by the reactor operator.
- 1. Isolate feedwater flow spilling out the feedline break and align auxiliary feedwater system so level in intact steam generators recovers.
- 2. Stop high head safety injection pumps if water level in the pressurizer is recovering, and the RCS is in subcooled condition and pressure is stable or increasing and is above the high head injection pumps shut off pressure, and a secondary heat sink exists.
ating feedwater flow through the break allows additional auxiliary feedwater flow to be rted to the intact steam generators (see Assumption 9, above).
sequent to meeting the SI termination criteria noted above, the high head safety injection ps are turned off and plant operating procedures followed in cooling the plant to hot tdown conditions. Plant characteristics and initial conditions are further discussed in tion 15.0.3.
engineered safety systems assumed to function are the auxiliary feedwater system and the ty injection system. For the auxiliary feedwater system, passive flow limiting devices itating venturis) limit flow to the faulted steam generator and permits all intact steam erators to receive auxiliary feedwater following the break.
the feedwater line break with loss of offsite power case, following the trip of the reactor lant pumps, there is a flow coastdown until flow in the loops reaches the natural circulation
- e. The natural circulation capability of the RCS has been shown in Section 15.2.6, for the loss C power transient, to be sufficient to remove core decay heat following reactor trip. Pump stdown characteristics are demonstrated in Sections 15.3.1 and 15.3.2 for single and multiple tor coolant pump trips, respectively.
etailed description and analysis of the safety injection system is provided in Section 6.3. The iliary feedwater system is described in Section 10.4.9.
ults culated plant parameters following a major feedwater line rupture are shown on Figures 15.2-hrough 15.2-24. Results for the cases with offsite power available are presented on ures 15.2-13 through 15.2-18. Results for the cases where offsite power is lost are presented Figures 15.2-19 through 15.2-24. The calculated sequence of events for all cases presented listed in Table 15.2-1.
system response following the feedwater line rupture is similar for all cases analyzed. Results ented on Figures 15.2-14 and 15.2-18 (with offsite power), and on Figures 15.2-20 and
-24 (without offsite power) show that the RCS and main steam system pressure remain below percent of the respective design pressures. Pressurizer pressure remains fairly constant until tor trip occurs on low-low steam generator water level. Pressure then decreases, due to the of heat input, until system heatup occurs. Consequently, coolant expansion due to reduced t transfer capability in the steam generators occurs; the pressurizer safety valves (PSVs) open aintain primary pressure at an acceptable value. The PORVs which are qualified for water ef and would be available to maintain primary pressure below the pressurizer safety valve oint are conservatively assumed inoperable. The pressurizer fills at approximately minutes for the case with offsite power.
ures 15.2-13 and 15.2-19 show that, following reactor trip, the core remains subcritical except a brief return to criticality for the case with offsite power and without offsite power. The return riticality during the subsequent heatup is terminated by negative reactivity insertion tributions from the most-negative MTC and DTC assumed in the analysis.
s event is not limiting with respect to DNB. Based on this, it is not explicitly analyzed for B concerns. Therefore, the minimum DNBR value would remain well above the safety
S pressure is maintained at the PSV set point until final RCS cooldown begins. At this time, heat removal capability of the Steam Generators, being fed by the auxiliary feedwater, eeds NSSS heat generation. The reactor core remains covered with water throughout the sient, since no bulk boiling occurs in the reactor coolant loops.
major difference between the with and without offsite power cases analyzed can be seen in plots of hot and cold leg temperatures, Figures 15.2-16 and 15.2-17 (with offsite power), and Figures 15.2-22 and 15.2-23 (without offsite power). It is apparent from the initial portion of transient (150 to 200 seconds), that the case without offsite power results in a less severe ldown and subsequently higher temperatures in the hot leg. For longer times, however, the with offsite power results in a more severe rise in temperature. The core remains covered h water at all times since no boiling occurs in the reactor coolant loops.
2.8.3 Conclusions ults of the analyses show that for the postulated feedwater line rupture, the assumed auxiliary water system capacity is adequate to remove decay heat, to prevent overpressurizing the S, and to prevent uncovering the reactor core. Radioactivity doses from the postulated water line rupture are less than those previously presented for the postulated steam line break.
applicable acceptance criteria are therefore met.
.8.4 Radiological Consequences feedwater line break with the most significant consequences would be one that occurred de the containment between a steam generator and the feedwater check valve. In this case, the tents of the steam generator and the PORV discharge from the Pressurizer Relief Tank would eleased to the containment. Since no fuel failures are postulated, the radioactivity released is than that from the steam line break. Furthermore, automatic isolation of the containment ld further reduce any radiological consequences from this postulated event.
.9 REFERENCES FOR SECTION 15.2
-1 WCAP-7769, Rev. 1, June 1972, Mangan, M.A. et al., Overpressure Protection for Westinghouse Pressurized Water Reactors.
-2 WCAP-7908, 1972, Hargrove, H.G. FACTRAN-A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod.
-3 WCAP-8330, 1974, Westinghouse Anticipated Transients Without Trip Analysis.
-4 WCAP-14882-P-A, April 1999, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
-6 WCAP-11397-P-A, 1989, Friedland, A. J., Revised Thermal Design Procedure.
-7 WCAP-14882-SI-P-A, October 2005, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactors Non-LOCA Safety Analyses, Supplement 1 -
Thick Metal Mass Heat Transfer Model and NUTRUMP-Based Steam Generator Mass Calculation Method.
-8 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
-9 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code, January 2019.
DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Accident Event Time (sec) rbine trip RCS Turbine trip, loss of main feed flow 0.0 Overpressurization High pressurizer pressure reactor trip point 6.2 case (minimum reached feedback, without pressure control) Rods begin to drop 8.2 Peak pressurizer pressure occurs 9.9 Initiation of steam release from steam generator 13.4 safety valves DNBR case Turbine trip, loss of main feed flow 0.0 (minimum feedback, High pressurizer pressure reactor trip point 8.1 with pressure control) reached Initiation of steam release from steam generator 8.5 safety valves Rods begin to drop 10.1 Minimum DNBR occurs 11.3 MSS Turbine trip, loss of main feed flow 0.0 Overpressurization Initiation of steam release from steam generator 5.4 case (minimum safety valves feedback, with pressure control) High pressurizer pressure reactor trip point 8.9 reached Rods begin to drop 10.9 Peak secondary side pressure occurs 15.9
Accident Event Time (sec) ss of normal feedwater Main feedwater flow stops 0.0 w and loss of offsite Low steam generator water level trip 39.5 wer Rods begin to drop 41.5 Reactor coolant pumps begin to coastdown 43.5 Four steam generators begin to receive auxiliary 99.5 feedwater from two motor-driven auxiliary feedwater pumps Peak water level in pressurizer occurs 2,882 Core decay heat decreases to auxiliary feedwater ~ 2,882 heat removal capacity ss of normal feedwater Main feedwater flow stops 0.0 w with offsite power Low steam generator water level trip 34.1 Rods begin to drop 36.1 Four steam generators begin to receive auxiliary 94.1 feedwater from two motor-driven auxiliary feedwater pumps.
Long term peak water level in pressurizer occurs 2,182 Core decay heat plus pump heat decreases to ~ 2,182 auxiliary feedwater heat removal capacity edwater system pipe ak With offsite power Main feedline rupture occurs 0.0 available Low-low steam generator level reactor trip 20.9 setpoint reached in affected steam generator Rods begin to drop 22.9 Low steam line pressure setpoint reached in 31.4 affected steam generator All main steam line isolation valves close 33.4 Steam generator safety valve setpoint reached in 76.0 intact steam generators Pressurizer safety valve setpoint reached 78.1
Accident Event Time (sec)
Three intact steam generators begin to receive 80.9 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Low pressurizer pressure safety injection N/A*
setpoint reached Safety injection flow starts N/A*
Without offsite power Main feedline rupture occurs 0.0 Low-low steam generator level reactor trip 20.9 setpoint reached in affected steam generator Rods begin to drop 22.9 Power lost to the reactor coolant pumps 22.9 Low steam line pressure setpoint reached in 30.5 affected steam generator All main steam line isolation valves close 32.5 Three intact steam generators begin to receive 80.9 auxiliary feedwater from two motor-driven auxiliary feedwater pumps Steam generator safety valve setpoint reached in 85.2 intact steam generators Pressurizer safety relief valve setpoint reached 86.5 Safety injection flow starts 3297.8**
IP setpoint is not reached; therefore, safety injection is not modeled prior to transient around.
LIP setpoint is reached significantly later in the transient.
Power (percent) Natural Circulation Flow (percent) 5.0 4.76 4.0 4.40 3.0 3.97 2.0 3.45 1.0 2.72 e: The data presented in this table was utilized in initial plant startup testing and it is retained for historical information only. This data was not used in any of the FSAR Chapter 15 analysis for Millstone Unit 3.
s figure shows typical transient results and should not be relied upon for absolute value.
FIGURE 15.2-1A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-2A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
1.2 Nuclear Power (Fraction of Nominal) 1 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 Pressurizer Water Volume (ft^3) 1600 1500 1400 1300 1200 1100 0 20 40 60 80 Time (seconds)
FIGURE 15.2-3A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
610 605 Vessel Average Temperature (Deg. F) 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 590 585 Vessel Inlet Temperature (Deg. F) 580 575 570 565 560 555 0 20 40 60 80 Time (seconds) 4 3.5 DNBR 3
2.5 2
0 20 40 60 80 Time (seconds) s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.2-4A DELETED BY FSARCR 02-MP3-017 Deleted by FSARCR 02-MP3-017
1.2 1
Nuclear Power (Fraction of Nominal) 0.8 0.6 0.4 0.2 0
0 20 40 60 80 Time (seconds) 2500 2400 Pressurizer Pressure (psia) 2300 2200 2100 2000 1900 0 20 40 60 80 Time (seconds) 1700 1600 Pressurizer Water Volume (ft^3) 1500 1400 1300 1200 1100 1000 0 20 40 60 80 Time (seconds)
FIGURE 15.2-5A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
615 Vessel Average Temperature (Deg. F) 610 605 600 595 590 585 580 575 0 20 40 60 80 Time (seconds) 690 Vessel Inlet Temperature (Deg. F) 685 580 575 570 565 560 0 20 40 60 80 Time (seconds) 1350 Steam Generator Pressure (psia) 1300 1250 1200 1150 1100 1050 1000 0 20 40 60 80 Time (seconds) s figure shows typical transient results and should not be relied upon for absolute value.
FIGURE 15.2-6A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-7A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-8A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE Calculation Note Westinghouse Proprietary Class 2 Page CN-TA-06-126 Rev. 3 WESTINGHOUSE ELECTRIC COMPANY LLC 235 FIGURE 15.2-9 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
IGURE 15.2-9A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE GURE 15.2-10A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE Calculation Note Westinghouse Proprietary Class 2 Page CN-TA-06-126 Rev. 3 WESTINGHOUSE ELECTRIC COMPANY LLC 238 FIGURE 15.2-10A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE FIGURE 15.2-11 LOSS OF NORMAL FEEDWATER WITH OFFSITE POWER AVAILABLE
GURE 15.2-11A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE Calculation Note Westinghouse Proprietary Class 2 Page CN-TA-06-126 Rev. 3 WESTINGHOUSE ELECTRIC COMPANY LLC 240 FIGURE 15.2-11A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE GURE 15.2-12A LOSS OF NORMAL FEEDWATER WITHOUT OFFSITE POWER AVAILABLE
AVAILABLE FIGURE 15.2-13 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 2.0 0.0
-2.0
-4.0
-6.0
-8.0
-10.0
-12.0
-14.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-13A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-14 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE 2800 2600 2400 2200 2000 1800 1600 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-14A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-15 MAIN FEEDLINE RUPTURE WITH OFFISTE POWER AVAILABLE 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 8000 7000 6000 5000 4000 3000 2000 1000 0
1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-15A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-16 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE Hot Leg Cold Leg Tsat 700 650 600 550 500 450 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-16A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-17 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE Hot Leg Cold Leg Tsat 700 650 600 550 500 450 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-17A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
FIGURE 15.2-18 MAIN FEEDLINE RUPTURE WITH OFFSITE POWER AVAILABLE Faulted Intact 1400 1200 1000 800 600 400 200 0
1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-18A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-19 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 1.0 0.0
-1.0
-2.0
-3.0
-4.0
-5.0
-6.0
-7.0
-8.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-19A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-20 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE 2800 2600 2400 2200 2000 1800 1600 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-20A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-21 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE 1.2 1.0 0.8 0.6 0.4 0.2 0.0 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec) 8000 7000 6000 5000 4000 3000 2000 1000 0
1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-21A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-22 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE Hot Leg Cold Leg Tsat 700 650 600 550 500 450 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-22A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-23 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE Hot Leg Cold Leg Tsat 700 650 600 550 500 450 1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-23A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
AVAILABLE FIGURE 15.2-24 MAIN FEEDLINE RUPTURE WITHOUT OFFSITE POWER AVAILABLE Faulted Intact 1400 1200 1000 800 600 400 200 0
1.0E+00 1.0E+01 1.0E+02 1.0E+03 Time (sec)
FIGURE 15.2-24A DELETED BY FSARCR 02-MP3-017 DELETED by FSARCR 02-MP3-017
umber of faults are postulated which could result in a decrease in reactor coolant system flow
. These events are discussed in this section. Detailed analyses are presented for the most ting of these events.
cussions of the following flow decrease events are presented in Section 15.3.
- 1. Partial loss of forced reactor coolant flow.
- 2. Complete loss of forced reactor coolant flow.
- 3. Reactor coolant pump shaft seizure (locked rotor).
- 4. Reactor coolant pump shaft break.
1 above is considered to be an ANS Condition II event, Item 2 an ANS Condition III event, Items 3 and 4 ANS Condition IV events. Section 15.0.1 contains a discussion of ANS sifications.
.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW
.1.1 Identification of Causes and Accident Description artial loss-of-coolant flow accident can result from a mechanical or electrical failure in a tor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a tor coolant pump bus. If the reactor is at power at the time of the accident, the immediate ct of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could lt in DNB with subsequent fuel damage if the reactor is not tripped promptly.
mal power for the pumps is supplied through individual buses connected to the generator.
en a turbine or generator trip occurs, the buses continue to receive power from an offsite rce and the pumps continue to supply coolant flow to the core.
s event is classified as an ANS Condition II incident (an incident of moderate frequency) as ned in Section 15.0.1.
necessary protection against a partial loss-of-coolant flow accident is provided by the low ary coolant flow reactor trip signal which is actuated in any reactor coolant loop by two out hree low flow signals. Above Permissive 8, low flow in any loop actuates a reactor trip.
ween approximately 10 percent power (Permissive 7) and the power level corresponding to missive 8, low flow in any two loops actuates a reactor trip.
hod of Analysis case has been analyzed for the loss of one pump with four loops in operation.
s transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A) e is used to calculate the loop and core flow during the transient, the time of reactor trip based he calculated flows, the nuclear power transient, and the primary system pressure and perature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux DNBR during the transient based on the nuclear power core inlet enthalpy and flow and core pressure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, iscussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR.
results met the applicable limit as specified in Section 4.4.
ial Conditions ial reactor power, pressure, and reactor coolant system (RCS) temperature are assumed to be at r nominal values. Uncertainties in initial conditions are included in the limit DNBR. Plant racteristics and initial conditions are further discussed in Section 15.0.3.
ctivity Coefficients onservatively large absolute value of Doppler-only power coefficient is used (Figure 15.0-2).
s is equivalent to a total integrated Doppler reactivity from 0 to 100 percent power of 0.016 most positive moderator temperature coefficient (MTC) at full power (0 pcm/F) is assumed e this maximizes the core power at the time minimum DNBR is reached. The 0 pcm/F MTC full power assumptions are conservative compared to other power level and MTC binations.
w Coastdown flow coastdown analysis is based on a momentum balance around each reactor coolant loop across the reactor core. This momentum balance is combined with the continuity equations, a p momentum balance, and the pump characteristics and is based on high estimates of system sure losses.
nt systems and equipment which are necessary to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
ures 15.3-1 through 15.3-4 show the transient response for the loss of one reactor coolant
- p. Figure 15.3-4 shows the DNBR to be always greater than the limit value.
ce DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly ve their respective initial values.
calculated sequence of events table for the case analyzed is shown in Table 15.3-1 The cted reactor coolant pump continues to coastdown, and the core flow reaches a new ilibrium value corresponding to the number of pumps still in operation. With the reactor ped, a stable plant condition is eventually obtained. Normal plant shutdown may then proceed.
3.1.3 Conclusions analysis shows that the DNBR does not decrease below the limit value at any time during the sient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met.
3.1.4 Radiological Consequences artial loss of reactor coolant flow from full load would result in a reactor and turbine trip.
uming in addition that the condenser is not available, atmospheric steam dump may be uired.
ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 3.2.1 Identification of Causes and Accident Description omplete loss of forced reactor coolant flow may result from a simultaneous loss of electrical plies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the ediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This ease could result in DNB with subsequent fuel damage if the reactor were not tripped mptly.
mal power for the reactor coolant pumps is supplied through buses from a transformer nected to the generator. When a turbine or generator trip occurs, the buses continue to receive er from an offsite source, and the pumps continue to supply coolant flow to the core.
s event is classified as an ANS Condition III incident (an infrequent incident), as defined in tion 15.0.1.
following signals provide the necessary protection against a complete loss of flow accident:
- 2. low reactor coolant loop flow reactor trip on reactor coolant pump underspeed is provided to protect against conditions ch can cause a loss of voltage to all reactor coolant pumps, i.e., loss of nonemergency AC er. This function is blocked below approximately 10 percent power (Permissive P-7).
reactor trip on reactor coolant pump underspeed is also provided to trip the reactor for an erfrequency condition, resulting from frequency disturbances on the power grid. If the imum grid frequency decay rate is less than approximately 5 Hertz/second, this trip protects core from underfrequency events (Section 7.2). This effect is fully described in WCAP-8424, ision 1 (1975). A specific analysis of a frequency decay event was performed as described in tion 15.3.2.3.
reactor trip on low primary coolant loop flow is provided to protect against loss of flow ditions which affect only one reactor coolant loop. This function is generated by two out of e low flow signals per reactor coolant loop. Above Permissive P-8, low flow in any loop ates a reactor trip. Between approximately 10 percent power (Permissive P-7) and the power l corresponding to Permissive P-8, low flow in any two loops actuates a reactor trip.
3.2.2 Analysis of Effects and Consequences case has been analyzed for the loss of four pumps with four loops in operation.
s transient is analyzed by two digital computer codes. The RETRAN (WCAP-14882-P-A) e is used to calculate the loop and core flow during the transient, the time of reactor trip based he calculated flows, the nuclear power transient, and the primary system pressure and perature transients. The VIPRE-D Code (Section 4.4) is then used to calculate the heat flux DNBR transient based on the nuclear power core inlet enthalpy and flow and core exit sure calculated by RETRAN. A DNB statepoint analysis was performed with VIPRE-D, as ussed in Section 15.0.3.1, based on the system conditions at the time of minimum DNBR. The lts met the applicable limit as specified in Section 4.4.
method of analysis and the assumptions made regarding initial operating conditions and tivity coefficients are identical to those discussed in Section 15.3.1, except that following the of power supply to all pumps at power, a reactor trip is actuated by reactor coolant pump erspeed.
ults ures 15.3-5 through 15.3-8 show the transient response for the loss of power to all reactor lant pumps. The reactor is assumed to be tripped on an underspeed signal. Figure 15.3-8 ws the DNBR to be always greater than the limit value.
ve their respective initial values.
calculated sequence of events is shown in Table 15.3-1. The reactor coolant pumps continue oastdown, and natural circulation flow is eventually established, as demonstrated in tion 15.2.6. With the reactor tripped, a stable plant condition would be attained. Normal plant tdown may then proceed.
.2.3 Underfrequency ss of forced primary coolant flow can result from a reduction in reactor coolant pump motor ply frequency. Therefore, the complete loss of flow accident was also analyzed where the ating event is a frequency decay. The same signals which provide the necessary protection inst a complete loss of flow provide for protection against an underfrequency event. The lysis is the same as that for the complete loss of flow with the exception of the simulation of frequency decay. That is, rather than the reactor coolant pumps coasting down freely, the rease in electrical frequency (5 Hz/sec) decelerates the reactor coolant pumps faster than a loss ower.
ults ures 15.3-13 through 15.3-16 show the transient response for the frequency decay to all tor coolant pumps. The minimum DNBR is greater than the limit value, as shown on ure 15.3-16. The calculated sequence of events table is shown in Table 15.3-1A.
.2.4 Conclusions analyses performed have demonstrated that for the complete loss of forced reactor coolant
, the DNBR does not decrease below the limit value at any time during the transient. Thus, no or clad damage is predicted, and all applicable acceptance criteria are met.
.2.5 Radiological Consequences omplete loss of reactor coolant flow from full load results in a reactor and turbine trip.
uming in addition that the condenser is not available, atmospheric steam dump would be uired. The quantity of steam released would be the same as for a loss of offsite power incident.
ce no fuel damage is postulated for this transient, a specific radiological release calculation not performed.
.3.1 Identification of Causes and Accident Description accident postulated is an instantaneous seizure of a reactor coolant pump rotor. Flow through affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a flow signal.
owing initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the m generators is reduced, first because the reduced flow results in a decreased tube side film fficient and then because the reactor coolant in the tubes cools down while the shell side perature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion he coolant in the reactor core, combined with reduced heat transfer in the steam generators, ses an insurge into the pressurizer and a pressure increase throughout the reactor coolant em. The insurge into the pressurizer compresses the steam volume, actuates the automatic y system, opens the power-operated relief valves, and opens the pressurizer safety valves, in sequence. The two power-operated relief valves are designed for reliable operation and would xpected to function properly during the accident. However, for conservatism, their pressure ucing effect, as well as the pressure reducing effect of the spray, are not included in the lysis.
s event is classified as an ANS Condition IV incident (a limiting fault) as defined in tion 15.0.1.
.3.2 Analysis of Effects and Consequences hod of Analysis o digital-computer codes are used to analyze this transient. The RETRAN Code CAP-14882-P-A) is used to calculate the resulting loop and core flow transients following the p seizure, the time of reactor trip based on the loop flow transients, the nuclear power owing reactor trip, and to determine the peak pressure. The thermal behavior of the fuel ted at the core hot spot is investigated using the VIPRE Code (Section 4.4), which uses the flow and the nuclear power calculated by RETRAN. The VIPRE Code includes a film ing heat transfer coefficient.
o case were analyzed:
- 1. Peak clad temperature (PCT) reactor coolant system (RCS) over pressurization, four loops in operation, one locked rotor.
- 2. Rods-in-DNB, four loops in operation, one locked rotor.
he beginning of the PCT/RCS over pressurization (i.e., at the time the shaft in one of the tor coolant pumps is assumed to seize) the plant is assumed to be in operation under the most
nt characteristics and initial conditions are further discussed in Section 15.0.3. The accident as luated bounds with and without offsite power available, with the loss of one protection train.
bound the scenario of a loss of offsite power, power to the unaffected pumps is assumed to be simultaneously with a reactor trip.
the peak pressure evaluation, the initial pressure is conservatively estimated as 50 psi above inal pressure (2,250 psia) to allow for errors in the pressurizer pressure measurement and trol channels. This is done to obtain the highest possible rise in the coolant pressure during the sient. Figure 15.3-10 shows the typical pressure response at the point of maximum pressure in cold leg as well as the lower plenum of the reactor vessel.
econd case was run with VIPRE-D to confirm that the number of rods-in-DNB is less than that med in the radiological analysis. Initial core power was assumed to be at its nominal value sistent with steady-state, full power operation. The reactor coolant system (RCS) pressure and rage coolant temperature were assumed to be at their nominal values. Minimum measured is also assumed. Uncertainties in initial conditions were accounted for in the DNBR limit e as described in the Statistical DNBR Evaluation Methodology (VEP-NE-2-A). Results of rods-in-DNB analysis using VIPRE-D demonstrated DNBR remains above the applicable t as specified in Section 4.4.
luation of the Pressure Transient er pump seizure, the neutron flux is rapidly reduced by control rod insertion. Rod motion is med to begin one second after the flow in the affected loop reaches 85 percent of nominal
. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer y, steam dump, or controlled feedwater flow after plant trip. Although these operations are ected to occur and would result in a lower peak pressure, an additional degree of conservatism rovided by ignoring their effect.
pressurizer safety valves start to open at 2,575 psia and are fully open at 2,652 psia.
luation of DNB in the Core during the Accident this accident, DNB is assumed to occur in the core, and therefore, an evaluation of the sequences, with respect to fuel rod thermal transients, is performed with VIPRE-01 (WCAP-65-P-A). Results obtained for analysis of this hot spot condition represent the upper limit h respect to clad temperature and zirconium water reaction.
he evaluation, the rod power at the hot spot is conservatively assumed to exceed 2.6 times the rage rod power (i.e., FQ = 2.6) at the initial core power level.
film boiling coefficient is calculated in the VIPRE-01 Code (WCAP-14565-P-A) using the hop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film perature (average between wall and bulk temperatures). The program calculates the film fficient at every time step, based upon the actual heat transfer conditions at the time. The tron flux, system pressure, bulk density, and mass flow rate as a function of time are used as gram input.
l Clad Gap Coefficient magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap fficient) has a pronounced influence on the thermal results. The larger the value of the gap fficient, the more heat is transferred between pellet and clad. Based on investigations on the ct of the gap coefficient upon the maximum clad temperature during the transient, the gap fficient in the VIPRE-01 (WCAP-14565-P-A) analysis was assumed to increase from a steady e value consistent with initial fuel temperature to 10,000 Btu/hr-ft2 -F at the initiation of the sient. Thus, the large amount of energy stored in the fuel because of the small initial value is ased to the clad at the initiation of the transient.
onium Steam Reaction zirconium steam reaction can become significant above 1,800F (clad temperature). The er-Just parabolic rate equation shown below is used to define the rate of the zirconium steam tion.
d(w2)/dt = 33.3 x 106exp((-45500/1.986T))
re:
w = amount reacted (mg/cm2) t = time (sec)
T = temperature (K) reaction heat is 1,510 cal/gm.
effect of zirconium-steam reaction is included in the calculation VIPRE-01 (WCAP-14565-
) of the hot spot clad temperature transient.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
transient results for the peak clad temperature and over pressurization cases are shown on ures 15.3-9 through 15.3-12. The results of these calculations are also summarized in le 15.3-2. The peak RCS pressure reached during the transient is less than that which would se stresses to exceed the faulted condition stress limits (approximately 3,200 psig). Also, the k clad surface temperature is less than 2,700F and the proprietary coolability limit for imized ZIRLO identified in Reference 15.3-5. It should be noted that the clad temperature was servatively calculated assuming that DNB occurs at the initiation of the transient.
3.3.3 Conclusions
- 1. Since the peak RCS pressure reached during any of the transients is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.
- 2. Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2,700F, the core remains in place and intact with no loss of core cooling capability.
3.3.4 Radiological Consequences postulated that if a locked rotor accident occurs, the activity in the gap of the fuel rods ering clad damage is released to the reactor coolant. The released activity leaks to the ondary side of the steam generator at a leak rate of 1 gpm. Seven percent of the fuel rods in the are postulated to have clad damage for four-loop operation. Secondary coolant activities are med to be at Technical Specification concentration. A main steam pressure relief valve is tulated to stick open, thereby allowing one steam generator to empty. All the initial secondary fluid, plus the feedwater flow and the primary coolant leakage to that steam generator for the 20 minutes, is assumed to be released to the atmosphere. The affected steam generator is ated, by operator action, to close the isolation valve upstream of the relief valve within 20 utes. A partition factor of 0.01 for iodine occurs between the water and steam phases in the ffected steam generators during the course of the accident. The iodine partition factor for the cted steam generator is assumed to be 1.0. The release to the environment continues for 35.75 rs, after which RHR is used for cooldown and steaming is not required.
site power is assumed to be lost, thereby making the condenser unavailable for steam dump.
radiological consequences of a postulated locked rotor accident are reported in Table 15.0-8.
assumptions used to perform this evaluation are summarized in Tables 15.3-3 and 15.6-12 the control room.
evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The ological consequences of the locked rotor accident are within the TEDE limits defined by CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, and 2.5 rem to the EAB and LPZ.
.4.1 Identification of Causes and Accident Description accident is postulated as an instantaneous failure of a reactor coolant pump shaft, such as ussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, ugh the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor ure event. Reactor trip is initiated on a low flow signal in the affected loop.
owing initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to coolant causing the coolant to expand. At the same time, heat transfer to the shell side of the m generators is reduced, first because the reduced flow results in a decreased tube side film fficient and then because the reactor coolant in the tubes cools down while the shell side perature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion he coolant in the reactor core, combined with reduced heat transfer in the steam generators ses an insurge into the pressurizer and a pressure increase throughout the reactor coolant em. The insurge into the pressurizer compresses the steam volume, actuates the automatic y system, opens the power-operated relief valves, and opens the pressurizer safety valves, in sequence. The two power-operated relief valves are designed for reliable operation and would xpected to function properly during the accident. However, for conservatism, their pressure ucing effect, as well as the pressure reducing effect of the spray, is not included in the analysis.
s event is classified as an ANS Condition IV incident (a limiting fault) as defined in tion 15.0.1.
locked rotor analysis described in Section 15.3.3 conservatively bounds both the locked rotor shaft break transients.
3.4.2 Conclusions radiological consequences of a reactor coolant pump shaft break are no worse than those ulated for the locked rotor incident (Section 15.3.3). With a failed shaft, the impeller could ceivably be free to spin in a reverse direction as opposed to being fixed in position, as assumed he locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a ht decrease in the end point (steady state) core flow. For both the shaft break and locked rotor dents, reactor trip occurs very early in the transient. In addition, the locked rotor analysis servatively assumes that DNB occurs at the beginning of the transient.
.5 REFERENCES FOR SECTION 15.3
-1 WCAP-14882-P-A, April 1999, D. S. Huegel, et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses.
-2 WCAP-14565-P-A, 1999, Y. X. Sung, et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis.
Frequency Transients in Westinghouse PWRs.
-4 DOM-NAF-2-P-A, Revision 0, Minion Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
-5 WCAP-12610-P-A & CENPD-404-P-A, Addendum 1-A, Optimized ZIRLO, July 2006.
A DECREASE IN REACTOR COOLANT SYSTEM FLOW Accident Event Time (sec) tial loss of forced reactor olant flow ur loops operating, one pump Coastdown begins 0.0 asting down Low flow reactor trip 1.7 Rods begin to drop 2.7 Minimum DNBR occurs 3.6 mplete loss of forced reactor All operating pumps lose power and begin 0.0 olant flow coasting down Reactor coolant pump underspeed trip point 0.9 reached Rods begin to drop 1.5 Minimum DNBR occurs 3.3 actor coolant pump shaft Rotor on one pump locks 0.0 zure (locked rotor) Low flow trip point reached 0.06 ithout offsite power)
Rods begin to drop 1.06 Remaining pumps begin to coast down 1.06 Maximum clad temperature 3.7 Maximum RCS pressure occurs 4.1
Accident Event Time (sec) derfrequency Event All operating pumps lose power and begin coasting 0.00 down Reactor coolant pump underspeed trip point reached 1.0 Rods begin to drop 1.6 Minimum DNBR occurs 3.7
Without Offsite Power Four Loops Initially Operating ximum Reactor Coolant System Pressure (psia) 2741.3 ximum Clad Temperature (F) Core Hot Spot 1919.0 H20 Reaction at Core Hot Spot (percent by weight) 0.99
Fuel Damage 7% Fuel Failure Radial Peaking Factor: 1.7 Primary to Secondary Leak rate: 0.35 gpm (affected SG) 0.65 gpm (intact SGs)
Release from secondary side is coincident with loss of off-site power Release Points: (1)
Off site Ground level- ventilation vent Control Room MSPRVs / MSSVs Iodine Chemical Form Released to Environment: Elemental 97%
Organic 3%
Fraction of Fission Product Inventory in Gap: Halogens 0.08 Noble Gases 0.10 Alkali Metals 0.12 Iodine Partitioning in Intact Steam Generator 100 Intact Steam Generator Tube Uncovery No tube bundle uncovery assumed.
Affected steam generator goes dry, immediately 100% flashing is assumed in affected SG Release Duration Intact Steam Generators 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> Affected Steam Generator 20 minutes (operator action)
Total Steam Flows to Atmosphere from Intact 0-2 hours: 432,000 lbm SGs 2-11hours: 1,328,000 lbm 8-11 hours: 820,800 lbm 11-24 hours: 1,918,222 lbm 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 196,515 lbm Mass Flow Rates from Intact Steam Generators 0-2 hours: 2.16E+05 lbm/hr 2-11hours: 1.48E+05 lbm/hr 11-24 hours: 1.48E+05 lbm/hr 24-35.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br />s: 1.67E+04 lbm/hr Moisture carryover in intact Steam Generators: 1%
Initial Steam Generator Liquid Mass 4.582E+07 grams / SG Control Room Parameters See Table 15.6-12 TES:
X/Qs are from Table 15.0-11. EAB and LPZ X/Qs are from ground level - ventilation vent location because of near proximity to the release point. Control room factors use the MSVB X/Qs because of near proximity to the release point.
ONE PUMP COASTING DOWN PUMP COASTING DOWN s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FOUR PUMPS COASTING DOWN COASTING DOWN s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.3-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
s figure shows typical Locked Rotor RCS Pressure transient results and should not be relied n for an absolute value of the RCS Pressure.
FIGURE 15.3-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
TRANSIENTS, ONE LOCKED ROTOR FIGURE 15.3-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
ROTOR s figure shows typical transient results and should not be relied upon for an absolute value.
FIGURE 15.3-12 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
FREQUENCY DECAY FOUR PUMPS EXPERIENCING FREQUENCY DECAY PUMPS EXPERIENCING FREQUENCY DECAY FREQUENCY DECAY s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
umber of faults have been postulated which could result in reactivity and power distribution malies. Reactivity changes could be caused by control rod motion or ejection, boron centration changes, or addition of cold water to the reactor coolant system (RCS). Power ribution changes could be caused by control rod motion, misalignment, or ejection, or by static ns such as fuel assembly mislocation. These events are discussed in this section. Detailed lyses are presented for the most limiting of these events.
cussions of the following incidents are presented in Section 15.4.
- 1. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.
- 2. Uncontrolled rod cluster control assembly bank withdrawal at power
- 3. Rod cluster control assembly misalignment.
- 4. Startup of an inactive reactor coolant pump at an incorrect temperature.
- 5. A malfunction or failure of the flow controller in a BWR loop that results in an increased reactor coolant flow rate (Not applicable to Millstone 3).
- 6. Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant.
- 7. Inadvertent loading and operation of a fuel assembly in an improper position.
- 8. Spectrum of rod cluster control assembly ejection accidents.
s 1, 2, 4, and 6 above are considered to be American Nuclear Society (ANS) Condition II nts, Item 7 is an ANS Condition III event, and Item 8 is an ANS Condition IV event. Item 3 ils both Condition II and III events. Section 15.0.1 contains a discussion of ANS sifications.
.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION
.1.1 Identification of Causes and Accident Description d cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled ition of reactivity to the reactor core caused by withdrawal of RCCAs resulting in a power ursion. Such a transient could be caused by a malfunction of the reactor control or rod control ems. This could occur with the reactor subcritical at hot zero power or at power. The at er case is discussed in Section 15.4.2.
imum rate of reactivity increase in the case of boron dilution is less than that assumed in this lysis (Section 15.4.6).
RCCA drive mechanisms are wired into preselected bank configurations which are not red during reactor life. These circuits prevent the RCCAs from being automatically withdrawn ther than their respective banks. Power supplied to the banks is controlled such that no more two banks can be withdrawn at the same time and in their proper withdrawal sequence. The CA drive mechanisms are of the magnetic latch type and coil actuation is sequenced to provide able speed travel. The maximum reactivity insertion rate analyzed in the detailed plant lysis is that occurring with the simultaneous withdrawal of the combination of two sequential trol banks having the maximum combined worth at maximum speed.
s event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined ection 15.0.1.
neutron flux response to a continuous reactivity insertion is characterized by a very fast rise inated by the reactivity feedback effect of the negative Doppler coefficient. This self tation of the power excursion is of primary importance since it limits the power to a tolerable l during the delay time for protective action. Should a continuous RCCA withdrawal accident ur, the transient is terminated by the following automatic features of the reactor protection em.
- 1. Source range high neutron flux reactor trip Actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.
- 2. Intermediate range high neutron flux reactor trip Actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two out of the four power range channels are reading above approximately 10 percent of full power and is automatically reinstated when three of the four channels indicate a power level below this value.
- 3. Power range high neutron flux reactor trip (low setpoint)
Actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two out of the four power range channels indicate a power level
- 4. Power range high neutron flux reactor trip (high setpoint)
Actuated when two out of the four power range channels indicate a power level above a preset setpoint.
- 5. Power range neutron flux high positive rate reactor trip Actuated when the positive rate of change of neutron flux on two out of four nuclear power range channels indicates a rate above the preset setpoint.
In addition, control rod stops on high intermediate range flux level (one of two) and high power range flux level (one of four) serve to discontinue rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.
.1.2 Analysis of Effects and Consequences hod of Analysis transient is analyzed by the RETRAN digital computer code. This code includes the ulation of prompt and delayed neutrons (using the six-group model), the thermal kinetics of fuel and moderator and the balance of the NSSS primary and secondary coolant system.
rmal feedback is modeled via temperature dependent coefficients of reactivity. A detailed core mal/hydraulics analysis, performed with the VIPRE-D computer code, demonstrates that ding integrity is maintained throughout the transient. The analysis conservatively accounts for ievable power distribution at low power.
nt characteristics and initial conditions are discussed in Section 15.0.3. In order to give servative results for a startup accident, the following assumptions are made.
- 1. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low (least negative) values as a function of temperature are used. See Section 15.0.4 and Table 15.0-2.
- 2. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time. However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A conservative positive value is used in the analysis to yield the maximum peak heat flux.
Tavg of 557F. This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect, thereby increasing the neutron flux peak. The initial effective multiplication factor is assumed to be 1.0 since this results in the worst nuclear power transient.
- 4. Reactor trip is assumed to be initiated by power range high neutron flux (low setpoint). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10 percent increase is assumed for the power range flux trip setpoint, raising it from the nominal value of 25 percent to 35 percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.0.5 for RCCA insertion characteristics.
- 5. The maximum positive reactivity insertion rate assumed is greater than that for the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth at maximum speed (45 inches/minute).
Control rod drive mechanism design is discussed in Section 4.6.
- 6. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.
- 7. The initial power level was assumed to be below the power level expected for zero power (just critical) condition (10-13 of nominal power). The combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.
- 8. Three reactor coolant pumps (RCPs) are assumed to be in operation.
nt systems and equipment, which are available to mitigate the effects of the accident, are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident.
ce the power range high neutron flux (low setpoint) is not required to be OPERABLE in des 3, 4 or 5, plant administrative controls have been implemented to preclude an uncontrolled bank withdrawal from occurring in these Modes when plant conditions are not bounded by assumptions described herein.
ures 15.4-1 and 15.4-3 show the transient behavior for the uncontrolled RCCA bank hdrawal incident, with the accident terminated by reactor trip at 35 percent of nominal power.
reactivity insertion rate used is greater than that calculated for the two highest worth uential control banks, both assumed to be in their highest incremental worth region.
ure 15.4-1 shows the neutron flux and core heat flux transients. The peak heat flux does not rshoot the nominal full power value.
energy release and the fuel temperature increases are relatively small. The thermal flux onse, of interest for DNB considerations, is shown on Figure 15.4-1. The beneficial effect of inherent thermal lag in the fuel is evidenced by a peak heat flux much less than the full power inal value. There is an adequate margin to DNB during the transient since the rod surface heat remains below the design value, and there is a high degree of subcooling at all times in the
. Figure 15.4-3 shows the response of the hot spot fuel and cladding temperatures. The fuel perature increases to a value lower than the nominal full power value. The minimum DNBR, ll times, remains above the limit value.
calculated sequence of events for this accident is shown in Table 15.4-1. With the reactor ped, the plant returns to a stable condition. The plant may subsequently be cooled down her by following normal plant shutdown procedures.
4.1.3 Conclusions he event of a RCCA withdrawal accident from the subcritical condition, the core and the RCS not adversely affected, since the combination of thermal power and the coolant temperature lt in a DNBR greater than the limit value. The DNBR design basis is described in Section 4.4; licable acceptance criteria have been met.
.1.4 Radiological Consequences ce no fuel damage is postulated following an uncontrolled rod cluster control assembly bank hdrawal from a subcritical or low power startup condition event, a specific radiological release ulation was not performed.
.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER
.2.1 Identification of Causes and Accident Description ontrolled RCCA bank withdrawal at power results in an increase in the core heat flux. Since heat extraction from the steam generator lags behind the core power generation until the steam erator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor lant temperature. Unless terminated by manual or automatic action, the power mismatch and ltant coolant temperature rise could eventually result in DNB. Therefore, in order to avert
s event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined ection 15.0.1.
automatic features of the reactor protection system which prevent core damage following the tulated accident include the following:
- 1. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint, or a high positive rate setpoint.
- 2. Reactor trip is actuated if any two out of four channels exceed the high positive neutron flux rate setpoint.
- 3. Reactor trip is actuated if any two out of four channels exceed an overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature and pressure to protect against DNB.
- 4. Reactor trip is actuated if any two out of four channels exceed an overpower T setpoint.
- 5. A high pressurizer pressure reactor trip is actuated from any two out of four pressure channels, which is set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.
- 6. A high pressurizer water level reactor trip is actuated from any two out of three level channels when the reactor power is above approximately 10 percent (Permissive P-7).
In addition to the above listed reactor trips, there are the following RCCA withdrawal blocks:
- 1. high neutron flux (one out of four power range);
- 2. overpower T (two out of four); and
- 3. overtemperature T (two out of four).
manner in which the combination of overpower and overtemperature T trips provide ection over the full range of RCS conditions is described in Chapter 7. Figure 15.0-1 presents wable reactor coolant loop average temperature and T for the design power distribution and as a function of primary coolant pressure. The boundaries of operation defined by the rpower T trip and the overtemperature T trip are represented as protection lines on the ram. The protection lines are drawn to include all adverse instrumentation and setpoint errors hat under nominal conditions trip would occur well within the area bounded by these lines.
safety analysis limit value. All points below and to the left of a DNB line for a given pressure e a DNBR greater than the safety analysis limit value. The diagram shows that DNB is vented for all cases if the area enclosed with the maximum protection lines is not traversed by applicable DNBR line at any point.
area of permissible operation (power, pressure, and temperature) is bounded by the bination of reactor trips: high neutron flux (fixed setpoint); high pressure (fixed setpoint); low sure (fixed setpoint); overpower and over temperature T (variable setpoints) and the ning of the steam generator safety valve.
.2.2 Analysis of Effects and Consequences hod of Analysis s transient is analyzed by the RETRAN Code (VEP-FRD-41-P-A). This code simulates the tron kinetics, RCS, pressurizer relief and safety valves, pressurizer spray, steam generator, and m generator safety valves. The code computes pertinent plant variables including peratures, pressures, and power level. A detailed DNB analysis is performed with the thermal hydraulic computer code VIPRE-D (DOM-NAF-2-P-A). This accident is analyzed with the istical DNBR Evaluation Methodology (VEP-NE-2-A). Plant characteristics and initial ditions are discussed in Section 15.0.3. In order to obtain conservative results for an ontrolled rod withdrawal at power accident, the following assumptions are made.
- 1. Initial reactor power and RCS temperatures are assumed to be at their nominal values consistent with steady state full power operation. The initial RCS pressure is assumed at a nominal value consistent with steady state full power operation.
- 2. Reactivity coefficients - two cases are analyzed:
- a. Minimum reactivity feedback.
A moderator temperature coefficient of 0 pcm/F is assumed for power 70 percent.
A positive moderator temperature coefficient of reactivity is assumed for power 70 percent corresponding to the beginning of core life. A conservatively small (in absolute magnitude) Doppler temperature coefficient is assumed.
- b. Maximum reactivity feedback A conservatively large negative moderator temperature coefficient and a large (in absolute magnitude) negative Doppler temperature coefficient are assumed.
instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.
- 4. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.
- 5. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the combinations of the two control banks having the maximum combined worth at maximum speed.
- 6. Cases are analyzed for operation with four loops in service, assuming a spectrum of reactivity insertion rates and initial reactor power levels.
- 7. To be conservative with respect to DNB, the pressurizer spray system and relief valves are assumed operational since they limit the reactor coolant pressure increase.
nt systems and equipment which are available to mitigate the effects of the accident are ussed in Section 15.0.7 and listed in Table 15.0-6. No single active failure in any of these ems or equipment will adversely affect the consequences of the accident. A discussion of cipated transients without trip (ATWT) considerations is presented in Section 15.8.
ults ures 15.4-4 through 15.4-6 show the transient response for a rapid RCCA withdrawal incident ting from full power and assuming a 100 pcm/sec. withdrawal rate. Reactor trip on high tron flux occurs shortly after the start of the accident. Since this is rapid with respect to the mal time constants of the plant, small changes in Tavg result and margin to DNB is ntained. The design basis for DNBR is described in Section 4.4.
transient response for a slow RCCA withdrawal from full power assuming a 1.5 pcm/sec.
hdrawal rate is shown on Figures 15.4-7 through 15.4-9. Reactor trip on over temperature T urs after a longer period and the rise in temperature is consequently larger than for rapid CA withdrawal. Again, the minimum DNBR is greater than the safety analysis limit value.
ure 15.4-10 shows the minimum DNBR as a function of reactivity insertion rate from initial power operation for minimum and maximum reactivity feedback. It can be seen that two tor trip channels provide protection over the whole range of reactivity insertion rates. These the high neutron flux and overtemperature T channels. The minimum DNBR is never less the safety analysis limit value.
ures 15.4-11 and 15.4-12 show the minimum DNBR as a function of reactivity insertion rate RCCA withdrawal incidents starting at 60 and 10 percent power, respectively. The results are ilar to the 100 percent power case, except as the initial power is decreased, the range over
shape of the curves of minimum DNBR versus reactivity insertion rate in the referenced res is due both to reactor core and coolant system transient response and to protection system on in initiating a reactor trip.
erring to the minimum feedback cases in Figure 15.4-10, for example, it is noted that:
- 1. For high reactivity insertions (i.e., higher than 10 pcm/sec), reactor trip is initiated by the high neutron flux trip relatively early in the transient. The neutron flux level in the core rises rapidly for these insertion rates while the core heat flux and coolant system pressure lag behind due to the thermal capacity of the fuel and coolant. Thus, the reactor is tripped prior to a significant increase in heat flux of coolant temperature with resultant high minimum DNBRs for these cases.
- 2. As reactivity insertion is decreased, reactor trip on high neutron flux occurs later in the transient allowing for greater increases in core heat flux and coolant temperatures. As a result, for reactivity insertions between 10 pcm/sec and 2 pcm/
sec, the minimum DNBRs decrease rapidly, but always remain above the safety analysis limit value.
- 3. Reactor trip on over temperature T (OTT) occurs for very low reactivity insertion rates (i.e., below 2 pcm/sec). These cases experience the largest increase in coolant temperature and are, therefore, typically limiting with respect to DNBR.
However, the minimum DNBR for these cases also remains above the safety analysis limit value.
ce the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures during the transient until after reactor trip occurs. For high reactivity insertion rates, the rpower transient is fast with respect to the fuel rod thermal time constant, and the core heat lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed
.5 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the l core power distribution, the peak fuel center-line temperature still remains below the fuel ting temperature.
slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the tron flux. The overpower transient is terminated by the over temperature T reactor trip before NB condition is reached. The peak heat flux again is maintained below 116.5 percent of its inal value. Taking into account the effect of the RCCA withdrawal on the axial core power ribution, the peak fuel center-line temperature remains below the fuel melting temperature.
reactor is tripped sufficiently fast during the RCCA withdrawal at power transient to ensure the ability of the primary coolant to remove heat from the fuel rods in not reduced. Thus, the cladding temperature does not rise significantly above its initial value during the transient.
sequently be cooled down further by following normal plant shutdown procedures.
.2.3 Conclusions high neutron flux and over temperature T trip channels provide adequate protection over the re range of possible reactivity insertion rates.
.2.4 Radiological Consequences reactor trip causes a turbine trip and heat is removed from the secondary system through the m generator power relief valves or safety valves. Since no fuel damage is postulated to occur owing an uncontrolled rod cluster control assembly bank withdrawal at power event, a specific ological release calculation was not performed.
.3 ROD CLUSTER CONTROL ASSEMBLY MISALIGNMENT
.3.1 Identification of Causes and Accident Description CA misalignment accidents include:
- 1. a dropped full length assembly;
- 2. a dropped full length assembly bank;
- 3. Statically misaligned full length assembly (Table 15.4-2); and
- 4. withdrawal of a single full length assembly.
h RCCA has a position indicator channel which displays position of the assembly. The lays of assembly positions are grouped for the operators convenience. Fully inserted mblies are further indicated by a rod at bottom signal, which actuates an indicating light and unciator in the control room. Group demand position is also indicated.
length RCCAs are always moved in preselected banks, and the banks are always moved in same preselected sequence. Each bank of RCCAs is divided into two groups. The rods prising a group operate in parallel through multiplexing thyristors. The two groups in a bank ve sequentially such that the first group is always within one step of the second group in the
- k. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism.
ce the stationary gripper, movable gripper, and lift coils associated with the four RCCAs of a group are driven in parallel, any single failure which would cause rod withdrawal would ct a minimum of one group. Mechanical failures are in the direction of insertion, or obility.
tion 15.0.1. The single RCCA withdrawal incident is classified as an ANS Condition III event, iscussed below.
single electrical or mechanical failure in the rod control system could cause the accidental hdrawal of a single RCCA from the inserted bank at full power operation. The operator could berately withdraw a single RCCA in the control bank since this feature is necessary in order to ieve an assembly should one be accidentally dropped. The event analyzed must result from tiple wiring failures or multiple deliberate operator actions and subsequent and repeated rator disregard of event indication. It is the position of Westinghouse that the probability of h a combination of conditions is so low that the limiting consequences may include slight fuel age.
s, consistent with the philosophy and format of ANSI N18.2, the event is classified as a dition III event. By definition Condition III occurrences include incidents, any one of which occur during the lifetime of a particular plant, and shall not cause more than a small tion of fuel elements in the reactor to be damaged...
s selection of criterion is not in violation of General Design Criterion (GDC) 25 which states, e protection system shall be designed to assure that specified acceptable fuel design limits are exceeded for any single malfunction of the reactivity control systems, such as accidental hdrawal (not ejection or dropout) of control rods. (Emphasis has been added). It has been wn that failures resulting in RCCA bank withdrawal do not violate specified fuel design limits.
reover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is cluded that criterion established for the withdrawal of a single RCCA at power is appropriate in accordance with GDC 25.
ropped assembly bank is detected by:
- 1. sudden drop in the core power level as seen by the nuclear instrumentation system;
- 2. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
- 3. rod at bottom signal;
- 4. rod deviation alarm;
- 5. rod position indication.
Misaligned assemblies are detected by:
- 1. asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples;
- 3. rod position indicators.
resolution of the rod position indicator is 4 steps (2.5 inches). The computer or rod ition indication system deviation alarms alert the operator to a control rod deviation greater 12 steps (7.5 inches) with respect to the group position or any other rod in a group.
iation of any rod control bank assembly from its group by twice this distance (24 steps or 15 es) will not cause power distribution worse than the design limits.
ne or more rod position indicator channels should be out of service, detailed operating ructions shall be followed to assure the alignment of the nonindicated assemblies. The rator is also required to take action as required by the Technical Specifications.
he extremely unlikely event of simultaneous electrical failures which could result in single CA withdrawal, rod deviation would be displayed on the plant annunciator, and the rod ition indicators would indicate the relative positions of the assemblies in the bank. Withdrawal single RCCA by operator action, whether deliberate or by a combination of errors, would lt in activation of the same alarm and the same visual indications. Withdrawal of a single CA results in both positive reactivity insertion tending to increase in core power, and an ease in local power density in the core area associated with the RCCA. Automatic protection this event is provided by the overtemperature T reactor trip, although due to the increase in l power density it is not possible in all cases to provide assurance that the core safety limits not violated.
nt systems and equipment which are available to mitigate the effects of the various control rod operations are discussed in Section 15.0.7 and listed in Table 15.0-6. (Note that automatic ection for the dropped assembly and dropped assembly bank events is provided by the rtemperature T, overpower T and low pressurizer pressure functions. However, the analysis ws that their actuation is not required.) No single active failure in any of these systems or ipment will adversely affect the consequences of the accident.
.3.2 Analysis of Effects and Consequences
- 1. Dropped assembly, dropped assembly bank, and statically misaligned assembly.
Method of Analysis
- a. One or more dropped assemblies from the same group.
For evaluation of the dropped assembly event, the transient system response is calculated using the LOFTRAN code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.
power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using dropped rod limit lines developed with VIPRE-D.
The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in WCAP-11395-A, Methodology for the Analysis of the Dropped Rod Event.
- b. Statically misaligned RCCA Steady state power distribution are analyzed using the computer codes as described in Table 4.1-2. The peaking factors are then compared to peaking factor limits developed using the VIPRE-D code, which are based on meeting the DNB design criterion.
Results
- a. One or more dropped RCCAs Single or multiple RCCAs within the same group result in a negative reactivity insertion (maximum absolute value for RCCA worth used in the analysis is a conservatively large 1000 pcm). The core is not adversely affected initially following a dropped RCCA(s) event since power is decreasing rapidly. Power may be re-established either by reactivity feedback or control bank withdrawal. The automatic rod withdrawal feature of the rod control system has been disabled. Therefore, following a dropped rod event the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, and a power overshoot is not predicted.
Figures 15.4-13 and 15.4-14 are generic curves for a typical transient response to a dropped RCCA (or RCCAs) without automatic rod withdrawal. In all cases, the minimum DNBR remains above the limit values.
Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.
- b. Dropped RCCA bank A dropped RCCA bank typically results in a reactivity insertion with an absolute value greater than 500 pcm. The core is not adversely affected during the insertion period, since power is decreasing rapidly. The transient
the plant.
- c. Statically misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where bank D is inserted to rod insertion limits with one D bank rod fully withdrawn, or any one RCCA fully inserted. Multiple independent alarms, including a bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one control rod fully inserted, or any one D bank control rod fully withdrawn without the DNBR failing below the limiting value.
The insertion limits in the Technical Specifications may vary depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for a position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor (Section 4.4) allows. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle depending on fuel arrangements.
For the RCCA misalignment with bank D inserted to its full power insertion limit and one other RCCA fully inserted, DNBR does not fall below the limit value. A DNB statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case was analyzed assuming nominal full power, nominal RCS pressure, nominal RCS average temperature, and minimum measured RCS flow, with the increased radial peaking factor associated with the misaligned RCCA.
Calculations have not been specifically performed for RCCAs missing from other control banks which are permitted to be either fully or partially inserted at part power conditions. However, it has been determined on a generic basis that the increase in radial peaking factor necessary to reach the DNBR limit at reduced power conditions is greater than the credible increase in radial peaking factors associated with reduced thermal power levels and deeper permitted control bank insertion. Therefore, the full power case discussed above with bank D at the insertion limit is more limiting than any credible part power RCCA misalignment scenario involving rods at the rod insertion limit.
with VIPRE-D, as discussed in Section 15.0.3.1, based on the system conditions at the time of the minimum DNBR. The results met the applicable limit as specified in Section 4.4. This case is analyzed assuming the initial reactor power, pressure, and RCS temperatures are at their nominal values, but with the increased radial peaking factor associated with the misaligned RCCA.
DNB does not occur for the RCCA misalignment incident, and thus the ability of the primary coolant to remove heat from the fuel rod is not reduced. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.
Following the identification of an RCCA misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.
- 2. Single RCCA Withdrawal Method of Analysis Core power distributions simulating a single RCCA withdrawal event are calculated using the computer code Simulate5. The case of the worst rod withdrawal from control bank D inserted at the insertion limit, with the reactor initially at full power, is identified and analyzed. The purpose of this calculation is to confirm that the number of fuel rods that experience DNB is less than the safety analysis limit of 5 percent. The Simulate5 calculated peaking factors are compared to the design peaking factor used to set the over temperature T trip. Over temperature T trip setpoints are established to prevent exceeding DNBR limits. If the calculated peaking factors are above the design peaking factor limit, including appropriate calculational uncertainty, a fuel census is generated for the most limiting case to determine the percentage of rods in the core which exceed the design peaking factor. All rods which exceed the design peaking factor are assumed to undergo DNB prior to reaching the power and coolant conditions that would trip the plant on over temperature T.
The Simulate5 calculations are performed at the time in core life which has the highest peak FH. Power distributions are generated for unique combinations of control bank D inserted to the full power insertion limit, with one control bank D RCCA fully withdrawn. Xenon reconstruction is used to skew the axial flux difference to the upper allowable limit. The most limiting configuration is determined by the case that produces the highest peaking factors under these conditions.
- a. Since the automatic rod withdrawal capability has been disabled, only the manual case for the single rod withdrawal event is considered. Continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the limit value. Evaluation of this case at the power and coolant conditions at which the over temperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the safety analysis limit value is 5 percent.
For the above event a reactor trip results, although not sufficiently fast in all instances to prevent a minimum DNBR in the core of less than the limit value. Following reactor trip, normal shutdown procedures may be followed to further cooldown the plant.
4.3.3 Conclusions cases of dropped single RCCAs or dropped banks, the DNBR remains greater than the limit e; therefore, the DNB design basis is met.
all cases of any RCCA fully inserted, or bank D inserted to its rod insertion limit with any le RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than limit value. Thus, the DNB design basis as described is Section 4.4 is met.
the case of the accidental withdrawal of a single RCCA, with the reactor initially operating at power with bank D at the insertion limit, an upper bound of the number of fuel rods eriencing DNB is 5 percent of the total fuel rods in the core.
.3.4 Radiological Consequences pecific radiological release calculation was not performed following a rod cluster control mbly misoperation. The cases of dropped single RCCAs or dropped banks, and the case of ically misaligned RCCA, do not result in a fuel failure. The case of accidental withdrawal of a le RCCA results in a limited fuel damage which is bounded by the reactor coolant pump shaft ure event discussed in Section 15.3.3.
s accident is precluded by technical specifications and administrative procedures.
.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE s section is not applicable to Millstone 3.
.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT 4.6.1 Identification of Causes and Accident Description accident scenario considered here is the inadvertent opening of the primary water makeup trol valve and failure of the blend system, either by controller or mechanical failure. The ition of unborated water to the RCS results in a positive reactivity insertion and an erosion of ilable shutdown margin. For at power and start-up conditions, technical specification Modes 1 2, the dilution accident erodes the shutdown margin made available through reactor trip. For tdown mode initial conditions, technical specification Modes 3, 4, 5, and 6, the dilution dent erodes the shutdown margin inherent in the borated RCS inventory and that which may rovided by control rods (control and shutdown banks) made available through reactor trip.
accident is mitigated by the manual isolation of the dilution flow path and the initiation of ated flow to the RCS. Unchecked, the reactivity addition due to an inadvertent boron dilution lead to the loss of shutdown margin. In Modes 1 and 2 (power and start-up), this would result n increase in power level and/or loss of the capability to maintain subcriticality following the of the control rods. In the shutdown modes, the reactivity insertion may cause criticality and plete loss of shutdown margin if all control rods are inserted or may cause complete loss of tdown margin and criticality following reactor trip if rods were available for insertion.
the at power modes, the analysis is performed to identify the amount of time available for rator mitigation of an inadvertent boron dilution prior to complete loss of shutdown margin.
calculated time is presented as that required for operator or automatic action to effectively gate the accident prior to complete loss of shutdown margin. For the shutdown modes, lyses are performed to define minimum shutdown margin requirements. These shutdown gin requirements ensure that minimum time requirements are met for the time from alarm/
cation to loss of shutdown margin. The analyses for all modes are performed employing servative assumptions.
r to complete loss of shutdown margin, RCS and core transient parameters are predicted to be hin the bounds of those calculated for other FSAR non-LOCAs. Therefore, the FSAR boron tion accident is not limiting with respect to the critical non-LOCA acceptance criteria such as
iting Dilution Flow Path limiting dilution flow path is identified as the lowest resistance flow path for an unintentional tion. The boron dilution analysis excludes deliberate dilution operations from considerations.
ing intentional boron dilution operations, the plant operators are keenly aware of and tinuously monitor the dilution process in progress for any sign of deviation or malfunction, h that the possibility of an undetected malfunction is considered remote. This is a standard mption in the boron dilution analysis methodology. Thus the limiting boron dilution flow path s not include either the normal dilute or the alternate dilute flow paths (these paths are used y for deliberate dilution operations). The limiting boron dilution flow path is the makeup flow of the PGS used in normal boration/blend operations.
most probable limiting dilution event is the misoperation of the CVCS reactor makeup trol system (RMCS). The specific accident scenario identified is the inadvertent operation of primary makeup control valve (FCV-111A) and failure of the blend system (either by troller or mechanical failure) which permits the primary makeup water system to inject ctly to the charging pump suction (at the VCT outlet) without being blended with boric acid at maximum rate permitted by the piping system (FT-111 fails forcing FCV-111A in the full-n position). The limiting dilution flow rate for this scenario has been concluded to be 150 gpm Mode 1 through Mode 6. For conservatism, all the analyses for the boron dilution event med 150 gpm dilution flow rate.
these limiting flow rates to be valid, valve V305 must be under strict administrative cedures during Modes 1-6 as required by plant technical specifications.
ety Functions and Mitigating Systems inadvertent boron dilution event due to a CVCS malfunction will be manually terminated.
nual actions taken by the operator are as follows:
Identification of the accident Isolation of the dilution flow path Initiation of RCS boration Manual reactor trip (if necessary) expected sources of dilution may be terminated by closing isolation valves in the CVCS. The shutdown margin (SDM) may be regained by the opening of isolation valves to the RWST, allowing the addition of borated water from the RWST to the RCS.
status of the RCS makeup is continuously available to the operator by the following:
- 2. CVCS and reactor makeup water system (RMWS) status lights for the following pumps:
- a. Charging pumps
- b. Boric acid transfer pumps
- c. Primary grade water supply pumps
- 3. Deviation alarms, if the boric or blended flow rates deviate from the preset values
- 4. Source range neutron flux when the reactor is subcritical
- a. Indicated source range neutron flux count rates
- b. Audible source range neutron flux count rate
- c. Source range neutron flux doubling alarm
- 5. When the reactor is critical
- a. Axial flux difference alarm (reactor power 50 percent RTP)
- b. Control rod insertion limit low and low-low alarms
- c. Overtemperature T alarm (at power)
- d. Overtemperature T turbine runback (at power)
- e. Overtemperature T reactor trip
- f. Power range neutron flux high, both high and low set point reactor trips.
ety Analysis Criteria & Regulatory Requirements s event is classified as an ANS Condition II incident and as such can, at worst, result in a tor trip with the plant capable of complete recovery and resumption of plant operation within requirements of the technical specifications. Condition II criteria are met if analyses results onstrate the following:
- 1. Minimum DNBR is greater than or equal to the design limit
- 2. Fuel centerline temperature is less than the bounding melt temperature given in Section 4.2.1.1 corresponding to the maximum allowed fuel burnup.
se specific criteria satisfy the relevant requirements of 10 CFR Part 50, Appendix A, GDC 10 15, and Section III, Article NB-7000 of the ASME Boiler and Pressure Vessel Code. The lysis assumptions used for this event satisfy the requirements of 10 CFR Part 50, Appendix A, C 26, by assuring that appropriate margin for malfunctions, such as stuck rods, are accounted discussed previously, the analysis for this event determines the amount of time available for rator mitigation of the boron dilution event prior to the complete loss of shutdown margin. If calculated time is accepted as being sufficient, it can be assumed that manual actions will ctively prevent the complete loss of minimum allowable shutdown margin. Because shutdown gin is not lost, the condition of the plant at any point in the transient is within the bounds of e calculated for other FSAR Condition II transients. If the above Condition II criteria are wn to be met for the balance of the FSAR Condition II transients and the calculated amount of e is accepted as sufficient for the successful mitigation of the dilution event, it can be cluded that the above criteria are met for the FSAR boron dilution accident.
ce the sequences of events that may occur depend on plant conditions at the time of the vertent dilution, a broad range of initial operating conditions must be considered. The rating modes to be considered are refueling (Mode 6), cold shutdown (Mode 5), hot shutdown de 4), hot standby (Mode 3), start-up (Mode 2), and power (Mode 1 both automatic and ual rod control). In all cases, the minimum time intervals available to the operator before a of shutdown margin occurs are calculated from the time an alarm alerts the operator to a tion, not from the time the dilution begins. The minimum available operator action times for various modes must be greater than or equal to the following:
de 6 Refueling 30 minutes de 5 Cold Shutdown 15 minutes de 4 Hot Shutdown 15 minutes de 3 Hot Standby 15 minutes de 2 Start-up 15 minutes de 1 Power Operation 15 minutes
.6.2 Analysis of Effects and Consequences hod of Analysis servative analysis assumptions for each mode of operation were used; i.e., high RCS critical on concentrations, high boron worths, minimum shutdown margins, and minimum RCS umes. These assumptions result in conservative determinations of the time available for rator or system response after detection of a dilution transient in progress. For Operating
es are greater than the above specified minimum requirements.
Operating Modes 3, 4, and 5, the boron dilution event is analyzed to generate minimum tdown margin requirements as a function of the critical boron concentration. The solution nique employed assumes the presence of the flux multiplication alarm and quantifies the unt of time available from the triggering of the alarm to the loss of shutdown margin.
each shutdown mode considered, the dilution event is analyzed assuming a conservatively ll dilution volume and the 150 gpm dilution flow rate previously defined. Combinations of al and critical boron concentrations are determined that produce a predicted time to critical corresponds to the minimum safety analysis acceptance criteria. For Modes 3, 4, and 5, the lting shutdown margin versus critical boron concentration curves guarantee the operator a imum of 15 minutes from alarm to criticality following initiation of the assumed boron tion. The analysis assumes that a doubling of the count rate, as detected by the Shutdown gin Monitor (SMM) (see Section 7.6.10), is required to initiate an alarm and a 10-second y time in the actual alarm actuation is also included. Acceptable values of minimum count and alarm ratio for the SMM are specified in the plant Core Operating Limits Report (COLR) ssure that the 15 minute operator action time and count rate doubling criteria are maintained.
ution During Refueling (Mode 6) analysis is not performed for an uncontrolled boron dilution accident during refueling. In this de, the event is prevented by the Technical Specifications for all potentially unborated water s to the CVCS to preclude the addition of unborated water to the reactor vessel via the CVCS.
ution During Cold Shutdown (Mode 5) plant is maintained in the cold shutdown mode when RCS temperatures of less than or equal 00F are required. Occasionally, reduced RCS Inventory may be necessary. Mode 5 can also transition mode to either refueling (Mode 6) or hot shutdown (Mode 4). The water level can ropped to the midplane of the hot leg for maintenance work that requires the steam generators e drained. Throughout the cycle, the plant may enter Mode 5 if reduced temperatures are uired in containment or as the result of a technical specification action statement. The plant is ntained in Mode 5 at the beginning of cycle for start-up testing of certain systems. During this de of operation, the control banks are fully inserted. The following conditions are assumed for ncontrolled boron dilution during cold shutdown.
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum water volume (3885 ft3) in the RCS is used. This is a conservative estimate of the active volume of the RCS while on one train of residual heat removal (RHR). This active volume does not include the reactor vessel upper head volume.
inistrative controls which isolate the RCS from the potential source of unborated water.
ertheless, analysis has been performed, and shutdown margin versus critical boron centration plots provided for a Mode 5 drained case. The minimum water volume for this nario in the RCS is 3624 ft3.
ution During Hot Shutdown (Mode 4) ode 4, the plant is being taken from a short term mode of operation, cold shutdown (Mode 5),
long term mode of operation, hot standby (Mode 3). Typically, the plant is maintained in the shutdown mode to achieve plant heatup before entering Mode 3. The plant is maintained in de 4 at the beginning of cycle for start-up testing of certain systems. Throughout the cycle, the t will enter Mode 4 if reduced temperatures are required in containment or as a result of a nical specification action statement. During this mode of operation, the control banks are y inserted. In Mode 4 the primary coolant forced flow which provides mixing can be provided ither the RHR system or a reactor coolant pump, depending on system pressure. The owing conditions are assumed for an uncontrolled boron dilution during hot shutdown:
- 1. The assumed dilution flow (150 gpm) is the best estimate maximum flow from the RMWS assuming multiple simultaneous failure of control valves.
- 2. In this mode for Millstone 3, RCS flow is conservatively assumed to be provided by the RHR system. With no RCP in operation during hot shutdown (with the required RHR pumps in operation), a conservatively low RCS water volume (3885 ft3) is used. This active volume does not include the reactor vessel upper head volume.
- 3. Perfect mixing in the RCS is assumed.
ution During Hot Standby (Mode 3) ing this mode, rod control is in manual and the rods can be either withdrawn or inserted. In de 3, all reactor coolant pumps may not be in operation. In an effort to balance the heat loss ugh the RCS and the heat removal of the steam generators, one or more of the pumps may be t off to decrease heat input into the system. In the approach to Mode 2, the operator must ually withdraw the control rods and may initiate a limited dilution according to shutdown gin requirements not simultaneously. If the shutdown or control banks are withdrawn, the tion scenario is similar to the Mode 2 analysis where the failure to block the source range trip lts in a reactor trip and immediate shutdown of the reactor. The dilution scenario is more ting if the control rods are not withdrawn and the reactor is shut down by boron to the nical specifications minimum requirement for Mode 3. The following conditions are med for an uncontrolled boron dilution during hot standby:
- 2. A minimum water volume (8760 ft3) in the RCS is used. This volume corresponds to the active volume of the RCS with one RCP in operation, excluding the pressurizer and the surge line. The volume specified here is conservative in that no consideration is given to mixing in the upper head region.
- 3. This mode is explicitly analyzed for four-loop operation.
ution During Start-up (Mode 2) his mode, the plant is being taken from one long term mode of operation, hot standby, to ther, power operation. The plant is maintained in the start-up mode only for the purpose of t-up testing at the beginning of each cycle. Assumed conditions at start-up require the reactor ave available at least 1.30 percent k shutdown margin. The following conditions are assumed an uncontrolled boron dilution during start-up:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This active RCS volume for Mode 2 includes the reactor vessel plus the active loops. Nonmixing regions (i.e., the pressurizer and surge line) are not included.
s mode of operation is a transitory operational mode in which the operator intentionally dilutes withdraws control rods to take the plant critical. During this mode, the plant is in manual trol with the operator required to maintain a very high awareness of the plant status. For a mal approach to criticality, the operator must manually initiate a limited dilution and sequently manually withdraw the control rods, a process that takes several hours. The nical specifications require that the shutdown margin shall be determined, prior to roaching criticality, to be above the minimum requirement by verifying that the predicted ition of the rods is within the rod insertion limits, thus assuring that the reactor does not go cal with the control rods below the insertion limits. Once critical, the power escalation must ufficiently slow to allow the operator to manually block the source range reactor trip minally at 105 cps) after receiving P-6 from the intermediate range. Too fast a power escalation e to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time anually block the source range reactor trip. Failure to perform this manual action results in a tor trip and immediate shutdown of the reactor.
wever, in the event of an unplanned approach to criticality or dilution during power escalation le in the start-up mode, the plant status is such that minimal impact will result. The plant will wly escalate in power to a reactor trip on the power range neutron flux low set point. After tor trip, the operator has more than 15 minutes to determine the cause of dilution, isolate the
ution During Power Operation (Mode 1) de 1 is divided into two cases. The first case is with the reactor in the manual Tavg/rod control de; the second case is with the reactor in automatic rod control. With the reactor in manual rod trol, dilution will result in a positive reactivity insertion and the power and temperature rise cause the reactor to reach the over temperature T trip set point resulting in a reactor trip. In case, the boron dilution transient up to the time of trip is essentially equivalent to an ontrolled RCCA bank withdrawal at power. With the reactor in automatic rod control, the er and temperature increase from boron dilution results in insertion of the control rods and a rease in the available shutdown margin. As the dilution and rod insertion continue, the rod rtion limit alarms (low and low-low settings) and axial flux difference alarm alert the operator a dilution event is in progress and that the technical specification requirement for shutdown gin may be challenged.
effective reactivity addition rate primarily is a function of the dilution rate, boron centration, and boron worth. The following conditions are assumed for an uncontrolled boron tion during full power:
- 1. The assumed dilution flow (150 gpm) is the maximum flow from the RMWS assuming multiple simultaneous failures of control valves.
- 2. A minimum RCS water volume of 9452 ft3. This corresponds to a conservative estimate of the active RCS volume excluding the pressurizer and surge line.
- 3. A 1.3 percent minimum shutdown margin is assumed in the analysis.
h the reactor in manual control, a boron dilution event will result in an increase in the power temperature followed by a reactor trip on the over temperature T trip set point if no operator on is taken. Following reactor trip, the operator has greater than 15 minutes to terminate the sient. In this case, the boron dilution accident up to the time of reactor trip is essentially tical to the RCCA withdrawal at power accident. In addition, prior to the over temperature T
, an over temperature T alarm and turbine runback would be actuated. There is adequate time ilable after a reactor trip for the operator to determine the cause of dilution, isolate the orated water source, and initiate boration before the reactor can return to criticality. Mode 1 lts are summarized in Table 15.4-1.
h the reactor in automatic control, the power and temperature increase from boron dilution lts in insertion of the RCCAs and a decrease in the shutdown margin. The rod insertion limit ms (low and low-low settings) provide the operator with greater than 15 minutes after reactor to determine the cause of the dilution, isolate the unborated water source, and initiate boration ore the total shutdown margin is lost.
operating Modes 1 through 5, the results presented above show that adequate time is available the operator to manually terminate the source of dilution flow, assuming the specified tdown margin requirements are met. Following termination of the dilution flow, the operator initiate boration to recover the shutdown margin.
analysis is presented for Mode 6 operation since dilution during refueling is precluded by the hnical Specifications requirements.
.6.4 Radiological Consequences ce no fuel failure is postulated for this transient, a specific radiological release calculation was performed.
.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY IN AN IMPROPER POSITION
.7.1 Identification of Causes and Accident Description l and core loading errors, such as those which can arise from the inadvertent loading of one or e fuel assemblies into improper positions, loading a fuel rod during manufacture with one or e pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture h pellets of the wrong enrichment, lead to increased heat fluxes if the error results in placing in core positions calling for fuel of lesser enrichment. Also included among possible core ing errors is the inadvertent loading of one or more fuel assemblies without burnable poison s when burnable poison rods are specified.
or in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which more peaked than those calculated with the correct enrichments. There is a 5 percent ertainty margin included in the design value of power peaking factor assumed in the analysis ondition I and Condition II transients. The incore system of movable flux detectors which is d to verify power shapes at the start of life, is capable of revealing any assembly enrichment r or loading error which causes power shapes to be peaked in excess of the design value.
educe the probability of core loading errors, each fuel assembly is marked with an tification number and loaded in accordance with a core loading diagram. During core loading, identification number is checked before each assembly is moved into the core. Serial numbers during fuel movement are subsequently recorded on the loading diagram as a further check roper placing after the loading is completed.
power distribution misplaced fuel assemblies with significant different burnup would raise king factors and would be readily observable with incore flux monitors. In addition to the flux nitors, thermocouples are located at the outlet of about one third of the fuel assemblies in the
. There is a high probability that these thermocouples would also indicate any abnormally
s event is classified as an ANS Condition III incident (an infrequent fault) as defined in tion 15.0.1.
.7.2 Analysis of Effects and Consequences hod of Analysis dy state power distribution in the x-y plane of the core is calculated using the TURTLE Code CAP-7213-A and WCAP-7758-A) based on macroscopic cross section calculated by the OPARD Code (WCAP-3269-26). A discrete representation is used wherein each individual rod is described by a mesh interval. The power distribution in the x-y plane for a correctly ed core assembly is also given in Chapter 4 based on enrichments given in that section.
each core loading error case analyzed, the typical percent deviations from detector readings a normally loaded core are shown at all incore detector locations (Figures 15.4-21 through 4-25, inclusive).
ults following core loading error cases have been analyzed.
e A:
e in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case sidered was the interchange to two adjacent assemblies near the periphery of the core ure 15.4-21).
e B:
e in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly.
o analyses have been performed for this case (Figures 15.4-22 and 15.4-23).
ase B-1, the interchange is assumed to take place with the burnable poison rods transferred h the Region 2 assembly mistakenly loaded into Region 1.
ase B-2, the interchange is assumed to take place closer to core center and with burnable on rods located in the correct Region 2 Position, but in a Region 1 assembly mistakenly ed in the Region 2 position.
e C:
ichment error: Case in which a Region 2 fuel assembly is loaded in the core central position ure 15.4-24).
e in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core phery (Figure 15.4-25).
.7.3 Conclusions l assembly enrichment errors would be prevented by administrative procedures implemented abrication.
he event that a single pin or pellet has a higher enrichment than the nominal value, the sequences in terms of reduced DNBR and increased fuel and clad temperatures are limited to incorrectly loaded pin or pins and perhaps the immediately adjacent pins.
l assembly loading errors are prevented by administrative procedures implemented during loading. In the unlikely event that a loading error occurs, analyses in this section confirm that lting power distribution effects are either readily detected by the incore movable detector em or cause a sufficiently small perturbation to be acceptable within the uncertainties allowed ween nominal and design power shapes.
.7.4 Radiological Consequences re are no radiological consequences associated with inadvertent loading and operation of a assembly in an improper position since activity is retained within the fuel rods and reactor lant system.
.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS
.8.1 Identification of Causes and Accident Description s accident is defined as the mechanical failure of a control rod mechanism pressure housing, lting in the ejection of a RCCA and drive shaft. The consequence of this mechanical failure is pid positive reactivity insertion together with an adverse core power distribution, possibly ing to localized fuel rod damage.
.8.1.1 Design Precautions and Protection tain features in the Millstone 3 pressurized water reactor are intended to preclude the sibility of a rod ejection accident, or to limit the consequences if the accident were to occur.
se include a sound, conservative mechanical design of the rod housings, together with a ough quality control (testing) program during assembly, and a nuclear design which lessens potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high er levels.
mechanical design is discussed in Section 4.6. Mechanical design and quality control cedures intended to preclude the possibility of a RCCA drive mechanism housing failure are d below.
- 1. Each full length control rod drive mechanism housing is completely assembled and shop tested at 4,100 psi.
- 2. The mechanism housings are individually hydrotested after they are attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed reactor coolant system.
- 3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments induced by the design basis earthquake can be accepted within the allowable primary stress range specified by the American Society of Mechanical Engineers (ASME) Code,Section III, for Class 1 components.
- 4. The latch mechanism housing and rod travel housing are each a single length of forged Typed 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.
gnificant margin of strength in the elastic range together with the large energy absorption ability in the plastic range gives additional assurance that gross failure of the housing will not ur. The joints between the latch mechanism housing and head adapter, and between the latch hanism housing and rod travel housing, are threaded joints reinforced by canopy type rod ds. Administrative regulations require periodic inspections of these (and other) welds.
lear Design n if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant zing chemical shim is such that the severity of an ejected RCCA is inherently limited. In eral, the reactor is operated with the RCCAs inserted only far enough to control design flux pe. Reactivity changes caused by core depletion and xenon transients are compensated by on changes. Further, the location and grouping of control RCCA banks are selected during the lear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ted from its normal position during full power operation, only a minor reactivity excursion, at st, could be expected to occur. However, it may be occasionally desirable to operate with er than normal insertions. For this reason, a rod insertion limit is defined as a function of er level. Operation with the RCCAs withdrawn above this limit guarantees adequate tdown capability and acceptable power distribution. The position of all RCCAs is tinuously indicated in the control room. An alarm occurs if a bank of RCCAs approaches its rtion limit or if one RCCA deviates from its bank. Operating instructions require boration at level alarm and immediate boration at the low-low alarm.
reactor protection in the event of a rod ejection accident has been described in WCAP-7588.
protection for this accident is provided by high neutron flux trip (high and low setting) and h rate of neutron flux increase trip. These protection functions are described in detail in tion 7.2.
cts on Adjacent Housings regarding the remote possibility of the occurrence of a RCCA mechanism housing failure, stigations have shown that failure of a housing due to either longitudinal or circumferential king would not cause damage to adjacent housings. The full length control rod drive hanism is described in Section 3.9N.4.
cts of Rod Travel Housing Longitudinal Failures longitudinal failure of the rod travel housing should occur, the region of the position indicator mbly opposite the break would be stressed by the reactor coolant pressure of 2,250 psia. The t probable leakage path would be provided by the radial deformation of the position indicator assembly, resulting in the growth of axial flow passages between the rod travel housing and hollow tube along which the coil assemblies are mounted.
ilure of the position indicator coil assembly should occur, the resulting free radial jet from the ed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings e on the periphery, they might bend outward from their bases. The housing material is quite tile; plastic hinging without cracking would be expected. Housing adjacent to a failed housing, ocations other than the periphery, would not be bent because of the rigidity of multiple cent housings.
ct of Rod Travel Housing Circumferential Failures rcumferential failure of a rod travel housing should occur, the broken off section of the sing would be ejected vertically because the driving force is vertical and the position indicator assembly and the drive shaft would tend to guide the broken-off piece upwards during its el. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When projectile reached the missile shield it would partially penetrate the shield and dissipate its tic energy. The water jet from the break would continue to push the broken-off piece against missile shield.
e broken-off piece of the rod travel housing were short enough to clear the break when fully ted, it would rebound after impact with the missile shield. The top end plates of the position cator coil assemblies would prevent the broken piece from directly hitting the rod travel sing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, low kinetic energy of the rebounding projectile would not be expected to cause significant age.
m the above discussion, the probability of damage to an adjacent housing must be considered ote. However, even if damage is postulated, it would not be expected to lead to a more severe sient, since RCCAs are inserted in the core in symmetric patterns, and control rods ediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage n adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; ever, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ted rod.
mary considerations given above lead to the conclusion that failure of a control rod housing, due er to longitudinal or circumferential cracking, would not cause damage to adjacent housings would increase severity of the initial accident.
.8.1.2 Limiting Criteria s event is classified as an ANS Condition IV incident. See Section 15.0.1 for a discussion of S classifications. Due to the extremely low probability of a RCCA ejection accident, some damage could be considered an acceptable consequence.
mprehensive studies of the threshold of fuel failure and of the threshold of significant version of the fuel thermal energy to mechanical energy have been carried out as part of the RT project by the Idaho Nuclear Corporation (Taxelius 1970). Extensive tests of UO2 onium clad fuel rods representative of those in pressurized water reactor type cores have onstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a htly different design have exhibited failures as low as 225 cal/gm. These results differ ificantly from the TREAT (Liimataninen and Testa 1966) results, which indicated a failure shold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10 ent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to hanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated s and 200 cal/gm for irradiated rods; catastrophic failure, (large fuel dispersal, large pressure
) even for irradiated rods, did not occur below 300 cal/gm.
iew of the above experimental results, criteria are applied to ensure that there is little or no sibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These eria are as follows.
- 1. Average fuel pellet enthalpy at the hot spot below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.
- 2. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.
above.
4.8.2 Analysis of Effects and Consequences hod of Analysis calculation of the RCCA ejection transient is performed in two stages, first an average core nnel calculation and then a hot spot calculation. The average core calculation is performed g spatial neutron kinetics methods to determine the average power generation with time uding the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.
halpy and temperature transients in the hot spot are then determined by multiplying the rage core energy generation by the hot channel factor and performing a fuel rod transient heat sfer calculation. The power distribution calculated without feedback is pessimistically med to persist throughout the transient.
etailed discussion of the method of analysis can be found in WCAP-7588, Rev. 1-A.
rage Core Analysis spatial kinetics computer code, TWINKLE (WCAP-7979-A and WCAP-8028-A) is used for average core transient analysis. This code uses cross sections generated by LEOPARD CAP-3269-26) to solve the two group neutron diffusion theory kinetic equation in one, two, or e spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 8,000 ial points. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat sfer model for calculation of pointwise Doppler and moderator feedback effects. In this lysis, the code is used as a one dimensional axial kinetics code since it allows a more realistic esentation of the spatial effects of axial moderator feedback and RCCA movement. However, e the radial dimension is missing, it is still necessary to employ very conservative methods cribed below) of calculating the ejected rod worth and hot channel factor. Further description WINKLE appears in Section 15.0.11.
Spot Analysis he hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel or. During the transient, the heat flux hot channel factor is linearly increased to the transient e in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that hot spot before and after ejection are coincident. This is very conservative since the peak after tion occurs in or adjacent to the assembly with the ejected rod, and prior to ejection the power his region is necessarily depressed.
hot spot analysis is performed using the detailed fuel and clad transient heat transfer puter code, FACTRAN (WCAP-7908-A). This computer code calculates the transient perature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the ace of the rod, using as input the nuclear power versus time and the local coolant conditions.
o, consistent with the PAD5 fuel performance code (WCAP-17642-P-A, Rev. 1), the effects of thermal conductivity degradation with burnup are accounted for in the analysis.
CTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer ore DNB, and the Bishop-Sandberg-Tong correlation (Bishop, Sandberg, and Tong 1965) to rmine the film boiling coefficient after DNB. The Bishop-Sandberg-Tong correlation is servatively used assuming zero bulk fluid quality. The DNBR is not calculated; instead the e is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer fficient can be calculated by the code; however, it is adjusted in order to force the full power dy state temperature distribution to agree with the fuel heat transfer design codes. Further cription of FACTRAN appears in Section 15.0.11.
tem Overpressure Analysis ause safety limits for fuel damage specified earlier are not exceeded, there is little likelihood uel dispersal into the coolant. The pressure surge may therefore be calculated on the basis of ventional heat transfer from the fuel and prompt heat generation in the coolant.
pressure surge was calculated generically (WCAP-7588, Rev. 1-A) by first performing the heat transfer calculation to determine the average and hot spot heat flux versus time. Using heat flux data, a THINC (Section 4.4) calculation was conducted to determine the volume
- e. Finally, the volume surge was simulated in a plant transient computer code. This code ulates the pressure transient taking into account fluid transport in the RCS and heat transfer to steam generators. No credit is taken for the possible pressure reduction caused by the assumed ure of the control rod pressure housing.
.8.2.1 Calculation of Basic Parameters ut parameters for the analysis are conservatively selected on the basis of values calculated for type of core. The more important parameters are discussed below. Table 15.4-3 presents the meters used in this analysis.
cted Rod Worths and Hot Channel Factors values for ejected rod worths and hot channel factors are calculated using either three ensional static methods or by a synthesis method employing one dimensional and two ensional calculations. The computer codes as described in Table 4.1-2 are used in the analysis.
credit is taken for the flux flattening effects of reactivity feedback. The calculation is ormed for the maximum allowed bank insertion at a given power level, as determined by the insertion limits. Adverse xenon distributions are considered in the calculation to provide st case results.
sification.
er distribution before and after ejection for a worst case can be found in WCAP-7588, Rev.
. During initial plant startup physics testing, ejected rod worths and power distributions were sured in the zero and full power configurations and compared to values used in the analysis. It been found that the ejected rod worth and power peaking factors are consistently rpredicted in the analysis.
ctivity Feedback Weighting Factors largest temperature rises, and hence the largest reactivity feedbacks occur in channels where power is higher than average. Since the weight of a region is dependent of flux, these regions e high weights. This means that the reactivity feedback is larger than that indicated by a ple channel analysis. Physics calculations have been carried out for temperature changes with at temperature distribution, and with a large number of axial and radial temperature ributions. Reactivity changes were compared and effective weighting multipliers which when lied to single channel feedbacks correct them to effective whole core feedbacks for the ropriate flux shape. In this analysis, since a one dimensional (axial) spatial kinetics method is loyed, axial weighting is not necessary if the initial condition is made to match the ejected rod figuration. In addition, no weighting is applied to the moderator feedback. A conservative al weighting factor is applied to the transient fuel temperature to obtain an effective fuel perature as a function of time accounting for the missing spatial dimension. These weighting ors have also been shown to be conservative compared to three dimensional analysis CAP-7588, Rev. 1-A).
derator and Doppler Coefficient critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the lear code in order to obtain moderator density coefficient curves which are conservative pared to actual design conditions for the plant. As discussed above, no weighting factor is lied to these results.
Doppler reactivity defect is determined as a function of power level using a one dimensional dy state computer code with a Doppler weighting factor of 1.0. The Doppler defect used is en in Table 15.4-3. The Doppler weighting factor increases under accident conditions, as ussed above.
ayed Neutron Fraction culations of the effective delayed neutron fraction (eff) typically yield values no less than 5 percent at beginning-of-life and 0.40 percent at end-of-life. The accident is sensitive to eff if ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow
ent at end of cycle were used in the analysis.
Reactivity Insertion trip reactivity insertion assumed is given in Table 15.4-3 and includes the effect of one stuck CA adjacent to the ejected rod. These values are reduced by the ejected rod reactivity. The tdown reactivity was simulated by dropping a rod of the required worth into the core. The start od motion occurred 0.5 seconds after the high neutron flux trip point was reached. This delay udes the delays for the instrument channel to produce a signal, for the trip breaker to open and the coil to release the rods. A curve of trip rod insertion versus time was used which assumed insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of h a conservative insertion rate means that there is over 1 second after the trip point is reached ore significant shutdown reactivity is inserted into the core. This conservatism is important for full power accidents.
minimum design shutdown margin available for this plant at hot zero power (HZP) may be hed only at end-of-life in the equilibrium cycle. This value includes an allowance for the st stuck rod, and adverse xenon distribution, conservative Doppler and moderator defects, and llowance for calculation uncertainties. The available margin is such that even after accounting the effect of two stuck RCCAs (one of which is the worst ejected rod), the reactor will be critical when the core return to HZP conditions following a reactor trip from an RCCA tion accident.
address the effects of the loss of primary system integrity as a result of the failed control rod sing, depressurization calculations have been performed for a typical four-loop plant, ming the maximum possible size break (2.75 inch diameter) located in the reactor pressure sel head. The results show a rapid pressure drop and a decrease in system water mass due to break. The safety injection system is actuated on low pressurizer pressure within 1 minute r the break. The RCS pressure continues to drop and reaches saturation (1,200 psi) in about 2 minutes. Due to the large thermal inertia of primary and secondary system, there has been no ificant decrease in the RCS temperature below no-load by this time, and the depressurization lf has caused an increase in shutdown margin by about 0.2 percent k due to the pressure fficient. The cooldown transient could not absorb the available shutdown margin until more 10 minutes after the break. The addition of borated (2,000 ppm) safety injection flow starting inute after the break is sufficient to ensure that the core remains subcritical during the ldown.
ctor Protection discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high tron flux trip (high and low setting) and high rate of neutron increase trip. These protection ctions are part of the reactor trip system. No single failure of the reactor trip system will negate protection functions required for the rod ejection accident, or adversely affect the sequences of the accident.
es are presented for both beginning and end-of-life at zero and full power.
- 1. Beginning of cycle, full power Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively set. The peak hot spot fuel centerline temperature reached the bounding melt temperature corresponding to a maximum fuel burnup of 62,000 MWD/MTU. However, it was restricted to less than 10 percent of the pellet.
- 2. Beginning of cycle, zero power For this condition, control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. Values were calculated for the ejected rod worth and the hot channel factor. The peak fuel centerline temperature was 4202F.
- 3. End of cycle, full power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively set. The peak hot spot fuel centerline temperature reached the bounding melt temperature corresponding to a maximum fuel burnup of 62,000 MWD/MTU. However, melting was restricted to less than 10 percent of the pellet.
- 4. End of cycle, zero power The ejected rod worth and hot channel factor for this case were calculated assuming control bank D to be fully inserted with banks C and B at their insertion limits. The peak fuel centerline temperature was 4209F. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor.
ummary of the parameters used for the above analysis is given in Table 15.4-3. The nuclear er and hot spot fuel and clad temperature transients for the worst cases (end of life, full power, end of life zero power) are presented on Figures 15.4-26 through 15.4-29.
calculated sequence of events for the worst case rod ejection accidents are presented in le 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear er excursion is terminated. As discussed previously in Section 15.4.8.2.1, the reactor remains critical following reactor trip.
ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel
- d. The effects and consequences of loss-of-coolant accidents are discussed in Section 15.6.5.
ion Product Release assumed that fission products are released from the gaps of all rods entering DNB. In all cases sidered, less than 10 percent of the rods entered DNB based on a detailed three dimensional NC analysis (WCAP-7588, Rev. 1-A). Although limited fuel melting at the hot spot was dicted for the beginning-of-life and the full power cases, in practice melting is not expected e the analysis conservatively assumed that the hot spots before and after ejection were cident.
ssure Surge etailed calculation of the pressure surge for an ejection worth of one dollar at inning-of-life, hot full power, indicates that the peak pressure does not exceed that which ld cause stress to exceed the faulted condition stress limits (WCAP-7588, Rev. 1-A). Since severity of the present analysis does not exceed the worst case analysis, the accident for this t does not result in an excessive pressure rise or further damage to the RCS.
ice Deformations rge temperature gradient exists in the region of the hot spot. Since the fuel rods are free to ve in the vertical direction, differential expansion between separate rods cannot produce ortion. However, the temperature gradients across individual rods may produce a differential ansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations e indicated that this bowing would result in a negative reactivity effect at the hot spot since tinghouse cores are under-moderated, and bowing tends to increase the under-moderation at hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be erved. In practice, no significant bowing is anticipated, since the structural rigidity of the core ore than sufficient to withstand the forces produced. Boiling in the hot spot region would duce a net flow away from that region. However, the heat from the fuel is released to the water tively slowly, and it is considered inconceivable that cross flow is sufficient to produce ificant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is othetically postulated, the large void fraction in the hot spot region would produce a reduction he total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net ct would therefore be a negative feedback. It can be concluded that no conceivable hanism exists for a net positive feedback resulting from lattice deformation. In fact, a small ative feedback may result. The effect is conservatively ignored in the analysis.
4.8.3 Conclusions n on a pessimistic basis, the analyses indicate that the described fuel and clad limits are not eeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since peak pressure does not exceed that which would cause stresses to exceed the faulted condition
RCS integrated break flow to containment following a rod ejection accident is shown on ure 15.4-30.
.8.4 Radiological Consequences radiological consequences of a postulated rod ejection accident incorporate the fuel failure des described in Regulatory Guide 1.183.
valuate the radiological consequences of a control rod ejection accident, it is assumed that 10 ent of the fuel rods experience clad damage, thereby releasing their respective gap activities he reactor coolant. The gap activity is assumed to be released instantaneously into the tainment atmosphere via the break in the reactor vessel head. In addition, it is further tulated that 0.25 percent of the core fuel experiences melting resulting in 100 percent of the le gases and 25 percent of iodines in the fraction of melted fuel to be available for release from containment. The releases to the environment from the secondary system are coincident with of offsite power and are assumed to continue for 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> until the RHR system is capable emoving all decay heat. The activity available for release from the secondary system due to ary to secondary leakage is based on 1) RCS at Technical Specification levels of reactor lant activity commensurate with 1 mCi/gm Dose Equivalent Iodine-131 (DEQ I-131), 2) 10%
he core gap activity (with associated release fractions of 10% noble gases and iodines) and
% of the activity from fuel melt (with associated release fractions of 100% noble gases and of iodines) and 3) S/G secondary system liquid activity at technical specification levels.
releases from containment are assumed to continue for 30 days after initiation of the accident.
inent parameters used to describe the releases are presented in Tables 15.4-4 and Table 15.6-IS signal is generated within 2 minutes following the accident which initiates secondary tainment. Assumptions regarding the time for the secondary containment to achieve negative sure are the same as that which was used for the LOCA analysis. The bypass leakage is ased unfiltered to the environment at ground level. The leakage which is not bypass leakage is med to be processed by the secondary containment filtration system. A more detailed cription of containment leakage is found in Section 15.6.5.4.
releases, together with the atmospheric dispersion factors listed in Table 15.0-11 and control m parameters in Table 15.6-12, are used to compute the doses to the Control Room, EAB and radiological consequences of a postulated rod ejection accident are analyzed with the rmation contained in Regulatory Guide 1.183 and the Standard Review Plan 15.0.1. The ulated dose results described in Table 15.0-8 for the rod ejection accident are presented
evaluated TEDE for the Control Room, EAB and LPZ is listed in Table 15.0-8. The ological consequences of the rod ejection accident are within the TEDE limits defined by CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control m personnel, and 6.3 rem to the EAB and LPZ.
.9 REFERENCES FOR SECTION 15.4
-1 Bishop, A. A.; Sandberg, R. O.; and Tong, L. S., 1965. Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux. ASME 65-HT-31.
-2 Liimataninen, R. C. and Testa, F. J. 1966. Studies in TREAT of Zircaloy-2-Clad, UO2 Core Simulated Fuel Elements. ANL-7225, January - June 1966, p. 177.
-3 WCAP-3269-26, 1963. Barry, R. F. LEOPARD - A Spectrum Dependent Non- spatial Depletion Code for the IBM-7094.
-4 WCAP-7213-A (Proprietary) and WCAP-7758-A (Nonproprietary), 1975. Barry, R. F.
and Altomare, S. The TURTLE 24.0 Diffusion Depletion Code.
-5 WCAP-7588, Revision 1-A, 1975. Risher, D. H., Jr. An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods.
-6 WCAP-7907-P-A (Proprietary), WCAP 7907-A (Nonproprietary), April 1984, Burnett, T. W. T., et al., LOFTRAN Code Description.
-7 WCAP-7908-A, 1989. Hargrove, H. G. FACTRAN - A Fortran-IV Code for Thermal Transients in a UO2 Fuel Rod.
-8 WCAP-7979-A (Proprietary) and WCAP-8028-A (Nonproprietary), 1975. Risher, D.
H., Jr. and Barry, R. F. TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code.
-9 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
-10 Taxelius, T. G. (Ed) 1970. Annual Report- Spert Project, October, 1968, September, 1969. Idaho Nuclear Corporation IN-1370.
-11 WCAP-11394-P-A (Proprietary), WCAP-11395-A (Nonproprietary), January 1990.
Haessler, R. L., et al., Methodology for the Analysis of the Dropped Rod Event.
-12 WCAP-14882-P-A (Proprietary), WCAP-15234-A (Nonproprietary), 1999. Huegel, D.S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
LOCA Thermal-Hydraulic Safety Analysis.
-14 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
-15 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, September 2014, Reactor Core Thermal Hydraulics Using the VIPRE-D Computer Code.
-16 O. Linsuain, et al., Westinghouse Performance Analysis and Design Model (PAD5),
WCAP-17642-P-A, Revision 1 (Proprietary), November 2017.
REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec) controlled RCCA bank Initiation of uncontrolled rod withdrawal from 0.00 hdrawal from a subcritical or 10-9 of nominal power
-power startup condition Power range high neutron flux low setpoint 10.86 reached Peak nuclear power occurs 10.99 Rods begin to fall into core 11.36 Minimum DNBR occurs 13.50 Peak heat flux occurs 13.50 Peak average clad temperature occurs 14.08 Peak average fuel temperature occurs 14.15 controlled RCCA bank hdrawal at power Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power high reactivity insertion rate (100 pcm/sec)
Power range high neutron flux high trip point 1.13 reached Rods begin to fall into core 1.63 Minimum DNBR occurs 2.6 Minimum reactivity Initiation of uncontrolled RCCA withdrawal at a 0.00 feedback 100% power small reactivity insertion rate (1.5 pcm/sec)
Overtemperature T, reactor trip point reached 85.35 Rods begin to fall into core 86.85 Minimum DNBR occurs 87.3 CS malfunction that results a decrease in the boron ncentration in the reactor olant Dilution during start-up Reactor trip on power range high neutron flux, 0.00 low setpoint Time to criticality for unmitigated event 900
Accident Event Time (sec)
Dilution during full-power operation
- a. Automatic reactor Dilution begins 0.00 control Time to criticality for unmitigated event 900
- b. Manual reactor control Dilution begins 0.00 Reactor trip signal on OTDT is generated 124 (power range high neutron flux) and operator initiates corrective action Time to criticality for unmitigated event 1024 d cluster control assembly ction accident End-of-life full power Initiation of rod ejection 0.00 Power range high neutron flux setpoint reached 0.04 Peak nuclear power occurs 0.13 Rods begin to fall into core 0.54 Peak fuel average temperature occurs 2.20 Peak clad temperature occurs 2.30 Peak heat flux occurs 2.31 End-of-life, zero power Initiation of rod ejection 0.00 Power range high neutron flux low setpoint 0.18 reached Peak nuclear power occurs 0.21 Rods begin to fall into core 0.68 Peak clad temperature occurs 1.53 Peak heat flux occurs 1.54 Peak average fuel temperature occurs 1.82
CONTROL ASSEMBLY EJECTION ACCIDENT Time in Life Beginning Beginning End End wer level (percent of RTP) 100.4 0 100.4 0 cted rod worth (percent K) 0.20 0.78 0.20 0.85 layed neutron fraction (percent) 0.50 0.50 0.40 0.40 edback reactivity weighting 1.232 2.081 1.355 3.765 p reactivity (percent K) 4.0 2.0 4.0 2.0 before rod ejection 2.60 -- 2.60 --
after rod ejection 5.0 11.5 6.0 26.0 ppler Defect (pcm, 0 to 10% power) -900 -900 -900 -900 mber of operational pumps 4 2 4 2
- x. fuel pellet average temperature (F) 4067 3655 4114 3765
- x. fuel centerline temperature (F) 5116 4202 5208 4209 x fuel stored energy (cal/gm) 178.0 156.6 180.5 162.4
ACCIDENT ANALYSIS Analysis Input Parameters Core thermal power including uncertainty (MWt) 3,723 Containment free volume (ft3) 2.35x106 Primary coolant concentrations Table 15.0-10 Primary to secondary leak rate (gpm) 1.0 Secondary coolant concentration Table 15.0-10 Failed fuel as a result of the accident (%) 10.0 Core activity Table 15.0-7 Quantity of fuel in the core which melts as a result of the accident (%) 0.25 Quantity of radionuclides from the melted fuel available for release from the containment (%):
- a. Iodine 25.0
- b. Noble gases 100 Quantity of radionuclides from the melted fuel available for release from the secondary side via primary-to-secondary leakage (%):
- a. Iodines 50.0
- b. Noble gases 100 Iodine partition factor in steam generator prior to and during accident 0.01 Offsite power Lost Steam release (lbm)
- a. 0 - 1200 seconds 2.000 E+05
- b. 2 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 3.246 E+06
- c. 24 - 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> 1.974 E+05 Containment leak rate (% per day)
- a. 0-24 hours 0.30
- b.24-720 hours 0.15 Bypass leakage (fraction of containment leakage) 0.06 Time between accident and equalization of primary and secondary 1200 pressures (sec)
Time to initiate SIS (min) 2
Analysis Input Parameters Time estimated for SLCRS to become effective (min) 2 Duration of leakage from containment (hr) 720.0 Iodine removal filter efficiency (%) 95.0 Steam generator liquid contents (lbm/SG) 100,933 RCS mass (lbm) 4.45 E+05 Credit for Sprays No Control Room Parameters Table 15.6-12 Containment Release Points Same as LOCA, see Table 15.6-9 Secondary Side Release Points EAB / LPZ Ground Level -
ventilation vent Control Room MSPRVs / MSSVs
- use MSVB X/Qs
Time (sec) Flow (lbm) 0.0 0.0 5.0 4,826.2 10.0 9,473.1 20.0 18,285.4 40.0 34,282.3 100.0 65,591.4 202.0 78,065.5 300.0 88,254.2 405.0 98,641.3 500.0 107,619.0 750.0 129,291.3 1,000.0 148,214.9 2,000.0 259,376.7 3,000.0 438,923.8 5,000.0 819,305.3 7,000.0 1,124,734.1 10,000.0 1,528,285.8 TE:
e between accident and equalization of primary and secondary system pressures = 140 sec.
TABLE 15.4-6 DELETED BY FSARCR PKG FSC 04-MP3-017 UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION
UNCONTROLLED RCCA WITHDRAWAL FROM A SUBCRITICAL CONDITION WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 1.4 1.2 Nuclear Power [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0.0 0 2 4 6 8 10 Time [seconds]
1.2 Core Heat Flux [Fraction of Nominal]
1.0 0.8 0.6 0.4 0.2 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-4 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 2330.0 2310.0 Pressurizer Pressure [psia]
2290.0 2270.0 2250.0 2230.0 2210.0 0 2 4 6 8 10 Time [seconds]
1190.0 1180.0 Pressurizer Water Volume [Cubic Feet]
1170.0 1160.0 1150.0 1140.0 1130.0 1120.0 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-5 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (100 PCM/SEC WITHDRAWAL RATE) 595.0 590.0 Vessel Average Temperature [deg-F]
585.0 580.0 575.0 570.0 565.0 0 2 4 6 8 10 Time [seconds]
10.0 9.0 8.0 7.0 6.0 DNBR 5.0 4.0 3.0 2.0 1.0 0.0 0 2 4 6 8 10 Time [seconds]
FIGURE 15.4-6 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 1.2 1.0 Nuclear Power [Fraction of Nominal]
0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
1.2 1.0 Core Heat Flux [Fraction of Nominal]
0.8 0.6 0.4 0.2 0.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-7 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 2400.0 2350.0 2300.0 Pressurizer Pressure [psia]
2250.0 2200.0 2150.0 2100.0 2050.0 2000.0 0 20 40 60 80 100 Time [seconds]
1500.0 1450.0 Pressurizer Water Volume [Cubic Feet]
1400.0 1350.0 1300.0 1250.0 1200.0 1150.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-8 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WER WITH MINIMUM REACTIVITY FEEDBACK (1.5 PCM/SEC WITHDRAWAL RATE) 605.0 600.0 Vessel Average Temperature [deg-F]
595.0 590.0 585.0 580.0 0 20 40 60 80 100 Time [seconds]
7.0 6.0 5.0 4.0 DNBR 3.0 2.0 1.0 0.0 0 20 40 60 80 100 Time [seconds]
FIGURE 15.4-9 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM FULL POWER 2.1 100% Pow w/Min Feedback 100% Pow w/Max Feedback 2
1.9 Minimum DNBR OTDT 1.8 HNF 1.7 1.6 1.5 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
FIGURE 15.4-10 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM 60% RTP 2.6 60% Pow w/Min Feedback 60% Pow w/Max Feedback 2.4 2.2 Minimum DNBR OTDT HNF 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
FIGURE 15.4-11 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
WITHDRAWAL FROM 10% RTP 3
10% Pow w/Min Feedback 2.8 10% Pow w/Max Feedbak 2.6 Minimum DNBR 2.4 OTDT HNF 2.2 2
1.8 1.6 1.4 1.0E-01 1.0E+00 1.0E+01 1.0E+02 Reactivity Insertion Rate [pcm/sec]
CONTROL CONTROL FIGURE 15.4-16 NOT USED FIGURE 15.4-17 NOT USED FIGURE 15.4-18 NOT USED FIGURE 15.4-19 NOT USED FIGURE 15.4-20 NOT USED
BURNABLE POISON RODS BEING RETAINED BY THE REGION 2 ASSEMBLY BURNABLE POISON RODS BEING RETAINED BY THE REGION 1 ASSEMBLY THE CORE CENTRAL POSITION NEAR CORE PERIPHERY
FIGURE 15.4-26 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
EOL HFP RCCA EJECTION FIGURE 15.4-27 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
RCPS RUNNING)
EOL HZP RCCA EJECTION (TWO RCPS RUNNING)
FOLLOWING A ROD EJECTION ACCIDENT cussion and analysis of the following events are presented in this section.
- 1. Inadvertent operation of the emergency core cooling system during power operation.
- 2. Chemical and volume control system malfunction that increases reactor coolant inventory.
- 3. A number of BWR transients (not applicable to Millstone 3).
se events, considered to be ANS Condition II, cause an increase in reactor coolant inventory.
tion 15.0.1 contains a discussion of ANS classifications.
.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION s event is analyzed for POWER OPERATION only. Analysis for shutdown modes is not uired.
.1.1 Identification of Causes and Accident Description rious emergency core cooling system (ECCS) operation at power could be caused by operator r or a false electrical actuation signal. A spurious signal may originate from any of the safety ction actuation channels as described in Section 7.3.
n receipt of the inadvertent safety injection actuation signal (SI), the reactor will trip with sequent turbine trip, letdown will be isolated, and the centrifugal charging pumps will align to suction from the refueling water storage tank (RWST) to inject into the RCS cold legs and RCP seals. The opening of the charging pump cold leg injection valves will be controlled by Cold Leg Injection Permissive (P-19). The Cold Leg Injection Permissive is activated when of four pressurizer pressure channels indicate less than 1900 psia.
n inadvertent SI signal is initiated from nominal hot full power conditions and no other sient is in progress, the RCS pressure will remain above the P-19 setpoint. Therefore, the Cold Injection Permissive will prevent charging pump flow through the ECCS cold leg injection es during spurious ECCS operation at power. Since RCS pressure will also be above the toff head of the Safety Injection and Residual Heat Removal pumps, the only source of water ition to the RCS is the charging pump injection into the RCP seals. With letdown isolated, the injection will result in an increase in Reactor Coolant System inventory.
n inadvertent SI signal is initiated from hot full power conditions that include the most adverse bination of instrument and control system uncertainties, it is possible for RCS pressure to rease to the P-19 setpoint during the event. P-19 prevents charging pump flow through the CS cold leg injection valves up until P-19 is satisfied. During this time, the only source of
injection path will result in an increase in RCS inventory.
.1.2 Analysis of Effects and Consequences hod of Analysis dvertent operation of the ECCS is analyzed using the RETRAN computer code (VEP-FRD-P-A). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety es, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
code computes pertinent plant variables including temperatures, pressures, and power level.
dvertent operation of the ECCS at power is classified as a Condition II event, a fault of derate frequency. The criteria established for Condition II events include the following.
- a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,
- b. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and,
- c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.
ed on historical precedence and a detailed understanding of the transient conditions associated h this event, conditions do not approach the core thermal DNB limits as the core power, RCS sure and RCS temperatures remain relatively unchanged. Therefore, the DNBR typically eases and does not approach the DNBR safety analysis limit following event initiation. For reason, it is not necessary to calculate a minimum DNBR value for this event.
ce operator action to terminate ECCS flow may not occur before the pressurizer becomes er solid, water relief from the pressurizer through the power-operated relief valves (PORVs) or pressurizer safety relief valves (PSRVs) could occur for this event. Therefore, to conclude that erion (c) is met, the evaluation of this event must demonstrate the integrity of these valves r being subjected to water discharge. The ability to isolate the RCS and maintain the integrity he RCS pressure boundary must be demonstrated so that this Condition II event does not lead more serious plant condition.
erican Nuclear Society standard 51.1/N18.2-1973 describes example 15 of a Condition II nt as a minor reactor coolant system leak which would not prevent orderly reactor shutdown cooldown assuming makeup is provided by normal makeup systems only. In said standard, mal makeup systems are defined as those systems normally used to maintain reactor coolant ntory under respective conditions of startup, hot standby, power operation, or cooldown, g onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS
lso met.
ensure orderly reactor shutdown can occur, the RCS pressure boundary must ultimately be atable once the source of the ECCS flow is terminated. To ensure the RCS pressure boundary be isolated, the PSRVs must function as designed and the PORVs and/or block valves must be ilable to the operator (after the operator action time) to provide isolation functions.
assess the capability of the PSRVs to function properly following the discharge of subcooled er, the fluid conditions associated with the water being discharged through these valves must etermined and the integrity of the valves shown to be acceptable for these conditions.
wever, with one or more PORVs available, the PSRV setpoint will not be reached and any sequent water discharge from the RCS would be through the PORV(s). In the latter case, ation of the RCS following operator action to terminate ECCS flow is obtainable by use of the RV block valve(s).
address criterion (c), an analysis is performed to demonstrate that the PSRVs will not be ated with the pressurizer in a water solid condition. For the potential condition of the plant rating with all the PORVs blocked, action must be taken to either terminate the ECCS flow to rt a water solid condition or to confirm that at least one PORV is unblocked and available for er relief prior to reaching the PSRV setpoint. This avoids any concerns regarding subcooled er relief through the plant PSRVs. Should water relief through the pressurizer power-operated ef valves (PORVs) occur, the PORV block valves would be available to isolate the RCS.
thermore, the acceptability of water discharge through the PORV(s) and associated piping has n confirmed via plant-specific analyses.
refore, the inadvertent ECCS actuation at power event is analyzed to demonstrate that the grity of the PSRVs is maintained by demonstrating that they will not be actuated with the surizer in a water solid condition. To ensure that this criterion is met, the time allowed for rator action is established as the shortest time to pressurizer overfill.
analysis assumptions for the most limiting case are as follows:
Initial Operating Conditions The most limiting results are obtained at hot full power with maximum uncertainty on power (see Section 15.0.3). Sensitivity to core power variations near full power is minimal. Uncertainties applied to initial average coolant temperature, initial pressurizer pressure and initial pressurizer level are +5F, -29.6 psi, and -7.6% respectively. Low initial fuel temperature is targeted.
Reactivity Feedback and Kinetics Parameters
sufficient to sustain the reactor in a subcritical state throughout the event.
Pressurizer Pressure Control Pressurizer heaters are assumed to fail so that P-19 is satisfied during the initial depressurization allowing injection through the cold leg injection path thereafter. In addition, pressurizer spray is allowed to operate as designed in order to slow the increase in RCS pressure and allow higher RCS injection flow rates.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item F below for additional information pertaining to PORV operation during this event.
Reactor Trip Reactor trip is assumed to occur upon receipt of the SI actuation signal including appropriate time delay.
Decay Heat Core residual heat is based on ANSI/ANS-5.1-1979 minus uncertainty. Minimizing decay heat in this manner results in a quicker cooldown and depressurization and the earliest time to satisfy P-19. This allows RCS injection through the cold leg injection path to begin earlier and results in the shortest time to pressurizer overfill.
Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate ECCS flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
Pressurizer Safety Valves The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
Secondary Heat Removal Condenser steam dumps are assumed to be operable in the limiting case. This maximizes the initial cooldown and depressurization allowing the P-19 to be satisfied. The condenser
which result in the shortest time to pressurizer overfill.
Feedwater The motor driven auxiliary feedwater pumps are assumed to start upon receipt of the SI actuations signal. Main feedwater is assumed to be isolated on receipt of the SI actuation signal.
Cold Leg Injection Permissive (P-19) Setpoint Uncertainty in the P-19 setpoint of 20.4 psi is added to the nominal setpoint. This is conservative for maximizing the mass addition to the RCS during the event.
Charging System Flow Prior to satisfying P-19, minimum charging flow through the RCP seals is assumed. After satisfying P-19, RCS injection though the cold leg injection pathway is assumed at the maximum flowrate for two charging pumps.
ults resentative transient response for the Inadvertent Operation of ECCS case is shown in ures 15.5-1 and 15.5-2. Table 15.5-1 shows a representative analysis sequence of events.
CS actuation is followed by reactor trip. A rapid cooldown of the RCS follows due to the on of the condenser steam dump system. Coolant contraction results in a short-term reduction ressurizer pressure and water level. As the RCS temperature reduction slows, the coolant traction ceases and ECCS injection flow (which increases after P-19 is satisfied) causes the sure and level transients to turn around. Pressurizer water level then increases throughout the ainder of the transient. The analysis shows that with credit for the cold leg injection missive, the operators have at least 23 minutes to complete actions to prevent the pressurizer m filling and thereby prevent water relief through the PSRVs. The time available for operator on is expected to be enough for the operators either to terminate the RCS mass addition or to re that at least one PORV is available. With at least one PORV available, the analysis shows water discharge through the PSRV is precluded. Once a PORV is available for water harge, operator action to terminate the ECCS flow can be performed according to existing cedures.
.1.3 Conclusions transient response to the Inadvertent Operation of ECCS shows that the reactor power, lant temperature and pressure decrease rapidly after the reactor trip. The primary temperature tinues to decrease gradually due to injection of cold water and decay heat removal by the denser dump system while pressure increase due to the continued mass addition. RCS ditions do not approach the DNBR safety limit following the initiation of this event.
vent water relief through the PSRVs and terminate ECCS. This is accomplished by performing h of the following operator actions:
- 1. Make at least one PORV available prior to pressurizer overfill (i.e., 23 minutes of event initiation),
and
- 2. Terminate excess RCS injection (i.e., terminate ECCS, restore normal charging and restore letdown within 73 minutes of event initiation.
5.1.4 Radiological Consequences re are only minimal radiological consequences associated with inadvertent ECCS operation.
reactor trip causes a turbine trip and heat is removed from the secondary system through the ndenser dump system), steam generator pressure relief valves or safety valves. Since no fuel age is postulated to occur following an inadvertent operation of the ECCS during power ration, a specific calculation for radiological releases from the secondary system was not ormed.
er relief from the pressurizer PORVs may result in overpressurization of the pressurizer relief (PRT), breaching the rupture disk and spilling contaminated fluid into containment. The ological releases (offsite doses) resulting from breaking the PRT rupture disk have been found e within acceptable limits.
5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY
.2.1 Identification of Causes and Accident Description eases in reactor coolant inventory caused by a malfunction of the chemical and volume trol system may be postulated to result from operator error or a control signal malfunction.
nsients examined in this section are characterized by increasing pressurizer level, increasing surizer pressure, and a constant boron concentration. The transients described in this section analyzed to demonstrate that there is adequate time for the operator to take corrective action to ure that the integrity of the PSRVs is maintained (i.e., the PSRVs do not actuate) with the surizer in a water-solid condition. An increase in reactor coolant inventory, which results m the addition of cold, unborated water to the RCS, is analyzed in Section 15.4.6, Chemical Volume Control System Malfunction that Results in a Decrease in Boron Concentration in the ctor Coolant.
most limiting case would result if charging was in automatic control and the pressurizer level nnel used for charging control failed in a low direction. This would cause maximum charging to be delivered to the RCS and letdown flow to be isolated. The worst single failure for this nt would be a second pressurizer level channel failing in an as-is condition or a low condition.
nblock at least one pressurizer PORV.
.2.2 Analysis of Effects and Consequences hod of Analysis CVCS malfunction is analyzed using the RETRAN computer code (WCAP-14882-P-A, 9). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety es, pressurizer spray, feedwater system, steam generator, and steam generator safety valves.
code computes pertinent plant variables including temperatures, pressures, and power level.
analysis assumptions are as follows:
Initial Operating Conditions Initial conditions with maximum uncertainties on power (see Section 15.0.3), vessel average temperature (-4.0°F), and pressurizer pressure (-50 psi) are assumed.
Pressurizer Pressure Control The Pressurizer heaters are assumed operable to maximize the fluid expansion in the pressurizer. Pressurizer spray is assumed available in order to minimize RCS pressure which allows for more flow to be injected. In addition, modeling spray increases the rate of the pressurizer level increase due to the density effects between the spray fluid (which is taken from the cold leg) and the pressurizer inventory.
Automatic operation of one or more PORVs would preclude the pressurizer pressure from reaching the PSRV set-pressure and, hence, preclude water discharge through the PSRVs.
If one or more PORVs are available and water relief through a PORV occurs, operator action to manually block the PORV (after the operator terminates the ECCS flow) ensures that the integrity of the RCS pressure boundary is maintained. See Item D below for additional information pertaining to PORV operation during this event.
Reactor Trip No reactor trip is assumed Operator Action Time The PSRVs must not discharge subcooled liquid at conditions for which they have not been qualified. Hence, operator action to terminate charging flow or provide an alternative water relief path via a PORV is assumed to occur such that water relief through the PSRVs does not occur.
Pressurizer Safety Valves The safety valves are assumed to open at 2425 psia, corresponding to a pressure 3% below the nominal set-pressure of 2500 psia.
Main Steam Safety Valves Secondary side pressure is controlled via the Main Steam Safety Valves. Steam generator PORVs and steam dump valves are conservatively assumed to be inoperable.
Auxiliary Feedwater Auxiliary feedwater is not credited.
Charging System Flow Maximum charging flow as a function of RCS pressure is assumed to be delivered to the RCS. Cases are examined with one and two charging pumps operating. The charging flow is assumed to have the same boron concentration as the RCS.
.2.3 Results transient response for the limiting CVCS malfunction cases are shown in Figures 15.5-3 and
-4. Table 15.5-2 shows the calculated sequence of events. In all cases analyzed, core power RCS temperatures remain relatively constant.
pressurizer level increases throughout the transient as a result of the injected flow. The surizer backup heaters are actuated on a high pressurizer water level deviation signal. In the with one pump operating, the pressurizer reaches a water solid condition at approximately minutes following event initiation, with the PSRVs opening (if the PORVs are unavailable) 9.3 minutes. In the case with two pumps operating, the pressurizer reaches a water solid dition at approximately 8.4 minutes following event initiation, with the PSRVs opening (if the RVs are unavailable) at 10.0 minutes. If available, one PORV has sufficient capacity to lude actuation of the PSRVs.
he same time the failure of the pressurizer level channel occurs, a number of main control rd alarms will be generated, including the following:
Pressurizer Level Deviation Pressurizer Level Low Heater Off and Letdown Secure Pressurizer Heater Backup Group Auto Trip
n receipt of these alarms, the operators will be alerted to take manual control of charging flow revent pressurizer overfill. Guidance is provided in plant procedures to defeat the failed nnel, restore letdown, and switch charging control to one of the two operable channels and inate the event. This type of malfunction is routinely included in the operator simulator ning and this operator training provides assurance that the operator action to terminate the rfill will occur within the required time frame.
.2.4 Conclusions results show none of the transient conditions during the event approach the core thermal B limits. With respect to not creating a more serious plant condition, water relief out of the Vs due to a water solid pressurizer would occur at a time which is longer than the time uired for the operators to respond to event and to terminate the RCS inventory addition or to lock at least one pressurizer PORV. The sequence of events presented in Table 15.5-1 shows operators have sufficient time to take corrective action.
.3 A NUMBER OF BWR TRANSIENTS s section is not applicable to Millstone 3.
.4 REFERENCES FOR SECTION 15.5
-1 WCAP-14882-P-A (Proprietary), April 1999 and WCAP-15234-A (Nonproprietary)
May 1999, Huegel, D. S. et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis.
-2 DELETED
-3 ANSI/ANS-5.1-1979, August 1979, American National Standard for Decay Heat Power in Light Water Reactors.
-4 VEP-FRD-41-P-A, Revision 0, Minor Revision 3, January 2019, VEPCO Reactor System Transient Analysis Using the RETRAN Computer Code.
OF ECCS Event Time (sec) tiating event: inadvertent SI signal 0.02 actor trip on SI signal 0.24 in Feedwater Isolation 1.82 rbine trip 2.64 rt MDAFW pumps 5.04 9 Satisfied, Cold Leg Injection Begins 68.7 ssurizer water solid 1416.0 V opens 1476.8
TABLE 15.5-2 TIME SEQUENCE OF EVENTS - CVCS MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY Case Event Time (sec)
CVCS malfunction, One pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 117.3 Pressurizer reaches water-solid condition 761.0 Pressurizer safety valve setpoint reached 1156.2 CVCS malfunction, Two pump operating Maximum charging fow initiated / letdown isolated 0.0 Pressurizer heater actuation on high pressurizer level deviation signal 78.6 Pressurizer reaches water-solid condition 503.0 Pressurizer safety valve setpoint reached 601.4
VERSUS TIME 2450 2400 2350 2300 2250 Pressure [psia]
2200 2150 2100 2050 2000 1950 1900 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
VERSUS TIME 115 105 95 85 Pressurizer Level [%]
75 65 55 45 35 25 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Time [sec]
INVENTORY, NUCLEAR POWER AND VESSEL AVERAGE TEMPERATURE VERSUS TIME
VERSUS TIME nts which result in a decrease in reactor coolant inventory as discussed in this section are as ows.
- 1. Inadvertent opening of a pressurizer safety or relief valve.
- 2. Break in instrument line or other lines from reactor coolant pressure boundary (RCPB) that penetrate containment.
- 3. Steam generator tube failure.
- 4. Spectrum of boiling water reactor (BWR) steam system piping failures outside of containment (not applicable to Millstone 3).
- 5. Loss-of-coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the RCPB.
- 6. A number of BWR transients (not applicable to Millstone 3).
6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE
.1.1 Identification of Causes and Accident Description accidental depressurization of the reactor coolant system (RCS) could occur as a result of an vertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve roximately twice the steam flow rate of a relief valve, and therefore allows a much more rapid ressurization upon opening, the most severe core conditions are associated with an inadvertent ning of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS sure which could reach the hot leg saturation pressure without reactor protection system rvention. The pressure continues to decrease throughout the transient. The effect of the sure decrease would be to increase power via the moderator density feedback. However, the t (if in the automatic mode) functions to maintain the power essentially constant throughout initial stage of the transient. The average coolant temperature remains approximately the same the pressurizer pressure decreases until reactor trip (and beyond) because of the stuck open ty valve.
reactor may be tripped by the following reactor protection system signals:
- 1. Overtemperature T
- 2. Pressurizer low pressure inadvertent opening of a pressurizer relief valve is classified as an American Nuclear Society S) Condition II event, a fault of moderate frequency. Although a stuck open safety valve is sified as an ANS Condition IV event, it is modeled here to bound the stuck open relief valve
.1.2 Analysis of Effects and Consequences hod of Analysis accidental depressurization transient is analyzed by employing the detailed digital computer e RETRAN (WCAP-14882-P-A, 1999). The code simulates the neutron kinetics, RCS, surizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam erator safety valves. The code computes pertinent plant variables, including temperatures, sures, and power level.
ial operating conditions are assumed at values consistent with steady state operations. Plant racteristics and initial conditions are discussed in Section 15.0.3. To give conservative results alculating the departure from nucleate boiling ratio (DNBR) during the transient, the owing assumptions are made.
- 1. Plant characteristics and initial conditions are discussed in Section 15.0.3.
Uncertainties in initial conditions are included in the calculation of the limit value DNBR. Consistent with this approach, nominal values are assumed for the initial reactor power, pressure, and RCS temperature along with the minimum measured RCS flow.
- 2. A zero moderator temperature coefficient of reactivity is assumed. The spatial affect of voids due to local or subcooled boiling is not credited in the analysis with respect to reactivity feedback or core power shape.
- 3. A least negative Doppler-only power coefficient is assumed (see Figure 15.0-2) so that the resultant amount of negative feedback is conservatively low in order to augment any power increase due to moderator reactor feedback.
- 4. Cases are analyzed considering four loops in operation.
nt systems and equipment which are necessary to mitigate the effects of RCS depressurization sed by an inadvertent safety valve opening are discussed in Section 15.0.7 and listed in le 15.0-6.
trol systems are assumed to function only if their operation yields more severe accident lts. For an Accidental Depressurization of the Reactor Coolant System event, the automatic control system is assumed to be functional. The rod control system is designed to maintain g at the nominal full power Tavg. This delays reactor trip, which results in a more limiting sient.
system response to an inadvertent opening of a pressurizer safety valve is shown on ures 15.6-1 and 15.6-2. Figure 15.6-1 illustrates the nuclear power transient following the ressurization. Nuclear power remains essentially unchanged until reactor trip occurs on rtemperature T. The pressure decay transient and average temperature transient following the dent are given on Figure 15.6-2. Pressure drops more rapidly while core heat generation is uced via the trip and then slows once saturation temperature is reached in the hot leg. The arture from nucleate boiling ratio (DNBR) decreases initially but increases rapidly following trip (Figure 15.6-1). The DNBR remains above the limit value throughout the transient. A B statepoint analysis was performed with VIPRE-D, as discussed in Section 15.0.3.1, based he system conditions at the time of the minimum DNBR. The results met the applicable limit pecified in Section 4.4.
calculated sequence of events for the inadvertent opening of a pressurizer safety valve dent is shown in Table 15.6-1.
6.1.3 Conclusions results of the analysis show that the pressurizer low pressure and the overtemperature T tor protection system signals provide adequate protection against the RCS depressurization nt. The DNBR remains above the limit value throughout the transient; thus, the DNB design s as described in Section 4.4 is met.
.1.4 Radiological Consequences inadvertent opening of a pressurizer safety or relief valve releases primary coolant to the surizer relief tank. Since no fuel damage is predicted for this event, a specific radiological ase calculation was not performed.
.2 FAILURE OF SMALL LINES CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT re are no instrument lines connected to the RCS that penetrate the containment. There are, ever, the sample lines from the hot legs of reactor coolant loops 1 and 3, from the cold legs of h reactor coolant loop, from the steam space of the pressurizer, the Post Accident Sampling tem (PASS) lines, and the chemical and volume control system (CHS) letdown and RCP seal rn lines penetrating the containment. The hot leg, cold leg, and pressurizer vapor space sample s are provided with normally open automatic isolation valves on both sides of the containment
- l. The PASS lines are provided with a normally closed automatic isolation valve inside tainment and a locked closed remote-manual isolation valve outside containment. The CHS own and RCP seal return lines are provided with normally open automatic containment ation valves on both sides of the containment wall. In all cases the containment isolation es are designed in accordance with the requirements of General Design Criterion 55.
most severe pipe rupture with regard to radioactivity release during normal plant operation urs in the CHS. This would be a complete severance of the 3-inch letdown line just outside
would result in a loss of reactor coolant at the rate of approximately 152 gpm (referenced at a sity of 62 lb/ft3) which would not cause engineered safety features system actuation.
a radiation and leakage detection instrumentation provide the means for detection of a own line rupture. Frequent operation of the CHS reactor makeup control system and other S instrumentation also aids the operator in diagnosing a letdown line rupture. The time uired for the operator to identify the accident and manually isolate the rupture is expected to be hin 30 minutes of the rupture. Once the rupture is identified, the operator would isolate the own line rupture by closing the letdown orifice isolation valves or the letdown line tainment isolation valves. The letdown containment isolation valves are credited to close and ate the leak. All valves are provided with control switches at the main control board. There are ingle failures that would prevent isolation of the letdown line rupture.
iological Consequences plant is assumed to be operating at the technical specification primary coolant activity.
complete severance of the letdown line results in a LOCA at the rate of approximately 152 which may not result in the activation of the engineered safety features (ESF) systems for the ation of the release. This implies that the supplementary leak collection and release system CRS) and auxiliary building filters are not in operation and the releases to the environment m the severed line are assumed to be at ground level. The time needed to identify and isolate rupture is conservatively assumed to be 30 minutes.
fraction of iodine release to the environment is derived from a calculated fraction of roximately 0.40 of the primary coolant flashing during pipe leakage. This is based on a direct ase of primary coolant at primary coolant temperature, which conservatively bounds potential dent sequences.
to transients in the core at the time of the accident, it is assumed that an iodine spike occurs currently with the letdown line rupture.
radiological consequences of the postulated small line break are reported in Table 15.0-8. The mptions used to perform this evaluation are summarized in Table 15.6-2. The assumptions d in Table 15.6-2 together with the atmospheric dispersion values listed in Table 15.0-11 (for tainment releases) are used to compute the doses to the EAB (0-2 hr). The resulting doses to exclusion area boundary (EAB) are within the TEDE limits defined by Regulatory Guide 3 for accidents involving a coincident iodine spike.
6.3 STEAM GENERATOR TUBE FAILURE o different analyses are performed for steam generator tube failure to determine the off site ation doses and the margin to steam generator overfill, respectively. To maximize doses or m generator overfill, each analysis uses a different methodology and set of assumptions.
.3.1 Identification of Causes and Accident Description accident examined is the complete severance of a single steam generator tube. This event is sidered an ANS Condition IV event, a limiting fault (Section 15.0.1). The accident is assumed ake place at full power with the reactor coolant contaminated with fission products esponding to the continuous operation with a limited amount of defective fuel rods. The dent leads to an increase in contamination of the secondary system due to leakage of oactive coolant from the RCS. In the event of a coincident loss of off site power, or failure of condenser steam dump system, discharge of activity to the atmosphere takes place via the m generator safety and/or atmospheric dump valves.
mplete severance of the steam generator tube rupture is considered a somewhat conservative mption since the Inconel-600 tube material is highly ductile. The more probable mode of tube ure would be one or more minor leaks of undetermined origin. Activity in the secondary em is subject to continual surveillance and an accumulation of minor leaks which exceed the ts established in the Technical Specifications is not permitted during unit operation.
operator is expected to determine that a steam generator tube rupture has occurred, to identify isolate the ruptured steam generator, and to complete the required recovery actions to stabilize plant and terminate the primary to secondary break flow. These actions should be performed restricted time scale in order to minimize contamination of the secondary system and ensure ination of radioactive release to the atmosphere from the faulted unit. Consideration of the cations provided at the control board, together with the magnitude of the break flow, leads to conclusion that the recovery procedure can be carried out on a time scale which ensures that k flow to the secondary system is terminated before water in the ruptured steam generator s into the main steam pipe. Sufficient indications and controls are provided to enable the rator to carry out these functions satisfactorily.
ormal operation of the various plant control systems is assumed, the following sequence of nts is initiated by a tube rupture.
- 1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, steam flow/feedwater flow mismatch occurs as feedwater flow to the ruptured steam generator is reduced as a result of primary coolant break flow to that unit.
- 2. The main steamline radiation monitors, the condenser air ejector radiation monitor, or the steam generator blowdown liquid monitor may alarm, indicating a sharp increase in radioactivity in the secondary system. At this point, steam generator blowdown is manually isolated.
- 3. The decrease in RCS pressure due to the continued loss of reactor coolant inventory leads to a reactor trip signal on low pressurizer pressure or overtemperature T. The resultant plant cooldown following reactor trip leads to a
injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater (AFW) addition via automatic initiation of the motor-driven AFW pumps.
- 4. The reactor trip automatically trips the turbine, and if off site power is available, the steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of off site power, the steam dump valves automatically close to protect the condenser. The steam generator pressure rapidly increases, resulting in steam discharge to the atmosphere through the steam generator safety and/or atmospheric dump valves.
- 5. Following reactor trip and safety injection actuation, the continued action of the auxiliary feedwater supply and borated safety injection flow provides a heat sink which absorbs some of the decay heat. This reduces the amount of steam bypass to the condenser, or in the case of loss of off site power, steam relief to the atmosphere.
- 6. Safety injection flow results in increasing RCS pressure and pressurizer water level, and the RCS pressure trends toward the equilibrium value where the safety injection flow rate equals the break flow rate.
he event of a steam generator tube rupture (SGTR), the plant operators must diagnose the TR and perform the required recovery actions to stabilize the plant and terminate the primary econdary leakage. The operator actions for SGTR recovery are provided in the Emergency rating Procedures. The major operator actions include identification and isolation of the ured steam generator, cooldown and depressurization of the RCS to restore inventory, and ination of SI to stop primary to secondary leakage. These operator actions are described w.
- 1. Identify the ruptured steam generator.
High secondary side activity, as indicated by the main steamline radiation monitors, the condenser air ejector radiation monitor, or steam generator blowdown radiation monitors, typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator level or a high radiation indication from a main steamline or a steam generator sample. For an SGTR that results in a reactor trip at high power, the steam generator water level will decrease significantly for all of the steam generators. The AFW flow will begin to refill the steam generators, distributing approximately equal flow to each of the steam generators. Since primary to secondary leakage adds additional liquid inventory to the ruptured steam generator, the water level will increase more rapidly in that steam generator.
This response, as indicated by the steam generator water level instrumentation,
- 2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.
Once a tube rupture has been identified, recovery actions begin by isolating steam flow from and stopping feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the possibility of overfilling the ruptured steam generator with water by 1) minimizing the accumulation of feedwater flow and 2) enabling the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary leakage.
- 3. Cool down the RCS using the intact steam generators.
After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator pressure by dumping steam from only the intact steam generators.
This ensures adequate subcooling in the RCS after depressurization to the ruptured steam generator pressure in subsequent actions. If off site power is available, the normal steam dump system to the condenser can be used to perform this cooldown.
However, if off site power is lost, the RCS is cooled using the atmospheric dump bypass valves on the intact steam generators.
- 4. Depressurize the RCS to restore reactor coolant inventory.
When the cooldown is completed, SI flow will tend to increase RCS pressure until break flow matches SI flow. Consequently, SI flow must be terminated to stop primary to secondary leakage. However, adequate reactor coolant inventory must first be assured. This includes both sufficient reactor coolant subcooling and pressurizer inventory to maintain a reliable pressurizer level indication after SI flow is stopped. Since leakage from the primary side will continue after SI flow is stopped until RCS and ruptured steam generator pressures equalize, an excess amount of inventory is needed to ensure that pressurizer level remains on span.
The excess amount required depends on RCS pressure and reduces to zero when RCS pressure equals the pressure in the ruptured steam generator.
The RCS depressurization is performed using normal pressurizer spray if the reactor coolant pumps (RCPs) are running. However, if off site power is lost or the RCPs are not running for some other reason, normal pressurizer spray is not available. In this event, RCS depressurization can be performed using a pressurizer PORV or auxiliary pressurizer spray.
- 5. Terminate SI to stop primary to secondary leakage.
longer needed. When these actions have been completed, SI flow must be stopped to terminate primary to secondary leakage. Primary to secondary leakage will continue after SI flow is stopped until the RCS and ruptured steam generator pressure equalize. Charging flow, letdown, and pressurizer heaters will then be controlled to prevent repressurization of the RCS and reinitiation of leakage into the ruptured steam generator.
owing SI termination, the plant conditions will be stabilized, the primary to secondary break will be terminated, and all immediate safety concerns will have been addressed. At this time, ries of operator actions are performed to prepare the plant for cooldown to cold shutdown ditions. Subsequently, actions are performed to cool down and depressurize the RCS to cold tdown conditions and to depressurize the ruptured steam generator.
6.3.2 Analysis of Effects and Consequences
.3.2.1 Margin to Steam Generator Overfill SGTR results in the leakage of contaminated reactor coolant into the secondary system and sequent release of a portion of the activity to the atmosphere, and an analysis is typically ormed to assure that the off site radiation doses resulting from an SGTR are within the wable guidelines. However, one of the major concerns for an SGTR is the possibility of steam erator overfill since this could potentially result in a significant increase in the off site ation doses. Therefore, to ensure that steam generator overfill will not occur for a design basis TR for Millstone Unit 3, an analysis was performed to demonstrate margin to steam generator rfill assuming the limiting single failure relative to overfill.
steam generator tube rupture analysis was performed for Millstone Unit 3 using the hodology developed in WCAP-10698. This analysis methodology was developed by the TR Subgroup of the Westinghouse Owners Group and was approved by the NRC in a Safety luation Report dated March 30, 1987. The LOFTTR2 program, an updated version of the FTTR1 program, was used to perform the SGTR analysis for Millstone Unit 3. The LOFTTR1 gram was developed as part of the revised SGTR analysis methodology and was used for the TR evaluations in WCAP-10698. However, the LOFTTR1 program was subsequently dified to accommodate steam generator overfill and the revised program, designated as FTTR2, was used for the evaluation of the consequences of overfill in WCAP-11002. The FTTR2 program is identical to the LOFTTR1 program, with the exception that the LOFTTR2 gram has the additional capability to represent the transition from two regions (steam and er) on the secondary side to a single water region if overfill occurs, and the transition back to regions again depending upon the calculated secondary conditions. Since the LOFTTR2 gram has been validated against the LOFTTR1 program, the LOFTTR2 program is also ropriate for performing licensing basis SGTR analyses.
nt response to the SGTR event was modeled using the LOFTTR2 computer code with servative assumptions of break size and location, condenser availability and initial secondary er mass in the ruptured steam generator. The analysis methodology includes the simulation of
ners Group Emergency Response Guidelines (ERGs). The operator action times used for the lysis are based on the results of simulator studies of the SGTR recovery operations which were ormed by the Millstone Unit 3 operations personnel using the plant training simulator. Thus, SGTR analysis is based on the application of the actual plant procedures and operator training.
limiting single failure was assumed to be the failure of the main steam pressure relief valve PRV) bypass valves on two of the intact steam generators to open on demand when the rator initiates cooling of the RCS using the intact steam generators. This is consistent with the hodology in WCAP-10698. The LOFTTR2 analysis to determine the margin to overfill was ormed for the time period from the tube rupture until the primary and secondary pressures are alized and the break flow is terminated. The water volume in the secondary side of the ured steam generator was calculated as a function of time to demonstrate that overfill does not ur. The results of this analysis demonstrate that there is margin to steam generator overfill for sign basis SGTR for Millstone Unit 3.
.3.2.2 Radiological Consequences analysis was also performed to determine the off site radiological consequences of an SGTR g the methodology in WCAP-10698 and Supplement 1 to WCAP-10698, assuming the ting single failure relative to off site doses without steam generator overfill. Since steam erator overfill does not occur, the results of this analysis represent the limiting consequences an SGTR for Millstone Unit 3. A thermal and hydraulic analysis was performed to determine plant response for a design basis SGTR, and to determine the integrated primary to secondary ak flow and the mass releases from the ruptured and intact steam generators to the atmosphere.
s information was then used to calculate the resulting radiological consequences.
.3.2.2.1 Thermal and Hydraulic Analysis plant response following an SGTR was analyzed with the LOFTTR2 program for the time od from the tube rupture until the primary and secondary pressures are equalized and the k flow is terminated. The reactor protection system and the automatic actuation of the ineered safeguards systems were modeled in the analysis. The major operator actions which required to terminate the break flow for an SGTR were also simulated in the analysis.
lysis Assumptions accident modeled is a double-ended break of one steam generator tube located at the top of tube sheet on the outlet (cold leg) side of the steam generator. It was assumed that the reactor perating at full power at the time of the accident and the secondary mass was conservatively med to be 10% more than the mass corresponding to full power operation at the nominal m generator water level plus a penalty to account for the mass added due to a turbine runback.
as also assumed that a loss of off site power occurs at the time of reactor trip and the highest th control assembly was assumed to be stuck in its fully withdrawn position at reactor trip.
NSSS power including the maximum power uncertainty = 3739 MWt (see Section 15.0.3)
Average RCS temperature = 571.5F (581.5F with a 10F coastdown)
RCS pressure = 2250 psia - 50 psi (uncertainty) = 2200 psia Thermal design flow = 363,200 gpm Pressurizer level = 45.4 SG tube plugging = 0 Auxiliary feed flow = 1200 gpm at 1140 psia Auxiliary feed flow delay time = 60 seconds Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia Main steam pressure relief valve flow = 820,000 lbm/hr/valve at 1140 psia Pressurizer power operated relief valve flow = 210,000 lbm/hr/valve at 2500 psia limiting single failure was assumed to be the failure of the MSPRV on the ruptured steam erator. Failure of this MSPRV in the open position will cause an uncontrolled depressurization he ruptured steam generator which will increase primary to secondary leakage and the mass ase to the atmosphere. It was assumed that the ruptured steam generator MSPRV fails open n the ruptured steam generator is isolated, and that the MSPRV is isolated by closing the ciated isolation valve.
major operator actions required for the recovery from an SGTR are discussed in tion 15.6.3.1, and these operator actions were simulated in the analysis. The operator action es used for the analysis are based on the results of the Millstone Unit 3 plant training simulator ies, and the times are presented in Table 15.6.3-1. It is noted that the MSPRV on the ruptured m generator was assumed to fail open at the time the ruptured steam generator was isolated.
ore proceeding with the recovery operations, the failed open MSPRV on the ruptured steam erator was assumed to be isolated by closing the associated isolation valve. It was assumed the ruptured steam generator MSPRV is isolated 20 minutes after the valve was assumed to open. After the ruptured steam generator was isolated, an additional 8-minute delay ble 15.6.3-1) was assumed before the operator initiates the RCS cooldown.
re are several operator actions credited to recover from a steam generator tube rupture. The ons assumed in the analysis bound the performance of the operators using the EOPs. The eptability of the EOP performance can be demonstrated by examining the impact on total dose ased or margin to overfill.
LOFTTR2 analysis results are described below. The sequence of events for this transient is ented in Table 15.6.3-2.
owing the tube rupture, reactor coolant flows from the primary into the secondary side of the ured steam generator since the primary pressure is greater than the stream generator pressure.
esponse to this loss of reactor coolant, pressurizer level decreases as shown in Figure 15.6.3-1.
RCS pressure also decreases as shown in Figure 15.6.3-2, as the steam bubble in the surizer expands. As the RCS pressure decreases due to the continued primary to secondary age, automatic reactor trip occurs on an overtemperature T trip signal at 135 seconds.
er reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves e, and steam flow to the turbine is terminated. The steam dump system is designed to actuate owing reactor trip to limit the increase in secondary pressure, but the steam dump valves ain closed due to the loss of condenser vacuum resulting from the assumed loss of off site er at the time of reactor trip. Thus, the energy transfer from the primary system causes the ondary side pressure to increase rapidly after reactor trip until the MSPRV (and safety valves if r setpoints are reached) lift to dissipate the energy, as shown in Figure 15.6.3-3. The main water flow will be terminated, and AFW flow will be automatically initiated following tor trip and the loss of off site power.
RCS pressure and pressurizer level continue to decrease after reactor trip as energy transfer to secondary shrinks the reactor coolant and the tube rupture break flow continues to deplete mary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI signal pproximately 143 seconds. After SI actuation, the SI flow rate initially exceeds the tube ure break flow rate, and the RCS pressure and pressurizer level begin to increase and roach the equilibrium values where the SI flow rate equals the break flow rate.
ce off site power is assumed lost at reactor trip, the RCPs trip and a gradual transition to ral circulation flow occurs. Immediately following reactor trip, the temperature differential ss the core decreases as core power decays (see Figures 15.6.3-4 and 15.6.3-5); however, the perature differential subsequently increases as natural circulation flow develops. The increase he temperature differential slows the rate of the pressurizer level and pressure decrease as wn in Figures 15.6.3-1 and 15.6.3-2, respectively. The cold leg temperatures initially trend ard the steam generator temperature as the fluid residence time in the tube region increases.
RCS hot leg temperatures slowly decrease until the time when the ruptured steam generator ospheric relief valve is assumed to fail open.
s event is not limiting with respect to DNB. The SGTR results in a relatively slow ressurization with reactor trip occurring on over temperature delta-T or low pressurizer sure. Based on this, SGTR is not explicitly analyzed for DNB.
or Operator Actions
- 1. Identify and Isolate the Ruptured Steam Generator
seconds.
The ruptured steam generator MSPRV is also assumed to fail open at this time.
However, the actual time used in the analysis is 2 seconds longer because of the computer program numerical requirements for simulating the operator actions. The failure of the MSPRV causes the ruptured steam generator to rapidly depressurize as shown in Figure 15.6.3-3. The depressurization of the ruptured steam generator increases the break flow (Figure 15.6.3-6), and the energy transfer from primary to secondary results in a decrease in the ruptured loop temperatures as shown in Figure 15.6.3-4. The intact steam generator loop temperatures also decrease, as shown in Figure 15.6.3-5, until the failed open MSPRV is isolated. The decrease in the RCS temperatures results in an initial decrease in the pressurizer level and RCS pressure. However, the increased SI flow subsequently causes the pressurizer level and RCS pressure to stabilize and begin to increase as shown in Figures 15.6.3-1 and 15.6.3-2, respectively. It was assumed that the time required for the operator to identify that the ruptured steam generator MSPRV is open and to close the associated block valve is 20 minutes. Thus, the MSPRV was isolated at 2702 seconds which terminates the depressurization of the ruptured steam generator, and the ruptured steam generator pressure begins to increase after that time.
- 2. Cool Down the RCS to Establish Subcooling Margin After the ruptured MSPRV isolation is closed, an 8-minute operator action time was imposed prior to initiation of cooldown. Since off site power is lost, the RCS was cooled by dumping steam to the atmosphere using the MSPRV bypass valves on the three intact steam generators. The cooldown was continued until RCS subcooling at the ruptured steam generator pressure is 20F plus an allowance of 32F for subcooling uncertainty. The depressurization of the ruptured steam generator due to the failed open MSPRV affects the RCS cooldown target temperature since the target temperature is dependent upon the pressure in the ruptured steam generator. Although the ruptured steam generator pressure is increasing when the cooldown is initiated, the pressure is substantially below the MSPRV setpoint. The lower pressure in the ruptured steam generator results in a lower RCS cooldown temperature, which extends the time required for cooldown.
The RCS cooldown was initiated at 3182 seconds by opening the MSPRV bypass valves on the three intact steam generators, and was completed at 3690 seconds.
The reduction in the intact steam generator pressure required to accomplish the cooldown is shown in Figure 15.6.3-3, and the effect of the cooldown on the intact loop temperatures is shown in Figure 15.6.3-5. The RCS pressure also decreases initially during the cooldown due to shrinkage of the reactor coolant as shown in Figure 15.6.3-2, and then begins to increase again as the SI flow increases. It is noted that the ruptured steam generator pressure continues to increase during the cooldown until the pressure approaches the MSPRV setpoint again.
After the RCS cooldown was completed, a 3-minute operator action time was assumed prior to depressurization. The RCS depressurization was initiated at 3872 seconds to assure adequate coolant inventory prior to terminating SI flow. With the RCPs stopped, normal pressurizer spray is not available, and thus the RCS was depressurized by opening a pressurizer PORV. The depressurization was continued until any of the following conditions are satisfied: RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than the allowance of 16 for pressurizer level uncertainty, or pressurizer level is greater than 73, or RCS subcooling is less than the 32F allowance for subcooling uncertainty. The RCS depressurization reduces the break flow as shown in Figure 15.6.3-6 and increases SI flow to refill the pressurizer as shown in Figure 15.6.3-1. For this case, the depressurization was terminated when the RCS pressure is reduced to the ruptured steam generator pressure (Figure 15.6.3-7) and the pressurizer level is above 16 (Figure 15.6.3-1). When the pressurizer PORV is closed, the level continues to increase and subsequently reaches a maximum of approximately 60 when SI flow is terminated.
- 4. Terminate SI to Stop Primary to Secondary Leakage The previous actions have established adequate RCS subcooling, verified a secondary side heat sink, and restored the reactor coolant inventory to ensure that SI flow is no longer needed. When these actions have been completed, the SI flow must be stopped to prevent repressurization of the RCS and to terminate primary to secondary leakage. The SI flow is terminated at this time if RCS subcooling is greater than the 32F allowance for subcooling uncertainty, minimum AFW flow is available or at least one intact steam generator level is in the narrow range, the RCS pressure is increasing, and the pressurizer level is greater than the 16 allowance for uncertainty. To assure that the RCS pressure is increasing, SI was not terminated in the analysis until the RCS pressure increases by at least 50 psi.
After depressurization was completed, an operator action time of 6 minutes was assumed prior to SI termination. Since the above requirements are satisfied, SI termination was performed at this time. After SI termination, the RCS pressure begins to decrease as shown in Figure 15.6.3-2, and the differential pressure between the RCS and ruptured steam generator decreases as shown in Figure 15.6.3-7. The intact MSPRV bypass valves are also opened to dump steam to maintain the prescribed RCS temperature to ensure that subcooling is maintained. When the MSPRV bypass valves are opened, the increased energy transfer from primary to secondary also aids in the depressurization of the RCS to the ruptured steam generator pressure. As shown in Figure 15.6.3-6, the primary to secondary leakage continues after the SI flow is terminated until the RCS and ruptured steam generator pressures equalize.
850 ft3 when the break flow is terminated. The mass of water in the ruptured steam generator so shown as a function of time in Figure 15.6.3-9.
ss Releases mass releases due to an SGTR from the steam generators to the environment were determined use in evaluating Control Room, EAB and LPZ doses.
postulated break allows primary liquid to leak to the secondary side of one of the steam erators (denoted as the affected generator) with an assumed release to the environment ugh the MSPRVs. The MSPRV on the affected steam generator is assumed to open to control m generator pressure at the beginning of the event, and then fail fully open after operator on was taken to close the MSPRV. The affected steam generator discharges steam to the ironment for 2702 seconds (0.7506 hours0.0869 days <br />2.085 hours <br />0.0124 weeks <br />0.00286 months <br />) until the generator is isolated a second time by ure of the MSPRV isolation valve. Break flow into the affected steam generator continues l 6412 seconds, at which time the RCS is at a lower pressure. Additional releases from the cted steam generator are modeled from 2 to 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> to complete depressurization of the m generator early in the event to maximize dose consequences. Table 15.6.3-3 provides the s releases associated with the thermal and hydraulic analysis. The mass release rates to the osphere from the LOFTTR2 analysis are presented in Figures 15.6.3-10 and 15.6.3-11 for the cted and intact steam generators respectively. Flashed break flow is presented in ure 15.6.3-12.
intact generators discharge steam for a period of 11 hours1.273148e-4 days <br />0.00306 hours <br />1.818783e-5 weeks <br />4.1855e-6 months <br /> until the primary system has cooled iciently (to 350F) to initiate Residual Heat Removal (RHR) system cooling of the RCS.
ing the entire steaming process, a primary to secondary leak rate of 1 gpm total to the intact m generators is assumed.
.3.2.2.2 Radiation Dose Analysis evaluation of the radiological consequences of a steam generator tube rupture event assumes the reactor has been operating at the maximum allowable Technical Specification iodine limit primary coolant activity and with a primary to secondary leakage of 1 gpm total for sufficient e to establish equilibrium concentrations of radionuclides in the reactor coolant and in the ondary coolant. Radionuclides from the primary coolant enter the steam generator via the ured tube and are released to the atmosphere through the atmospheric dump valves and ospheric dump bypass valves (and safety valves). It was assumed that a loss of off site power urs at the time of SGTR. This is a conservative assumption that causes the condenser to be vailable and the release to the environment to begin at the time of SGTR.
quantity of radioactivity released to the environment, due to an SGTR, depends upon primary secondary coolant activity, iodine spiking effects, primary to secondary break flow, break flashing fractions, attenuation of iodine carried by the flashed portion of the break flow, itioning of iodine between the steam generator liquid and steam phases and the mass of fluid ased from the generators. All of these parameters were conservatively evaluated in a manner
- 1. Design Basis Analytical Assumptions The major assumptions and parameters used in the analysis are itemized in Tables 15.6.3-4 and 15.6-12 (for the Control Room).
- 2. Source Term Calculations The radionuclide concentrations in the primary and secondary system, prior to and following the SGTR, are determined as follows:
- a. The iodine concentrations in the reactor coolant will be based upon accident initiated and pre-accident iodine spikes.
- i. Accident Initiated Spike - The initial primary coolant iodine concentration is 1.0 Ci/g of Dose Equivalent (D.E.) I-131.
Following the primary system depressurization associated with the SGTR, an iodine spike is initiated in the primary system which increases the iodine release rate from the fuel to the coolant to a value 335 times greater than the release rate corresponding to the initial primary system iodine concentration.
ii. Pre-accident Spike - A reactor transient has occurred prior to the SGTR and has raised the primary coolant iodine concentration from 1.0 to 60 Ci/gram of D.E. I-131.
- b. The initial secondary coolant iodine concentration is 0.1 Ci/gram of D.E.
- c. The gross activity concentrations in the reactor coolant are based on the Technical Specification limit of 1Ci/gm D.E. I-131 (equivalent to 0.29%
failed fuel).
- 3. Dose Calculations The radioactivity transport model utilized in this analysis is consistent with Regulatory Guide 1.183. The model considers break flow flashing, droplet size, bubble scrubbing, steaming, and partitioning. The model assumes that a fraction of the iodine carried by the break flow becomes airborne immediately due to flashing and atomization. Removal credit can be taken for scrubbing of iodine contained in the atomized coolant droplets as they rise from the rupture site to the secondary water surface. However, the benefit associated with the scrubbing of the steam bubbles has been shown to be relatively insignificant and has been neglected in this analysis. The fraction of primary coolant iodine which is not assumed to
coefficient. This analysis conservatively assumes an iodine partition coefficient of 0.01 between the steam generator liquid and steam phases. Droplet removal by the dryers is conservatively assumed to be negligible.
The transport of gross activity in this analysis is consistent with Regulatory Guide 1.183. Noble gases are released from the primary system without mitigation or holdup. Particulate activity in the flashed break flow is released from the primary to the steam generator steam volume without mitigation. Particulate activity in the steam generator liquid volume is released through moisture carryover during steaming and is credited with a factor of 100 reduction due to assumed moisture carryover.
The following assumptions and parameters were used to calculate the activity released to the atmosphere and the doses following an SGTR.
- a. The mass of reactor coolant discharged into the secondary system through the rupture and the mass of steam released from the ruptured and intact steam generators to the atmosphere assumed in the radiation dose analysis are presented in Table 15.6.3-3. A loss of off site power is assumed to occur at the time of SGTR. This is a conservative assumption that causes the condenser to be unavailable and the release to the environment to begin at the time of the SGTR. Additionally, the steam release period is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry. This is followed by a 11.75 hour8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> period of simultaneous steaming and RHR operation to address safety grade cold shutdown requirements.
- b. The amount of rupture flow that flashes to steam and is immediately released to the environment is presented in Figure 15.6.3-12. The amount of flashed break flow was conservatively calculated assuming that 100 percent of the break flow comes from the hot leg side of the steam generator, whereas the break flow actually comes from both the hot leg and the cold leg sides of the steam generator.
- c. The total primary to secondary leak rate is assumed to be 1.0 gal/min. All of the 1.0 gal/min leak rate is assumed to be to the three intact steam generators, since the effect of leakage to the ruptured steam generator is negligible compared to the activity in the primary to secondary break flow from the tube rupture.
- d. The iodine partition coefficient between the liquid and steam of the ruptured and intact steam generators is assumed to be 0.01.
or for cloud depletion by ground deposition during transport to the Control Room, EAB or LPZ.
- f. Short-term atmospheric dispersion factors (X/Qs) for accident analysis are provided in Table 15.0-11.
- g. Moisture carryover in intact steam generators is assumed to be 1%.
- 4. Dose Calculation Models The dose calculation model used for control room, EAB and LPZ TEDE evaluation is based upon a modified version of the RADTRAD computer code discussed in Regulatory Guide 1.183. Dose conversion factors used in this model are from Federal Guidance Reports 11 and 12.
- 8. The radiological consequences of the steam generator tube rupture are within the TEDE limits defined by 10 CFR 50.67 and as clarified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel, 25 rem to EAB and LPZ for the pre-accident spike and 2.5 rem to the EAB and LPZ for the concurrent spike.
.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT (NOT APPLICABLE TO MILLSTONE 3).
.5 LOSS-OF-COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY
.5.1 Identification of Causes and Frequency Classification OCA is the result of a pipe rupture of the RCPB (Section 5.2). For the analyses reported here, ajor pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or ter than 1.0 square feet (ft2). This event is considered an ANS Condition IV event, a limiting t, in that it is not expected to occur during the lifetime of the plant but is postulated as a servative design basis (Section 15.0.1).
inor pipe break (small break), as considered here, is defined as a rupture of the reactor coolant sure boundary with a total cross-sectional area less than 1.0 ft2 in which the normally rating charging system flow is not sufficient to sustain pressurizer level and pressure. This is
Acceptance Criteria for the LOCA are described in 10 CFR 50.46 (10 CFR 50.46 and endix K of 10 CFR 50 1974) as follows.
- 1. The calculated peak fuel element clad temperature is below the requirement of 2,200F.
- 2. The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1 percent of the total amount of Zircaloy in the reactor.
- 3. The clad temperature transient is terminated at a time when the core geometry is still amenable to cooling. The localized cladding oxidation limit of 17 percent is not exceeded during or after quenching.
- 4. The core remains amenable to cooling during and after the break.
- 5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.
se criteria were established to provide significant margin in emergency core cooling system CS) performance following a LOCA. Input parameters used in the ECCS analysis are cribed in Table 15.6-3 for large break LOCA and Table 15.6-15 for small break LOCA.
.5.2 Large Break Loss-of-Coolant Accident rge break LOCA (LBLOCA) analysis with the FULL SPECTRUM' loss-of-coolant dent (FSLOCA') evaluation model (EM) has been completed for the Millstone Power ion Unit 3. Section 15.6.5.2.1 through Section 15.6.5.2.7 discuss the analysis.
en the final acceptance criteria governing the LOCA for Light Water Reactors was issued in endix K of 10 CFR 50.46 (Reference 15.6-28), both the NRC and the industry recognized the stipulations of Appendix K were highly conservative. That is, using the then accepted lysis methods, the performance of the ECCS would be conservatively underestimated, lting in predicted PCTs much higher than expected. At that time, however, the degree of servatism in the analysis could not be quantified. As a result, the NRC began a large-scale firmatory research program with the following objectives:
- 1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those areas in which a purposely prescriptive approach was used in the Appendix K rule could be quantified with additional data so that a less prescriptive future approach might be allowed.
- 2. Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The
respect to the Appendix K limits could be quantified.
ce that time, the NRC and the nuclear industry have sponsored reactor safety research grams directed at meeting the above two objectives. The overall results have quantified the servatism in the Appendix K rule for LBLOCA analyses and confirmed that some relaxation he rule can be made without a loss in safety to the public. It was also found that some plants e being restricted in operating flexibility by the overly conservative Appendix K uirements. In recognition of the Appendix K conservatism that was being quantified by the arch programs, the NRC adopted an interim approach for evaluation methods. This interim roach is described in SECY-83-472 (Reference 15.6-38). The SECY-83-472 approach retained e features of Appendix K that were legal requirements, but permitted applicants to use best mate thermal hydraulic models in their ECCS evaluation model. Thus, SECY-83-472 esented an important step in basing licensing decisions on realistic calculations, as opposed to e calculations prescribed by Appendix K.
.5.2.1 General FSLOCA EM (Reference 15.6-36) was developed to address the full spectrum of loss-of-lant accidents (LOCAs) which result from postulated break in the reactor coolant system S) of a pressurized water reactor (PWR). The break sizes considered in the Westinghouse OCA EM include any break size in which break flow is beyond the capacity of the normal rging pumps, up to and including a double-ended guillotine (DEG) rupture of an RCS cold leg h a break flow area equal to two times the pipe area, including what traditionally are defined as ll and large break LOCAs.
Region II analysis simulations only include breaks above 1.0 ft2 break area and provide erage to a maximum size of a DEG break. Only the Region II (LBLOCA) analysis was ormed for this application of the FSLOCA EM. A Region I (small break LOCA (SBLOCA))
lysis was not performed.
FSLOCA EM explicitly considered the effects of fuel pellet thermal conductivity degradation D) and other burnup-related effects by initializing to fuel rod performance data input erated by PAD5 code (Reference 15.6-37), which explicitly models TCD and is benchmarked igh burnup data. The fuel pellet thermal conductivity model in the WCOBRA/TRAC-TF2 e used in the FSLOCA EM explicitly accounts for pellet TCD.
ee of the Title 10 of the Code of Federal Regulations (CFR) 50.46 criteria (peak cladding perature (PCT), maximum local oxidation (MLO), and core-wide oxidation (CWO)) are sidered directly in the FSLOCA EM. A high probability statement is developed for the PCT, O, and CWO that is needed to demonstrate compliance with 10 CFR 50.46 acceptance criteria 1), (b)(2), and (b)(3) (Reference 15.6-28) via statistical methods. The MLO is defined as the of pre-transient corrosion and transient oxidation consistent with the position in Information ice 98-29 (Reference 15.6-39). The coolable geometry acceptance criterion, 10 CFR 50.46 4), is assured by compliance with acceptance criteria (b)(1), (b)(2), and (b)(3), and
FSLOCA EM has been generically approved by the Nuclear Regulatory Commission (NRC)
Westinghouse 3-loop and 4-loop plants with cold leg Emergency Core Cooling System CS) injection (Reference 15.6-36). Since Millstone Unit 3 is a Westinghouse designed 4-loop t with cold leg ECCS injection, the approved method is applicable.
section summarizes the application of the Westinghouse FSLOCA EM to Millstone Unit 3.
application of the FSLOCA EM to Millstone Unit 3 is consistent with the NRC-approved hodology (Reference 15.6-36) and with the changes reported in References 15.6-40 and 15.6-pursuant to 10 CFR 50.46. The application of the FSLOCA EM is also applicable for the lstone Unit 3 plant design and operating conditions.
sequent to the completion of the analysis, revised pre-transient oxidation (PTO) data was erated which increased the PTO assumed in the analysis. Due to the substantial conservatisms he fuel temperature and rod internal pressure methodology, there is no change to the analyzed rod temperature and rod internal pressure data; therefore, there is no impact on the FSLOCA analysis transient results (PCT, transient MLO, CWO). However, the updated PTO impacts steady-state MLO and thus the total MLO (transient plus pre-transient). The largest difference pper bound oxidation relative to the data used in the base LBLOCA analysis was used to servatively estimate the impact of the revised PTO. The evaluation resulted in an estimated ease to the Region II analysis MLO of 1.55%. Analysis results continue to demonstrate pliance with the 10 CFR 50.46 acceptance criteria.
major plant parameter and analysis assumptions used in the Millstone Unit 3 analysis with FSLOCA EM are provided in Tables 15.6-3 through 15.6-6.
.5.2.2 Identification of Cause and Accident Description BLOCA is a hypothetical, design-basis accident that is considered in the sizing of ECCS ponents. The accident is initiated by an instantaneous rupture of a RCS pipe. The break type sidered is either a double-ended guillotine, defined as a complete severance of the pipe lting in unimpeded flow from either end, or a split break, defined as a partial tear. The break s considered vary from 1 ft2 to two times the cold leg area. A break in the cold-leg piping ween the reactor coolant pump and the reactor vessel inlet nozzle has been concluded to be the t limiting location for a large break in a PWR.
uld a large break occur, rapid depressurization of the RCS to a pressure nearly equal to the tainment pressure occurs in approximately 40 seconds, with a nearly complete loss of RCS ntory. Rapid voiding in the core shuts down the reactor. The Safety Injection (SI) system is ated when the low pressurizer pressure setpoint (SI signal) is reached, and the accumulators ct upon RCS depressurization below the accumulator cover pressure, mitigating the sequences of the accident in two ways:
- 1. The borated water injection complements void formation in causing a rapid reduction in nuclear power to a residual level corresponding to fission product
considerations (long term core-cooling considerations are discussed in Chapter 6 and Chapter 9). However, no credit is taken for the insertion of control rods to shut down the reactor in the large break analysis.
- 2. The injection of borated water provides core cooling and prevents excessive fuel rod cladding temperatures.
ore the break occurs, the reactor is assumed to be in a full power equilibrium condition, i.e.,
heat generated in the core is being removed by the steam generators. At the beginning of the wdown phase, the entire RCS contains sub-cooled liquid which transfers heat from the core by ed convection with some nucleate boiling. During blowdown, heat from fission product decay stored energy in the fuel pellets continues to be transferred to the fuel rod cladding. After the k occurs, departure from nucleate boiling occurs.
heat transfer between the RCS and the secondary system may be in either direction, based on progression of the transient and the relative fluid temperatures. In the case of the large break CA, the primary pressure rapidly decreases below the secondary system pressure, and the m generators become an additional heat source.
he RCS pressure decreases to the accumulator cover pressure, injection of accumulator liquid the cold leg begins. However, significant accumulator inventory is lost out of the break due to phenomenon of emergency core cooling bypass. After the initial surge of accumulator ntory is lost out of the break, core bypass breaks down and the remaining accumulator liquid lls the lower portion of the reactor vessel. Reflood of the core and eventual quench of the fuel s is accomplished by the injection of water from the refueling water storage tank (RWST).
operation of the low head safety injection pumps supplies water for long term cooling. When RWST is nearly empty, long term cooling of the core is accomplished by switching to the rculation mode of core cooling, in which the spilled borated water is drawn from the tainment sump by the low head safety injection pumps and returned to the reactor vessel. The tainment spray system and the recirculation spray system operate to return the containment ironment to subatmostpheric pressure.
.5.2.3 Method of Analysis
.5.2.3.1 FULL SPECTRUM LOCA Evaluation Model Development 988, the NRC Staff amended the requirements of 10 CFR 50.46 (References 15.6-28 and
-41) and Appendix K, ECCS Evaluation Models, to permit the use of a realistic EM to lyze the performance of the ECCS during a hypothetical LOCA. Westinghouses previously roved best-estimate LBLOCA EM is discussed in Reference 15.6-42. The EM is referred to as Automated Statistical Treatment of Uncertainty Method (ASTRUM) and was developed owing Regulatory Guide (RG) 1.157 (Reference 15.6-30).
elopment and assessment process of a PWR accident and safety analysis EM. Therefore, the elopment of the FSLOCA EM followed the Evaluation Model Development and Assessment cess (EMDAP), which is documented in RG 1.203. While RG 1.203 expands upon RG 1.157, e are certain aspects of RG 1.157 which are more detailed than RG 1.203; therefore, both RGs e used for the development of the FSLOCA EM.
.5.2.3.2 WCOBRA/TRAC-TF2 COMPUTER CODE FSLOCA EM (Reference 15.6-36) uses the WCOBRA/TRAC-TF2 code to analyze the em thermal-hydraulic response for the full spectrum of break sizes. WCOBRA/TRAC-TF2 created by combining a 1D module (TRAC-P) with a 3D module (based on Westinghouse dified COBRA-TF). The 1D and 3D modules include an explicit non-condensable gas sport equation. The use of TRAC-P allows for the extension of a two-fluid, six-equation mulation of the two-phase flow to the 1D loop components. This new code is WCOBRA/
AC-TF2, where TF2 is an identifier that reflects the use of a three-field (TF) formulation of 3D module derived by COBRA-TF and a two-fluid (TF) formulation of the 1D module based TRAC-P.
best-estimate computer code contains the following features:
- 1. Ability to model transient three-dimensional flows in different geometries inside the reactor vessel
- 2. Ability to model thermal and mechanical non-equilibrium between phases
- 3. Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes
- 4. Ability to represent important reactor and plant components such as fuel rods, steam generators (SGs), reactor coolant pumps (RCPs), etc.
etailed assessment of the computer code WCOBRA/TRAC-TF2 was made through parisons to experimental data. These assessments were used to develop quantitative estimates he ability of the code to predict key physical phenomena for a LOCA. Modeling of a LOCA oduces additional uncertainties which are identified and quantified in the plant-specific lysis. The reactor vessel and loop noding scheme used in the FSLOCA EM is consistent with noding scheme used for the experiment simulations that form the validation basis for the sical models in the code. Such noding choices have been justified by assessing the model inst large and/or full scale separate effect and integral effect test facility experiments ference 15.6-36).
rge break LOCA transient can be divided into phases in which specific phenomena are urring. A convenient way to divide the transient is in terms of the various heatup and ldown phases that the fuel assemblies undergo. For each of these phases, specific phenomena heat transfer regimes are important, as discussed below.
wdown - Critical Heat Flux (CHF) Phase his phase, the break flow is subcooled, the discharge rate of coolant from the break is high, the flow reverses, the fuel rods go through departure from nucleate boiling (DNB), and the ding rapidly heats up and the reactor is shut down due to the core voiding.
regions of the RCS with the highest initial temperatures (upper core, upper plenum, and hot
) begin to flash during this period. This phase is terminated when the water in the lower um and downcomer begins to flash. The mixture level swells and a saturated mixture is hed into the core by the intact loop RCPs, still rotating in single-phase liquid. As the fluid in cold leg reaches saturation conditions, the discharge flow at the break decreases significantly.
wdown - Upward Core Flow Phase t transfer is increased as the two-phase mixture is pushed into the core. The break discharge is reduced because the fluid becomes saturated at the break. This phase ends as the lower um mass is depleted, the fluid in the loops become two-phase, and the RCP head degrades.
wdown - Downward Core Flow Phase break flow begins to dominate and pulls flow down through the core as the RCP head rades due to increased voiding, while liquid and entrained liquid flows also provide core ling. Heat transfer in this period may be enhanced by liquid flow from the upper head. Once system has depressurized to less than the accumulator cover pressure, the accumulators begin nject cold water into the cold legs. During this period, due to steam upflow in the downcomer, rtion of the injected ECCS water is bypassed around the downcomer and sent out through the
- k. As the system pressure continues to decrease, the break flow and consequently the nward core flow are reduced. The system pressure approaches the containment pressure at the of this last period of the blowdown phase. During this phase, the core begins to heat up as the em approaches containment pressure, and the phase ends when the reactor vessel begins to ll with ECCS water.
ill Phase core continues to heat up as the lower plenum refills with ECCS water. This phase is racterized by a rapid increase in fuel cladding temperature at all elevations due to the lack of id and steam flow in the core region. The water completely refills the lower plenum and the ll phase ends. As ECCS water enters the core, the fuel rods in the lower core region begin to nch and liquid entrainment begins, resulting in increased fuel rod heat transfer.
ing the early reflood phase, the accumulators begin to empty and nitrogen is discharged into RCS. The nitrogen surge forces water into the core, which is then evaporated, causing system ressurization and a temporary reduction of pumped ECCS flow; this re-pressurization is strated by the increase in RCS pressure. During this time, core cooling may increase due to or generation and liquid entrainment, but conversely the early reflood pressure spike results in of mass out through the broken cold leg.
pumped ECCS water aids in the filling of the downcomer throughout the reflood period. As quench front progresses further into the core, the PCT elevation moves increasingly higher in fuel assembly.
he transient progresses, continued injection of pumped ECCS water refloods the core, ctively removes the reactor vessel metal mass stored energy and core decay heat, and leads to ncrease in the reactor vessel fluid mass. Eventually the core inventory increases enough that id entrainment is able to quench all the fuel assemblies in the core.
econd cladding heatup transient may occur due to boiling in the downcomer. The mixing of CS water with hot water and steam from the core, in addition to the continued heat transfer m the hot vessel and vessel metal, reduces the subcooling of ECCS water in the lower plenum downcomer. The saturation temperature is dictated by the containment pressure. If the liquid perature in the downcomer reaches saturation, subsequent heat transfer from the vessel and r structures will cause boiling and level swell in the downcomer. The downcomer liquid will l out of the broken cold leg and reduce the driving head, which can reduce the reflood rate, sing a late reflood heatup at the upper core elevations.
.5.2.5 Analysis Results Millstone Unit 3 Region II analysis was performed in accordance with the NRC-approved hodology in Reference 15.6-36, with exceptions identified in Section 15.6.5.2.1. The analysis performed assuming both loss-of-offsite power (LOOP) and offsite power available (OPA),
the results of both of the LOOP and OPA analyses are compared to the 10 CFR 50.46 eptance criteria. The most limiting ECCS single failure of one ECCS train is assumed in the lysis as identified in Table 15.6-3. The results of the Millstone Unit 3 Region II LOOP and A uncertainty analyses are summarized in Table 15.6-7.
le 15.6-8 contains a sequence of events for the transient that produced the more limiting lysis PCT result relative to the offsite power assumption. Figures 15.6-8 through 15.6-21 strate the key response parameters for this transient.
containment pressure is calculated for each LOCA transient in the analysis using the COCO e (References 15.6-9 and 15.6-44). The COCO containment code is integrated into the OBRA/TRAC-TF2 thermal-hydraulic code. The transient-specific mass and energy releases ulated by the thermal-hydraulic code at the end of each timestep are transferred to COCO.
CO then calculates the containment pressure based on the containment model (the inputs are marized in Tables 15.6-4 and 15.6-5) and the mass and energy releases, and transfers the sure back to the thermal-hydraulic code as a boundary condition at the break, consistent with
ucing systems and processes assuming all trains of containment spray are operable. The tainment backpressure for the transient that produced the analysis PCT result is provided in ure 15.6-15.
.5.2.6 Compliance with 10 CFR 50.46 ust be demonstrated that there is a high level of probability that the following criteria in 10 R 50.46 are met:
(b)(1) The analysis PCT corresponds to a bounding estimate of the 95th percentile PCT at 95-percent confidence level. Since the resulting PCT is less than 2200F, the analysis with the FSLOCA EM confirms that 10 CFR 50.46 acceptance criterion (b)(1), i.e., Peak Cladding Temperature does not exceed of 2200F, is satisfied.
The results are shown in Table 15.6-7 for Millstone Unit 3.
(b)(2) The analysis MLO corresponds to a bounding estimate of the 95th percentile MLO at the 95-percent confidence level. Since the resulting MLO is less than 17 percent when converting the time-at-temperature to an equivalent cladding reacted using the Baker-Just correlation and adding the pre-transient corrosion, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(2), i.e., Maximum Local Oxidation of the cladding does not exceed 17 percent, is satisfied.
The results are shown in Table 15.6-7 for Millstone Unit 3.
(b)(3) The analysis CWO corresponds to a bounding estimate of the 95th percentile CWO at the 95-percent confidence level. Since the resulting CWO is less than 1 percent, the analysis confirms that 10 CFR 50.46 acceptance criterion (b)(3), i.e.,
Core-Wide Oxidation does not exceed 1 percent, is satisfied.
A detailed CWO calculation takes advantage of the core power census that includes many lower power assemblies. Because there is significant margin to the regulatory limit, the CWO value may be conservatively chosen as that calculated for the limiting hot assembly rod. A detailed CWO calculation is therefore not needed because the outcome will always be less than the hot assembly rod.
The results are shown in Table 15.6-7 for Millstone Unit 3.
(b)(4) 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains in a coolable geometry.
This criterion is met by demonstrating compliance with criteria (b)(1), (b)(2), and (b)(3), and by assuring that fuel assembly grid deformation due to combined
It is discussed in Section 32.1 of the NRC-approved FSLOCA EM (Reference 15.6-36) that the effects of LOCA and seismic loads on the core geometry do not need to be considered unless fuel assembly grid deformation extends beyond the core periphery (i.e., deformation in a fuel assembly with no sides adjacent to the core baffle plates). Inboard grid deformation due to combined LOCA and seismic loads is not calculated to occur for Millstone Unit 3.
(b)(5) 10 CFR 50.46 acceptance criterion (b)(5) requires that long-term core cooling be provided following the successful initial operation of the ECCS.
Long-term cooling is dependent on the demonstration of continued delivery of cooling water to the core. The actions that are currently in place to maintain long-term cooling are not impacted by the application of the NRC-approved FSLOCA EM (Reference 15.6-36).
ed on the analysis results for Region II presented in Table 15.6-7 for Millstone Unit 3, it is cluded that Millstone Unit 3 complies with the criteria in 10 CFR 50.46.
.5.2.7 Post Analysis of Record Evaluations ddition to the analyses presented in this section, evaluations and reanalyses may be performed eeded to address computer code errors and emergent issues, or to support plant changes. The es or changes are evaluated, and the impact on the PCT is determined. The resultant increases ecreases in PCT is applied to the analysis of record PCT. The PCT, including all penalties and efits, is presented in Table 15.6-7A for the large break LOCA. The current PCT is onstrated to be less than the 10 CFR 50.46(b) requirement of 2200°F.
ddition, 10 CFR 50.46 requires that licensees assess and report the effect of changes to or rs in the evaluation model used in the large break LOCA analysis. These reports constitute enda to the analysis of record (AOR) provided in the FSAR until the overall changes become ificant as defined in 10 CFR 50.46. If the assessed changes or errors in the evaluation model lts in significant changes in calculated PCT, a schedule for formal reanalysis or other action as ded to show compliance will be addressed in the report to the NRC.
ally, the criteria of 10 CFR 50.46 requires that holders and users of the evaluation models blish a number of definitions and processes for assessing changes in the models or their use.
tinghouse, in consultation with the PWR Owners Group (PWROG) has developed an roach for compliance with the reporting requirements. This approach is documented in AP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting ference 15.6-34). The NRC is provided with annual and 30 day reports, as applicable, for lstone Power Station.
.5.3.1 Description of Small Break LOCA Transient OCA can result from a rupture of the reactor coolant system (RCS) or of any line connected to system up to the first isolation valve. Ruptures of small cross section will cause expulsion of coolant at a rate that can be accommodated by the charging pumps. Breaks of greater size (up ft2 area) are defined as small breaks and are analyzed with the NOTRUMP computer code. A ure in the reactor coolant system results in the discharge to the containment of reactor coolant associated energy. The result of this discharge is a decrease in coolant pressure in the reactor lant system and an increase in containment temperature and pressure.
reactor trip signal subsequently occurs when the pressurizer low pressure trip setpoint is hed. A safety injection system (SIS) signal is actuated when the appropriate pressurizer low sure setpoint is reached, activating the high head safety injection pumps. The SIS actuation subsequent activation of the emergency core cooling system, which results from the SIS al, assumes the most limiting single failure of ECCS equipment.
ore the break occurs, the unit is assumed to be in an equilibrium condition, (i.e., the heat erated in the core is being removed via the secondary system). In the small break LOCA, the wdown phase of the small break occurs over a long time period. Thus, for a small break CA, there are three characteristic stages: (1) a gradual blowdown in which the decrease in er level is checked by the inventory replenishment associated with safety injection, (2) core very, and (3) long term recirculation. The heat transfer between the reactor coolant system the secondary system may be in either direction, depending on the relative temperature. For case of continued heat addition to the secondary side, the secondary side pressure increases the main steam safety valves may actuate to reduce the pressure. Make up to the secondary is automatically provided by the auxiliary feedwater system. Coincident with the safety ction signal, normal feedwater flow is stopped by closing the main feedwater control valves tripping the main feedwater pumps. Emergency feedwater flow is initiated by starting the iliary feedwater pumps. The secondary side flow aids in the reduction of RCS pressure with break being the primary means of heat removal. When the reactor coolant system ressurizes to approximately 600 psia, the accumulators begin to inject borated water into the tor coolant loops. Reflecting the loss of off site power assumption, the reactor coolant pumps assumed to be tripped at the time of reactor trip, and the effects of pump coastdown are uded in the blowdown analysis.
.5.3.2 Small Break LOCA Evaluation Model NOTRUMP and LOCTA-IV computer codes are used to perform the analysis of LOCAs due mall breaks in the RCS. The NOTRUMP computer code, approved for this use by the U.S.
lear Regulatory Commission in May 1985 (WCAP-10079-P-A and WCAP-10080-A), is used calculate the transient depressurization of the RCS as well as to describe the mass and alpy of the flow through the break. This code is a one dimensional general network code rporating a number of advanced features. Among these features are the utilization of non ilibrium thermal calculation in all-fluid volumes, flow regime-dependent drift flux
ken loop is modeled using the COSI condensation model (WCAP-10054-P-A, Addendum 2).
NOTRUMP small break LOCA emergency core cooling system evaluation model was eloped to determine the RCS response to design basis small break LOCAs and to address the C concerns expressed in NUREG-0611, Generic Evaluation of Feedwater Transients and all Break Loss-of-Coolant Accidents in Westinghouse-Designed Operating Plants.
OTRUMP, the RCS is subdivided into fluid filled control volumes (fluid nodes) and metal es interconnected by flow paths and heat transfer links. The transient behavior of the system is rmined from the governing conservation equations of mass, energy, and momentum applied hese nodes. The broken loop is modeled explicitly, and the intact loops are lumped into a ond loop. A detailed description of the NOTRUMP code is provided in WCAP-10079-P-A, AP-10080-A, WCAP-10054-P-A, WCAP-10081-A, and WCAP-10054-P-A, Addendum 2.
he NOTRUMP model, the reactor core is represented as a vertical stack of heated control umes with an associated bubble rise model to permit a transient mixture height calculation.
multimode capability of the program enables an explicit and detailed spatial representation of ous system components. In particular, it enables a proper calculation of the behavior of the p seal during a LOCA.
ct RCS response boundary conditions are extracted from the NOTRUMP calculations and are d in the SBLOCTA fuel rod heat up code. SBLOCTA is a small break specific version of the CTA-IV code (WCAP-8301 and WCAP-8305). Peak cladding temperature calculations are ormed with the LOCTA-IV code using the NOTRUMP calculated core pressure, fuel rod er history, uncovered core steam flow and mixture levels as boundary conditions. LOCTA-IV dels the hot rod and the average hot assembly rod. As stated above, LOCTA-IV contains many t transfer models, however, due to the relatively low velocities experienced in the core during SBLOCTA transient, heat transfer is basically limited to forced convection to super heated or and rod-to-rod radiation. In addition to PCT, SBLOCTA also calculates maximum local and rod axial average ZrO2.
d thermal analysis are performed with the LOCTA-IV code (WCAP-8301 and WCAP-8305) ch uses as input the RCS pressure, fuel rod power history, steam flow past the uncovered part he core, and mixture height from the NOTRUMP hydraulic calculations. For all computations, NOTRUMP and LOCTA runs were terminated slightly after the time the core mixture level rned to the core following uncovery.
chematic representation of the computer code interfaces is given in Figure 15.6-6.
.5.3.3 Input Parameters and Initial Conditions le 15.6-15 lists important input parameters and initial conditions used in the small break CA analysis.
analysis presented in this section was performed with a reactor vessel upper head temperature al to the RCS cold leg temperature. The effect of using the cold leg temperature in the reactor
bases used to select the numerical values that are input parameters to the analysis have been servatively determined from extensive sensitivity studies (WCAP-8341 and WCAP-8342, 4; WCAP-8340 and WCAP-8356, 1974; WCAP-8565-P-A and WCAP-8566-A, 1975). In ition, the requirements of Appendix K, regarding specific model features, were met by cting models which provide a significant overall conservatism in the analysis. The mptions made pertain to the conditions of the reactor and associated safety system equipment e time that the LOCA occurs and include such items as the core peaking factors, the tainment pressure, and the performance of the ECCS. Decay heat generated throughout the sient is also conservatively calculated.
.5.3.4 Small Break Results calculated peak clad temperature resulting from the limiting small break LOCA is less than calculated for the limiting large break. Based on the results of the LOCA sensitivity studies CAP-8341 and WCAP-8342, 1974) the limiting small break was found to be less than a 10 diameter rupture of the RCS cold leg. Therefore, a range of small break analyses are ented, which establishes the limiting break size. The results of these analyses are summarized ables 15.6-14 and 15.6-16.
ed on the results of these studies, the limiting small break was determined to be a 4 inch meter rupture of the RCS cold leg with a PCT of 1193F. In none of the cases simulated did the rupture. In addition, sensitivity studies combined with the results of the present study cate little or no uncovering will occur for break sizes that are less than 2 inches. A range of ll break analyses are presented which establishes the limiting small break at 4 inches. The lts of these analyses are summarized in Tables 15.6-14 and 15.6-16.
ures 15.6-7 and 15.6-31 through 15.6-43 present the principal parameters of interest for the ll break ECCS analyses. For all cases analyzed, the following transient parameters, where licable, are presented:
Reactor coolant system pressure Core mixture level Clad temperature transient at peak temperature elevation the limiting (4 inch) break analyzed, the following additional transient parameters are ented:
Core exit steam flow rate Clad surface heat transfer coefficient at peak clad temperature elevation Fluid temperature at peak clad temperature elevation.
Pumped safety injection flow rate
PCT margin is available to accommodate permanent penalties due to 10 CFR 50.59 Safety luations and LOCA model assessments. These penalties are summarized in the 30 day and the ual 10 CFR 50.46 reporting of the PCT Margin Utilization. The reporting process and the ntion to PCT margin assure that the PCT remains below 2200F limit of 10 CFR 50.46.
analysis assumed a limiting small break power shape consistent with a LOCA FQ(z) envelope
.60 at the core midplane elevation and 2.40 at the top of the core. The maximum local metal-er reaction is 0.08 percent, and the total core metal-water reaction is less than 1.0 percent for ases analyzed. The clad temperature transients turn around at a time when the core geometry ill amenable to cooling.
analyses described in the preceding sections demonstrate that one centrifugal charge pump one high head safety injection pump, together with the accumulators, provide sufficient core ding to keep the calculated PCT well below the required limits of 10 CFR 50.46 for breaks than 8.75 inch diameter. For the 8.75 inch diameter break, the RHR pumps, along with one trifugal charging pump, one high head safety injection pump, and the accumulators provide icient core flooding to keep the calculated PCT well below the required limits of CFR 50.46 before switchover to recirculation.
quate protection is therefore afforded by the ECCS in the event of a small break LOCA.
.5.4 Radiological Consequences OCA would increase the pressure in the primary containment building resulting in tainment isolation and initiation of the ECCS and the containment spray systems. A safety ction system (SIS) signal automatically starts operation of the supplementary leak collection release system (SLCRS) and the charging pump, component cooling water pump, and heat hanger area, MCC, rod control, cable vault, and auxiliary building filtration portions of the iliary building ventilation system (ABVS). These systems operating together maintain a ative pressure within the secondary containment enclosure, auxiliary building, engineered ty features (ESF) building, hydrogen recombiner building, and the main steam valve building ng accident conditions. The nuclide inventory assumed to be initially available for release m within the containment building is consistent with Regulatory Guide 1.183 and is described able 15.6-9.
containment pressure Hi-1 signal also initiates control room isolation (CBI), which initiates pressurized filtration mode of operation. The containment pressure Hi-1 signal also initiates trol room isolation (CBI) which initiates the pressurized filtration mode of operation.
cribed in Section 9.4, the control building will pressurize within two (2) minutes of receipt of BI signal. After the control room isolates, unfiltered inleakage of 100 cfm is assumed while surized and 350 cfm while in neutral conditions.
cfm. After 101 minutes, unfiltered inleakage of 100 cfm is assumed.
ease Pathways release pathways to the environment subsequent to a loss-of-coolant DBA are leakages from containment building and ESF systems, which are collected and processed, and leakage from containment building which is assumed to bypass SLCRS.
tainment Leakage Pathway containment is assumed to leak at the design leak rate for 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> after the accident. After ours, since the pressure has been decreased significantly, Regulatory Guide 1.183 allows the tainment leakage to be reduced to one half the design leak rate. For the dose calculations to the trol Room and Technical Support Center, a reduced containment leak rate was assumed at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. This was justified and approved as part of the Amendment that eliminated the post-CA negative pressure containment requirement. It is based on the fact that the Millstone Unit 3 tainment pressure is rapidly reduced compared to typical PWRs because of its original design negative pressure containment.
collection, processing, and release of containment leakage varies depending on the location he leak. Ventilation characteristics and release paths are different for each building comprising secondary containment.
o emergency ventilation systems collect most of the containment leakage and process it ugh HEPA and charcoal filters. The SLCRS exhausts from the containment enclosure, iliary, ESF, and the main steam valve buildings, and the compartment of the hydrogen mbiner building abutting the containment. SLCRS flow is filtered and released through the lstone stack. The charging pump, component cooling water pump, and heat exchanger area ion of the auxiliary building ventilation system (ABVS), described in Section 9.4.2, supplies exhausts a relatively high flow on the 24 foot 6 inch elevation floor of the auxiliary building.
exhaust flow is filtered and released through the ventilation vent on the roof of the turbine ding.
to a higher /Q, all containment leakage is assumed to be collected and filtered by the ABVS ept for the following:
- 1. The fraction of containment leakage which is assumed to bypass the secondary containment. This is assumed to be an unfiltered ground level release to the environment.
- 2. The initial containment leakage during the 2 minute time period required for SLCRS to establish negative pressure conditions. This is assumed to be an unfiltered ground level release to the environment.
released unfiltered from the auxiliary building ventilation vent location due to its proximity to the control building inlet.
- 4. The ductwork leakage from the auxiliary building into the SLCRS and emergency portion of the ABVS between the filter and the exhaust fan. This leakage is released unfiltered, along with the rest of the flow for these systems through the ventilation vent.
dit is taken for iodine removal due to containment sprays during the duration of the accident.
umptions pertaining to the spray system are listed in Table 15.6-9.
System Leakage Pathway t-accident radioactive releases from the ESF system are derived from fluid leakages assumed ng recirculation of containment sump water through systems located outside the containment ding. The quantity of leakage is based on the assumption that the ESF equipment leaks at ce the maximum expected operational leak rate and that a fraction of the iodine nuclides tained in the leakage fluid becomes airborne in the areas containing ESF equipment. For poses of analysis, all liquid leakage from the ESF systems are assumed to be in the auxiliary ding. The nuclides which become airborne are collected and released to the environment ugh the auxiliary building ventilation system HEPA and charcoal filtration units.
ST Back Leakage Pathway t-accident radioactive releases from the ECCS are a result of ECCS subsystems containing rculated sump fluid back leaking to the RWST. The backflow rate to the RWST, as a result of ation valve leakage, is predefined and time dependent. Due to this time dependency, the taminated sump fluid from back leakage does not arrive into the RWST until 4.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br /> post-CA. Since the RWST is vented to atmosphere, the release is the result of the breathing rate of RWST due to solar heating.
trol Room Habitability potential radiation dose to a control room operator is evaluated for the LOCA. The analysis is ed on the assumptions and meteorological parameters (/Q values) given in Tables 15.6-12 15.0-11, respectively.
control room is designed to be continuously occupied for the duration of the accident; i.e.,
days. The control building shielding serves to protect the operators from direct radiation due to passing cloud of radioactive effluent assumed to have leaked from the containment structure from the ESF system. The control building walls also provide shielding protection for ation emanating from buildings located onsite which may contain significant quantities of oactivity.
resented in Table 15.0-8 and is below the 10 CFR 50.67 limit of 5 rem.
e Computation radiological dose consequences resulting from a postulated LOCA at Millstone 3 are reported able 15.0-8. Assumptions used to perform the evaluation are summarized in Table 15.6-9.
dose methodology used to determine the results of the hypothetical DBAs is described in ulatory Guide 1.183.
.5.5 Conclusions evaluated TEDE for the Control Room, EAB and LPZ are listed in Table 15.0-8. The ological consequences of the LOCA are within the TEDE limits defined by 10 CFR 50.67 and larified by Regulatory Guide 1.183. Those limits are 5 rem to the Control Room personnel and em to the EAB and LPZ.
.6 BWR TRANSIENTS applicable to Millstone 3.
.7 REFERENCES FOR SECTION 15.6
-1 Anderson, T. M. 1979. Westinghouse Electric Corporation (Westinghouse). Letter to Stolz, J., Nuclear Regulatory Commission (NRC), Letter Number NS TMA 2030.
-2 Eicheldinger, C. 1976. (Westinghouse). Letter to Vassallo, D.B., (NRC).
-3 Eicheldinger, C. 1978. (Westinghouse). Letter to Stolz, J.F., (NRC), Letter Number NS-CE-1672.
-4 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, 1974. Acceptance Criteria for Emergency Core Cooling System for Light Water Cooled Nuclear Power Reactors.
-5 WARD-TM-84, 1969. Porsching, T.A.; Murphy, J.H.; Redfield, J.A.; and Davis, V.C.
FLASH-4, A Fully Implicit FORTRAN-IV Program for the Digital Simulation of Transients in a Reactor Plant. WARD-TM-84, Bettis Atomic Power Laboratory.
-6 WASH-1400, NUREG-75/104, 1975. Reactor Safety Study - An Assessment of Accident Risks in U.S. Commercial Nuclear Power Plants.
-7 WCAP-7907-P-A (proprietary), WCAP-7907-A (non proprietary), April 1984. Burnett, T. W. T. et al., LOFTRAN Code Description.
-9 WCAP-8327 (Proprietary) and WCAP-8326 (non proprietary) 1974. Bordelon, F.M.
and Murphy, E.T. Containment Pressure Analysis Code (COCO).
-10 WCAP-8340 (Proprietary) and WCAP-8356 (non proprietary), 1974. Salvatori, R.,
Westinghouse ECCS - Plant Sensitivity Studies.
-11 WCAP-8341 (Proprietary) and WCAP-8342 (non proprietary), 1974, Westinghouse ECCS Evaluation Model Sensitivity Studies.
-12 WCAP-8586-P-A (Proprietary) and WCAP-8566-A (non proprietary), 1975. Johnson, W.J.; Massie, H.W.; and Thompson, C.M. Westinghouse ECCS-Four Loop Plant (17 x
- 17) Sensitivity Studies.
-13 WCAP-8970 (Proprietary) and WCAP-8971 (non proprietary), 1977. Skwarek, R.J.;
Johnson, W.J.; and Meyer, P.E. Westinghouse Emergency Core Cooling System Small Break October 1975 Model.
-14 WCAP-9168 (Proprietary) and WCAP-9169 (non proprietary), 1977. Johnson, W.J. and Thompson, C.M. Westinghouse Emergency Core Cooling System Evaluation Model -
Modified October 1975 Version.
-15 ROHE, E.P. 1981. (Westinghouse). Letter to Tedesco, R.L., (NRC), Letter Number NS-ER-2538.
-16 WCAP-10079-P-A (proprietary) and WCAP-10080-A (non proprietary), 1985. Meyer, P. E., NOTRUMP, A Nodal Transient Small Break and General Network Code.
-17 WCAP-10054-P-A (proprietary) and WCAP-10081-A (non proprietary), 1985. Lee, N.
Rupprecht, S. D., Schwarz, W. R, and Tauche, W. D., Westinghouse Small ECCS Evaluation Model Using the NOTRUMP Code.
-18 WCAP-10444-P-A, 1985. Davidson, S. L., ed., et al., VANTAGE 5 Fuel Assembly Reference Core Report.
-19 WCAP-10698-P-A (proprietary) and WCAP-10750 (non proprietary), 1987, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill.
-20 Supplement 1 to WCAP-10698-P-A, 1986, Evaluation of Off-site Radiation Doses for an SGTR Accident.
-21 WCAP-11002 (proprietary) and WCAP-11003 (non proprietary), 1986, Evaluation of Steam Generator Overfill due to a SGTR Accident.
Specifications, Supplemental Collection and Release System.
-23 Postma, A.K. and Tam, P.S., Iodine Behavior in a PWR Cooling System Following a Postulated Steam Generator Tube Rupture, NUREG-0409.
-24 WCAP-10054-P-A, Addendum 2, Revision 1, Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, Thompson, C. M., et al., July 1997.
-25 WCAP-11145-P-A, Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code, Rupprecht, S. D., et al., October 1986.
-26 WCAP-15085, Model Changes to the Westinghouse Appendix K Small Break LOCA NOTRUMP Evaluation Model: 1988-1997, J. J. Akers, ed., July 1998.
-27 WCAP-14882-P-A, RETRAN-O2 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, Huegel, D.S. et al., April 1999.
-28 Acceptance Criteria for Emergency Core Cooling Systems for Light Water Cooled Nuclear Power Reactors, 10 CFR 50.46 and Appendix K of 10 CFR 50. Federal Register, Volume 39, Number 3, January 4, 1974.
-29 SECY-83-472, Information Report from W.J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, November 17, 1983.
-30 Regulatory Guide 1.157, Best-Estimate Calculations of Emergency Core Cooling System Performance, USNRC, May 1989.
-31 NUREG/CR-5249, Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident, B. Boyack, et al., 1989
-32 DELETED
-33 DELETED
-34 WCAP-13451, Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting, October 1992.
-35 DOM-NAF-2-P-A, Revision 0, Minor Revision 3, Reactor Core Thermal-Hydraulics Using the VIPRE-D Computer Code, September 2014.
November 2016.
-37 Westinghouse Performance Analysis and Design Model (PAD5), WCAP-17642-P-A, Revision 1, November 2017.
-38 Information Report from W.J. Dircks to the Commissioners, Emergency Core Cooling System Analysis Methods, SECY-83-472, November 1983.
-39 Information Notice 98-29: Predicted Increase in Fuel Rod Cladding Oxidation, USNRC, August 1998.
-40 U.S. Nuclear Regulatory Commission 10 CFR 50.46 Annual Notification and Reporting for 2017, LTR-NRC-18-30, July 2018.
-41 Emergency Core Cooling Systems: Revisions to Acceptance Criteria, Federal Register, V53, N180, pp. 35996-36005, September 1988.
-42 Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment Of Uncertainty Method (ASTRUM), WCAP-16009-P-A, January 2005.
-43 Transient and Accident Analysis Methods, Regulatory Guide 1.203, USNRC, December 2005.
-44 Westinghouse Emergency Core Cooling System Evaluation Model - Summary, WCAP-8339, June 1974.
-45 U.S. Nuclear Regulatory Commission 10 CFR 50.46 Annual Notification and Reporting for 2018, LTR-NRC-19-6, February 2019.
PRESSURIZER SAFETY VALVE Accident Event Time (sec) dvertent opening of a Safety valve fully opens 0.0 ssurizer safety valve Overtemperature T reactor trip signal initiated 40.4 Low pressurizer pressure reactor trip setpoint ---
reached Rods begin to drop 41.9 Minimum DNBR occurs 42.5
CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT Assumption Primary coolant activity Table 15.0-10 Fraction of iodine assumed airborne 0.4 Fraction of other isotopes assumed airborne 1.0 Time to isolate letdown line (minutes) 30 Rate of release from ruptured line (gpm) 152 Pipe break size (inches) 3 Concurrent iodine release rate shown in Iodine spike factor Table 15.0-13 Amount of reactor coolant released (lb.) 3.8 x 104 RCS mass (lbm) 4.483 x 105 Breathing rate (m3/sec) 3.5 x 10-4
TABLE 15.6-3 PLANT OPERATING RANGE ALLOWED BY THE FULL SPECTRUM LARGE BREAK LOCA ANALYS 1.0 Plant Physical Description Parameter As Analysed Value or Range Operating Range or Target Value a) Dimensions Nominal N/A b) Pressurizer location On an intact loop N/A c) Hot assembly location Anywhere in core (1) d) Hot assembly type 17x17 RFA-2 fuel design 17x17 RFA-2 fuel design e) Steam generator tube plugging 10% 0% SGTP 10% (in any one steam generat level 17x17 RFA-2 fuel with IFMs, Optimized 17x17 RFA-2 fuel with IFMs, Optimized f) Fuel assembly type ZIRLO cladding, non-IFBA or IFBA ZIRLO cladding, non-IFBA or IFBA 2.0 Plant Initial Operating Conditions 2.1 Reactor Power Parameter As Analysed Value or Range Operating Range or Target Value a) Core Power 3723 MWt (100.4% of 3709 MWt) 3723 MWt b) Peak Heat Flux hot channel factor (FQ) 2.6 2.6 c) Peak hot rod enthalpy rise hot channel factor (FH) 1.65 1.65 d) Hot assembly radial peaking factor (PHA) 1.65/1.04 1.65/1.04 e) MTC 0 at hot full power (HFP) 0 at hot full power (HFP) f) Typical cycle length 18 months 18 months
g) Maximum steady state depletion, FQ 2.0 2.0 h) Maximum transient operation 0.5 0.5 fraction (6) i) Axial flux difference (AFD) band
-12% to + 9% -12% to + 9%
at 100% power 2.2 Fluid Conditions Parameter As Analysed Value or Range Operating Range or Target Value a) Tavg 581.5-5.0F Tavg 589.5+5.0F (2) 581.5 - 589.5 (3) b) Pressurizer Pressure 2250-46.8 psia PRCS 2250+46.8 psia 2250 psia (3) c) Loop flow TDF 90,800 gpm/loop mmf 94,800 gpm/loop (4) d) Upper head design TCOLD TCOLD e) Pressurizer water volume (at hot 1018.8 ft3 (Tavg of 581.5F), 1126.5 ft3 (Tavg of 1018.8 ft3 (Tavg of 581.5F)(3), 1126.5 ft3 (Ta full power) 589.5F) of 589.5F)(3) f) Accumulator temperature 67F TACC 84F 67F TACC 84F g) Accumulator pressure 626 psia PACC 704 psia 626 psia PACC 704 psia h) Accumulator liquid volume 884.5 ft3 VACC 939.5 ft3 884.5 ft3 VACC 939.5 ft3 i) Accumulator fL/D 6.264 (5) Current line configuration j) Minimum accumulator boron 2600 ppm 2600 ppm
Parameter As Analysed Value or Range Operating Range or Target Value a) Minimum safety injection flow Table 15.6-6 Table 15.6-6 b) Safety injection temperature 40.0F SI Temperature 75.0F 40.0F SI Temperature 75.0F 45 seconds (with offsite power), 45 seconds (with 45 seconds (with offsite power), 45 seconds c) Safety injection delay loss of offsite power) (with loss of offsite power)
See Figure 15.6-15 and raw data in Table 15.6-4 See Figure 15.6-15 and raw data in d) Containment modeling and Table 15.6-5(7) Table 15.6-4 and Table 15.6-5(7) e) Single failure Loss of one ECCS train Loss of one ECCS train NOTES:
(1) 44 peripheral locations will not physically be lead power assembly.
(2) An assessment was performed to support an end-of-cycle temperature coastdown to 571.5F.
(3) Plant control systems are designed to control these parameters to the stated values.
(4) TDF plus uncertainties.
(5) fL/D based on average L/D of 447.4.
(6) The analyzed maximum transient operation fraction is the sum of the planned (0.2) and unplanned (0.1) transient operation fractio plus 0.2, as defined by the approved methodology (Reference 15.6-36).
(7) Containment response calculated for each transient using transient-specific mass and energy releases.
TABLE 15.6-4 CONTAINMENT DATA USED FOR REGION II (LBLOCA)
CALCULATION OF CONTAINMENT PRESSURE FOR MILLSTONE UNIT 3 Parameter Value ximum containment net free volume 2,350,000 ft nimum initial containment temperature at full power operation 89F fueling water storage tank (RWST) temperature for 40F < TRWST < 75F ntainment spray (TRWST) nimum RWST temperature for broken loop spilling SI 40F
-20F (air) nimum containment outside air/ground temperature 55F (ground) nimum initial containment pressure at normal full power 10.4 psia eration nimum containment spray pump initiation delay from 26.3 seconds (OPA) ntainment high pressure signal time 37.3 seconds (LOOP) ximum containment spray flow rate from all pumps 6500 gpm(1) ximum number of containment fan coolers in operation during 0
CA transient ximum number of containment venting lines (including purge es, pressure relief lines or any others) which can be OPEN at 0 set of transient at full power operation ntainment walls/heat sink properties Table 15.6-5 spilling flows 274.83 lbm/sec TE:
The minimum time to recirculation spray actuation is well after the PCT time calculated for the FSLOCA EM Large Break analysis. Therefore, containment recirculation spray is not modeled in the FSLOCA EM Large Break analysis.
CALCULATION OF CONTAINMENT PRESSURE FOR MILLSTONE UNIT 3 Wall Area (ft2) Thickness (ft) Material 1 866 0.0375, 2.16 Stainless Steel, Concrete 2 7674 0.0375, 1.50 Stainless Steel, Concrete 3 133277 1.36 Concrete 4 17926 2.11 Concrete 5 6563 3.00 Concrete 6 2007 1.75 Concrete 7 12269 2.0, 0.25, 10.00 Concrete, Carbon Steel, Concrete 8 24675 0.0428, 4.5 Carbon Steel, Concrete 9 38493 0.0428, 4.5 Carbon Steel, Concrete 10 34100 0.0462, 2.56 Carbon Steel, Concrete 11 1722 0.1075 Stainless Steel 12 552 0.0592 Carbon Steel 13 13230 0.02 Stainless Steel 14 2063 0.0548 Stainless Steel 15 8966 0.0231 Carbon Steel 16 1282 0.0825 Carbon Steel 17 514279 0.0182 Carbon Steel 18 182517 0.00925 Carbon Steel 19 11033 0.0304 Stainless Steel 20 37068 0.0651 Carbon Steel 21 21000 0.0119 Stainless Steel 22 866 2.16 Concrete 23 7674 1.50 Concrete
LOOPS) USED FOR REGION II (LBLOCA) CALCULATION FOR MILLSTONE UNIT 3 Safety Injection High Residual Heat Charging System (CHS)/
Pressure/Head (SIH) / Removal (RHR) /
High Head Safety essure (psia) Intermediate Head Low Head Safety Injection (HHSI) Flow Safety Injection (IHSI) Injection (LHSI)
(gpm)
Flow (gpm) Flow (gpm) 14.7 281.58 402.23 2596.92 34.7 279.585 399 2061.88 54.7 277.59 395.77 1502.615 74.7 275.595 392.54 1011.75 94.7 273.6 389.31 623.2 114.7 271.605 386.08 119.415 114.71 271.605 386.08 0.0 134.7 269.61 382.28 154.7 267.615 378.48 174.7 265.62 374.585 194.7 263.625 370.785 214.7 261.63 366.985 314.7 250.8 346.75 414.7 239.97 325.47 514.7 228.855 303.24 614.7 217.645 280.06 714.7 206.055 254.41 814.7 194.18 227.145 914.7 181.925 192.85 1014.7 169.385 152.95 1114.7 156.56 105.83 1214.7 142.595 42.085 1214.71 142.595 0.0 1314.7 127.775 1414.7 112.29
UNIT 3 Safety Injection High Residual Heat Charging System (CHS)/
Pressure/Head (SIH) / Removal (RHR) /
High Head Safety essure (psia) Intermediate Head Low Head Safety Injection (HHSI) Flow Safety Injection (IHSI) Injection (LHSI)
(gpm)
Flow (gpm) Flow (gpm) 1514.7 95.95 1614.7 79.135 1714.7 61.56 1814.7 41.325 1914.7 15.485 2014.7 0.0
WITH THE FSLOCA EM Outcome Region II Value (OPA) Region II Value (LOOP) Criterion 95 PCT 1712F 1661F < 2200F 95 MLO** 7.82% 7.81%
< 17%
ansient MLO] [0.0%] [0.0%]
95 CWO 0.12% 0.08% < 1%
he MILO values presented in the table show the uncertainty analysis result. However, an luation of revised pre-transient oxidation (PTO) data was completed, resulting in an MLO ease of 1.55% for both OPA and LOOP.
BLE 15.6-7A PEAK CLADDING TEMPERATURE INCLUDING ALL PENALTIES AND BENEFITS, REGION II (LBLOCA) FOR MILLSTONE UNIT 3 T for Analysis of Record (AOR) 1712F T Assessments Allocated to AOR ne -
LOCA PCT for Comparison to 10 CFR 50.46 Requirements 1712F
BLE 15.6-8 MILLSTONE UNIT 3 SEQUENCE OF EVENTS FOR THE REGION II (LBLOCA) ANALYSIS PCT CASE Event Time after Break (sec) rt of Transient 0.0 fety Injection Signal 6.6 cumulator Injection Begins 16.0 d of Blowdown 29.0 el Rod Burst Occurs 30.8 ttom of Core Recovery ~40.0 fety Injection Begins 51.6 cumulator Empty 62.5 T Occurs 121 Rods Quenched 246 d of Analysis Time 600
TABLE 15.6-9 ASSUMPTIONS USED FOR THE RADIOLOGICAL CONSEQUENCES OF A LOCA ANALYSIS
- 1. Power Level (MWt) 3,723 (includes uncertainty).
- 2. Core Inventory Table 15.0-7
- 3. Containment Leak Rate: 0.3% by weight of the containment air per 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (La).
- 4. Containment Bypass Leak Rate: 0.06 La.
- 5. Containment leak rate Reduction: 50% after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> (offsite).
- 6. Secondary Containment Drawdown Time: 50% after 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> (control room).
- 7. Regulatory Guide 1.183 RELEASE FRACTIONS AND DURATION Isotope Group Gap Early In-Vessel Noble Gases 0.05 0.95 Halogens 0.05 0.35 Alkali Metals 0.05 0.25 Telluriums 0 0.05 Bariums 0 0.02 Noble Metals 0 0.0025 Ceriums 0 0.0005 Lanthanides 0 0.0002 Duration (hours) 0.5 1.3
- 8. Iodine Chemical Form in Containment Atmosphere: 95% Cesium Iodide; 4.85% Elemental Iodine; 0.15% Organic Iodine.
- 10. Containment Sump pH: at least 7.
- 11. Dose Conversion Factors: FGR 11 and 12.
- 12. SLRCS Filter Efficiency: 95% all Iodines and Particulates.
- 13. Auxiliary Building Filter Efficiency: 95% all Iodines and Particulates.
- 14. Quench Spray System Effective Period: 80 - 10,000 seconds.
- 15. Recirculation Spray System Effectiveness Time: 5500 seconds - 30 days.
- 16. Mixing Rate for Unsprayed to Sprayed Regions 2 per hour.
- 17. Elemental Iodine Removal Coefficient: 10 per hour.
- 19. Particulate Iodine Removal Coefficient for Quench and Recirculation Spray: DF 50: 13.57; DF 50: 1.36.
- 21. Containment Free Volume 2.35E+06 ft3.
- 22. Quench Spray Volume of Containment: 1,166,200 ft3.
- 23. Quench and Recirculation Spray Volume: 1,515,858 ft3.
- 24. Recirculation Spray Volume 1,102,000 ft3.
- 25. Minimum Available RWST Volume: 1,072,886 gallons.
- 26. Minimum Quench Spray System Auto Trip Value: 47,652 gallons.
- 27. RWST Maximum Fill Volume: 1,206,644 gallons.
- 28. Percentage of Total Containment Leakage into the Secondary Containment:
ESF Building 10.59.
MSV Building 23.31.
Enclosure Building/H2 Recombiner Building 8.47.
Auxiliary Building 57.63.
- 29. Secondary Containment Free Volume (ft3)
ESF Building 225,000.
MSV Building 70,000.
Enclosure Building/H2 Recombiner Building 831,000.
Auxiliary Building, all elevations 914,000
- 30. 50% mixing in all buildings that form the secondary containment.
- 32. Unfiltered releases occur from ventilation vent, ESF Building roof vent and MSV Building roof vent.
- 33. All filtered releases are from the ventilation vent. This is conservative because Millstone stack releases have lower /Qs.
- 34. The Auxiliary Building is homogeneously mixed. The Auxiliary Building is treated as one compartment.
- 35. Unfiltered ventilation and leakage parameters (T=0 hours to 30 days post LOCA).
Ground Level Release CFM 3HVQ-FN2 (ESF building normal exhaust) 77 3HVV-FN1A&B (MSVB exhaust) 134 3HVQ*ACUS1A&B (ESF building AC) 4 3HVQ*ACUS2A&B (ESF building AC) 2
Ventilation Vent 3GWS-FN1A&B (Process Vent Fan) 70 (Auxiliary 66 foot 6 inches).
3HVR*FN12A&B (SLCRS exhaust duct leak) 63 (Auxiliary 66 foot 6 inches).
3HVR-FN5 (Auxiliary Building normal exhaust) 553 (Auxiliary 43 foot 6 inches & 66 foot 6 inches).
3HVR-FN7 (Auxiliary Building normal exhaust) 218 (Auxiliary Building - all elevations).
3HVR-FN8A & B (Waste Disposal Building normal exhaust) 43 (Auxiliary Building 66 foot 6 inches).
3HVR-FN11 (Electrical Tunnel purge air) 28.
3HVR-FN9 (Fuel Building exhaust duct leak) 75 (Auxiliary Building 66 foot 6 inches).
3HVR*FN6A & B (Auxiliary Building filter exhaust) 17 (Auxiliary Building 66 foot 6 inches).
3HVR*AOD44 A& B (Normal exhaust isolation) 113 (Auxiliary Building 24 foot 6 inches).
3HVR*AOD32A & B (Containment purge exhaust) 118 (Auxiliary Building 24 foot 6 inches).
- 36. Duration of Release from containment (hour) 720.
ECCS LEAKAGE ASSUMPTIONS
- 37. ECCS Leak Initiation and Cessation Times 2500 seconds to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />.
- 38. ECCS System Leakage Outside of Containment (1): 5,000 cc/hr.
- 39. ECCS Leakage Location 100% Auxiliary Building.
- 40. Fraction of Core Iodine Inventory in ECCS Sump Water 0.05 during gap release, 0.35 during early in-vessel phase.
Filter Efficiency Elemental iodine 95(%), Methyl iodine 95(%), HEPA 95(%).
ST BACKLEAKAGE ASSUMPTIONS Time Dependent Backleakage Volume to the RWST:
Time Volume (ft3) (cumulative) 4.25 hrs 0.00 14.91 hrs 17.11 18.46 hrs 39.88 33.74 hrs 162.41 63.13 hrs 445.21 68.83 hrs 509.27 72.21 hrs 552.68 720 hrs 9904.49 Iodine DF 100.
RWST Breathing Rate (cfm): 8.7.
TES:
In accordance with Appendix A of Regulatory Guide 1.183, the analysis assumed the maximum post-LOCA equipment leakage was a factor of at least 2 times the system leakage to give a total of 10,000 cc/hr.
TABLE 15.6-10 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6-11 DELETED BY CHANGE PKG FSC 07-MP3-054 BLE 15.6-12 ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS trol room (CR) parameters:
Control room volume (ft3) 2.38 E+05 Control building concrete wall thickness (ft) 2 Unfiltered ventilation intake rate pre CR isolation (cfm) 1,595 Filtered ventilation intake rate post CR isolation (cfm) 230 Filtered recirculation rate post CR isolation (cfm) 666 Unfiltered Inleakage rate (cfm) 350 (neutral), 100 (pressurized)
Time to place control room emergency ventilation system in service:
Pressurized control room 101 minutes Recirculation 101 minutes ke ventilation filter efficiencies (percent):
HEPA 95 Charcoal 95 (elemental), 95 (methyl) ease points (distance to Unit 3 control room intake in meters):
Millstone stack 351 Unit 2 containment surface 223 Unit 3 containment surface 69.5 Unit 3 Turbine Building ventilation vent 37.3 Unit 3 RWST 150.1 Unit 3 Turbine Building 30.0 Unit 3 MSV Building 60.3 Unit 3 ESF Building 134.8 Control room air intake height 28.7 kage values based on single damper closure
ABLE 15.6-12 (CONTINUED) ASSUMPTIONS USED FOR THE CONTROL ROOM HABITABILITY ANALYSIS TIMETABLE POST-ACCIDENT FOR CONTROL ROOM ISOLATION AND PRESSURIZATION PERIODS Control Room Isolated Control Room Pressurized (1)
CA 6 seconds (2) 1.683 hours0.00791 days <br />0.19 hours <br />0.00113 weeks <br />2.598815e-4 months <br /> SLB 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> TR 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> A (4) 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> (5)
A 2 min 10 seconds (6) 1.717 hours0.0083 days <br />0.199 hours <br />0.00119 weeks <br />2.728185e-4 months <br /> A 10 seconds (3) 1.685 hours0.00793 days <br />0.19 hours <br />0.00113 weeks <br />2.606425e-4 months <br /> TES:
Control Room is pressurized 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 41 minutes after CBI signal.
Per Regulatory Guide 1.183, the onset of gap release does not start until 30 seconds post-LOCA. Therefore the Control Room is isolated due to CBI from Containment Pressure - High 1 prior to the plume reaching it.
Control Room isolates on CBI due to ventilation intake radiation monitor alarm.
CBI generated within 4 seconds. Control Room isolates 6 seconds later.
Fuel has decayed 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> at start of FHA.
CREVs filtered recirculation flow is placed in operation within 30 minutes of a drop of a spent fuel assembly.
SI signal initiated 2 minutes post-accident. CBI generated within 4 seconds. Control Room isolates 6 seconds later.
TABLE 15.6-13 DELETED BY FSARCR PKG FSC 04-MP3-017 COOLANT INVENTORY (SMALL BREAK)
Event (seconds) 1.5 inch 2.0 inch 3.0 inch 4.0 inch 6.0 inch 8.75 inch Transient Initiated 0.0 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 174 180 60 32 16 10 Safety Injection Signal 184 191 70 41 20 11 Safety Injection Begins (1) 224 231 110 81 60 51 Loop Seal Clearing Occurs (2) 2152 1092 422 255 127 18 Top of Core Uncovered (3) 2478 705 637 429 (3)
Accumulator Injection Begins N/A N/A 1919 887 386 176 (4)
Top of Core Recovered N/A 4290 2389 1550 445 N/A RWST Low Level (5) 5210 5164 N/A N/A N/A N/A (1) Safety Injection (SI) begins 40 seconds (SI delay time) after the safety injection signal.
(2) Loop seal clearing is considered to occur when the broken loop seal vapor flow rate is sustained above 1 lbm/sec.
(3) There is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case.
(4) For the 8.75 inch case, the broken loop (BL) accumulator is spilling to containment and the accumulator injection time listed here only the intact loop (IL) accumulator injection time.
(5) The analysis assumes minimum usable RWST volume (598,000 gallons)* before the RWST low level signal for switchover to col leg recirculation is reached.
- Actual RWST volume is 614,000 gallons (see Section 6.3.2 and Figure 6.3-6).
BREAK)
Parameter Value re Power (MWt) (1) 3723 ak linear power (kW/ft)(4) 14.75 tal peaking factor (FTQ) 2.60 wer Shape Figure 15.6-7 el Assembly array 17x17 cumulator water volume, nominal (ft3/accumulator) 900 cumulator tank volume, nominal (ft3/accumulator) 1350 cumulator gas pressure, minimum (psia) 609.4 (2) fety Injection pumped flow See Tables 15.6-17 and 15.6-18 ntainment parameters See Section 6.2 tial loop flow (lb/sec) 9413.3 ssel inlet temperature (F) 555.6 ssel outlet temperature (F) 623.3 actor coolant pressure 2300 (3) am pressure (psia) 936.5 am Generator tube plugging level (%) 10 Accounts for calorimetric error.
This value is the minimum accumulator pressure of 636 psia minus 26.6 psi uncertainty.
This value is the nominal RCS pressure of 2250 psia plus 50 psi uncertainty.
This value includes factor for calorimetric error assumed for core power.
4.0 inch with Event (seconds) 1.5 inch (1) 2.0 inch 3.0 inch 4.0 inch Annular Pellets 6.0 inch 8.75 inch (1)
Peak Cladding Temperature, N/A 922 1128 1193 1193 527 N/A (F)
PCT Time, seconds N/A 3340 1646 971 971 438 N/A PCT Elevation, feet N/A 11.00 11.25 11.25 11.25 11.50 N/A Burst Time, seconds (2) N/A N/A N/A N/A N/A N/A N/A Burst Elevation, feet (2) N/A N/A N/A N/A N/A N/A N/A Maximum Hot Rod Zro2, % N/A 0.01 0.08 0.05 0.05 0.0 N/A Maximum Hot Rod Zro2 N/A 11.00 11.25 11.25 11.25 11.50 N/A Elevation, feet Hot Rod Average Zro2, % N/A 0.0 0.01 0.01 0.01 0.0 N/A (1) There is no core uncovery for the 1.5 inch break case and minimal core uncovery for the 8.75 inch break case; therefore rod heatu calculations were not performed.
(2) None of the SBLOCTA calculations exhibited rod burst (hot rod or hot assembly average rod).
INCH TO 6 INCH BREAKS (BROKEN LOOP SI FLOWS SPILL TO RCS PRESSURE)
Intact Loop Injection Flow Broken Loop Injection Flow RCS Pressure (psia) (gpm) (gpm) 14.7 719.8 259.0 114.7 697.7 251.1 214.7 675.1 242.9 314.7 650.4 234.1 414.7 625.0 225.0 514.7 598.9 215.6 614.7 570.9 205.6 714.7 541.4 195.1 814.7 509.9 183.7 914.7 476.0 171.6 1014.7 438.7 158.1 1114.7 393.9 142.2 1214.7 334.1 120.7 1314.7 248.8 90.3 1414.7 173.4 63.4 1514.7 162.9 59.5 1614.7 152.1 55.6 1714.7 138.9 50.8 1814.7 125.1 45.7 1914.7 111.0 40.6 2014.7 96.9 35.4 2114.7 84.0 30.7 2214.7 74.4 27.2 2314.7 64.8 23.7 2414.7 55.2 20.1 2482.7 0.0 0.0
INCH BREAK BEFORE SWITCHOVER oken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 14.7 3453.4 1340.6 34.7 2884.7 1716.9 54.7 2290.5 2079.6 74.7 1768.3 2359.1 94.7 1353.8 2533.5 114.7 818.0 2732.0 134.7 686.2 2777.1 154.7 680.1 2778.4 174.7 673.9 2779.9 194.7 667.8 2781.4 214.7 661.7 2782.9 314.7 629.0 2791.2 414.7 595.2 2799.4 514.7 560.1 2807.5 614.7 523.9 2815.8 714.7 484.7 2823.8 814.7 443.5 2831.9 914.7 394.5 2870.0 1014.7 339.3 2880.3 1114.7 276.2 2891.1 1114.7 276.2 2891.1 1214.7 194.4 2902.4 1314.7 134.5 2909.6 1414.7 118.2 2915.6 1514.7 101.0 2919.4 1614.7 83.3 2923.4 1714.7 64.8 2927.5
oken Loop SI flows to containment pressure, 0 psig)
Intact Loop Injection Flow Broken Loop Spilling Flow RCS Pressure (psia) (gpm) (gpm) 1814.7 43.5 2931.6 1914.7 16.3 2936.0 2014.7 0.0 2939.4 2114.7 0.0 2939.4 e that the above flows are applicable before switchover to recirculation and include RHR s.
TABLE 15.6-19 OMITTED TABLE 15.6-20 OMITTED TABLE 15.6-21 DELETED BY FSARCR 03-MP3-022 TABLE 15.6-22 DELETED BY FSARCR 03-MP3-022 GENERATOR TUBE RUPTURE ANALYSIS Action Time late AFW flow to the ruptured steam Calculated time to reach 30% narrow range level nerator in the ruptured steam generator for overfill analysis.
Calculated time to reach 8% narrow range level in the ruptured steam generator for mass release analysis (input to doses).
late ruptured steam generator 25 minutes from the time of break initiation.
erator action time to isolate failed 20 minutes.
ened Main Steam Pressure Relief Valve mass release analysis) erator action to initiate cooldown 8 minutes from complete isolation of ruptured steam generator.
actor Coolant System cooldown LOFTTR2 calculated time for Reactor Coolant System cooldown.
erator action time to initiate 3 minutes from end of cooldown.
pressurization actor Coolant System depressurization LOFTTR2 calculated time for Reactor Coolant System depressurization.
erator action time to initiate safety Maximum of 6 minutes from end of ection termination depressurization or time to satisfy safety injection termination criteria.
ssure equalization LOFTTR2 calculated time for equalization of Reactor Coolant System and ruptured steam generator pressures.
EVENTS Event Time (seconds) am Generator tube rupture 0 actor trip on OTT (1) 135 fety Injection Actuated 143 ptured Steam Generator Auxiliary Feed Water isolation level 178 ched ptured steam line isolated 1500 ptured Steam Generator Main Steam Pressure Relief Valve fails 1502 en ptured Steam Generator Main Steam Pressure Relief Valve 2702 lation valve closed actor Coolant System cooldown Initiated 3182 eak Flow stops flashing 3381 actor Coolant System cooldown Terminated 3690 actor Coolant System depressurization Initiated 3872 actor Coolant System depressurization Terminated 3952 fety Injection terminated 4312 eak Flow terminated 6412 The nominal trip setpoint specified in the Technical Specifications is modeled since earlier reactor trip is conservative for this analysis. Although the low pressurizer pressure reactor trip setpoint is not reached, the analysis modeled the Technical Specification value with positive uncertainties.
Time Period Time of Reactor Time at Trip to Time at Which Break Start of Event to Which Break Flow is 24 Ho Time of Reactor Flow is Terminated to 2 Hours to 11 Hours to to 35 Trip (1) Terminated 2 Hours 11 Hours 24 Hours (2) Hour Ruptured steam generator to 159,610 0 0 0 0 0 condenser (lbm) (1)
Ruptured steam generator to 0 198,330 0 40,920 0 0 atmosphere (lbm) (1)
Intact steam generators (total for 3) 475,090 0 0 0 0 0 to condenser (lbm) (1)
Intact steam generators (total for 3) 0 344,190 47,960 1,678,380 2,424,000 196,55 to atmosphere (lbm) (1)
Total break flow (lbm) 7,040 222,750 (4) 0 0 0 0 Flashed break flow (lbm) 1,138.6 14,506.9 (5) 0 0 0 0 NOTES:
- 1. The thermal and hydraulic analysis assumes that a loss of offsite power occurs at time of reactor trip. Thus, the condenser is availa during the first period identified above. The radiation dose analysis assumes that a loss of offsite power occurs at the time of Stea Generator Tube Rupture; thus, the condenser is unavailable. The radiation dose analysis assumes that the entire mass release is to atmosphere.
- 2. The time period from 11 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is not discussed in the thermal and hydraulic analysis. In the dose analysis, the steam release period is extended to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to provide additional margin for RHR entry.
- 3. The time period from 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to 35.75 hours8.680556e-4 days <br />0.0208 hours <br />1.240079e-4 weeks <br />2.85375e-5 months <br /> is a period of simultaneous steaming and RHR operation to address safety grade co shutdown requirements.
- 4. Reactor Coolant System break flow terminates after 1.78 hours9.027778e-4 days <br />0.0217 hours <br />1.289683e-4 weeks <br />2.9679e-5 months <br />.
- 5. Flashed break flow terminates after 0.9392 hours0.109 days <br />2.609 hours <br />0.0155 weeks <br />0.00357 months <br />.
USED IN EVALUATING RADIOLOGICAL CONSEQUENCES Source Data A. Total steam generator tube leakage, 1.0 prior to accident, gpm B. Reactor coolant iodine activity:
- 1. Accident-Initiated Spike The initial RC iodine activities based on 1.0 Ci/gram of D.E. I-131 are presented in Table 15.0-10. The iodine appearance rates assumed for the accident-initiated spike are presented in Table 15.6.3-6.
- 2. Pre-accident Spike Primary coolant iodine activities based on 60 Ci/gram of D.E. I-131 are presented in Table 15.6.3-5.
- 3. Gross Activity The initial primary coolant gross activities based on Technical Specification limit of 1 D.E. Ci/gm I-131 (equivalent to 0.29%
failed fuel) and are presented in Table 15.0-10.
C. Secondary system initial activity (1) Dose equivalent of 0.1 Ci/gm of I-131 and gross activity are presented in Table 15.0-10.
D. Initial Steam generator mass (each), 100, 933 concurrent to iodine spike; 9722 lbm pre-accident iodine spike E. Offsite power Lost at time of SGTR F. Primary-to-secondary leakage duration 35.75 for intact SG, hrs.
G. Species of iodine released to 97 percent elemental; 3 percent organic environment H. RCS volume (ft3) 10,000 concurrent iodine spike; 11,750 concurrent iodine spike
Activity Release Data A. Ruptured steam generator
- 1. Break flow See Table 15.6.3-3
- 2. Flashed rupture flow See Table 15.6.3-3
- 3. Total steam release, lbm See Table 15.6.3-3
- 4. Iodine partition coefficient 0.01
- 5. Moisture Carryover 1 percent B. Intact steam generators
- 1. Total primary-to-secondary leakage, 1.0 gpm
- 2. Total steam release, lbm See Table 15.6.3-3
- 3. Iodine partition coefficient 0.01
- 4. Moisture Carryover 1 percent C. Atmospheric Dispersion Factors (2) See Table 15.0-11
. Control Room Data See Table 15.6-12 TES:
There is no Technical Specification limit on Secondary Side gross activity, but gross activity was included for conservatism.
EAB and LPZ factors utilize the X/Qs for the ventilation vent because of near proximity to the release point. Control Room factors use the MSVB X/Qs because of near proximity to the release point.
TABLE 15.6.3-5 DELETED BY CHANGE PKG FSC 07-MP3-054 APPEARANCE RATES Nuclide Appearance Rates (Curies/second)
I-131 2.03 I-132 2.63 I-133 3.76 I-134 3.17 I-135 3.16
TABLE 15.6.3-7 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-8 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-9 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.6.3-10 DELETED BY FSARCR PKG FSC 04-MP3-017 s figure shows typical DNBR transient results and should not be relied upon for an absolute e of the DNBR.
FIGURE 15.6-1 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
FIGURE 15.6-2 A DELETED BY FSARCR 02-MP3-017 DELETED BY FSARCR 02-MP3-017
DELETED BY FSARCR 02-MP3-017 FIGURE 15.6.3-1 PRESSURIZER LEVEL FIGURE 15.6.3-2 REACTOR COOLANT SYSTEM PRESSURE FIGURE 15.6.3-3 SECONDARY PRESSURE IGURE 15.6.3-4 RUPTURED LOOP HOT AND COLD LEG RCS TEMPERATURES FIGURE 15.6.3-5 INTACT LOOP HOT AND COLD LEG RCS TEMPERATURES FIGURE 15.6.3-6 PRIMARY TO SECONDARY BREAK FLOW RATE IGURE 15.6.3-7 DIFFERENTIAL PRESSURE BETWEEN REACTOR COOLANT SYSTEM AND RUPTURED STEAM GENERATOR
FIGURE 15.6.3-8 RUPTURED STEAM GENERATOR WATER VOLUME FIGURE 15.6.3-9 RUPTURED STEAM GENERATOR WATER MASS IGURE 15.6.3-10 RUPTURED STEAM GENERATOR MASS RELEASE RATE TO THE ATMOSPHERE
GURE 15.6.3-11 INTACT STEAM GENERATORS MASS RELEASE RATE TO THE ATMOSPHERE
FIGURE 15.6.3-12 FLASHED BREAK FLOW
MODEL PRESSURE CORE EXIT MASS FLOWRATE NOTRUMP MIXTURE LEVEL LOCTA CORE INLET ENTHALPY FUEL ROD POWER HISTORY
RODS FOR THE REGION II ANALYSIS PCT CASE IGURE 15.6-8: MILLSTONE UNIT 3 PEAK CLADDING TEMPERATURE FOR ALL RODS FOR THE REGION II ANALYSIS PCT CASE
FIGURE 15.6-8 A DELETED BY FSARCR PKG FSC 07-MP3-054 LEVATION (RELATIVE TO BOTTOM OF ACTIVE FUEL) FOR THE REGION II ANALYSIS MPS 3PCT FSARCASE FIGURE 15.6-9: MILLSTONE UNIT 3 PEAK CLADDING TEMPERATURE ELEVATION RELATIVE TO BOTTOM OF ACTIVE FUEL) FOR THE REGION II ANALYSIS PCT CASE
REGION II ANALYSIS PCT CASE LEVEL (RELATIVE TO INSIDE BOTTOM OF VESSEL) FOR THE REGION II ANALYSIS PCT CASE ELATIVE TO INSIDE BOTTOM OF VESSEL) FOR THE REGION II ANALYSIS PCT CAS
LL FACE OF THE CORE AVERAGE CHANNEL NOT UNDER GUIDE TUBES FOR THE REGION II ANALYSIS PCT CASE
ANALYSIS PCT CASE LOOP FOR THE REGION II ANALYSIS PCT CASE REGION II ANALYSIS PCT CASE ANALYSIS PCT CASE ORE CHANNEL (RELATIVE TO BOTTOM OF ACTIVE FUEL) FOR THE REGION II ANALYSIS PCT CASE
LIQUID LEVEL (RELATIVE TO BOTTOM OF UPPER TIE PLATE) FOR THE REGION II ANALYSIS PCT CASE
CLUDING ACCUMULATOR INJECTION FLOW) FOR THE REGION II ANALYSIS PCT CASE
THE REGION II ANALYSIS PCT CASE II ANALYSIS PCT CASE
ELEVATION (4 INCH BREAK)
CLAD TEMPERATURE ELEVATION (4 INCH BREAK)
ELEVATION (4 INCH BREAK)
02-MP3-017 FIGURE 15.B-1 FIGURES DELETED BY FSARCR 02-MP3-017 nts which may result in a radioactive release from a subsystem or component are as follows:
- 1. Radioactive Gaseous Waste System Failure (Section 15.7.1)
- 2. Radioactive Liquid Waste System Leak or Failure (Atmospheric Release)
(Section 15.7.2)
- 3. Liquid Containing Tank Failure (Section 15.7.3)
- 4. Design Basis Fuel Handling Accidents (Section 15.7.4)
- 5. Spent Fuel Cask Drop Accidents (Section 15.7.5) s 1, 2, and 3 are classified as ANS Condition III events. Item 4 is classified as ANS Condition event. Item 5 is not assigned an ANS classification. Section 15.0.1 defines the ANS ditions.
.1 RADIOACTIVE GASEOUS WASTE SYSTEM FAILURE s section has been moved to Section 11.3.3.
.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE (ATMOSPHERIC RELEASE) s section has been moved to Section 11.2.3.1.
.3 LIQUID CONTAINING TANK FAILURE s section has been moved to Section 11.2.3.2.
.4 DESIGN BASIS FUEL HANDLING ACCIDENTS
.4.1 Identification of Causes and Accident Description s accident results from the dropping of a spent fuel assembly onto another fuel assembly in the nt fuel pool, resulting in the rupture of the cladding of all the fuel rods in the dropped assembly 19 fuel rods in the impacted assembly.
.4.2 Sequence of Events and Systems Operation method of analysis used for evaluating the potential radiological consequences of a fuel dling accident complies with Regulatory Guide 1.183, except that 67% of the damaged fuel s do not comply with footnote 11 of Regulatory Guide 1.183. For these fuel rods, the gap vity fractions used are taken from Regulatory Guide 1.25, as modified by NUREG/CR-5009.
le 15.7-8 for a list of assumptions used.
.4.2.1 Fuel Handling Accident in the Fuel Building s accident has been re-analyzed using the methods and assumptions contained in Regulatory de 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of ulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This lysis does not require re-alignment of the fuel building ventilation system, nor does it require building integrity.
fuel handling operations are conducted underwater using fuel handling equipment. The imum water depth between the top of the irradiated fuel rods in the racks and the spent fuel l surface is 23 feet.
pent fuel assembly is dropped into the fuel pool onto another fuel assembly. This results in the ure of all the rods in the dropped assembly and 19 rods in the impacted assembly. It is med that the gap activity from each ruptured fuel rod is released to the fuel pool. The ntion of noble gases in the fuel pool water is negligible. It is assumed that the radioactive erial from the fuel building is released to the environment, through the turbine building tilation vent, over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period.
fuel building ventilation system and its filters are not required while handling fuel in the fuel ding, nor is fuel building integrity required. This allows any penetration to the fuel building
., including roll-up doors) to be open during fuel movement. Suitable radiological monitoring quired per the Millstone Effluent Control Program when boundary integrity is not set to ure releases to the environment are monitored.
.4.2.2 Fuel Handling Accident in Containment s accident has been re-analyzed using the methods and assumptions contained in Regulatory de 1.183. In addition, the gap activity fractions defined in Regulatory Guide 1.25, as modified NUREG/CR-5009 was utilized for those fuel rods that do not comply with footnote 11 of ulatory Guide 1.183. A complete list of assumptions is provided in Table 15.7-8. This lysis does not require automatic isolation of purge from radiation monitor response, nor does it uire containment integrity because it is assumed that containment penetrations such as the ipment hatch are open.
el handling accident in containment is defined as the dropping of a spent fuel assembly onto ther spent fuel assembly in the refueling cavity from the refueling machine. This results in the ure of all rods in the dropped assembly and 19 rods in the impacted assembly. It is assumed the gap activity from each ruptured fuel rod is released to the refuel pool. The retention of le gases in the refuel pool water is negligible. The refuel pool water retains a large fraction of gap activity of iodines.
.4.2.3 Fuel Handling Accident Involving the Drop of an Insert Component in the Spent Fuel Pool s event assumes a drop of an insert (non-spent fuel assembly) component into the spent fuel l, assuming control room emergency ventilation system is not operable. Analysis shows that a foot drop of a RCCA handling tool containing a Rod Cluster Control Assembly (RCCA) onto ent fuel assembly will result in a maximum of 18 fractured rods if a Westinghouse 17x17 dard spent fuel assembly was impacted. There would be no fuel failure if the RCCA impacted estinghouse 17x17 RFA fuel assembly. The 17x17 standard fuel assemblies were removed m the core over 20 years ago. The radiological consequences analysis assumes that 30 rods are tured in the event. Due to the long decay time of the 17x17 standard fuel assemblies, the ological consequences of the failure of 30 rods is not significant.
omatic isolation of the control room, filtered control room recirculation, filtered surization of the control room, and control room envelope integrity are not credited in this lysis. All other assumptions used in the fuel handling accident involving the drop of a spent assembly are valid for this analysis.
7.4.3 Radiological Consequences results of the analyses are listed in Table 15.0-8. The results are within the limits as defined 0 CFR 50.67 and within the criteria identified in Regulatory Guide 1.183. The fuel gap vity is based on the halogen and noble gas inventory in the reactor core as listed in Table 15.0-nd the assumptions in Table 15.7-8. These assumptions include decay time, number of fuel s damaged, gap activity fractions, and peaking factor.
7.5 SPENT FUEL CASK DROP ACCIDENTS upgraded spent fuel shipping cask trolley is designed with special features to the structure will ensure that a single failure will not result in the loss of the capability of the system to ly retain the load. The upgraded shipping cask trolley is designed to meet the single failure of requirements of NUREG-0554 and NUREG-0612. When a cask is rigged to the crane in ordance with single failure criteria, a cask drop is not credible; therefore, there will be no ological consequences.
TABLE 15.7-1 OMITTED TABLE 15.7-2 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017 TABLE 15.7-3 TABLE RELOCATED TO TABLE 11.3-13 BY FSARCR 04-MP3-017 TABLE 15.7-4 TABLE RELOCATED TO TABLE 11.2-12 BY FSARCR 04-MP3-017 TABLE 15.7-5 TABLE RELOCATED TO TABLE 11.2-11 BY FSARCR 04-MP3-017 TABLE 15.7-6 TABLE RELOCATED TO TABLE 11.2-13 BY FSARCR 04-MP3-017 TABLE 15.7-7 TABLE RELOCATED TO TABLE 11.2-14 BY FSARCR 04-MP3-017 Fuel Building Containment Design Bases Design Bases wer level (MWt) 3,723 3,723 dial peaking factor 1.7 1.7 el damaged (Drop of a Fuel Assembly) 1 assembly plus 19 rods 1 assembly plus 19 rods el damaged (Drop of an insert component 30 rods 30 rods a fuel assembly) (1) rcentage of Fuel Rods that do not comply 67% 67%
h footnote 11 of Regulatory Guide 1.183 p activity fractions:
For Fuel Rods that do not comply with I-131: 012 I-131: 0.12 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.30 Kr-85: 0.30 All others: 0.10 All others: 0.10 For Fuel Rods that comply with I-131: 0.08 I-131: 0.08 footnote 11 of Regulatory Guide 1.183 Kr-85: 0.10 Kr-85: 0.10 All others: 0.05 All others: 0.05 ine chemical form, when released from ol (percent):
Inorganic 57 57 Organic 43 43 me after shutdown (hours) 100 100 el Building/Containment leak rate All activity is released All activity is released within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ration of release 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> ent fuel pool iodine decontamination 200 200 tor lease pathway Ventilation Vent (2) Ventilation Vent (2)
(unfiltered) (unfiltered) se conversion factors FGR 11 and 12 FGR 11 and 12 ntrol Room Habitability Assumptions (3) nsistent with Table 15.6-12 except as ed)
TES:
A bounding analysis was performed that assumed 30 rods were fractured from a drop of an insert component. The number of standard fuel rods that would be damaged in this event was determined to be 18. Westinghouse evaluations demonstrate that fuel damage only occurs if the impacted fuel assembly is Westinghouse 17x17 standard fuel.
For EAB & LPZ dose, containment-ground release X/Qs are used for conservatism.
TABLE 15.7-9 DELETED BY FSARCR PKG FSC 04-MP3-017 TABLE 15.7-10 DELETED BY PKG FSC 07-MP3-056 TABLE 15.7-11 DELETED BY FSARCR PKG FSC 04-MP3-017 worst common mode failure which is postulated to occur is the failure to scram the reactor r an anticipated transient has occurred. A series of generic studies [1 & 2] on Anticipated nsients Without Scram (ATWS) showed acceptable consequences would result provided that turbine trips and auxiliary feedwater flow are initiated in a timely manner. A Millstone Unit 3 cific calculation at a NSSS thermal power of 3739 MWt has been performed to confirm licability of the generic studies. The effects of ATWS events are not considered as part of the gn basis for transients analyzed in Chapter 15. The final NRC ATWS rule [3] requires that tinghouse-designed plants install ATWS Mitigation System Actuation Circuitry (AMSAC) to ate turbine trip and actuate auxiliary feedwater flow independent of the Reactor Protection tem (RPS). The Millstone Unit 3 AMSAC design is described in Section 7.8.
.1 REFERENCES FOR SECTION 15.8
-1 WCAP-8330, 1974. Westinghouse Anticipated Transients Without Trip Analysis.
-2 Anderson, T. M., ATWS Submittal, Westinghouse Letter NS-TMA-2182 to S. H. Hanauer of the NRC, December 1979.
-3 ATWS Final Rule - Code of Federal Regulations 10 CFR 50.62 and Supplementary Information Package, Reduction of Risk from Anticipated Transients Without Scram (ATWS) Events for Light-Water-Cooled Nuclear Power Plants.
-4 NUREG-0460, Anticipated Transients Without Scram for Light Water Reactors, December 1978.
-5 Anderson, T. M., Rule making on Anticipated Transients Without Scram, Westinghouse Letter NS-EPR-83-2833 to S. J. Chilk of the NRC, October 3, 1983.
radiological consequences of design basis accidents evaluated using the Alternate Source m (AST) are quantified in terms of Total Effective Dose Equivalent (TEDE) at the control m, Exclusion Area Boundary (EAB) and Low Population Zone (LPZ). The dose methodology d is consistent with Regulatory Guide 1.183 and has been implemented via use of the DTRAD computer code.
radiological consequences of all other design-basis accidents are quantified in terms of oid doses and whole-body gamma doses at the exclusion area boundary (EAB), and at the low ulation zone (LPZ). The doses at the EAB are based upon releases of radionuclides over a od of two hours following the occurrence of an assumed accident; those at the LPZ are based n releases over a thirty-day period following the occurrence of this accident.
roid doses for these accidents are calculated based upon Equation 15A-1:
D thy = Ai Q B.R. Cthy (15A-1) i re:
Dthy = thyroid dose (rem)
Ai = activity of iodine isotope i released (curies)
/Q = atmospheric dispersion factor (sec/meter3)
B.R. = breathing rate (meter3/sec)
Cthy = thyroid dose conversion factor (rem/ci) (Reg. Guide 1.109, 1977)
/Q values presented in Table 15.0-11 were calculated using the methodology described in R Section 2.3.4.
ne nuclide contribution to the external whole body gamma dose for the nonrevised accidents alculated using Equation 15A-2 (derived from equations in Regulatory Guide 1.4, 1974):
D = 0.25 A i E i Q (15A-2) i re:
D = gamma dose from a semi-infinite cloud (rem)
Ei = average gamma energy per disintegration of isotope i (MeV/dis)
Ai = activity of isotope i released over the given time interval (curies)
/Q = atmospheric dispersion factor (sec/m3)
- e. Dose factors from Table B-1, Regulatory Guide 1.109 Revision 1 or FGR 12 or ICRP 30 are d to calculate potential gamma whole body. The equation from Regulatory Guide 1.109 is as ows:
4 D = 3.17X10 Q i X Q DF i
(15A-3) i re:
D = gamma whole body dose (mrem)
Qi = release rate of radionuclide i (Ci/year)
X/Q = atmospheric dispersion factor (sec/meter3)
DFi = gamma whole body dose factor for a uniform semi-infinite cloud of radionuclide i mrem-m3/pCi-year constant 3.17 x 104 is in units of pCi-year/Ci-sec.
following is a list of computer programs which are used to calculate design-basis source s and radiological consequences of the nonrevised design basis accidents in FSAR pter 15:
- 1. ACTIVITY 2 Program ACTIVITY 2 calculates the concentration of fission products in the fuel, coolant, waste gas decay tanks, ion exchangers, miscellaneous tanks, and release lines to the atmosphere for a PWR system. The program uses a library of properties of more than 100 significant fission products and may be modified to include as many as 200 isotopes. The output of ACTIVITY 2 presents the isotopic activity and energy spectrum at the selected part of the system for a given operating time.
- 2. RADIOISOTOPE Program RADIOISOTOPE calculates the activity of isotopes in a closed system by solving the appropriate decay equations. Based on the activity of any isotope in the system at an initial time, the program calculates the activity of that isotope and its offspring at any later time, provided that the decay scheme is contained in the program library. Furthermore, because gamma activity is important for dose rate
- 3. IONEXCHANGER Program IONEXCHANGER computes the buildup of isotopic activity in the resin bed of a demineralizer for constant feed flow rate and constant feed activity conditions. This program also calculates the energy releases in seven energy groups of gamma radiation accompanying decay for each of these isotopes, considering up to two parents of an isotope. A library of more than 100 isotopes is provided, and, when desired, has the ability to handle 200 different isotopes.
- 4. REM 123 REM 123 is a computer program developed to calculate the beta, gamma, and thyroid doses at the EAB and LPZ boundary. This calculation is based on the xenon releases, krypton releases, iodine releases, and X/Q values for a specified period of time. REM 123 makes use of built-in constants such as average gamma energies, thyroid dose conversion factors, and appropriate breathing rates; it performs its dose calculations in accordance with Regulatory Guides 1.3 and 1.4.
- 5. DRAGON 4 Program DRAGON 4 evaluates the activities, dose rates, and time-integrated dose in the reactor building and control room of a nuclear facility or at an adjacent site following release of halogens and noble gases from some control volume. The fission product release to the atmosphere, together with the activities and time-integrated activity concentrations of the halogens which are accumulated in the system, are also computed. Site dose calculations performed by DRAGON 4 employ the semi-infinite cloud models suggested by Regulatory Guides 1.3 and 1.4; the gamma dose in the control room is computed based upon a finite cloud model. Average gamma energies are used in all dose calculations.
- 6. QADMOD Program QADMOD calculates dose rates at specified detector locations for a number of different source points representing volumetric sources. The calculational technique employed by this program is commonly referred to as the point kernel technique. QADMOD is a modified version of the QAD P-5 program written at Los Alamos Scientific Laboratory by R.E. Malenfant. This modification includes a) the FASTER geometry routines, b) a point source option, c) a translated cylindrical source volume option, and d) an internal data library
For the revised Millstone 3 dose calculations, the dose methodology incorporated Regulatory Guide 1.183 methods. The revised Millstone 3 dose calculations used the following computer codes to calculate the TEDE doses.
- 7. RADTRAD The RADionuclide, Transport, Removal, and Dose (RADTRAD) model estimates doses at offsite locations: the exclusion area boundary (EAB) or the low population zone (LPZ), and in the control room. The code has two optional source terms to describe fission product release from the reactor coolant system: those specified in: Calculation of Distance Factors for Power and Test Reactor Sites (TID-14844) along with Regulatory Guides 1.3 and 1.4; and those specified for boiling water reactors (BWRs) and pressurized water reactors (PWRs) in Accident Source Terms for Light Water Nuclear Power Plants (NUREG-1465).
As radioactive material is transported through the containment, the user can account for sprays and natural deposition that may reduce the quantity of radioactive material. Material can flow between buildings, from buildings to the environment, or into control rooms through high-efficiency particulate air (HEPA) filters, piping, or other connectors. An accounting of the amount of radioactive material retained due to these tortuous pathways is maintained. Decay and in-growth of daughters can be calculated over time as the material is transported. The code contains over 25 model and table options to perform these tasks. Dose Conversion Factors used in RADTRAD are from Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion and Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water and Soil. The RADTRAD code was originally developed by the Accident Analysis and Consequence Assessment Department at Sandia National Laboratories (SNL) for the U. S. Nuclear Regulatory Commission (NRC), Office of Nuclear Reactor Regulation (NRR), Division of Reactor Program Management.
- 8. ORIGEN-ARP The ORIGEN-ARP code is a neutron depletion and decay code that is used to generate the reactor core inventory. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
- 9. ARCON96 ARCON96 was developed to calculate relative concentrations in plumes from nuclear power plants at control room air intakes in the vicinity of the release point.
ARCON96 implements a straight line Gaussian dispersion model with dispersion coefficients that are modified to account for low wind meander and building wake
ranging from 2 to 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> in duration. It is maintained by the Radiation Safety Shielding Information Computational Center (RSICC) of the Oak Ridge National Laboratory.
A.1 REFERENCES FOR APPENDIX 15A A-1 Regulatory Guide 1.109, Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
A-2 Regulatory Guide 1.4, Assumption Used for Evaluating the Potential Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50, Appendix I, Rev. 1, Oct. 1977.
A-3 Federal Guidance Report No. 11, Dose Conversion Factors for Inhalation, Submersion and Ingestion, (FGR 11), 1988.
A-4 Federal Guidance Report No. 12, External Exposure to Radionuclides in Air, Water, and Soil, (FGR 12), 1993.
A-5 International Commission on Radiological Protection Report No. 30, Limits of Intakes of Radionuclides by Workers, (ICRP 30), 1980.