ML17334A163

Amendment 1 to Updated Safety Analysis Report, Chapter 15, Accident Analyses

ML17334A163
Person / Time
Site:	Watts Bar
Issue date:	11/02/2017
From:	Tennessee Valley Authority
To:	Office of Nuclear Reactor Regulation
Shared Package
ML17334A154	List: ML17334A156 ML17334A157 ML17334A158 ML17334A159 ML17334A160 ML17334A162 ML17334A163 ML17334A164 ML17334A165 ML17334A169 ML17334A170 ML17334A172 ML17334A173 ML17334A177
References
Download: ML17334A163 (522)

Text

WBN 15.1-1 15.0 ACCIDENT ANALYSES

The ANS classification of plant conditions divides plant conditions into four categories in

accordance with anticipated frequency of occurrence and potential radiological consequences

to the public. The four categories are as follows:

Condition I: Normal Operation and Operational Transients Condition II: Faults of Moderate Frequency Condition III: Infrequent Faults Condition IV: Limiting Faults

The basic principle applied in relating design requirements to each of the conditions is that the

most probable occurrences should yield the least radiological risk to the public and those

extreme situations having the potential for the greatest risk to the public shall be those least

likely to occur. Where applicable, Reactor Trip System and engineered safeguards functioning

is assumed to the extent allowed by considerations such as the single failure criterion, in

fulfilling this principle.

In the evaluation of the radiological consequences associated with initiation of a spectrum of

accident conditions numerous assumptions must be postulated. In many instances these

assumptions are a product of extremely conservative judgments. This is due to the fact that

many physical phenomena, in particular fission product transport under accident conditions, are presently not understood to the extent that accurate predictions can be made. Therefore, the

set of assumptions postulated would predominantly determine the accident classification.

This chapter addresses the accident conditions listed in Table 15-1 of the NRC Standard

Format and Content Guide, Regulatory Guide 1.70, Revision 3, which apply to WBN.

15.1 CONDITION I - NORMAL OPERATION AND OPERATIONAL TRANSIENTS

Condition I occurrences are those which are expec ted frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I

occurrences are accommodated with margin between any plant parameter and the value of that

parameter which would require either automatic or manual protective action. Condition I

occurrences occur frequently or regularly. Therefor e, they must be considered from the point of view of affecting the consequences of fault conditions (Condition II, III, and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial

conditions corresponding to the most adverse set of conditions which can occur during

Condition I operation.

WBN 15.1-2 Typical Condition I events are listed below:

1. Steady-state and shutdown operations

a. Power operation (>5% to 100% of full power)

b. Startup (critical, 0% to <5% of full power)

c. Hot shutdown (subcritical, residual heat removal system isolated)

d. Cold shutdown (subcritical, residual heat removal system in operation)

e. Refueling (reactor vessel head open)

2. Operation with permissible deviations

Various deviations which may occur during continued operation as permitted by the plant Technical Specifications must be considered in conjunction with other operational

modes. These include:

a. Operation with components or systems out of service (such as power operation with a reactor coolant pump out of service)

b. Leakage from fuel with cladding defects

c. Radioactivity in the reactor coolant

i. Fission products ii. Activation products iii. Tritium

d. Operation with steam generator leaks up to the maximum allowed by the Technical Specifications

e. Testing as allowed by the Technical Specifications

3. Operational transients

a. Plant heatup and cooldown (up to 100ºF/hour for the reactor coolant system; 200ºF/hour for the pressurizer)

b. Step load changes (up to + 10%)

c. Ramp load changes (up to 5%/minute)

d. Load rejection up to and including design load rejection transient

WBN 15.1-3 15.1.1 Optimization of Control Systems

A setpoint study was performed to simulate performance of the reactor control and protection

systems. In this study, emphasis was plac ed on the development of a control system to automatically maintain prescribed conditions in the plant even under the most conservative set

of reactivity parameters with respect to both system stability and transient performance.

For each mode of plant operation, a group of optimum controller setpoints was determined. In

areas where the resultant setpoints were different, compromises based on the optimum overall

performance were made and verified. A consist ent set of control system parameters was derived, satisfying plant operational requirements throughout the core life and for power levels

between 15 and 100%.

The study was comprised of an analysis of the following control systems: rod cluster control

assembly, steam dump, steam generator level, pressurizer pressure and pressurizer level.

15.1.2 Initial Power Conditions Assumed In Accident Analyses

15.1.2.1 Power Rating

Table 15.1-1 lists the principle power rating values which are used in analyses performed in this

section. Two ratings are given:

1. The guaranteed Nuclear Steam Supply System thermal power output rating. This power output includes the thermal power generated by the reactor coolant pumps.

2. The Engineered Safety Features design rating. The Westinghouse supplied Engineered Safety Features are designed for thermal power higher than the guaranteed value in

order not to preclude realization of future potential power capability. This higher thermal

power value is designated as the Engineered Safety Features design rating. This power

output includes the thermal power generated by the reactor coolant pumps.

Where initial power operating conditions are assumed in accident analyses, the "guaranteed

Nuclear Steam Supply System thermal power output" plus allowance for errors in steady state

power determination is assumed. Where demonstration of adequacy of the containment and

Engineered Safety Features is concerned, the "Engineered Safety Features design rating" plus

allowance for error is assumed. The thermal power values used for each transient analyzed are

given in Table 15.1-2.

WBN 15.1-4 15.1.2.2 Initial Conditions

For Unit 1 accident evaluation, the initial conditions are obtained by adding bounding steady

state errors to rated values. The following steady state errors are bounded:

For Unit 2 accident evaluation, the initial conditions are obtained by adding the maximum steady

state errors to rated values. The following steady state errors are considered:

1. Core power

+ 0.6% allowance for calorimetric error (Unit 1)

+ 2% allowance for calorimetric error (Unit 2) 2. Average reactor coolant system temperature

+ 6ºF allowance for deadband and measurement error (bounds an instrument

uncertainty of

+/-5°F and instrument bias of -

1°F) 3. Pressurizer pressure

+ 70/-50 psi allowance for steady state fluctuations and measurement error (bounds

an instrument uncertainty of

+/-50 psi and instrument bias of -20 psi)

For most accidents which are departure from nucleate boiling (DNB) limited, nominal values of

initial conditions are assumed. The allowance on power, temperature, and pressure are

determined on a statistical basis and are included in the DNB limit ratio (DNBR) as described in

Reference [27]. This procedure is known as the Revised Thermal Design Procedure (RTDP).

The minimum measured flow value is used in all RTDP transients.

Note that the signs of the errors used in the accident analyses are typically opposite of the signs

describing the instrument uncertainties; e.g., an instrument error of +50, defined as indicated

value of 50 greater than actual value, may be applied in the analysis as -50, i.e., the analysis

assumes that the actual value may be 50 less than the nominal value.

For accidents which are not DNB limited or for which the RTDP is not employed, the initial

conditions are obtained by adding the bounding steady-state errors to nominal values in such a

manner to maximize the impact on the limiting parameter. The thermal design flow value, which

is the minimum measured flow minus measurem ent uncertainty, is used for such analyses.

The thermal design (Unit 1 and Unit 2) and minimum measured flowrates (Unit 1 only) are given

in Table 15.1-1.

WBN 15.1-5 15.1.2.3 Power Distribution

The transient response of the reactor system is dependent on the initial power distribution. The

nuclear design of the reactor core minimizes adverse power distribution through the placement

of control rods and operation instructions. The power distribution may be characterized by the

radial factor FH and the total peaking factor F

q. The peaking factor limits are given in the Core Operating Limits Report.

For transients that may be DNB-limited the radial peaking factor is of importance. The radial

peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15.1-1. All transients that may be DNB limited

are assumed to begin with a value of FH consistent with the initial power level defined in the Technical Specifications.The axial power shape used in the DNB calculations is discussed in

Section 4.4.3.2.2.

For transients which may be overpower-limited the total peaking factor F q is of importance. The value of F q may increase with decreasing power level such that full power hot spot heat flux is not exceeded (i.e., F q x Power = design hot spot heat flux). All transients that may be overpower-limited are assumed to begin with a value of F q consistent with the initial power level as defined in the Technical Specifications.

The value of peak kW/ft can be directly related to fuel temperature. For transients which are

fast with respect to the fuel rod thermal time constant, for example, rod ejection, a detailed heat

transfer calculation is made.

15.1.3 Trip Points And Time Delays To Trip Assumed In Accident Analyses

A reactor trip signal acts to open two trip breakers connected in series feeding power to the

control rod drive mechanisms. The loss of power to the mechanism coils causes the

mechanisms to release the rod cluster control assemblies which then fall by gravity into the

core. There are various instrumentation delays associated with each trip function, including

delays in signal actuation, in opening the trip breakers, and in the release of the rods by the

mechanisms. The total delay to trip is defined as the time delay from the time that trip

conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints

assumed in accident analyses and the time delay assumed for each trip function are given in

Table 15.1.3. Reference is made in that table to overtemperature and overpower T trip shown in Figure 15.1-1.

Accident analyses which assume the steam generator low-low water level trip signal to initiate

protection functions may be affected by the Trip Time Delay (TTD)

[23] system, which was developed to reduce the incidence of unnecessary feedwater-related reactor trips.

WBN 15.1-6 The TTD imposes a system of pre-determined delays upon the steam generator low-low level

reactor trip and auxiliary feedwater initiation. The values of these delays are based upon (1) the

prevailing power level at the time the low-low level trip setpoint is reached, and by (2) the

number of steam generators in which the low-low level trip setpoint is reached. The TTD delays

the reactor trip and auxiliary feedwater actuation in order to provide time for corrective action by the operator or for natural stabilization of shrink/swell water level transients. The TTD is

primarily designed for low power or startup operations.

The difference between the limiting trip point assumed for the analysis and the nominal trip point

represents an allowance for instrumentation channel error and setpoint error. During

preoperational start-up tests, it is demonstrated that actual instrument errors and time delays

are equal to or less than the assumed values.

Additionally, protection system channels are

calibrated and instrument response times determined periodically in accordance with the plant

Technical Specifications.

15.1.4 Instrumentation Drift And Calorimetric Errors - Power Range Neutron Flux

The instrumentation drift and calorimetric errors used in establishing the power range high

neutron flux setpoint are presented in Reference [22] and [28] (Unit 2 only).

The calorimetric error is the error assumed in the determination of core thermal power as

obtained from secondary plant measurements. The total ion chamber current (sum of the top

and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet

temperature to the steam generators and steam pr essure. High accuracy instrumentation is provided for these measurements with accuracy tolerances much tighter than those which

would be required to control feedwater flow.

15.1.5 Rod Cluster Control Assembly Insertion Characteristic

The rate of negative reactivity insertion following a reactor trip is a function of the acceleration of

the rod cluster control assemblies and the variation in rod worth as a function of rod position.

With respect to accident analyses, the critical parameter is the time of insertion up to the

dashpot entry or approximately 85% of the rod cluster travel. The most limiting insertion time to

dashpot entry used for accident analyses is 2.7 seconds. The normalized rod cluster control

assembly position versus time curve assumed in accident analyses is shown in Figure 15.1-2.

Figure 15.1-3 shows the fraction of total negative r eactivity insertion for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to

the lower region of the core can arise from an unbalanced xenon distribution. There is inherent

conservatism in the use of this curve in that it is based on a skewed flux distribution which

would exist relatively infrequently.

WBN 15.1-9 Condition IV Events

1. Major Rupture of a Main Steam Line 15.4.2.1

2. Major Rupture of a Main Feedwater Pipe 15.4.2.2

3. Steam Generator Tube Rupture 15.4.3

4. Single Reactor Coolant Pump Locked Rotor 15.4.4

5. Rupture of a Control Rod Drive Mechanism 15.4.6 Housing (Rod Cluster Control Assembly Ejection)

15.1.7 Fission Product Inventories

15.1.7.1 Radioactivity in the Core

Unit 1

The core fission product-inventory is calculated by the ORIGEN

[2] computer code. The inventories of fission products important from a health hazard point of view are given in Table 15.1-4. The isotopes included in Table 15.1-4 are the isotopes controlling from considerations

of inhalation dose (iodines) and from direct dose due to immersion (noble gases).

Unit 2

The average core fission product-inventory is calc ulated by the ORIGEN-S Subcode within the SCALE-4.2 [2] computer code. The inventories of fission products important from a health

hazard point of view are given in Table 15.1-4. The isotopes included in Table 15.1-4 are the

isotopes controlling from considerations of inhalation dose (iodines) and from direct dose due to

immersion (noble gases).

15.1.7.2 Radioactivity in the Fuel Pellet Clad Gap

Unit 1

The calculation of the maximum core fission product-inventories are also calculated by the

ORIGEN computer code and are the basis for determining the gap activities used in single fuel

assembly accident analyses. The gap activities are consistent with the guidance of Regulatory

Guide 1.25

[3]: 10% of the total noble gases other than Kr-85 and 30% of Kr-85. For an accident analysis involving a fuel assembly, 10% of the total radioactive iodine in the rods at the time of

the accident is also in the gap.

The radioactivity in the reactor coolant as well as in the volume control tank, pressurizer, and

waste gas decay tanks are given in Chapter 11 along with the data on which these

computations are based.

WBN 15.1-10 Unit 2

The calculation of the maximum core fission product-inventories are also calculated by the

ORIGEN-S computer code and are the basis for determining the gap activities used in single

fuel assembly accident analyses. The gap activities are consistent with the guidance of Safety

Guide 25 [3]: 10% of the total noble gases other than Kr-85 and 30% of Kr-85. For an accident

analysis involving a fuel assembly, 10% of the total radioactive iodine in the rods at the time of

the accident is also in the gap.

The radioactivity in the reactor coolant as well as in the volume control tank, pressurizer, and

waste gas decay tanks are given in Chapter 11 along with the data on which these

computations are based.

15.1.8 Residual Decay Heat

Residual heat in a subcritical core consists of:

1. Fission product decay energy,

2. Decay of neutron capture products, and

3. Residual fissions due to the effect of delayed neutrons.

These constituents are discussed separately in the following paragraphs.

15.1.8.1 Fission Product Decay Energy

For short times (10 3 seconds) after shutdown, data on yields of short half life isotopes is sparse. Very little experimental data is available for the X-ray contributions and even less for the -ray contribution. Several authors have compiled the available data into a conservative estimate of

fission product decay energy for short times after shutdown, notably Shure

[7] and Dudziak.

[8] Of these two selections, Shure's curve is the highest, and it is based on the data of Stehn and

Clancy[10] and Obenshain and Foderaro.

[11]

The fission product contribution to decay energy which has been assumed in the accident

analyses is the curve of Shure increased by 20% for conservatism unless otherwise stated in

the sections describing specific accidents. This curve with the 20% factor included is shown in

Figure 15.1-6.

WBN 15.1-11 15.1.8.2 Decay of U-238 Capture Products

Betas and gammas from the decay of U-239 (23.5 minute half-life) and Np-239 (2.35 day

half-life) contribute significantly to the heat generation after shutdown. The cross section for

production of these isotopes and their decay schemes is relatively well known. For long

irradiation times their contribution can be written as:

10-t P/P = E + E200Mev c(1+)

e watts/watt 11 1 t watts/wat e+e -e( - )+c(1 Mev200 E+E = P/Pt-t)-t-21 202 2 1 2 2 2 where:

P 1/P 0 = the energy from U-239 decay P 2/P 0 = the energy from Np-239 decay t = the time after shutdown (seconds) c(l+a) = the ratio of U-238 captures to total fissions = 0.6 (1 + 0.2) 1 = the decay constant for U-239 = 4.91 x 10

-4 second-1 2 = the decay constant for Np-239 = 3.41 x 10

-6 second-1 1 E1 = total (-ray energy from U-239 decay = 0.06 Mev 2 E2 = total (-ray energy from Np-239 decay = 0.30 Mev 1 E3 = total -ray energy from U-239 decay = 1/3 x 1.18 Mev 2 E4 = total -ray energy from Np-239 decay = 1/3 x 0.43 Mev (Two-thirds of the potential -energy is assumed to escape by the accompanying neutrinos.)

This expression with a margin of 10% has been assumed in the accident analysis unless

otherwise stated in the sections describing specific accidents and is shown in Figure 15.1-6.

The 10% margin, compared to 20% for fission product decay, is justified by the availability of the

basic data required for this analysis. The decay of other isotopes, produced by neutron

reactions other than fission, is neglected.

WBN 15.1-13 15.1.9.1 FACTRAN

FACTRAN calculates the transient temperature distribution in a cross section of a metal clad

UO 2 fuel rod and the transient heat flux at the surface of the clad using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density).

The code uses a fuel model which exhibits the following features simultaneously:

1. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

2. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.

3. The necessary calculations to handle post-DNB transients, film boiling heat transfer correlations, Zircaloy-water reaction and partial melting of the materials.

The gap heat transfer coefficient is calculated according to an elastic pellet model (refer to

Figure 15.1-8). The thermal expansion of the pellet is calculated as the sum of the radial (one-

dimensional) expansions of the rings. Each ring is assumed to expand freely. The cladding

diameter is calculated based on thermal expansion and internal and external pressures.

If the outside radius of the expanded pellet is smaller than the inside radius of the expanded

clad, there is no fuel-clad contact and the gap conductance is calculated on the basis of the

thermal conductivity of the gas contained in the gap. If the pellet's outside radius so calculated

is larger than the clad inside radius (negative gap), the pellet and the clad are pictured as

exerting upon each other a pressure sufficiently important to reduce the gap to zero by elastic

deformation of both. The contact pressure determines the gap heat transfer coefficient.

FACTRAN is further discussed in Reference [12].

15.1.9.2 LOFTRAN

LOFTRAN is used for studies of transient response of a pressurized water reactor system to

specified perturbations in process parameter

s. LOFTRAN simulates a multi-loop system containing reactor vessel, hot and cold leg piping, steam generators (tube and shell sides) and

the pressurizer. The pressurizer heaters, spray, relief and safety valves are also considered in

the program. Point model neutron kinetics, and reactivity effects of the moderator, fuel, boron

and rods are included. The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and

control. The reactor protection system is simulated to include reactor trips on neutron flux, overpower and overtemperature reactor coolant T, high and low pressure, low flow, and high pressurizer level. Control systems are also simulated including rod control, steam dump, feedwater control and pressurizer pressure control. The safety injection system including the

accumulators is also modeled.

LOFTRAN is suited to both accident evaluation and control studies as well as parameter sizing.

WBN 15.1-15 15.1.9.7 LOFTTR

The steam generator tube rupture (SGTR) analyses were performed for Watts Bar using the

analysis methodology developed in WCAP-10698

[24] and Supplement 1 to WCAP-10698.

[25] The methodology was developed by the SGTR Subgroup of the Westinghouse Owners Group (WOG) and was approved by the NRC in Safety Evaluation Reports (SERs) dated December 17, 1985 and March 30, 1987. The LOFTTR2 program, an updated version of the LOFTTR1

program, was used to perform the SGTR analys is for Watts Bar. The LOFTTR1 program was developed as part of the revised SGTR analysis methodology and was used for the SGTR

evaluations.

[24][25] However, the LOFTTR1 program was subsequently modified to accommodate steam generator overfill and the revised program, designated as LOFTTR2, and

was used for the evaluation of the consequences of overfill in WCAP-11002.

[26] The LOFTTR2 program is identical to the LOFTTR1 program, with the exception that the LOFTTR2 program has the additional capability to represent the transition from two regions (steam and water) on

the secondary side to a single water region if overfill occurs, and the transition back to two

regions again depending upon the calculated secondary conditions. Since the LOFTTR2

program has been validated against the LOFTTR1 program, the LOFTTR2 program is also appropriate for performing licensing basis SGTR analyses. The specific Watts Bar LOFTTR2

analysis utilizing this methodology is described in 15.4.3.

WBN 15.1-16 REFERENCES

1. Deleted in initial UFSAR.

2a. SCALE: A Modular Code System for Performing Standardized Computer Analyses for Licensing Evaluation, Vols. I-III, NUREG/CR-0200, Rev. 5 (ORNL/NUREG/CSD-2/R5),

March 1997. (Unit 1)

2b. SCALE-4.2: A Modular Code System for Performing Standardized Computer Analyses for Licensing Evaluation, Volumes I-III, NUREG/CR-0200, Rev. 5 (ORNL/NUREG/CSD-

2/R5), March 1997 (ORIGEN-S Subsection) (Unit 2)

3. Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents At Nuclear Power Reactors, July 2000

4. Toner, D. F. and Scott, J. S., "Fission-Product Release from UO", Nuc. Safety 3 No. 2, 15-20, December 1961.

5. Belle, J., "Uranium Dioxide Properties and Nuclear Applications," Naval Reactors, Division of Reactor Development United States Atomic Energy Commission, 1961.

6. Booth. A. H., "A Suggested Method for Calculating the Diffusion of Radioactive Rare Gas Fission Products From UO Fuel Elements," DCI-27, 1957.

7. Shure, K., "Fission Product Decay Energy" in Bettis Technical Review, WAPD-BT-24, p.

1-17, December 1961.

8. Shure, K. and Dudziak, D. J., "Calculating Energy Released by Fission Products," Trans.

Am. Nucl. Soc. 4 (1) 30 (1961).

9. Deleted in initial UFSAR.

10. Stehn, J.R. and Clancy, E. F., "Fission-Product Radioactivity and Heat Generation" and "Proceedings of the Second United Nations International Conference on the Peaceful

Uses of Atomic Energy, Geneva, 1958," Volu me 13, pp. 49-54, United Nations, Geneva, 1958.

11. Obershain, F. E. and Foderaro, A. H., "Energy from Fission Product Decay," WAPD-P-652, 1955.

12. Hargrove, H. G., "FACTRAN, a FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908, December 1989.

13. Deleted in initial UFSAR.

14. Deleted. in initial UFSAR

15. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A (Proprietary), WCAP-7907-A (Non-Proprietary) April 1984.

WBN 15.1-17 16. Barry, R. F., "LEOPARD, A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963.

17. Barry, R. F. and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code," WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary), January 1975.

18. Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Non-Proprietary),

January 1975.

19. Deleted in initial UFSAR.

20. Deleted in initial UFSAR.

21. Deleted by UFSAR Amendment 1

22. Reagan, J. R. and Tuley, C. R., "Westinghouse Setpoint Methodology for Protection Systems, Watts Bar Units 1 and 2, Eagle 21 Version," WCAP-12096, Rev. 9, March

1998. (Proprietary). Unit 1 only

23. Miranda, S., et.al., "Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater Related Trips," WCAP-11325-P-A, Revision 1, February 1988.

24. Lewis, Huang, Behnke, Fittante, Gelman, "SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill," WCAP-10698-P-A [PROPRIETARY]/WCAP-

10750-A [NON-PROPRIETARY], August 1987.

25. Lewis, Huang, Rubin, "Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident," Supplement 1 to WCAP-10698-P-A

[PROPRIETARY]/Supplement 1 to WCAP-10750-A [NON-PROPRIETARY], March

1986.

26. Lewis, Huang, Rubin, Murray, Roidt, Hopkins, "Evaluation of Steam Generator Overfill Due to a Steam Generator Tube Ruptur e Accident," WCAP-11002 [PROPRIETARY]/

WCAP-11003 [NON-PROPRIETARY], February 1986.

27. Friedland, A. J. and S. Ray, "Revised Thermal Design Procedure," WCAP-11397-P-A (PROPRIETARY) and WCAP-11398-A (NON-PROPRIETARY), April 1989.

28. Trozzo, R. W., "Westinghouse Setpoint Methodology for Protection Systems - Watts Bar Unit 2," WCAP-17044-P, Revision 1, September 2012, (Unit 2 Only).

WBN 15.3-1 15.3 CONDITION III - INFREQUENT FAULTS By definition Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel

rods although sufficient fuel damage might occur to preclude resumption of the operation for a

considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict

public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the RCS or

containment barriers. For the purposes of this report the following faults have been grouped

into this category: 1.Loss of reactor coolant, from sm all ruptured pipes or from cracks in large pipes, which actuates the ECCS.2.Minor secondary system pipe breaks.3.Inadvertent loading of a fuel assembly into an improper position.

4.Complete loss of forced reactor coolant flow.5.Waste gas decay tank rupture.

6.Single rod cluster control assembly withdrawal at full power.15.3.1 LOSS OF REACTOR COOLANT FROM SMALL RUPTURED PIPES OR FROM CRACKS IN LARGE PIPES WHICH ACTUATE THE EMERGENCY CORE COOLING SYSTEM 15.3.1.1 Identification of Causes and Accident Description A LOCA is defined as the loss of reactor coolant at a rate in excess of the reactor coolant normal makeup rate from breaks or openings in the RCPB inside primary containment up to, and including, a break equivalent in size to the largest justified pipe rupture (or in the absence of

justification, a double-ended rupture of the largest pipe) in the reactor coolant pressure

boundary (RCPB)(ANSI/ANS-51.1-1983). See Section 3.6 for a more detailed description of the

loss of reactor coolant accident boundary limits. Ruptures of small cross section will cause

expulsion of the coolant at a rate which can be accommodated by the charging pumps which

would maintain an operational water level in the pressurizer, permitting the operator to execute

an orderly shutdown. The coolant which would be released to the containment contains the

existing fission products.

WBN 15.3-2 The maximum break size for which the normal makeup system can maintain the pressurizer

level is obtained by comparing the calculated flow from the RCS through the postulated break

against the charging pump makeup flow at normal RCS pressure, i.e., 2250 psia.

Should a larger break occur, depressurization of the RCS causes fluid to flow to the RCS from

the pressurizer, resulting in a pressure and level decrease in the pressurizer. A reactor trip

occurs when the pressurizer low pressure trip setpoint is reached. The safety injection system

is actuated when the appropriate pressure setpoint is reached. The consequences of the

accident are limited in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of nuclear power to a residual level corresponding to the delayed fission and

fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive clad temperatures.

Before the break occurs, the plant is in an equilibrium condition, i.e., the heat generated in the

core is being removed via the secondary syst em. During blowdown, heat from decay, hot internals and the vessel continues to be transferred to the reactor coolant. The heat transfer

between the RCS and the secondary system may be in either direction, depending on the

relative temperatures. In the case of continued heat addition to the secondary system, pressure

increases, and steam dump may occur. Makeup to the secondary side is automatically

provided by the auxiliary feedwater pumps. The reactor trip signal coincident with low Tavg signal (with assumed coincident loss of offsite pow er), stops normal feedwater flow by closing

the main feedwater isolation valves and flow control valves. The secondary flow aids in the

reduction of RCS pressure.

When the RCS depressurizes to the cold leg accumulator tank pressure, the accumulators

begin to inject water into the reactor coolant loops. The reactor coolant pumps are assumed to

be tripped concurrent with the reactor trip, and effects of pump coastdown are included in the

blowdown analyses.

15.3.1.2 Analysis of Effects and Consequences

Method of Analysis

For breaks less than 1.0 ft 2 , the NOTRUMP

[1, 2] digital computer code is employed to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow

through the break. (Unit 1)

For breaks less than 1.0 ft 2 , the NOTRUMP

[1,2,16] digital computer code is employed to calculate the transient depressurization of the RCS as well as to describe the mass and enthalpy of flow

through the break. (Unit 2)

WBN 15.3-3 Small Break LOCA Analysis Using NOTRUMP

The NOTRUMP computer code is used in the analysis of loss-of-coolant accidents due to small

breaks in the reactor coolant system. The NOTRUMP computer code is a one-dimensional general network code consisting of a number of advanced features. Among these features are

the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux

calculations with counter-current flooding limitations, mixture level tracking logic in multiple-

stacked fluid nodes, and regime-dependent heat transfer correlations. The NOTRUMP small

break LOCA emergency core cooling system (ECCS) evaluation model was developed to determine the RCS response to design basis small break LOCAs and to address the NRC

concerns expressed in NUREG-0611, "Generic Evaluation of Feedwater Transients and Small Break Loss-of-Coolant Accidents in Westinghouse Designed Operating Plants."[15]

In NOTRUMP, the RCS is nodalized into volumes interconnected by flowpaths. The broken

loop is modeled explicitly with the intact loops lumped into a second loop. The transient

behavior of the system is determined from the governing conservation equation of mass, energy, and momentum applied throughout the system. For Unit 1, a detailed description of

NOTRUMP is given in References [1] and [2]. For Unit 2, a detailed description of NOTRUMP

is given in References [1], [2] and [16].

The use of NOTRUMP in the analysis involves, among other things, the representation of the

reactor core as heated control volumes with an associated bubble rise model to permit a

transient mixture height calculation. The multinode capability of the program enables an explicit

and detailed spatial representation of various system components. In particular, it enables a

proper calculation of the behavior of the loop seal during a loss-of-coolant transient.

Cladding thermal analyses are performed with the LOCTA-IV

[3] code which uses the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core, and mixture

height history from the NOTRUMP hydraulic calculations as input.

A schematic representation of the computer code interfaces is given in Figure 15.3-1.

Safety injection flow rate to the RCS as a func tion of system pressure is an input parameter.

The SIS is assumed to begin delivering full flow to the RCS (30 - Unit 1; 27 - Unit 2)seconds

after the generation of a safety injection signal. Also, minimum safeguards ECCS capability and

operability has been assumed in these analyses including use of the COSI/safety injection in

the broken loop model described in Reference [16] and approved by the NRC in Reference [17].

Hydraulic transient analyses are performed wi th the NOTRUMP code which determines the RCS pressure, fuel rod power history, steam flow past the uncovered part of the core and

mixture height history. The core thermal transient is performed with the LOCTA-IV

[3] code. Both calculations assume the core is operating at (100.6% - Unit 1; 102% - Unit 2) of licensed power.

WBN 15.3-4 15.3.1.3 Reactor Coolant System Pipe Break Results

Unit 1

A spectrum of break sizes was analyzed to determine the limiting break size in terms of the

highest peak cladding temperature. These break sizes were 2, 3, 4, and 6 inches.

For all cases reported, during the earlier part of the small break transient, the effect of the break

flow is not strong enough to overcome the flow maintained by the reactor coolant pumps

through the core as they are coasting down following reactor trip. Therefore, upward flow

through the core is maintained.

The resultant heat transfer cools the fuel rod cladding to very near the coolant temperatures as

long as the core remains covered by a two-phase mixture. When the mixture level drops below

the top of the core, the steam flow computed with NOTRUMP provides cooling to the upper

portion of the core.

The typical core power (dimensionless) transient following the accident (relative) to reactor scram time is shown in Figure 15.3-9. Also shown is the typical hot rod axial power shape in

Figure 15.3-10.

The reactor scram delay time is equal to the reactor trip signal time plus control rod insertion

time, or a total of 5.0 seconds. During this delay period, the reactor is conservatively assumed

to continue to operate at the initial rated power level.

The safety injection flow is depicted in Figure 15.3-2 as a function of RCS pressure. Auxiliary

feedwater flow is 1050 gpm based on the operation of one motor-driven and the turbine-driven

auxiliary feedwater pump, each deliv ering to two steam generators.

The 30 second delay time includes the time for diesel generator startup, loading on the 6.9 kV

shutdown board, and sequential loading of the centrifugal charging and safety injection pumps

onto the emergency buses, with acceleration to full speed and capability for injection. Although

included in the 30 second delay, the effect of the residual heat removal pump flow is not a factor

in this analysis since their shutoff head is lower than RCS pressure during the time period for

this transient.

The 4-inch break was determined to be the limiting break size, with a peak cladding

temperature of 1132 o F. The transient results for the limiting 4-inch break are presented in Figures 15.3-3 to 15.3-8. The depressurization transient for the 4-inch break is shown in Figure

15.3-3. The extent to which the core is uncovered is shown in Figure 15.3-4. The peak

cladding temperature transient is shown in Figure 15.3-5. Figure 15.3-5a shows the peak

cladding temperature transient for IFBA fuel with annular pellets. The results show there is no

difference in PCT with annular pellets. The steam flow rate for this break is shown in Figure

15.3-6. The heat transfer coefficients for the rod for this phase of the transient are given in

Figure 15.3-7, and the hot spot fluid temperature is shown in Figure 15.3-8.

WBN 15.3-5 The comparable transient results for the 2-inch break are presented in Figures 15.3-11 to 15.3-

11b, for the 3-inch break in Figures 15.3-12 to 15.3-12e, and for the 6-inch break in Figures

15.3-13 to 15.3-13e.

Calculated peak cladding temperatures for large breaks are presented in Section 15.4.1.

Unit 2

A spectrum of break sizes was analyzed to determine the limiting break size in terms of the

highest peak cladding temperature. These break sizes were 2, 3, 4, 6, and 8.75 inches.

For all cases reported, during the earlier part of the small break transient, the effect of the break

flow is not strong enough to overcome the flow maintained by the reactor coolant pumps

through the core as they are coasting down following reactor trip. Therefore, upward flow

through the core is maintained.

The resultant heat transfer cools the fuel rod cladding to very near the coolant temperatures as

long as the core remains covered by a two-phase mixture. When the mixture level drops below

the top of the core, the steam flow computed with NOTRUMP provides cooling to the upper

portion of the core.

The typical core power (dimensionless) transient following the accident (relative) to reactor scram time is shown in Figure 15.3-9. Also shown is the typical hot rod axial power shape in

Figure 15.3-10.

The reactor scram delay time is equal to the reactor trip signal time plus control rod insertion

time, or a total of 4.7 seconds (conservatively modeled as 5.0 seconds). During this delay

period, the reactor is conservatively assumed to continue to operate at the initial rated power

level.

The safety injection flow vs. RCS pressure in Figure 15.3-2a is modeled for spill to RCS

pressure cases (i.e., 2, 3, 4, and 6 inch break sizes). The safety injection flow vs. RCS pressure

in Figure 15.3-2b is modeled for spill to containment pressure (0 psig) cases (i.e., 8.75 inch

break size). Auxiliary feedwater flow is 660 gpm to four steam generators based on the operation of one motor-driven and one turbine driv en auxiliary feedwater pump, each delivering to two steam generators. The flow rate is based on the conservative minimum flow of 165 gpm

delivered by one motor-driven pump to one steam generator.

The 27 second delay time includes the time for diesel generator startup, loading on the 6.9 kV

shutdown board, and sequential loading of the centrifugal charging and safety injection pumps

onto the emergency buses, with acceleration to full speed and capability for injection.

The 4-inch break was determined to be the limiting break size, with a peak cladding

temperature of 1183.9°F. The transient results for the limiting 4-inch break are presented in

Figures 15.3-3 to 15.3-8. The depressurization transient for the 4-inch break is shown in Figure

15.3-3. The extent to which the core is uncovered is shown in Figure 15.3-4. The peak

cladding temperature transient is shown in Figure 15.3-5. The steam flow rate for this break is

shown in Figure 15.3-6. The heat transfer coefficients for the rod for this phase of the transient

are given in Figure 15.3-7, and the hot spot fluid temperature is shown in Figure 15.3-8.

WBN 15.3-6 The comparable transient results for the 2-inch break are presented in Figures 15.3-11 to 15.3-

11e, for the 3-inch break in Figures 15.3-12 to 15.3-12e, for the 6-inch break in Figures 15.3-13

to 15.3-13e, and for the 8.75-inch break in Figures 15.3-14 to 15.3-14b. Note that since there is

no core uncovery for the 8.75-inch break, cladding heatup is not calculated.

An evaluation has been performed to determine the impact of change in the lower radial key

stiffness value and concluded that the fuel assemblies on the core periphery are the only

assemblies to experience grid deformation for Watts Bar Unit 2. An SBLOCA assessment has

concluded that core coolable geometry is maintained if grid deformation remains in peripheral

assembly locations. Therefore, it is further concluded that coolable core geometry is maintained

for Watts Bar Unit 2 for cores of 17x17 RFA-2 fuel following a SBLOCA.

Calculated peak cladding temperatures for large breaks are presented in section 15.4.1.

15.3.1.4 Conclusions - Thermal Analysis (Unit 1 Only)

For cases considered, the emergency core cooling system meets the acceptance criteria as

presented in 10 CFR 50.46. That is:

1. The calculated peak fuel element cladding temperature provides margin to the limit of 2200ºF, based on an F q value of 2.50.

2. The amount of fuel element cladding that reacts chemically with water or steam does not exceed 1% of the total amount of zircaloy in the reactor.

3. The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. The oxidation limit of 17% of the cladding thickness is not

exceeded during or after quenching.

4. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.

The time sequence of events is shown in Table 15.3-1. Table 15.3-2 summarizes the results of

these analyses.

15.3.1.5 Evaluations

Replacement of V+/P+ fuel with RFA-2 has been evaluated for its effect on the small break loss-

of-coolant-accident peak cladding temperature. The changes resulting from the introduction of

RFA-2 are either not modeled in NOTRUMP-EM or would be expected to have a negligible effect on the analysis results. The evaluation concludes that Watts Bar will remain in

compliance with 10 CFR 50.46 for both transition from the current fuel to the new fuel and for a

full core of the new fuel. Assessments related to plant safety will remain.

An evaluation was performed to determine the effects of updated intermediate head safety

injection (IHSI) flows on the small break loss-of-coolant-accident peak cladding temperature.

Figure 15.3-2a depicts the updated total SI flows as a function of RCS pressure from this

evaluation. The evaluation concludes that Watts Bar remains in compliance with 10 CFR 50.46

and there will be no peak cladding temperature assessment as a result of this evaluation.

WBN 15.3-7 An evaluation has been performed for the potential for additional grid deformation for

LOCA/seismic conditions at Watts Bar Unit 1 with respect to correct modeling of the lower radial

keys in the reactor equipment system model (R ESM). It concluded that fuel grid deformation most likely will not occur at Watts Bar Unit 1 with the revised radial key modeling in the RESM.

However, to be conservative, it is recommended that fuel grid deformation be considered only in

the physical peripheral locations for evaluations. Therefore, because assemblies on the core

periphery are the only assemblies to experience grid deformation, it is concluded that coolable

geometry is maintained for small breaks; additional analyses are not warranted, and no peak

clad temperature penalty is applied.

15.3.2 MINOR SECONDARY SYSTEM PIPE BREAKS

15.3.2.1 Identification of Causes and Accident Description Included in this grouping are ruptures of secondary system lines which would result in steam

release rates equivalent to a 6 inch diameter break or smaller.

15.3.2.2 Analysis of Effects and Consequences

Minor secondary system pipe breaks must be accommodated with the failure of only a small

fraction of the fuel elements in the reactor. Since the results of analysis presented in Section

15.4.2 for a major secondary system pipe rupture also meet this criteria, separate analysis for

minor secondary system pipe breaks is not required.

The evaluation of the more probable accidental opening of a secondary system steam dump, relief or safety valve is presented in Section 15.2.13. These analyses are illustrative of a pipe

break equivalent in size to a single valve opening. These smaller equivalent pipe break sizes

are also bounded by the analysis presented in Section 15.4.2 for the MSLB event.

15.3.2.3 Conclusions

The analyses presented in Section 15.4.2 demonstrate that the consequences of a minor

secondary system pipe break are acceptable since a DNBR of less than the limiting value does

not occur even for a more critical major secondary system pipe break.

15.3.3 INADVERTENT LOADING OF A FUEL ASSEMBLY INTO AN IMPROPER POSITION 15.3.3.1 Identification of Causes and Accident Description

Fuel and core loading errors such as can arise from the inadvertent loading of one or more fuel

assemblies into improper positions, loading a fuel rod during manufacture with one or more

pellets of the wrong enrichment or the loading of a full fuel assembly during manufacture with

pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing

fuel in core positions calling for fuel of lesser enrichment. Also included among possible core

loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable

poison rods into a new core without burnable poison rods.

WBN 15.3-8 For Unit 1, any error in enrichment, beyond the normal manufacturing tolerances, can cause

power shapes which are more peaked than those calculated with the correct enrichments.

There is a 5% uncertainty margin included in the design value of power peaking factor assumed

in the analysis of Condition I and Condition II transients. The incore system of moveable flux

detectors which is used to verify power shapes at the start of life is capable of revealing any

assembly enrichment error or loading error which causes power shapes to be peaked in excess

of the design value.

For Unit 2, any error in enrichment, beyond the normal manufacturing tolerances, can cause

power shapes which are more peaked than those calculated with the correct enrichments.

There is a 5% uncertainty margin included in the design value of power peaking factor assumed

in the analysis of Condition I and Condition II transients. The Power Distribution Monitoring

System [17] is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an

identification number and loaded in accordance with a core loading diagram. During core

loading the identification number is checked before each assembly is moved into the core.

Serial numbers read during fuel movement are subsequently recorded on the loading diagram

as a further check on proper placing after the loading is completed.

For Unit 1, in addition to the flux monitors, thermocouples are located at the outlet of about one

third of the fuel assemblies in the core. There is a high probability that these thermocouples

would also indicate any abnormally high coolant enthalpy rise. Finally, the Power Distribution

Monitoring System, which is equivalent to an up-to-the-minute flux map, would indicate any abnormal power distribution after it has been calibrated by the movable incore detector system.

For Unit 2, in addition to the Power Distribution Monitoring System, thermocouples are located

at the outlet of about one third of the fuel assemblies in the core. There is a high probability that

these thermocouples would also indicate any abnormally high coolant enthalpy rise.

15.3.3.2 Analysis of Effects and Consequences

Method Of Analysis

Steady-state power distributions in the x-y plane of the core are calculated by the TURTLE

[6] Code based on macroscopic cross section calculated by the LEOPARD

[7] Code. A discrete representation is used wherein each individual fuel rod is described by a mesh interval. The

power distributions in the x-y plane for a correctly loaded core assembly are also given in

Chapter 4 based on enrichments given in that section.

For each core loading error case analyzed, the percent deviations from detector readings for a

normally loaded core are shown at all incore detector locations (see Figures 15.3-15 to 15.3-19, inclusive).

WBN 15.3-9 Results The following core loading error cases have been analyzed.

Case A:

Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular

case considered was the interchange of two adjacent assemblies near the periphery of the core (see Figure 15.3-15).

Case B:

Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly.

Two analyses have been performed for this case (see Figures 15.3-16 and 15.3-17).

In Case B-1, the interchange is assumed to take place with the burnable poison rods transferred

with the Region 2 assembly mistakenly loaded into Region 1.

In Case B-2, the interchange is assumed to take place closer to core center and with burnable

poison rods located in the correct Region 2 position but in a Region 1 assembly mistakenly

loaded into the Region 2 position.

Case C:

Enrichment error: Case in which a Region 2 fuel assembly is loaded in the core central position (see Figure 15.3-18).

Case D:

Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core

periphery (see Figure 15.3-19).

15.3.3.3 Conclusions

Fuel assembly enrichment errors would be prevented by administrative procedures

implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the

consequences in terms of reduced DNBR and increased fuel and clad temperatures will be

limited to the incorrectly loaded pin or pins.

For Unit 1, fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in

this section confirm that resulting power distribution effects will either be readily detected by

incore power distribution measurements or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

For Unit 2, fuel assembly loading errors are prevented by administrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in

this section confirm that resulting power distribution effects will either be readily detected by the

Power Distribution Monitoring System or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

WBN 15.3-10 15.3.4 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW

15.3.4.1 Identification of Causes and Accident Description

A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical

supplies to all reactor coolant pumps (RCPs). If the reactor is at power at the time of the

accident, the immediate effect of loss of forced reactor coolant flow is a rapid increase in the

reactor coolant temperature and subsequent increase in reactor coolant pressure. The flow

reduction and increase in coolant temperature could eventually result in DNB and subsequent

fuel damage before the peak pressures exceed the values at which the integrity of the pressure

boundaries would be jeopardized unless the reactor was tripped promptly.

Normal power for the reactor coolant pumps is supplied through individual buses from a

transformer connected to the generator. When generator trip occurs, the buses are

automatically transferred to a transformer supp lied from external power lines, and the pumps will continue to provide forced coolant flow to the core. Following a turbine trip where there are

no electrical faults or a thrust bearing failure which requires tripping the generator from the

network, the generator remains connected to the network for approximately 30 seconds. The

reactor coolant pumps remain connected to the generator thus ensuring full flow for 30 seconds

after the reactor trip before any transfer is made.

The following reactor trips provide the necessary protection against a loss of coolant flow

accident:

1. Reactor coolant pump power supply undervoltage or underfrequency.

2. Low reactor coolant loop flow.

The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions

which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of power supply to all

reactor coolant pumps. This function is blocked below the approximately 10% power (Permissive 7) interlock setpoint to permit startup.

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an

underfrequency condition, resulting from frequency disturbances on the power grid. This

function is also blocked below the approximately 10% power (Permissive 7) interlock setpoint to

permit startup.

Reference [8] provides analyses of grid frequency disturbances and the resulting Nuclear Steam

Supply System protection requirements which are applicable to current generation

Westinghouse plants.

These analyses have shown that the reactor is adequately protected by the underfrequency

reactor trip such that DNB will be above the limiting value for grid frequency decay rates less

than 6.8 Hz/sec based on a trip setpoint of approximately 57 Hz. In addition, for a maximum

frequency decay rate of 5 Hz/sec, the selected trip setpoint would have to be at least 54.3 Hz.

The sensing relay connected to the load side of each RCP breaker for WBN is set at

approximately 57 Hz. A grid analysis has been provided which determined that for the worst

case the maximum system frequency decay rate is less than 5 Hz/sec.

WBN 15.3-11 The reactor trip on low primary coolant loop flow is provided to protect against loss of flow

conditions which affect only one reactor coolant loop. This function is generated by two out of

three low flow signals per reactor coolant loop. Above approximately 48% power (Permissive

8), low flow in any loop will actuate a reactor trip. Between approximately 10% power and 48%

power (Permissive 7 and Permissive 8), low flow in any two loops will actuate a reactor trip.

The effect of low loop flow trip protection alone relative to frequency decay rate, although not

the primary trip function taken credit for in WBN's design, is also addressed in Reference [8].

15.3.4.2 Analysis of Effects and Consequences

Method of Analysis

This transient is analyzed by three digital computer codes. The LOFTRAN

[9] Code is used to calculate the loop flow, core flow, the time of reactor trip, the nuclear power transient, and the

primary system pressure and coolant temperature transients. The FACTRAN

[10] Code is then used to calculate the heat flux transient based on the nuclear power and flow from LOFTRAN.

Finally, the VIPRE-01

[13,14] Code (see Section 4.4.3.4) is used to calculate the DNBR during the transient based on the heat flux from FACTRAN and flow from LOFTRAN. The DNBR

transients presented represent the minimum of the typical or thimble cell. The method of

analysis and the assumptions made regarding initial operating conditions and reactivity

coefficients are identical to those discussed in Section 15.2, except that following the loss of

supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power

supply undervoltage or underfrequency.

Results The calculated sequence of events for the case analyzed is shown on Table 15.3-3. The

reactor is assumed to trip on an undervoltage signal. Figures 15.3-20 and 15.3-23 through

15.3-25 show the transient response for the loss of power to all reactor coolant pumps. The

DNBR never goes below the design basis limit.

The most limiting statepoint occurred for the complete loss of flow under- frequency case for the

DNB transient. The DNB evaluation showed that the minimum DNBR remained above the

limiting value. An axial power shape that bounds the cycle specific conditions is used to

perform the statepoint evaluation of the complete loss of flow analysis (also partial loss of flow

analysis as presented in Section 15.2.5). For Unit 1, the calculated peak RCS pressure is 2461

psia, demonstrating that the RCS remains below 110% of design pressure.

Following reactor trip, the pumps will continue to coast down until natural circulation flow is

established and will approach a stabilized hot standby condition as shown in Section 15.2.8.

The operating procedures call for operator action to control RCS boron concentration and

pressurizer level using the CVCS, and to maintain steam generator level through control of the

main or auxiliary feedwater system. Any action required of the operator to maintain the plant in a

stabilized condition is in a time frame in excess of ten minutes following reactor trip.

15.3.4.3 Conclusions

The analysis performed has demonstrated that for the complete loss of forced reactor coolant

flow, the DNBR will not decrease below the design basis limit at any time during the transient.

WBN 15.3-12 15.3.5 WASTE GAS DECAY TANK RUPTURE

15.3.5.1 Identification of Causes and Accident Description

The gaseous waste processing system, as discussed in Section 11.3, is designed to remove

fission product gases from the reactor coolant. The system consists of a closed loop with waste

gas compressors, waste gas decay tanks for service at power and other waste gas decay tanks

for service at shutdown and startup.

The maximum amount of waste gases stored occurs after a refueling shutdown at which time

the gas decay tanks store the radioactive gases stripped from the reactor coolant.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and

krypton fission product gases stored in a waste decay tank as a consequence of a failure of a

single gas decay tank or associated piping.

15.3.5.2 Analysis of Effects and Consequences

For the analyses and consequences of the postulated waste gas decay tank rupture, please

refer to Section 15.5.2.

15.3.6 SINGLE ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL AT FULL POWER 15.3.6.1 Identification of Causes and Accident Description

The current WBN design basis for the single rod cluster control assembly (RCCA) withdrawal at

full power event assumes no single electrical or mechanical failure in the rod control system

could cause the accidental withdrawal of a single RCCA from the inserted bank at full power

operation. The operator could deliberately withdraw a single RCCA in the control bank since

this feature is necessary in order to retrieve an assembly should one be accidentally dropped.

In the extremely unlikely event of simultaneous electrical failures which could result in single

RCCA withdrawal, rod deviation and rod control urgent failure would both be displayed on the

plant annunciator, and the rod position indicators would indicate the relative positions in the

assemblies in the bank. The urgent failure alarm also inhibits automatic rod withdrawal.

Withdrawal of a single RCCA by operator action would result in activation of the same alarm

and the same visual indications.

Each bank of RCCAs in the system is divided into two groups of 4 mechanisms each (except

group 2 of bank D which consists of 5 mechanisms). The rods comprising a group operate in

parallel through multiplexing thyristors. The two groups in a bank move sequentially such that

the first group is always within one step of the second group in the bank. A definite sequence of

actuation of the stationary gripper, movable gripper, and lift coils of a mechanism is required to

withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the RCCAs of a rod group are driven in parallel, any single failure

which would cause rod withdrawal would affect a minimum of one group. Mechanical failures

are in the direction of insertion, or immobility.

WBN 15.3-13 In the unlikely event of multiple failures which result in continuous withdrawal of a single RCCA, it is not possible, in all cases, to provide assurance of automatic reactor trip such that DNB safety limits are not violated. Withdrawal of a single RCCA results in both positive reactivity

insertion tending to increase core power, and an increase in local power density in the core area

associated with the RCCA.

15.3.6.2 Analysis of Effects and Consequences

Method of Analysis

For Unit 1, power distributions within the core are calculated by using the computer codes

described in Table 4.1-2. The peaking factors are then used by VIPRE-01 to calculate the

minimum DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the

insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to

occur at beginning-of-life since this results in the minimum value of moderator temperature

coefficient. This maximizes the power rise and minimizes the tendency of increased moderator

temperature to flatten the power distribution.

For Unit 2, power distributions within the core are calculated by the TURTLE

[6] Code based on macroscopic cross sections generated by LEOPARD

[7]. The peaking factors calculated by TURTLE are then used by THINC

[11] to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from bank D inserted at the insertion limit, with the reactor initially at full

power, was analyzed. This incident is assumed to occur at beginning-of-life since this results in

the minimum value of moderator temperature coefficient. This maximizes the power rise and

minimizes the tendency of increased moderator temperature to flatten the power distribution.

Results Two cases have been considered as follows:

1. If the reactor is in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature, and an increase in

the local hot channel factor in the area of the failed RCCA. In terms of the overall

system response, this case is similar to those presented in Section 15.2.2; however, the

increased local power peaking in the area of the withdrawn RCCA results in lower

minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion

and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently

fast to prevent the minimum core DNB ratio from falling below the limiting value.

Evaluation of this case at the power and coolant conditions at which the overtemperature T trip would be expected to trip the plant shows that an upper limit for the number of

rods with a DNBR less than the limiting value is 5%.

2. If the reactor is in automatic control mode, the multiple failures that result in the withdrawal of a single RCCA will result in the immobility of the other RCCAs in the

controlling bank. The transient will then proceed in the same manner as Case 1

described above. For such cases as above, a trip will ultimately ensue, although not

sufficiently fast in all cases to prevent the minimum DNBR in the core from decreasing

below the limiting value.

WBN 15.3-14 Following reactor trip, the plant will approach a stabilized condition at hot standby; normal plant

operating procedures may then be followed. The operating procedures would call for operator

action to control RCS boron concentration and pressurizer level using the CVCS, and to

maintain steam generator level through control of the main or auxiliary feedwater system. Any

action required of the operator to maintain the plant in a stabilized condition will be in a time

frame in excess of ten minutes following reactor trip.

15.3.6.3 Conclusions

For the case of one RCCA fully withdrawn, with the reactor in the automatic or manual control

mode and initially operating at full power with bank D at the insertion limit, an upper bound of

the number of fuel rods experiencing DNBR at values less than the limiting value is 5% of the

total fuel rods in the core.

For both cases discussed, the indicators and alarms mentioned would function to alert the

operator to the malfunction. For case 1, the insertion limit alarms (low and low-low alarms)

would also serve to alert the operator.

It is to be additionally noted that the current analysis methodology for the bank withdrawal at

power uses point-kinetics and one-dimensional kinetics transient models, respectively. These

models use conservative constant reactivity feedback assumptions which result in an overly

conservative prediction of the core response for these events.

The accidental withdrawal of a bank or banks of RCCAs in the normal overlap mode is a transient which has been specifically considered in the safety analysis. The consequences of a

bank withdrawal accident meet Condition II criteria (no DNB). If, however, it is assumed that less than a full group or bank of control rods is withdrawn, and these rods are not symmetrically

located around the core, this then can cause a "tilt" in the core radial power distribution. The "tilt" could result in a radial power distribution peaking factor which is more severe than is

normally considered in the safety analysis, and therefore cause a loss of DNB margin.

A more detailed DNBR analysis addressing the limiting transient setpoints has been conducted (References 11 and 12) and the Revised Thermal Design Procedure (RTDP) maximizes DNBR

margins and determines setpoints that are conservatively low when compared to previous

results.

Using these approaches, generic analyses and their plant-specific application demonstrate that

for WBN DNB does not occur for the worst-case asymmetric rod withdrawal, and the licensing

basis for the facility with regard to the requirements for system response to a single failure in the

rod control system (GDC-25 or equivalent) is still satisfied.

REFERENCES

1. Lee, N., Rupprecht, S. D., Tauch, W. D., and Schwartz, W. R., "Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code," WCAP-10054-P-A, August

1985.

2. Meyer, P. E. and Kornfilt, J., "NOTRUMP: A Nodal Transient Small Break and General Network Code," WCAP-10079-P-A, August 1985.

WBN 15.3-15 3. F. M. Bordelon, et. al., "LOCTA-IV Program: Loss-of-Coolant Transient Analysis," WCAP-8305 (Non-Proprietary) and WCAP-8301 (Proprietary), June 1974.

4. Deleted in initial UFSAR.

5. Deleted in initial UFSAR.

6a. Deleted by UFSAR Amendment 2. (Unit 1 Only)

6b. Barry, R. F. and Altomare, S. "The TURTLE 24.0 Diffussion Depletion Code," WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary), January 1975. (Unit 2

Only) 7a. Deleted by UFSAR Amendment 2. (Unit 1 Only)

7b. Barry, F. R., "LEOPARD, A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963. (Unit 2 Only)

8. Balwin, M. S., Merrian, M. M., Schenkel, H. S., and Vandewalle, D. J., "An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in

Westinghouse PWRs," WCAP-8424, Revision 1, June 1975.

9. Burnett, T. W. T, et.al., "LOFTRAN Code Description", WCAP-7907-P-A (Proprietary) and WCAP-7907-A (Non-Proprietary), April 1984.

10. Hargrove, H. G., "FACTRAN, A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908-A, December 1989.

11. Friedland, A. J., and Ray, S., "Improved THINC IV Modeling for PWR Core Design," WCAP-12330-P, August 1989.

12. Huegel, D., et al., "Generic Assessment of Asymmetric Rod Cluster Control Assembly Withdrawal," WCAP-13803, August 1993.

13. C. W. Stewart, et al., "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores," Volume 1-3 (Revision 3, August 1989), Volume 4 (April 1987), NP-2511-CCM-A, EPRI.

14. WCAP-14565-P-A, "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis," October 1999.

15. "Generic Evaluation of Feedwater Transients and SBLOCA in Westinghouse Designed Operating Plants," NUREG-0611, January 1980.

16a. Thompson, C. M., et al., "Addendum to t he Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code and Safety Injection in the Broken Loop and COSI

Condensation Model," WCAP-10054-P, Addendum 2, Revision 1 (Proprietary) and

WCAP-10081-NP, Revision 1 (Non-Proprietary), October 1995. (Unit 1 Only)

WBN 15.3-16 16b. Thompson, C. M., et al., "Addendum to t he Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, "WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), July

1997. (Unit 2 Only)

17a. USNRC Letter from Robert C. Jones to N. J. Liparulo (W), "WCAP-10054-P, Addendum 2, Revision 1, NOTRUMP SBLOCA Using the COSI Steam Condensation Model,"

August 12, 1996. (Unit 1 Only)

17b. Beard, C.L. and Morita, T. "BEACON: Core Monitoring and Operations Support System", WCAP-12472-P-A (Proprietary), August 1994, Addendum 1-A, January 2000, Addendum 2-A, April 2002, Addendum 4-A, September 2012, and WCAP-12473-A (Non-proprietary), August 1994. (Unit 2 Only)

18. "BEACON Core Monitoring and Operations Support System, " WCAP-12472-P-A, August 1994. (Unit 1 Only)

19. "BEACON Core Monitoring and Operations Support System, " WCAP-12472-P-A, Addendum 1-A, January 2000. (Unit 1 Only)

20. "BEACON Core Monitoring and Operations Support System," WCAP-12472-P-A, Addendum 4-A, September 2012. (Unit 1 Only)

N O T R U M P L O C T A

WBN 15.4-1 15.4 CONDITION IV - LIMITING FAULTS

Condition IV occurrences are faults which are not expected to take place, but are postulated

because their consequences would include the potential for the release of significant amounts

of radioactive material. They are the most drastic which must be designed against and

represent limiting design cases. Condition IV faults are not to cause a fission product release to

the environment resulting in an undue risk to public health and safety in excess of guideline

values of 10 CFR Part 100 (Unit 1 and Unit 2) and 10 CFR 50.67 (Unit 1). A single Condition IV

fault is not to cause a consequential loss of required functions of systems needed to cope with

the fault including those of the emergency core cooling system (ECCS) and the containment.

For the purposes of this report the following faults have been classified in this category:

1. Major rupture of pipes containing reactor coolant up to and including double ended rupture of the largest pipe in the reactor coolant system (loss of coolant accident).

2. Major secondary system pipe ruptures.

3. Steam generator tube rupture.

4. Single reactor coolant pump locked rotor.

5. Fuel handling accident.

6. Rupture of a control rod drive mechanism housing (rod cluster control assembly ejection).

The analysis of thyroid and whole body doses, resulting from events leading to fission product

release, appears in Section 15.5. The fission product inventories which form a basis for these

calculations are presented in Chapter 11 and Section 15.1. Section 15.5 also includes the

discussion of systems interdependency contributing to limiting fission product leakages from the

containment following a Condition IV occurrence.

15.4.1 MAJOR REACTOR COOLANT SYSTEM PIPE RUPTURES (LOSS OF COOLANT ACCIDENT)

Loss-of-coolant accidents (LOCAs) are accidents that would result from the loss of reactor

coolant at a rate in excess of the capability of the reactor coolant makeup system. LOCAs could

occur from breaks in pipes in the reactor coolant pressure boundary up to and including a break

equivalent in size to the double-ended rupture of the largest pipe in the reactor coolant system (RCS). Large breaks are defined as breaks in the reactor coolant pressure boundary having a

cross-sectional area greater than or equal to 1.0 ft

2. Reference [34] documents this criterion.

The large break LOCA analysis is performed to demonstrate compliance with the 10 CFR 50.46

acceptance criteria

[35] for emergency core cooling systems for light water nuclear power reactors.

WBN 15.4-2 A large break LOCA is the postulated double-ended guillotine or split rupture of one of the RCS

primary coolant pipes.

The boundary considered for loss of coolant accidents is the RCS or any line connected to the

system up to the first closed valve.

For Unit 1, the sequence of events following a nominal large double-ended cold leg guillotine

break LOCA is presented in Table 15.4-17. Before the break occurs, the RCS is assumed to be

operating normally at full power in an equilibrium condition, i.e., the heat generated in the core

is being removed via the secondary system. A large double-ended cold leg guillotine (DECLG)

break is assumed to open almost instantaneously in one of the main RCS pipes. Calculations

have demonstrated that the most severe transient results occur for a DECLG break in the cold

leg between the pump and the reactor vessel.

Immediately following the cold leg break, a rapid system depressurization occurs along with a

core flow reversal due to a high discharge of subcooled fluid into the broken cold leg and out the

break. The fuel rods go through departure from nucleate boiling (DNB) and the cladding rapidly

heats up, while the core power shuts down due to voiding in the core. The hot water in the

core, upper plenum, and upper head flashes to steam, and subsequently the cooler water in the

lower plenum and downcomer begins to flash. Once the system has depressurized to the

accumulator pressure, the accumulators begin to inject cold borated water into the intact cold

legs. During the blowdown period a portion of the injected ECCS water is calculated to be

bypassed around the downcomer and out the break. The bypass period ends as the system pressure (initially assumed at a nominal 2250 psia Unit 1), continues to decrease and

approaches the containment pressure, resulting in reduced break flow and consequently

reduced core flow.

As the refill period begins, the core begins a period of heatup and the vessel begins to fill with

ECCS water. This phase continues until the lower plenum is filled and the bottom of the core

begins to reflood and entrainment begins.

During the reflood period, the core flow is oscillatory as ECCS water periodically rewets and

quenches the hot fuel cladding which generates steam and causes system repressurization.

The steam and entrained water must pass through the vessel upper plenum, the hot legs, the

steam generators, and the reactor coolant pumps before it is vented out the break. This flow

path resistance is overcome by the downcomer water elevation head which provides the gravity driven reflood force. The pumped ECCS water aids in the filling of the downcomer and

subsequently supplies water to maintain a full downcomer and complete the reflood period.

For Unit 2, the sequence of events following a large break LOCA is presented in Table 15.4-17.

Before the break occurs, the RCS is assumed to be operating normally at full power in an

equilibrium condition, i.e., the heat generated in the core is being removed via the secondary

system. A large break is assumed to open almost instantaneously in one of the main RCS

pipes. Calculations have demonstrated that the most severe transient results occur for a break

in the cold leg between the pump and the reactor vessel.

WBN 15.4-3 15.4.1.1 Thermal Analysis

15.4.1.1.1 Westinghouse Performance Criteria for Emergency Core Cooling System

The reactor is designed to withstand thermal effects caused by a loss of coolant accident

including the double ended severance of the largest reactor coolant system pipe. The reactor

core and internals together are designed so that the reactor can be safely shutdown and the

essential heat transfer geometry of the core preserved following the accident. The current

internals is of the upflow barrel/baffle design. The ECCS, even when operating during the

injection mode with the most limiting single active failure, is designed to meet the acceptance

criteria.

15.4.1.1.2 Method of Thermal Analysis

Unit 1

In 1988, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, "ECCS

Evaluation Models," to permit the use of a rea listic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.

Under the amended rules, best estimate thermal-hydraulic models may be used in place of

models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this

analysis uncertainty be included when comparing the results of the calculations to the

prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best estimate

codes is provided in Regulatory Guide 1.157.

[44]

To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method

called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology.

[45] This method outlined an approach for defining and qualifying a best estimate thermal-hydraulic code

and quantifying the uncertainties in a LOCA analysis.

A LOCA evaluation methodology for three- and four-loop PWR plants based on the revised 10

CFR 50.46 rules was developed by Westinghouse with the support of EPRI and Consolidated

Edison and has been approved by the NRC. The methodology is documented in WCAP-12945-

P-A, "Code Qualification Document (CQD) for Best Estimate LOCA Analysis."

[46]

The thermal-hydraulic computer code which was reviewed and approved for the calculation of

fluid and thermal conditions in the PWR during a large break LOCA is WCOBRA/TRAC Version Model 7A.[46]

WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and

detailed simulation of a PWR. This best estimate computer code contains the following

features:

• Ability to model transient three-dimensional flows in different geometries inside the vessel.

WBN 15.4-4

• Ability to model thermal and mechanical non-equilibrium between phases.

• Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes.

• Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pump, etc.

The two-fluid formulation uses a separate set of conservation equations and constitutive

relations for each phase. The effects of one phase on another are accounted for by interfacial

friction and heat and mass transfer interaction terms in the equations. The conservation

equations have the same form for each phase; only the constitutive relations and physical

properties differ. Dividing the liquid phase into two fields is a convenient and physically

accurate way of handling flows where the liquid can appear in both film and droplet form. The

droplet field permits more accurate modeling of thermal-hydraulic phenomena such as

entrainment, de-entrainment, fallback, liquid pooling, and flooding.

WCOBRA/TRAC also features a two-phase, one-di mensional hydrodynamics formulation. In this model, the effect of phase slip is modeled indirectly via a constitutive relationship which

provides the phase relative velocity as a function of fluid conditions. Separate mass and energy

conservation equations exist for the two-phase mixture and for the vapor.

The reactor vessel is modeled with the three-dimensional, three field model, while the loop, major loop components, and safety injection points are modeled with the one-dimensional

model.

All geometries modeled using the three-dimensional model are represented as a matrix of cells.

The number of mesh cells used depends on the degree of detail required to resolve the flow

field, the phenomena being modeled, and practical restrictions such as computing costs and

core storage limitations.

The equations for the flow field in the three-dimensional model are solved using a staggered

difference scheme on the Eulerian mesh. The velocities are obtained at mesh cell faces, and

the state variables (e.g., pressure, density, enthalpy, and phasic volume fractions) are obtained

at the cell center. This cell is the control volume for the scalar continuity and energy equations.

The momentum equations are solved on a staggered mesh with the momentum cell centered

on the scalar cell face.

The basic building block for the mesh is the channel, a vertical stack of single mesh cells.

Several channels can be connected together by gaps to model a region of the reactor vessel.

Regions that occupy the same level form a section of the vessel. Vessel sections are

connected axially to complete the vessel mesh by specifying channel connections between

sections. Heat transfer surfaces and solid structures that interact significantly with the fluid can

be modeled with rods and unheated conductors.

WBN 15.4-5 One-dimensional components are connected to the vessel. The basic scheme used also employs the staggered mesh cell. Special purpose components exist to model specific

components such as the steam generator and pump.

A typical calculation using WCOBRA/TRAC begins with the establishment of a steady-state, initial condition with all loops intact. The input parameters and initial conditions for this steady-

state calculation are discussed in Section 15.4.1.1.4.

Following the establishment of an acceptable steady-state condition, the transient calculation is

initiated by introducing a break into one of the loops. The evolution of the transient through

blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with the BREAK component using a time dependent pressure table. Containment pressure is

calculated using the LOTIC-2 code

[5] and a mass and energy releases from the WCOBRA/TRAC calculation.

The methods used in the application of WCOBRA/TRAC to the large break LOCA are described in Reference [46]. A detailed assessment of the computer code WCOBRA/TRAC was made through comparisons to experimental data.

These assessments were used to develop

quantitative estimates of the code's ability to predict key physical phenomena in a PWR large

break LOCA. Modeling of a PWR introduces additional uncertainties which were identified and

quantified in the plant specific analysis. The final step of the best estimate methodology is to

combine all the uncertainties related to the code and plant parameters, and estimate the PCT at

95% probability. The steps taken to derive the PCT uncertainty estimate are summarized

below:

1. Plant Model Development

In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used, in order to provide an accurate simulation of the transient. However, specific guidelines are followed to assure that the model is consistent with models used

in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences such as in the upper plenum

of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions

In this step, the expected or desired operating range of the plant to which the analysis applies is established. The parameters considered are based on a "key LOCA

parameters" list which was developed as part of the methodology. A set of these

parameters, at mostly nominal values, is chosen for input as initial conditions to the plant

model. A transient is run utilizing these parameters and is known as the "initial

transient." Next, several confirmatory runs are made, which vary a subset of the key

LOCA parameters over their expected operati ng range in one-at-a-time sensitivities.

The most limiting input conditions, based on these confirmatory runs, are then combined

into a single transient, which is then called the "reference transient."

WBN 15.4-6 3. PWR Sensitivity Calculations

A series of PWR transients are performed in which the initial fluid conditions and boundary conditions are ranged around the nominal conditions used in the reference

transient. The results of the calculations for WBN form the basis for the determination of

the initial condition bias and uncertainty discussed in Section 6 of Reference [47].

Next, a series of transients are performed which vary the power distribution, taking into account all possible power distributions during normal plant operation. The results of

these calculations for WBN form the basis for the determination of the power distribution

bias and uncertainty discussed in Section 7 of Reference [47].

Finally, a series of transients are performed wh ich vary parameters that affect the overall system response ("global" parameters) and loca l fuel rod response ("local" parameters).

The results of these calculations for WBN form the basis for the determination of the

model bias and uncertainty discussed in Section 8 of Reference [47].

4. Response Surface Calculations

Regression analyses are performed to derive PCT response surfaces from the results of the power distribution run matrix and the global model run matrix. The results of the

initial conditions run matrix are used to generate a PCT uncertainty distribution.

5. Uncertainty Evaluation

The total PCT uncertainty from the initial conditions, power distribution, and model calculations is derived using the approved methodology.

[47] The uncertainty calculations assume certain plant operating ranges which may be varied depending on the results

obtained. These uncertainties are then combined to determine the initial estimate of the

total PCT uncertainty distribution for the DECLG and split breaks. The results of these

initial estimates of the total PCT uncertainty are compared to determine the limiting

break type. If the split break is limiting, an additional set of split transients are performed

which vary overall system response ("global" parameters) and local fuel rod response

("local" parameters). Finally, an additional series of superposition runs is made to

quantify the bias and uncertainty due to assuming that the above three uncertainty

categories are independent. The final PCT uncertainty distribution is then calculated for

the limiting break type, and the 95th percentile PCT is determined.

6. Plant Operating Range

The plant operating range over which the uncertainty evaluation applies is defined.

Depending on the results obtained in the above uncertainty evaluation, this range may

be the desired range established in Step 2, or may be narrower for some parameters to

gain additional margin.

WBN 15.4-7 There are three major uncertainty categories or elements:

1. Initial condition bias and uncertainty 2. Power distribution bias and uncertainty

3. Model bias and uncertainty

Conceptually, these elements may be assumed to affect the reference transient PCT as shown

below:

PCT i = PCTREF,i + PCTIC,i + PCT PD,i + PCTMOD,i Equation 15.4-1)

where, PCTREF,i = Reference transient PCT: The reference transient PCT is calculated using WCOBRA/TRAC at the nominal conditions identified in Table 15.4-19, for blowdown (i=1), first reflood (i=2), and second reflood (i=3).

PCTIC,i = Initial condition bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes several

nominal or average initial conditions, and the average PCT taking

into account all possible values of the initial conditions. This bias

takes into account plant variations which have a relatively small

effect on PCT. The elements which make up this bias and its

uncertainty are plant specific.

PCT PD,i = Power distribution bias and uncertainty: This bias is the difference between the reference transient PCT, which assumes a nominal

power distribution, and the average PCT taking into account all

possible power distributions during normal plant operation.

Elements which contribute to the uncertainty of this bias are

calculational uncertainties, and variations due to transient

operation of the reactor.

PCTMOD,i = Model bias and uncertainty: This component accounts for uncertainties in the ability of the WCOBRA/TRAC code to accurately predict important phenomena which affect the overall

system response ("global" parameters) and the local fuel rod

response ("local" parameters). The code and model bias is the

difference between the reference transient PCT, which assumes

nominal values for the global and local parameters, and the

average PCT taking into account all possible values of global and

local parameters.

WBN 15.4-8 The separability of the uncertainty components in the manner described above is an

approximation, since the parameters in each el ement may be affected by parameters in other elements. The bias and uncertainty associated with this assumption is quantified as part of the

overall uncertainty methodology and included in the final estimates of PCT.

95%

Unit 2

When the Final Acceptance Criteria (FAC) governing the loss-of-coolant accident (LOCA) for

Light Water Reactors was issued in Appendix K of 10 CFR 50.46, both the Nuclear Regulatory Commission (NRC) and the industry recognized that the stipulations of Appendix K were highly

conservative. That is, using the then accepted analysis methods, the performance of the

Emergency Core Cooling System (ECCS) would be conservatively underestimated, resulting in

predicted Peak Clad Temperatures (PCTs) much higher than expected. At that time, however, the degree of conservatism in the analysis could not be quantified. As a result, the NRC began

a large-scale confirmatory research program with the following objectives:

1. Identify, through separate effects and integral effects experiments, the degree of conservatism in those models permitted in the Appendix K rule. In this fashion, those

areas in which a purposely prescriptive approach was used in the Appendix K rule could

be quantified with additional data so that a less prescriptive future approach might be

allowed.

2 Develop improved thermal-hydraulic computer codes and models so that more accurate and realistic accident analysis calculations could be performed. The purpose of this

research was to develop an accurate predictive capability so that the uncertainties in the

ECCS performance and the degree of conservatism with respect to the Appendix K

limits could be quantified.

Since that time, the NRC and the nuclear industry have sponsored reactor safety research

programs directed at meeting the above two objec tives. The overall results have quantified the conservatism in the Appendix K rule for LOCA analyses and confirmed that some relaxation of

the rule can be made without loss in safety to the public. It was confirmed that some plants were

being restricted in operating flexibility by the ov erly conservative Appendix K requirements. In recognition of the Appendix K conservatism that was being quantified by the research programs, the NRC adopted an interim approach for evaluation methods. This interim approach is

described in SECY-83-472 [50]. The SECY-83-472 [50] represented an important step in basing

licensing decisions on realistic calculations, as opposed to those calculations prescribed by

Appendix K.

In 1998, the NRC Staff amended the requirements of 10 CFR 50.46 and Appendix K, "ECCS

Evaluation Models", to permit the use of a rea listic evaluation model to analyze the performance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research programs.

Under the amended rules, best-estimate thermalhydraulic models may be used in place of

models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this

analysis uncertainty be included when comparing the results of the calculations to the

prescribed acceptance criteria of 10 CFR 50.46. Further guidance for the use of best-estimate

codes is provided in Regulatory Guide 1.157[44]

WBN 15.4-9 To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method

called the Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (NUREG/CR-5249[45]). This method outlined an approach for defining and qualifying a best-

estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis. A LOCA

evaluation methodology for three- and fourloop Pressurized Water Reactor (PWR) plants based

on the revised10 CFR 50.46 rules was developed by Westinghouse with support of EPRI and

Consolidated Edison and has been approved by the NRC (WCAP-12945-P-A [46]).

More recently, Westinghouse developed an alternative methodology called ASTRUM, which

stands for Automated Statistical TReament of Uncertainty Method (WCAP-16009-P-A [49]). This

method is still based on the CQD methodology and follows the steps in the CSAU methodology (NUREG/CR-5249 [45]). However, the uncertainty analysis (Element 3 in the CSAU) is replaced

by a technique based on order statistics. The ASTRUM methodology replaces the response

surface technique with a statistical sampling method where the uncertainty parameters are

simultaneously sampled for each case. The ASTRUM methodology has received NRC approval

for referencing in licensing calculations in WCAP-16009-P-A [49].

The three 10 CFR 50.46 criteria (peak clad temperature, maximum local oxidation, and core-

wide oxidation) are satisfied by running a sufficient number of WCOBRA/TRAC calculations (sample size). In particular, the statistical theory predicts that 124 calculations are required to

simultaneously bound the 95th percentile values of three parameters with a 95-percent

confidence level.

This analysis is in accordance with the applicability limits and usage conditions defined in

Section 13-3 of WCAP-16009-P-A [49], as applicable to the ASTRUM methodology. Section 13-

3 of WCAP-16009-P-A [49] was found to acceptably disposition each of the identified conditions

and limitations related to WCOBRA/TRAC and CQD uncertainty approach per section 4.0 of the

ASTRUM Final Safety Evaluation Report appended to this topical report.

The Watts Bar 2 ASTRUM LBLOCA uses a plant-specific adaptation of the ASTRUM

methodology that includes explicit modeling of fuel thermal conductivity degradation (TCD), as

well as a larger sampling range for rod internal pressure (RIP) uncertainty. The methods used in

the application of WCOBRA /TRAC to the large break LOCA with ASTRUM are described in

WCAP-12945-P-A [46] and WCAP-16009-P-A [49]. A detailed assessment of the computer

code WCOBRA/TRAC was made through comparisons to experimental data. These

assessments were used to develop quantitative estimates of the code's ability to predict key

physical phenomena in a PWR large break LOCA. Modeling of a PWR introduces additional

uncertainties which are identified and quantified in the plant-specific analysis.

WCAP-16009-P-A [49] states that the ASTRUM methodology is based on the frozen code

version WCOBRA/TRAC MOD7A, Revision 6. WCOBRA/TRAC MOD7A, Revision 8-T2 was

used for the execution of ASTRUM Uncertainty Studies for Watts Bar Unit 2. The confirmatory

analysis (paragraph "2) Determination of Plant Operating Conditions) were executed with

WCOBRA/TRAC MOD7A Revision 7.

WBN 15.4-10 The Nuclear Regulatory Commission (NRC) approved Westinghouse Best-Estimate Loss-of-

Coolant Accident (BELOCA) ASTRUM methodology [49] is based on the PAD 4.0 fuel

performance code [51]. PAD 4.0 was licensed without explicitly considering fuel thermal

conductivity degradation (TCD) with burnup. Explicit modeling of TCD in the fuel performance

code leads directly to increased fuel temperatures (pellet radial average temperature) as well as other fuel performance related effects beyond beginning-of-life. Since PAD provides input to the

large-break LOCA analysis, this will tend to increase the stored energy at the beginning of the

simulated large-break LOCA event. This in turn leads to an increase in Peak Cladding

Temperature (PCT) if there is no provision to credit off-setting effects. In addition, a different fuel

thermal conductivity model in WCOBRA/TRAC and HOTSPOT was used to more accurately model the fuel temperature profile when accounting for TCD.

In order to mitigate the impact of the increasing effect of pellet TCD with burnup, the large-break

LOCA evaluation of second/third Cycle fuel utilized reduced peaking factors from those shown directly in FSAR Table 15.4-19. The reduced peaking factors are limited to the following

application: Burndown credit for the hot rod and hot assembly is taken for higher burnup fuel in

the second/third cycle of operation. The Watts Bar Unit 2 peaking factor values utilized in this

analysis are shown in Table 15.4-24. Note that the beginning to middle of life values are

retained at their direct Table 15.4-19 values.

It should be noted that evaluation of fuel in its second/third cycle of irradiation is beyond the first

cycle considered in the approved ASTRUM Evaluat ion Model (EM), but was considered in the analysis when explicitly modeling TCD to demons trate that conformance to the acceptance criteria is met for the second/third cycle fuel.

In addition to the standard uncertainty calculations, the Watts Bar 2 LBLOCA analysis sampled

a larger rod internal pressure (RIP) uncertainty than originally included in the ASTRUM

methodology [49]. It was discovered that the as-approved sampling range did not bound the

plant-specific rod internal pressure uncertainties for Watts Bar 2. Therefore, the approved

sampling range was expanded to bound the Watts Bar 2 plant-specific data.

WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the

vessel with one-dimensional drift-flux equations used in the loops to allow a complete and

detailed simulation of a PWR. This best-estimate computer code contains the following features:

1. Ability to model transient three-dimensional flows in different geometries inside the vessel

2. Ability to model thermal and mechanical non-equilibrium between phases

3. Ability to mechanistically represent interfacial heat, mass, and momentum transfer in different flow regimes

4. Ability to represent important reactor components such as fuel rods, steam generators, reactor coolant pumps, etc.

WBN 15.4-11 The two-fluid formulation uses a separate set of conservation equations and constitutive

relations for each phase. The effects of one phase on another are accounted for by interfacial

friction and heat and mass transfer interaction terms in the equations. The conservation

equations have the same form for each phase; only the constitutive relations and physical

properties differ. Dividing the liquid phase into two fields is a convenient and physically accurate

way of handling flows where the liquid can appear in both film and droplet form. The droplet field

permits more accurate modeling of thermal-hydraulic phenomena such as entrainment, de-

entrainment, fallback, liquid pooling, and flooding.

WCOBRA/TRAC also features a two-phase, one-dim ensional hydrodynamic formulation. In this model, the effect of a phase slip is modeled indirectly via a constitutive relationship which

provides the phase relative velocity as a function of fluid conditions. Separate mass and energy

conservation equations exist for the two-phase mixture and for the vapor.

The reactor vessel is modeled with the three-dimensional, three-field model, while the loop, major loop components, and safety injection points are modeled with the one dimensional

model.

All geometries modeled using the three-dimensional model are represented as a matrix of cells.

The number of mesh cells used depends on the degree of detail required to resolve the flow

field, the phenomena being modeled, and practical restrictions such as computing costs and

core storage limitations.

The equations for the flow field in the three-dimensional model are solved using a staggered

difference scheme on the Eulerian mesh. The velocities are obtained at mesh cell faces, and

the state variables (e.g., pressure, density, enthalpy, and phasic volume fractions) are obtained

at the cell center. This cell is the control volume for the scalar continuity and energy equations.

The momentum equations are solved on a staggered mesh with the momentum cell centered on

the scalar cell face.

The basic building block for the mesh is the channel, a vertical stack of single mesh cells.

Several channels can be connected together by gaps to model a region of the reactor vessel.

Regions that occupy the same level form a section of the vessel. Vessel sections are connected

axially to complete the vessel mesh by specifying channel connections between sections. Heat

transfer surfaces and solid structures that interact significantly with the fluid can be modeled

with rods and unheated conductors.

One-dimensional components are connected to the vessel. The basic scheme used also employs the staggered mesh cell. Special purpose components exist to model specific

components such as the steam generator and pump.

A typical calculation using WCOBRA/TRAC begins with the establishment of a steady-state

initial condition with all loops intact. The input parameters and initial conditions for this steady-

state calculation are discussed in the next section.

WBN 15.4-12 Following the establishment of an acceptable steady-state condition, the transient calculation is

initiated by introducing a break into one of the loops. The evolution of the transient through

blowdown, refill, and reflood proceeds continuously, using the same computer code (WCOBRA/TRAC) and the same modeling assumptions. Containment pressure is modeled with

the BREAK component using a time dependent pressure table. Containment pressure is

calculated using the LOTIC-2 [5] code and mass and energy releases from the WCOBRA/TRAC

calculation .

The final step of the best-estimate methodology, in which all uncertainties of the LOCA

parameters are accounted for to estimate a Peak Cladding Temperature (PCT), Maximum Local

Oxidation (MLO), and Core-Wide Oxidation (CWO) at 95-percent probability, is described in the

following sections.

1. Plant Model Development:

In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding

detail is used in order to provide an accurate simulation of the transient. However, specific guidelines are followed to ensure that the model is consistent with models used

in the code validation. This results in a high level of consistency among plant models, except for specific areas dictated by hardware differences, such as in the upper plenum

of the reactor vessel or the ECCS injection configuration.

2. Determination of Plant Operating Conditions:

In this step, the expected or desired operating range of the plant to which the analysis

applies is established. The parameters considered are based on a "key LOCA

parameters" list that was developed as part of the methodology. A set of these

parameters, at mostly nominal values, is chosen for input as initial conditions to the plant

model. A transient is run utilizing these parameters and and is known as the "initial transient".

Next, several confirmatory runs are made, which vary a subset of the key LOCA

parameters over their expected operating range in one-at-a-time sensitivities. Because certain parameters are not included in the uncertainty analysis, these parameters are set

at their bounding condition. This analysis is commonly referred to as the confirmatory

analysis. The most limiting input conditions, based on these confirmatory runs, are then

combined into the model that will represent the limiting state for the plant, which is the

starting point for the assessment of uncertainties. The confirmatory configuration

analysis was performed previous to the ASTRUM uncertainty calculations prior to the

identification of the TCD issue and associated PAD data. However, as no miscellaneous

plant configuration changes were introduced, and the effects of TCD are minimal for the

confirmatory analysis, the limiting plant configuration (Referred to as the Reference

Transient) was judged to remain the same.

WBN 15.4-13 3. Assessment of Uncertainty:

The ASTRUM methodology is based on order statistics. The technical basis of the order

statistics is described in Section 11 of WCAP-16009-P-A [49]. The determination of the

PCT uncertainty, MLO uncertainty, and CWO uncertainty relies on a statistical sampling

technique. According to the statistical theory, 124 WCOBRA /TRAC calculations are

necessary to assess against the three 10 CFR 50.46 criteria (PCT,MLO,CWO).

The uncertainty contributors are sampled randomly from their respective distributions for

each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are

randomly sampled for each time in the cycle, break type (split or double-ended

guillotine), and break size for the split break are also sampled as uncertainty contributors

within the ASTRUM methodology. Results from the 124 calculations are tallied by

ranking the PCT from highest to lowest. A similar procedure is repeated for MLO and

CWO. The highest rank of PCT, MLO, and CWO will bound 95 percent of their

respective populations with 95-percent confidence level.

4. Plant Operating Range:

The plant operating range over which the uncertainty evaluation applies is defined.

Depending on the results obtained in the above uncertainty evaluation, this range may

be the desired range or may be narrower for some parameters to gain additional margin.

15.4.1.1.3 Containment Analysis

Unit 1

The containment pressure analysis is performed with the LOTIC-2

[5] code. Transient mass and energy releases for input to the LOTIC-2 model are obtained from the WCOBRA/TRAC code.

[47] The transient pressure computed by the LOTIC-2 code is then used in WCOBRA/TRAC for the purpose of supplying a backpressure at the break plane while computing the reflood transient.

The containment pressure transients and associ ated parameters were computed by LOTIC-2 for WBN's current upflow barrel/baffle internals design and are presented in Figures 15.4-40b

through 15.4-40g. The data used to model the containment for the analysis is presented in

Tables 15.4-14 and 15.4-15. Mass and energy release rates to containment can be found in

Table 15.4-16.

WBN 15.4-14 Unit 2

The containment pressure analysis is performed with the LOTIC-2 [5] code. Transient mass and

energy releases for input to the LOTIC-2 model are obtained from the WCOBRA/TRAC code.

The transient pressure computed by the LOTIC-2 code is then used in WCOBRA/TRAC for the

purpose of supplying a backpressure at the break plane while computing the reflood transient.

The containment pressure transients and associ ated parameters were computed by LOTIC-2 and are presented in Figures 15.4-40b through 15.4-40g. The data used to model the

containment for the analysis is presented in Tables15.4-14 and 15.4-15. Mass and energy

release rates to containment can be found in Table 15.4-16. The Table 15.4-16 mass and

energy releases are taken from the 'Reference Transient' case of Section 15.4.1.1.2, which did

not include the fuel TCD modeling. The conservatively low containment backpressure from this

LOTIC-2 study is bounding since the core stored ener gy increases when explicitly modeling fuel TCD, which would tend to increase energy released through the break and hence increase the

containment pressure.

The impact of purging on the calculated containment pressure was addressed by performing a

calculation to obtain the amount of mass which exits through two available purge lines during

the initial portion of a postulated LOCA transient. The maximum air loss was calculated using

the transient mass distribution (TMD) computer code model, which is described in Section

6.2.1.3.4, to be 1160 lbm. The containment pressure calculations account for a loss of 1160 lbm

of air after initiation of the accident through modifying the compression ratio input to the LOTIC-

2 code.

15.4.1.1.4 Results of Large Break Spectrum Unit 1

The initial transient calculation is based upon a combination of nominal and bounding parameter

values. The values assumed in the WBN initial transient are shown in Table 15.4-19. In the

initial transient calculation, the majority of the bounded parameters are based upon generic

studies documented in Reference [46] (e.g., pressurizer location, break location, etc.). WBN

specific sensitivity studies (referred to as confirmatory cases) were completed for three of the

bounded parameters, steam generator tube plugging, the offsite power assumption, and the low

power region relative power, to verify their direction of conservatism. The results of these

sensitivity studies (Table 15.4-24) are reflected in the reference transient, which is described in

Section 15.4.1.1.4.1.

Input parameters used for the WBN analyses are presented in Tables 15.4-14, 15.4-15, 15.4-

16, 15.4-19, and 15.4-23. Mass and energy releases based on the initial WCOBRA/TRAC transient (Table 15.4-16) were utilized to calculate a containment back pressure (Figure 15.4-

40b) using the methods and assumptions described in Reference [1], Appendix A.

A series of WCOBRA/TRAC calculations were performed using the WBN model to determine the PCT effect of variations in key LOCA parameters (those with an uncertainty designed as PCT IC in Table 15.4-19). Single parameter variation studies based on the reference transient were performed to assess which parameters have a significant effect on the PCT results. The

results of these studies, which are referred to as the initial condition cases, are presented in

Sections 15.4.1.1.4.2 to 15.4.1.1.4.6. The initial transient calculation, confirmatory runs, and

final reference transient are described in detail in Section 4 and 5 of Reference [47]. The initial

condition study is described in Section 6 of Reference [47].

WBN 15.4-15 15.4.1.1.4.1 Reference Transient Description

Unit 1

The WBN Reference Transient models a double-ended cold leg guillotine break which assumed

the conditions listed in Table 15.4-19 and includes the offsite power available, low peripheral

assembly power and high SGTP configuration bounded study assumptions. The Reference

Transient calculation was performed with other parameters set at their bounding values as

denoted in Table 15.4-19 in order to calculate a relatively high PCT. The Reference Transient

is the basis for the uncertainty calculations necessary to establish the WBN 95th percentile

PCT.

The LOCA transient can be conveniently divided into a number of time periods in which specific

phenomena are occurring. For a typical large break, the blowdown period can be divided into

the critical heat flux (CHF) phase, the upward core flow phase, and the downward core flow

phase. These are followed by the refill, reflood, and long term cooling phases. The important

phenomena occurring during each of these phases are discussed for the Reference Transient

DECLG break with a Cd of 1.0. The results are shown in Figures 15.4-41 through 15.4-56. Key

events and the time of their occurrence are listed in Table 15.4-17.

Unit 2

The Watts Bar Unit 2 PCT and MLO/CWO transients are double ended cold leg guillotine

breaks with an effective break area of 1.911, and 2.0968 respectively (note that the limiting MLO

and CWO arise from the same case), which analyzes conditions that fall within those listed in

Table 15.4-19. Traditionally, cold leg breaks have been limiting for large break LOCA. Analysis

experience indicates that this break location most likely causes conditions that result in flow

stagnation to occur in the core. Scoping studies with WCOBRA/TRAC have confirmed that the

cold leg remains the limiting break location (WCAP-12945-P-A[46]).

The large break LOCA transient can be divided into convenient time periods in which specific

phenomena occur, such as various hot assembly heatup and cool down transients. For a typical

large break, the blowdown period can be divided into the Critical Heat Flux (CHF) phase, the

upward core flow phase, and the downward core flow phase. These are followed by the refill, reflood, and long-term cooling periods. Specific important transient phenomena and heat

transfer regimes are discussed below, with the transient results shown in Figure 15.4-41

through 15.4-55. (The limiting PCT case was chosen to show a conservative representation of

the response to a large break LOCA.)

Critical Heat Flux (CHF) Phase

Unit 1

In this phase, the break discharge rate is subcooled and high, the core flow reverses, the fuel

rods go through departure from nucleate boiling (DNB) and the cladding rapidly heats up while

core power shuts down. Figure 15.4-41 shows the maximum cladding temperature in the core, as a function of time. The hot water in the core and upper plenum flashes during this period.

This phase is terminated when the water in the lower plenum and downcomer begin to flash.

The mixture swells and the intact loop pumps, still rotating in single-phase liquid, push this two-

phase mixture into the core.

WBN 15.4-16 Unit 2

Immediately following the cold leg rupture, the break discharge rate is subcooled and high (Figure 15.4-42). The region of the RCS with the highest initial temperatures (core, upper

plenum, upper head, and hot legs) begin to flash to steam, the core flow reverses and the fuel

rods begin to go through departure from nucleate boiling (DNB). The fuel cladding rapidly heats

up (Figure 15.4-41) while the core power shuts down due to voiding in the core. This phase is

terminated when the water in the lower plenum and downcomer begins to flash (Figures 15.4-47

and 15.4-51). The mixture swells and intact loop pumps, still rotating in single phase liquid, push

this two-phase mixture into the core.

Upward Core Flow Phase

Unit 1

Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be

enhanced if the performance of the RCS pumps is not degraded by two phase fluid conditions, or if the break discharge rate is low because the fluid is saturated at the break. Figures 15.4-42

and 15.4-43 show the break flowrate from the vessel and loop sides of the break. This phase

ends as lower plenum mass is depleted, the loops become two-phase, and the pump head

degrades. If pumps are highly degraded or the break flow is large, the cooling effect due to

upward flow may not be significant. Figure 15.4-44 shows the void fraction at the pump inlet for

one intact loop pump and the broken loop pump. The intact loop pump remains in single-phase

liquid flow for several seconds, while the broken loop pump is in two-phase and steam flow

soon after the break.

Unit 2

Heat transfer is improved as the two-phase mixture is pushed into the core. This phase may be

enhanced if the pumps are not degraded, or if the break discharge rate is low due to saturated

fluid conditions at the break. If pump degradation is high or the break flow is large, the cooling

effect due to upward flow may not be significant. Figure 15.4-44 shows the void fraction for one

intact loop pump and the broken loop pump. This figure shows that the intact loop remains in

single-phase liquid flow for several seconds, resulting in enhanced upward core flow cooling.

This phase ends as the lower plenum mass is depleted, the loop flow becomes two-phase, and

the pump head degrades.

WBN 15.4-17 Downward Core Flow Phase

Unit 1

Fluid from the intact loops is pushed into the vessel by the pumps and decreases as conditions

in the pumps become two-phase. The break fl ow begins to dominate and pulls flow down through the core. Figures 15.4-45 and 15.4-46 show the vapor flow into the top of Channels 13

and 15 on a per assembly basis. While entrained liquid and liquid flow also provides cooling, the vapor flow entering the core was found to be the best indicator of core cooling. This period

is enhanced by flow from the upper head. As the sy stem pressure continues to fall, the break flow and consequently the core flow are reduced. The core begins to heat up as the system

reaches containment pressure and the vessel begins to fill with ECCS water.

Unit 2

The loop flow is pushed into the vessel by the intact loop pumps and decreases as the pump

flow becomes two-phase. The break flow begins to dominate and pulls flow down through the

core, up the downcomer to the broken loop cold leg, and out the break. While liquid and

entrained liquid flow provide core cooling, the top of the core vapor flow (Figures 15.4-45 and

15.4-46) best illustrates this phase of core cooling. Once the system has depressurized to the

accumulator pressure (Figure 15.4-43), the accumulators begin to inject cold borated water into

the intact cold legs (Figure 15.4-48). During this period, due to steam upflow in the downcomer, a portion of the injected ECCS water is calculated to be bypassed around the downcomer and

out the break. As the system pressure continues to fall, the break flow, and consequently the

downward core flow, is reduced. The core begins to heat up as the system pressure

approaches the containment pressure and the vessel begins to fill with ECCS water (Figure

15.4-52).

Refill Phase

Unit 1

The core continues to heat up as the lower plenum fills with ECCS water. Figure 15.4-47 shows

the lower plenum collapsed liquid level. This phase ends when the ECCS water enters the core

and entrainment begins, with a resulting improvement in heat transfer. Figures 15.4-48 and

15.4-49 show the liquid flows from the accumulator and safety injection on an intact loop.

Unit 2

As the refill period begins, the core begins a period of heatup and the vessel begins to fill with

ECCS water (Figure 15.4-48). This period is characterized by a rapid increase in cladding

temperatures at all elevations due to the lack of liquid and steam flow in the core region. This

period continues until the lower plenum is filled and the bottom of the core begins to reflood and

entrainment begins.

WBN 15.4-18 Early Reflood Phase

Unit 1

The accumulators begin to empty, and nitrogen enters the system. This forces water into the

core which then boils as the lower core region begins to quench, causing repressurization. The

repressurization is best illustrated by the reduction in pumped safety injection flow at

approximately 70 seconds. During this time, core cooling may be increased. The system then

settles into a gravity driven reflood which exhibits lower core heat transfer. Figures 15.4-50 and

15.4-51 show the core and downcomer liquid levels. Figure 15.4-52 shows the vessel fluid

mass. As the quench front progresses further into the core, the PCT location moves higher in

the top core region. Figure 15.4-53 shows the movement of the PCT location. As the vessel

continues to fill, the PCT location is cooled and the heatup PCT transient is terminated.

Unit 2

During the early reflood phase, the accumulators begin to empty and nitrogen enters the

system. This forces water into the core, which then boils, causing system repressurization, and

the lower core region begins to quench (Figure 15.4-50). During this time, core cooling may

increase due to vapor generation and liquid entrainment. During the reflood period, the core

flow is oscillatory as cold water periodically rewets and quenches the hot fuel cladding, which

generates steam and causes system repressurization. The steam and entrained water must

pass through the vessel upper plenum, the hot legs, the steam generators, and the reactor coolant pumps before it is vented out the break. This flow path resistance is overcome by the

downcomer water elevation head, which provides t he gravity driven reflood force. From the later stage of blowdown to the beginning of reflood, the accumulators rapidly discharge borated

cooling water into the RCS, filling the lower plenum and contributing to the filling of the

downcomer. The pumped ECCS water (Figure 15.4-49) aids in the filling of the downcomer and

subsequently supplies water to maintain a full downcomer and complete the reflood period. As

the quench front progresses up the core, the PCT location moves higher into the top core

region. As the vessel continues to fill, the PCT location is cooled and the early reflood period is

terminated.

Late Reflood Phase

Unit 1

The late reflood phase is characterized by boiling in the downcomer. The mixing of ECCS water

with hot water and steam from the core, in addition to the continued heat transfer from the hot

vessel metal, reduces the subcooling of water in the lower plenum and downcomer. Figure

15.4-54 illustrates the reduction in lower plenum subcooling.

The saturation temperature is dictated by the containment backpressure. For WBN, which has

a low containment pressure after the LOCA, boiling does occur and has a significant effect on

the gravity reflood. Vapor generated in the downcomer reduces the driving head which results

in a reduced core reflood rate. The top core elevations experience a second reflood heatup, which exceeds the first.

WBN 15.4-19 The Reference transient resulted in a blowdown PCT of 1299

°F and second reflood PCT of 1671°F.

Unit 2

The late reflood phase is characterized by boiling in the downcomer. The mixing of ECCS water

with hot water and steam from the core, in addition to the continued heat transfer from the hot

vessel metal, reduces the subcooling of water in the lower plenum and downcomer. Figure 15.4-

54 illustrates the reduction in lower plenum subcooling. The saturation temperature is dictated

by the containment backpressure. For WBN, which has a low containment pressure after the

LOCA, boiling does occur and has a significant effect on the gravity reflood. Vapor generated in

the downcomer reduces the driving head which results in a reduced core reflood rate. The top

core elevations experience a second reflood heatup, which exceeds the first (Figure 15.4-41, HOTSPOT result).

15.4.1.1.4.2 Sensitivity Studies (Unit 1 Only)

A large number of single parameter sensitivity calculations of key LOCA parameters were

performed to determine the PCT effect on the large break LOCA transient. These calculations

are required as part of the approved Best Estimate methodology

[46] to develop data for use in the uncertainty evaluation. For each sensit ivity study, a comparison between the Reference Transient results and the sensitivity transient results was made.

The results of a small sample of these sensitivity studies are summarized in Table 15.4-24. The

results of the entire array of sensitivity studies are included in Reference [47].

15.4.1.1.4.3 Initial Condition Sensitivity Studies (Unit 1 Only)

Several calculations were performed to evaluate the PCT effect of changes in the initial

conditions on the large break LOCA transient. These calculations modeled single parameter

variations in key initial plant conditions over the expected ranges of operation. These studies

included the ranging of T AVG , RCS pressure, and ECCS temperatures, pressures, and volumes.

The results of these studies are presented in Section 6 of Reference [47].

The results of these sensitivity studies were used to develop uncertainty distributions for the

blowdown, first and second reflood peaks. The uncertainty distributions resulting from the initial

conditions, PCTIC,i , are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT.

95%

15.4.1.1.4.4 Power Distribution Sensitivity Studies (Unit 1 Only)

Several calculations were performed to evaluate the PCT effect of changes in power

distributions on the large break LOCA transient. The approved methodology was used to

develop a run matrix of peak linear heat rate relative to the core average, maximum relative rod

power, relative power in the bottom third of the core, and relative power in the middle third of the

core, as the power distribution parameters to be considered. These calculations modeled single

parameter variations as well as multiple parameter variations. The results of these studies

indicate that power distributions with peak powers skewed to the top of the core produced the

most limiting PCTs. These results are presented in Section 7 of Reference [47].

WBN 15.4-20 The results of these sensitivity studies were used to develop response surfaces, which are used

to predict the delta PCT due to changes in power distributions for the blowdown, first and

second reflood peaks. The uncertainty distributions resulting from the power distributions, PCT PD,i , are used in the overall PCT uncertainty evaluation to determine the final estimate of PCT.95%

15.4.1.1.4.5 Global Model Sensitivity Studies (Unit 1 Only)

Several calculations were performed to evaluate the PCT effect of changes in global models on

the large break LOCA transient. Table 26-4-3 of Reference [46] provides a run matrix of break

discharge coefficient, broken cold leg resistance, and condensation rate as the global models to

be considered for the double-ended guillotine break. These calculations modeled single

parameter variations as well as multiple parameter variations. The limiting split break size was

also identified using the approved methodology.

[46] These results are presented in Section 8 of Reference [47].

The results of these sensitivity studies were used to develop response surfaces, which are used

to predict the delta PCT due to changes in global models for the DECLG blowdown, first and

second reflood peaks. The uncertainty distribution resulting from the global models, delta

PCTMOD,i , is used in the overall PCT uncertainty evaluation to determine the final estimate of PCT.95%

15.4.1.1.4.6 Overall PCT Uncertainty Evaluation and Results (Unit 1 Only)

The equation used to initially estimate the 95th percentile PCT (PCT i of Equation 15.4-1) was presented in Section 15.4.1.1.2. Each of the uncertainty elements (PCTIC,i , PCT PD,i , PCTMOD,i) are considered to be independent of each other. Each element includes a correction or bias, which is added to PCTREF,i to move it closer to the expected, or average PCT. The bias from each element has an uncertainty associated with the methods used to derive the bias.

Each bias component of the uncertainty elements is considered a random variable, whose

uncertainty distribution is obtained directly, or is obtained from the uncertainty of the parameters of which the bias is a function. Since PCT i is the sum of these biases, it also becomes a random variable. Separate initial PCT frequency distributions are constructed as follows for the

DECLG and the limiting split break:

1. Generate a random value of each uncertainty element (PCT IC , PCT PD , PCT MOD).

2. Calculate the resulting PCT using Equation 15.4-1.

3. Repeat the process many times to generate a histogram of PCTs.

For WBN, the results of this assessment showed the DECLG to be the limiting break type.

A final verification step is performed to quantify the bias and uncertainty resulting from the

superposition assumption (i.e., the assumption that the major uncertainty elements are

independent). Several additional WCOBRA/TRAC calculations are performed in which variations in parameters from each of the three uncertainty elements are modeled for the

DECLG. These predictions are compared to the predictions based on Equation 15.4-1 and

additional biases and uncertainties are applied where appropriate.

WBN 15.4-21 The estimate of the PCT at 95% probability is determined by finding that PCT below which 95%

of the calculated PCTs reside. This estimate is the licensing basis PCT, under the revised

ECCS rule. The results of the WBN Best Estimate Large Break LOCA analysis are presented in

Table 15.4-18. The difference between the 95th percentile PCT and the 50th percentile PCT

increases during reflood due to propagation of uncertainties.

15.4.1.1.4.7 Evaluations

Unit 1

Replacement of V+/P+ fuel with RFA-2 fuel has been evaluated for its effect on the large break

loss of coolant accident peak cladding temperature. Calculations using WCOBRA/TRAC were performed with the Double Ended Guilletine Transient conditions to determine the effects of a

full core of RFA-2 fuel with intermediate flow mixers (IFMs) and a mixed core of V+/P+ and

RFA-2 fuels. One mixed core modeled fresh RFA-2 fuel in the hot assembly surrounded by a

least once burned V+/P+ fuel in the average fuel assemblies and the low power assemblies.

The second mixed core modeled fresh RFA-2 fuel in the hot assembly and in the average fuel

assemblies under guide tubes with the remainder at least once burned V+/P+ fuel. A minimum

burnup of 8,000 MWD/MTU was assumed for all of the V+/P+ assemblies.

The analysis was performed using the current approved methodology and the same version of

WCOBRA/TRAC. The calculated maximum PCT for each case considered remained below the PCT calculated for the calculation. The Best Estimate LBLOCA evaluation concludes that, with

the new fuel and limiting transition core, WBN remains in compliance with the requirements of

10 CFR 50.46 for both the tranisition from the current fuel to the new fuel and for a full core of

the new fuel. Assessments related to plant safety will remain.

Replacement Steam Generators (RSGs) have been ev aluated for their effect on the large break loss of coolant accident peak cladding temperature. Calculations using WCOBRA/TRAC were performed to determine the PCT effects of the new steam generators (Westinghouse model 68AXP). The evaluation concluded that the PCT effects of the RSGs are bounded by the PCT

effects of the original D-3 steam generators that were originally modeled. As such, the

evaluation shows continued compliance with the requirements of 10 CFR 50.46. Other margin

assessments related to plant safety will remain applicable.

Unit 2

An evaluation of IFBA fuel including the effects of pellet TCD was performed, and shows that

IFBA fuel is limiting for MLO but not for PCT. The AOR PCT and MLO results in Tables 15.4-

18a and 15.4-18b reflect the higher results of IFBA/non-IFBA.

In addition to the analyses presented in this section, evaluations and reanalyses may be

performed as needed to address computer code errors and emergent issues, or to support plant

changes. The issues or changes are evaluated, and the impact on the Peak Cladding

Temperature (PCT) is determined. The resultant increase or decrease in PCT is applied to the

analysis of record PCT. The PCT, including all penalties and benefits is presented in Table

15.4-18a for the large break LOCA. The current PCT is demonstrated to be less than the 10

CFR 50.46(b) requirement of 2200 °F.

WBN 15.4-22 In addition, 10 CFR 50.46 requires that licensees assess and report the effect of changes to or

errors in the evaluation model used in the large break LOCA analysis. These reports constitute

addenda to the analysis of record provided in the FSAR until overall changes become

significant as defined by 10 CFR 50.46. If the assessed changes or errors in the evaluation

model results in significant changes in calculated PCT, a schedule for formal reanalysis or other

action as needed to show compliance will be addressed in the report to the NRC.

Finally, the criteria of 10 CFR 50.46 requires that holders and users of the evaluation models

establish a number of definitions and processes for assessing changes in the models or their

use. Westinghouse, in consultation with the PWR Owner's Group (PWROG), has developed an

approach for compliance with the reporting requirements. This approach is documented in

WCAP-13451 [36], Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting.

TVA provides the NRC with annual and 30-day reports, as applicable, for Watts Bar Unit 2. TVA

intends to provide future reports required by 10 CFR 50,46 consistent with the approach

described in WCAP-13451.

15.4.1.1.5 Effect of Containment Purging

To assess the impact of purging on the calculated post-LOCA Watts Bar containment pressure, a calculation was performed to obtain the amount of mass which exits through two available

purge lines during the initial portion of a postulated LOCA transient. Purge line isolation closure

time is assumed at 4.0 seconds after receipt of signal; during this interval, the full flow area is

presumed available. In addition, the time to reach the SI signal setpoint and the delay

necessary to generate the SI signal are conservatively assessed as 1.5 seconds total. Thus, flow through a pair of fully open available purge lines was evaluated from 0.0 to 5.5 seconds for

the postulated Double-Ended Cold Leg break. When the CVI signal is generated by the safety

injection signal from the reactor protection system, a maximum response time of 2.0 seconds is

allocated, thereby resulting in a total isolation time of 6.0 seconds.

Subsequent plant specific analysis issued in support of a 2.0 second signal response time

documents that less air mass is released when the actual valve closure characteristics are

considered with purge discharge continuing at a progressively diminishing flowrate until 6.0

seconds. Therefore, the analysis of record remains bounding and conservative.

The calculation employed the 50-node transient mass distribution (TMD) computer code model

which is described in Section 6.2.1.3.4. Referring to Figure 6.2.1-9, purge supply lines are

connected to volumes 34, 37, and 25; purge exhaust lines are connected to volumes 36 and 25.

Possible combinations of one supply line and one exhaust line open to the atmosphere were

considered. Each of the purge lines is represented by a flowpath of cross-section area equal to

2.948 ft 2 and a total flow resistance factor equal to 3.98 (entrance and exit loss, three fully open butterfly valves, and a debris screen). The flow area and resistance bounds either one 24-inch

supply line and one 24-inch exhaust line with wide open valves in the upper compartment or a

combination of one 24-inch supply and one 24-inch exhaust line with 50

° limited open valves and one 8-inch line with wide open valve all in the lower compartment.

WBN 15.4-23 In a computation for ECCS performance, the greatest impact on containment pressure occurs

for the purge case of maximum air mass loss which involves two purge lines open in the lower

compartment (TMD elements 34 and 36) together with a cold leg break in TMD Volume 1; 1160

lbs. of air are calculated to be lost in this case. The maximum air loss case is the limiting case

because any steam lost via purging in an ECCS backpressure evaluation would otherwise be

calculated to condense in the ice bed. Therefore, any steam lost via purging is ultimately of no

consequence in the containment pressure determination while any air loss directly reduces

calculated pressure.

The impact of the air loss from purging is implicitly included in the calculations of peak clad

temperature. The containment pressure transient calculations account for a loss of 1160 lbm of

air after initiation of the accident through modifying the compression ratio input to the LOTIC-2

Code. The acceptable performance of the ECCS, as calculated using the resulting containment

backpressure, permits the purging of the Watts Bar containment during normal operation.

15.4.1.1.6 Conclusions - Thermal Analysis

Unit 1

It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR

50.46 are met. The demonstration that these limits are met for WBN is as follows:

1. There is a high level of probability that the peak cladding temperature (PCT) shall not exceed 2200

°F. The 95th percentile result of 1892

°F presented in Table 15.4-18 indicates that this regulatory limit has been met.

2. The maximum calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation. The approved Best

Estimate LOCA methodology assesses this requirement using a plant-specific

transient which has a PCT in excess of the estimated 95th percentile PCT.

Based on this conservative calculation, a maximum total oxidation of 15% is

calculated (Table 15.4-18), which meets the regulatory limit.

3. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam shall not exceed 0.01 times the hypothetical

amount that would be generated if all of the metal in the cladding cylinders

surrounding the fuel were to react. This requirement was assessed using the

approved analysis option described in Section 10-3 of Reference [47]. The total

amount of hydrogen generated, based on this conservative assessment, is

0.0061 times the maximum theoretical amount as presented in Table 15.4-18, which meets the regulatory limit.

4. Calculated changes in core geometry shall be such that the core remains amenable to cooling. This requirement is met by demonstrating that the PCT

does not exceed 2200°F, and the seismic and LOCA forces are not sufficient to

distort the fuel assemblies to the extent that core cannot be cooled. The

approved methodology specifies that effects of LOCA and seismic loads on core

geometry do not need to be considered unless grid crushing extends to in-board

assemblies. This situation is not predicted to occur for WBN. Therefore, this

regulatory limit is met.

WBN 15.4-24 5. After any calculated successful initial operation of the ECCS, the calculated core temperature shall be maintained at an acceptable low value and decay heat shall

be removed for the extended period of time required by the long lived

radioactivity remaining in the core. While WCOBRA/TRAC is typically not run past full core quench, all base calculations are run well past PCT turnaround and

past the point where increasing vessel inventories are calculated. The conditions

at the end of the WCOBRA/TRAC calculations indicate that the transition to long term cooling is underway even before the entire core is quenched.

Unit 2

It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR

50.46 are met. The demonstration that these limits are met is as follows:

(b)(1) The limiting PCT corresponds to a bounding estimate of the 95th percentile at the 95-percent confidence level. Figure 15.4-41 shows the predicted HOTSPOT cladding

temperature transient at the PCT location and the WCOBRA/TRAC PCT transient, both

for the limiting PCT case. The HOTSPOT PCT plot includes local uncertainties applied

to the Hot Rod, whereas the WCOBRA/TRAC PCT plot does not account for any local

uncertainties. Since the resulting HOTSPOT PCT for the limiting case is 1766°F, the

analysis confirms that 10 CFR 50.46 acceptance criterion (b)(1), i.e., "Peak Clad

Temperature less than 2200°F, is demonstrated. The results are shown in Table 15.4-

18b.

(b)(2) The maximum cladding oxidation corresponds to a bounding estimate of the 95th percentile MLO at the 95-percent confidence level. Since the resulting MLO for the

limiting case is 1.99 percent, the analysis confirms that 10 CFR 50.46 acceptance

criterion (b)(2), i.e., "Maximum Local Oxi dation of the cladding less than 17 percent", is

demonstrated. The results are shown in Table 15.4-18b.

(b)(3) The limiting core-wide oxidation corresponds to a bounding estimate of the 95th percentile CWO at the 95-percent confidence level. The limiting Hot Assembly Rod (HAR) total maximum oxidation is 0.08 percent. A detailed CWO calculation takes

advantage of the core power census that includes many lower power assemblies.

Because there is significant margin to the regulatory limit, the CWO value can be

conservatively chosen as that calculated for the limiting HAR. A detailed CWO

calculation is therefore not needed because the outcome will always be less than the

HAR value. Since the resulting CWO is 0.08 percent, the analysis confirms that 10 CFR

50.46 acceptance criterion (b)(3), i.e., "Core Wide Oxidation less than 1 percent", is

demonstrated.

WBN 15.4-25 (b)(4) 10 CFR 50.46 acceptance criterion (b)(4) requires that the calculated changes in core geometry are such that the core remains amenable to cooling. This criterion has

historically been satisfied by adherence to criteria (b)(1) and (b)(2), and by assuring that

the fuel deformation due to combined LOCA and seismic loads is specifically addressed.

It has been demonstrated that the PCT and maximum cladding oxidation limits remain in

effect for Best- Estimate LOCA applications. The approved methodology (WCAP-12945-

P-A [46]) specifies that effects of LOCA and seismic loads on core geometry do not need

to be considered unless grid crushing extends beyond the 44 assemblies in the low-

power channel. This situation has not been calculated to occur for Watts Bar Unit 2.

Therefore, acceptance criterion (b)(4) is satisfied.

(b)(5) 10 CFR 50.46 acceptance criterion (b)(5) requires that the long-term core cooling be provided following the successful initial operation of the ECCS. Long-term cooling is

dependent on the demonstration of continued delivery of cooling water to the core. While

WCOBRA/TRAC is typically not run past full core quench, all base calculations are run

well past PCT turnaround and past the point where increasing vessel inventories are

calculated. The conditions at the end of the WCOBRA/TRAC calculations indicate that

the transition to long term cooling is underway even before the entire core is quenched.

Based on the ASTRUM Analysis results (Table 15.4-18b), it is concluded that Watts Bar Unit 2 maintains a margin of safety to the limits prescribed by 10 CFR 50.46.

15.4.1.1.7 Plant Operating Range

Unit 1

The expected PCT and associated uncertainty which was presented in Section 15.4.1.1.4.6 is

valid for a range of plant operating conditions. In contrast to current Appendix K calculations, many parameters in the Reference Transient calculation are at nominal values. The range of

variation of the operating parameters has been accounted for in the estimated PCT uncertainty.

Table 15.4-25 summarizes the operating ranges. Note that Figure 15.4-56 illustrates the axial

power distribution limits which were analyzed and are verified on a cycle-specific basis.

Unit 2

The expected PCT and its uncertainty developed are valid for a range of plant operating

conditions. The range of variation of the operating parameters has been accounted for in the

uncertainty evaluation. Tables 15.4-19 summarizes the operating ranges as defined for the

proposed operating conditions which are supported by the Best-Estimate LBLOCA analysis for

Watts Bar Unit 2. Tables 15.4-14 and 15.4-15 summarize the LBLOCA containment data used

for calculating containment pressure. If operation is maintained within these ranges, the

LBLOCA results developed in this report using WCOBRA/TRAC are considered to be valid.

Note that some of these parameters vary over their range during normal operation (accumulator

temperature) and other ranges are fixed for a given operational condition (Tavg).

WBN 15.4-26 15.4.1.2 Hydrogen Production and Accumulation

Unit 1

Hydrogen accumulation in the containment atmosphere following the DBA can be the result of

production from several sources. The potential sources of hydrogen are the zirconium-water

reaction, corrosion of construction materials, and radiolytic decomposition of the emergency

core cooling solution. The latter source, solution radiolysis, includes both core solution

radiolysis and sump solution radiolysis.

Unit 2

Pursuant to NRC final rule as defined in 10 CFR 50.44 and Regulatory Guide 1.7, the new

definition of design-basis LOCA hydrogen releas e eliminates requirements for hydrogen control systems for mitigation of releases. "All PWRs with ice condenser type containments must have the capability to control combustible gas generated from metal-water reaction involving 75% of

the fuel cladding surrounding the active fuel region (excluding the cladding surrounding the

plenum volume) so that there is no loss of containment structural integrity. The deliberate

ignition systems provided to meet this existi ng combustible gas source term are capable of safely accommodating even greater amounts of combustible gas associated with even more severe core melt sequences that fail the reactor vessel and involve molten core-concrete

interaction. Deliberate ignition systems, if av ailable, generally consume the combustible gas

before it reaches concentrations that can be detrimental to containment integrity." On the basis

of this definition, no further analysis is required to support events considered to be outside the

design basis. Deliberate ignition systems are described in FSAR Section 6.2.5

15.4.1.2.1 Method of Analysis

The quantity of zirconium which reacts with the core cooling solution depends on the

performance of the ECCS. The criteria for evaluation of the ECCS require that the

zircaloy-water reaction be limited to 1% by weight of the total quantity of zirconium in the core.

ECCS calculations have shown the zircaloy-water reaction to be less than or equal to 0.61%,

which is less than required by the criteria.

The use of aluminum inside the containment is limited and is not used in safety-related

components which are in contact with the recirculating core cooling fluid. Aluminum is more

reactive with the containment spray alkaline borate solution than other plant materials such as

galvanized steel, copper, and copper nickel alloys. By limiting the use of aluminum, the aggregate source of hydrogen over the long term is essentially restricted to that arising from

radiolytic decomposition of core and sump water. The upper limit rate of such decomposition

can be predicted with ample certainty to permit the design of effective countermeasures.

It should be noted that the zirconium-water reaction and aluminum corrosion with containment

spray are chemical reactions and thus essentially independent of the radiation field inside the

containment following a LOCA. Radiolytic decomposition of water is dependent on the radiation

field intensity. The radiation field inside the containment is calculated for the maximum credible

accident by the ORIGEN code in which the fission product releases are given by TID-14844.

[20]

WBN 15.4-27 The hydrogen generation calculations are performed based on the guidance of Regulatory

Guide 1.7.

[32] The results are shown in Figures 15.4-4 and 15.4-6.

15.4.1.2.2 Typical Assumptions

The following discussion outlines the assumptions used in the calculations.

1. Zirconium-Water Reaction

The zirconium-water reaction is described by the chemical equation:

The hydrogen generation due to this reaction will be completed during the first day following the LOCA. The Westinghouse model assumes a 0.5- or 1.5% zirconium-water reaction. The NRC

model assumes a 1.5% zirconium-water reaction or a corewide average depth of reaction into

the original cladding of 0.00023 inches of clad thickness. In accordance with Regulatory Guide

1.7, the hydrogen generation has been assumed to be five times the maximum amount

calculated in accordance with 10CFR50.46, but no less than the amount that would result from

the reaction of all the metal surrounding the fuel (excluding the cladding surrounding the plenum

volume) to a depth of 0.00023 inches. This meets the current NRC basis for evaluating

hydrogen production inside containment. The hydrogen generated is assumed to be released

to the containment atmosphere over the first two minutes following the break in both models.

2. Primary Coolant Hydrogen

The maximum equilibrium quantity of hydrogen in the primary coolant is 1120 scf. This value

includes both hydrogen dissolved in the coolant water at 35 cc (STP) per kilogram of water and

the corresponding equilibrium hydrogen in the pressurizer gas space. The 1120 scf of hydrogen is assumed to be released immediately and uniformly to the containment atmosphere.

3. Corrosion of Plant Materials

Oxidation of metals in aqueous solution results in the generation of hydrogen gas as one of the

corrosion products. Extensive corrosion testing has been conducted to determine the behavior

of the various metals used in the containment in the emergency core cooling solution at DBA

conditions. Metals tested include zircaloy, inconel, aluminum alloys, cupronickel alloys, carbon

steel, galvanized carbon steel, and copper. Tests conducted at ORNL

[22,23] have also verified the compatibility of the various materials (exclusive of aluminum) with alkaline borate solution.

As applied to the quantitative definition of hydrogen production rates, the results of the corrosion

tests have shown that only aluminum and zinc will corrode at a rate that will significantly add to the hydrogen accumulation in the containment atmosphere.

The corrosion of aluminum may be described by the overall reaction:

Zr + 2 H Zr + 2 H + Heat 22 O O 2 2 Al + 3 H Al + 3 H222 O O 3 WBN 15.4-28 Therefore, three moles of hydrogen are produced for every two moles of aluminum that is

oxidized (approximately 20 scf of hydr ogen for each pound of aluminum corroded).The corrosion of zinc may be described by the overall reaction:

Therefore, one mole of hydrogen is produced for each mole of zinc oxidized. This corresponds to 5.5 scf hydrogen produced for each pound of zinc corroded.

The time-temperature cycle (Table 15.4-2) consider ed in the calculation of aluminum and zinc corrosion is based on a conservative step-wise representation of the postulated postaccident

containment transient. The corrosion rates at the various steps are determined from the

aluminum and zinc corrosion rate design curves shown in Figures 15.4-1 and 15.4-1a. The

corrosion data points include the effects of temperature, alloy, and spray solution conditions.

Based on these corrosion rates and corrodible metal inventory given in Table 15.4-3, the

contribution of aluminum and zinc corrosion to hydrogen accumulation in the containment

following the DBA was calculated. For conservative estimation, no credit is taken for protective

shield effects of insulation or enclosures from the spray and complete and continuous

immersion is assumed.

Calculations based on the NRC model are performed by allowing an increased aluminum

corrosion rate during the final step of the post-accident containment temperature transient (Table 15.4-2) corresponding to 200 mils (15.7 mg/dm 2/hr). The corrosion rates earlier in the accident sequence are the higher rates determined from Figure 15.4-1.

4. Radiolysis of Core and Sump Water

Water radiolysis is a complex process involving reactions of numerous intermediates. However, the overall radiolytic process may be described by the reaction:

Of interest here is the quantitative definition of the rates and extent of radiolytic hydrogen production following the DBA.

An extensive program has been conducted by Westinghouse to investigate the radiolytic

decomposition of the core cooling solution following the DBA. In the course of this investigation, it became apparent that two separate radiolytic environments exist in the containment at DBA conditions. In one case, radiolysis of the core cooling solution occurs as a result of the decay

energy of fission products in the fuel. In the other case, the decay of dissolved fission products, which have escaped from the core, results in the radiolysis of the sump solution. The results of

these investigations are discussed in Reference [24].

Zn + 2 H Zn (OH) + H 2 2 2 O 2 H 2 H + 22 O O 2 WBN 15.4-29 15.4.1.2.3 Core Solution Radiolysis

As the emergency core cooling solution flows through the core, it is subjected to gamma

radiation by decay of fission products in the fuel. This energy deposition results in solution

radiolysis and the production of molecular hydrogen and oxygen. The initial production rate of

these species will depend on the rate of energy absorption and the specific radiolytic yields.

The energy absorption rate in solution can be assessed from knowledge of the fission products

contained in the core, and a detailed analysis of the dissipation of the decay energy between

core materials and the solution. The results of Westinghouse studies show essentially all of the

beta energy is absorbed within the fuel and cladding and that this represents approximately

50% of the total beta-gamma decay energy. This study shows further that of the gamma

energy, a maximum of 7.4% will be absorbed by the solution incore. Thus, an overall absorption

factor of 3.7% of the total core decay energy ( + ) is used to compute solution radiation dose rates and the time-integrated dose. Table 15.4-4 presents the total decay energy ( + ) of a reactor core, which considers full power operation with extended fuel cycles before the accident.

For the maximum credible accident case, the contained decay energy in the core accounts for

the assumed TID-14844 release of 50% halogens and 1% other fission products. The noble

gases are assumed by Regulatory Guide 1.7 to escape to the containment vapor space where little or no water radiolysis would result from decay of these nuclides.

The radiolysis yield of hydrogen in solution has been studied extensively by Westinghouse and

ORNL.[22, 23] The results of static capsule tests conducted by Westinghouse indicate that hydrogen yields much lower than the maximum of 0.44 molecules per 100 ev would be the case

incore. With little gas space to which the hydrogen formed in solution can escape, the rapid

back reactions of molecular radiolytic products in solution to reform water is sufficient to result in

very low net hydrogen yields.

However, it is recognized that there are differences between the static capsule tests and the

dynamic condition incore, where the core cooling fluid is continuously flowing. Such flow is

reasoned to disturb the steady-state conditions which are observed in static capsule tests, and

while the occurrence of back reactions would still be significant, the overall net yield of hydrogen

would be somewhat higher in the flowing system.

The study of radiolysis in dynamic systems wa s initiated by Westinghouse, which formed the

basis for experimental work performed at ORNL.

Both studies clearly illustrate the reduced yields in hydrogen from core radiolysis, i.e., reduced from the maximum yield of 0.44 molecules

per 100 ev. These results have been published.

[24,26]

For the purposes of this analysis, the calculati ons of hydrogen yield from core radiolysis are performed with the very conservative value of 0.50 molecules per 100 ev. That this value is

conservative and a maximum for this type of aqueous solution and gamma radiation is

confirmed by many published works. The Westi nghouse results from the dynamic studies show

0.44 molecules per 100 ev to be a maximum at very high solution flow rates through the gamma

radiation field. The referenced ORNL

[26] work also confirms this value as a maximum at high flow rates. A. O. Allen

[27] presents a very comprehensive review of work performed to confirm the primary hydrogen yield to be a maximum of 0.44 - 0.45 molecules per 100 ev.

WBN 15.4-30 On the foregoing basis, the production rate and total hydrogen produced from core radiolysis, as a function of time, has been conservatively estimated for the maximum credible accident case.

Calculations are based on a hydrogen yield value of 0.5 molecules per 100 ev, 10% of the

gamma energy produced from fission products in the fuel rods is absorbed by the solution in the

region of the core, and the noble gases escape to the containment vapor space.

15.4.1.2.4 Sump Solution Radiolysis

Another potential source of hydrogen assumed for the postaccident period arises from water

contained in the reactor containment sump being subjected to radiolytic decomposition by

fission products. In this consideration, an assessment must be made as to the decay energy

deposited in the solution and the radiolytic hydrogen yield, much in the same manner as given

above for core radiolysis.

The energy deposited in solution is computed using the following basis:

1. For the maximum credible accident, a TID-14844 release model

[20] is assumed where 50% of the total core halogens and 1% of all other fission products, excluding noble

gases, are released from the core to the sump solution.

2. The quantity of fission product release considers reactor operation with extended fuel cycles before the accident.

3. The total decay energy from the released fission products, both beta and gamma, is assumed to be fully absorbed in the solution.

Within the assessment of energy release by fission products in water, account is made of the

decay of the fission products. To arrive at the time-integrated energy release, the energy

release rate from the fission products are integrated over time after a LOCA. The energy

release rates for various times after LOCA are included in Table 15.4-5. The values are

normalized to the total core thermal power level.

The yield of hydrogen from sump solution radiolysis is most nearly represented by the static

capsule tests performed by Westinghouse and ORNL with the alkaline sodium borate solution.

The differences between these tests and the actual conditions for the sump solution, however, are important and render the capsule tests conservative in their predictions of radiolytic

hydrogen yields.

In this assessment, the sump solution will have considerable depth, which inhibits the ready

diffusion of hydrogen from solution, as compared to the case with shallow-depth capsule tests.

This retention of hydrogen in solution will have a significant effect in reducing the hydrogen

yields to the containment atmosphere. The buildup of hydrogen concentration in solution will

enhance the back reaction to formation of water and lower the net hydrogen yield, in the same

manner as a reduction in gas to liquid volume ratio will reduce the yield.

WBN 15.4-31 This is illustrated by the data presented in Figure 15.4-2 for capsule tests with various gas to

liquid volume ratios. The data show a significant reduction in the apparent or net hydrogen yield

from the published primary maximum yield of 0.44 molecules per 100 ev. Even at the very

highest ratios, where capsule solution depths are very low, the yield is less than 0.30, with the

highest scatter data point at 0.39 molecules per 100 ev.

With these considerations taken into account, a reduced hydrogen yield is a reasonable

assumption to make for the case of sump radiolysis. While it can be expected that the yield will

be on the order of 0.1 or less, the calculations do not take credit for a reduced hydrogen yield in

the case of sump radiolysis and a hydrogen yield value of 0.5 molecules per 100 ev has been

used.

15.4.1.2.5 Results

Figures 15.4-3 and 15.4-5 show the hydrogen production and accumulation in the containment

following a LOCA for both the Westinghouse model, while Figures 15.4-7 and 15.4-8 give the

volume percent of hydrogen in the containment for both the Westinghouse and NRC models, respectively. Figures 15.4-4 and 15.4-6 reflect the current NRC basis (Regulatory Guide 1.7)

and provide the hydrogen generation and accumulation in containment following a LOCA. The

figures for hydrogen accumulation and volume percent in the containment are based on the

assumption that no measures are taken to remove the hydrogen (i.e., no recombination or

purging of the hydrogen is taken into account). The effect of the hydrogen recombiner system

on hydrogen accumulation is discussed in Section 6.2, while the effect of hydrogen purging to

atmosphere is discussed in Section 15.5.

15.4.2 MAJOR SECONDARY SYSTEM PIPE RUPTURE

15.4.2.1 Major Rupture of a Main Steam Line

15.4.2.1.1 Identification of Causes and Accident Description

The steam release arising from a rupture of a main steam line would result in an initial increase

in steam flow which decreases during the accident as the steam pressure falls. The energy

removal from the reactor coolant system causes a reduction of coolant temperature and

pressure. In the presence of a negative moderator temperature coefficient, the cooldown

results in a reduction of core shutdown margin. If the most reactive rod cluster control assembly (RCCA) is assumed stuck in its fully withdrawn position after reactor trip, there is an increased

possibility that the core will become critical and return to power. A return to power following a

steam line rupture is a potential problem mainly because of the high power peaking factors

which exist, assuming the most reactive RCCA to be stuck in its fully withdrawn position. The

core is ultimately shut down by the boric acid in jection delivered by the safety injection system.

The analysis of a main steam line rupture is performed to demonstrate that the following

criterion is satisfied:

WBN 15.4-32 Assuming a stuck RCCA with or without offsite power and assuming a single failure in the

engineered safeguards, the core remains in place and intact. Radiation doses are not expected to

exceed the guidelines of 10 CFR 100.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily

unacceptable, the following analysis, in fact, shows that no violation of the DNB design basis

occurs for any rupture assuming the most reactive assembly stuck in its fully withdrawn position.

The following functions provide the necessary protection for a steam line rupture:

1. Safety injection system actuation from any of the following:

a. Two out of three low pressurizer pressure signals.

b. Two out of three high containment pressure signals.

c. Two out of three low steamline pressure signals in any steamline.

2. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal.

3. Redundant isolation of the main feedwater lines: Sustained high feedwater flow would cause additional cooldown. A safety injection signal will rapidly close all feedwater

control valves and main feedwater isolation valves, and trip the main feedwater pumps, condensate booster pumps, condensate demineralizer pump, and motor-operated

standby feedwater pump if operating.

4. Trip of the fast acting steam line stop valves (main steam isolation valves) (designed to close in less than 6 seconds) on:

a. Two out of four high-high containment pressure signals.

b. Two out of three low steamline pressure signals in any steamline.

c. Two out of three high negative steamline pressure rate signals in any steamline.

Fast-acting isolation valves are provided in each steam line that will fully close within 6 seconds

after a steamline isolation signal setpoint is reached. The time delay for actuation of the low

steamline pressure safety injection actuation signal, high negative steamline pressure rate

signal, high-high containment pressure signal, and manual block of the low steamline pressure

safety injection actuation signal must be within 2 seconds after initiation. This, along with the

main steam isolation time of approximately 6 seconds shall not exceed an 8 second total

response time for this action in the safety analysis for this event. For breaks downstream of the

isolation valves, closure of all valves would co mpletely terminate the blowdown. For any break, in any location, no more than one steam generator would blowdown even if one of the isolation

valves fails to close. A description of steam line isolation is included in Chapter 10.

WBN 15.4-33 Steam flow is measured by moni toring dynamic head in nozzles located in the throat of the steam generator. The effective throat area of the nozzles is 1.4 square feet, which is

considerably less than the main steam pipe and thus the nozzles also serve to limit the

maximum steam flow for a break at any location.

Table 15.4-6 lists the equipment required in the recovery from a high energy line rupture. Not

all equipment is required for any one particular break, since it will vary depending upon

postulated break location and details of initial conditions. Design criteria and methods of

protection of safety related equipment from the dy namic effects of postulated piping ruptures are provided in Section 3.6.

15.4.2.1.2 Analysis of Effects and Consequences

Method of Analysis

The analysis of the steam pipe rupture has been performed to determine:

1. The core heat flux and reactor coolant syst em temperature and pressure resulting from the cooldown following the steam line break. The LOFTRAN

[11] Code has been used.

2. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital computer code, VIPRE-01,[30] has been used to determine if the calculated DNBR occurs for the core conditions computed in Item 1 above.

The following conditions were assumed to exist at the time of a main steam line break accident.

1. End-of-life shut down margin at no load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks

during core burnup is restricted in such a way that addition of positive reactivity in a

steam line break accident will not lead to a more adverse condition than the case

analyzed.

2. The negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position: The variation of the coefficient with

temperature and pressure has been included. The k eff versus temperature at 1110 psi corresponding to the negative moderator temperature coefficient used is shown in Figure

15.2-40. The effect of power generation in the core on overall reactivity is shown in

Figure 15.4-9. The parameters used to determine the radioactivity releases for the

steamline break are given in Table 15.5-16.

WBN 15.4-34 The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain

average core properties for reactivity feedback calculations. Further, it was

conservatively assumed that the core power distribution was uniform. These two

conditions cause under prediction of the reactivity feedback in the high power region

near the stuck rod. To verify the conservatism of this method, the reactivity as well as

the power distribution was checked for the statepoints shown on Table 15.4-7. These

core analyses considered the Doppler reactivity from the high fuel temperature near the

stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution and non-uniform core inlet temperature effects. For cases in which

steam generation occurs in the high flux regions of the core, the effect of void formation

was also included. It was determined that the reactivity employed in the kinetics analysis

was always larger than the reactivity calculated including the above local effects for all

statepoints. The limiting statepoint is presented in Table 15.4-7. These results verified

conservatism, i.e., underproduction of negat ive reactivity feedback from power generation.

3. Minimum capability for injection of concentrated boric acid (which is bounding for higher boric acid concentrations) solution corresponding to the most restrictive single failure in

the safety injection system. The emergency core cooling system consists of three systems: 1) the passive accumulators (at 2400 ppm for Unit 1; at 1900 ppm for Unit 2),

2) the residual heat removal system, and 3) the safety injection system (at 2000ppm).

The actual modeling of the safety inject ion system in LOFTRAN is described in Reference [11] and reflects injection as a function of RCS pressure versus flow including

RCP seal injection, excluding centrifugal charging pump miniflow, and with no spilling

lines. This injection analysis result is bounded when using the minimum composite

pump curve (degraded by 5% of design head) as shown in Figure 6.3-4. This

corresponds to the flow delivered by one charging pump and one safety injection pump delivering its full flow to the cold leg header. No credit has been taken for the low

concentration borated water, which must be swept from the lines downstream of the

RWST prior to the delivery of concentrated boric acid to the reactor coolant loops.

For the cases where offsite power is assu med, the sequence of events in the safety injection system is the following. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the

appropriate valves begin to operate and the high head safety injection pump starts. In

27 seconds, the valves are assumed to be in their final position and the pump is

assumed to be at full speed. The volume containing the low concentration borated water

is swept, of course, before the 2000 ppm (which is bounding for higher boric acid

concentrations) reaches the core. This delay, described above is inherently included in

the modeling.

In cases where offsite power is not available, a 10-second delay is assumed to start the diesels and then begin loading the necessary safety injection equipment sequentially

onto the diesels. This assumption results in additional conservatism in the analysis, which adds the 10 seconds to the 27 seconds assumed for valve alignment in the offsite

power available case for a total of 37 seconds.

WBN 15.4-35 4. Design value of the steam generator heat transfer coefficient including allowance for fouling factor.

5. Since the steam generators are provided with integral flow restrictors with a 1.4 square foot throat area, any rupture with a break area greater than 1.4 square feet, regardless

of location would have the same effect on the Nuclear Steam Supply System (NSSS) as

the 1.4 square foot break. The following cases have been considered in determining the

core power and reactor coolant system transients:

a. Complete severance of a pipe, with the plant initially at no load conditions, full reactor coolant flow with offsite power available.

b. Case a above with loss of offsite power. Loss of offsite power results in coolant pump coastdown.

6. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet

temperatures are assumed to occur in the sector with the stuck rod. The power peaking

factors account for the effect of the local void in the region of the stuck control assembly

during the return to power phase following the steam line break.

The limiting statepoints for the two cases are presented in Table 15.4-7.

Both the cases above assume initial hot shutdown conditions at time zero since this represents the most limiting initial condition. Should the reactor be just critical or

operating at power at the time of a steam line break, the reactor will be tripped by the

normal overpower protection system when power level reaches a trip point. Following a trip at power the reactor coolant system contains more stored energy than at no load, the average coolant temperature is higher than at no load and there is appreciable

energy stored in the fuel. Thus, the additional stored energy is removed via the

cooldown caused by the steam line break before the no load conditions of RCS

temperature and shutdown margin assumed in the analyses are reached. After the

additional stored energy has been removed, the cooldown and reactivity insertions

proceed in the same manner as in the analysis which assumes no load condition at time

zero.

However, since the initial steam generator water inventory is greatest at no load, the magnitude and duration of the RCS cooldown are greater for steam line breaks

occurring from no load conditions.

7. In computing the steam flow duri ng a steam line break, the Moody Curve

[9] for fl/D = 0 is used.

8. For Unit 1, a steam generator tube plugging level of 0% is conservatively assumed. For Unit 2, a steam generator tube plugging level of 10% is assumed.

WBN 15.4-36 9. For Unit 1, a thermal design flowrate of 372,400 gpm is used which accounts for instrumentation uncertainty. For Unit 2, a thermal design flowrate of 372,400 gpm is

used which accounts for the 10% steam generator tube plugging level and

instrumentation uncertainty.

Results The results presented are a conservative indication of the events which would occur assuming a

steam line rupture since it is postulated that all of the conditions described above occur

simultaneously.

Core Power and RCS Transient

Figures 15.4-11a through 15.4-11c show the RCS transient and core response following a main

steam line rupture (complete severance of a pipe) at initial no load condition (Case a). Offsite power is assumed available so that full reactor coolant flow exists. The transient shown

assumes an uncontrolled steam release from only one steam generator. Should the core be

critical at near zero power when the rupture occurs the initiation of safety injection by low

steamline pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the fast acting isolation valves in the steam lines by high-high containment pressure or low steam line pressure signals. Even with the failure of one valve, release is limited by isolation valve closure for the other steam generators while the one

generator blows down. The main steamline isolation valves are designed to be fully closed in

less than 6 seconds from receipt of a closure signal.

For Unit 1, as shown in Figure 15.4-11a the core attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) shortly after boron solution at 2400 ppm (which is bounding for higher boric acid concentrations) enters the reactor coolant system from the accumulators. The safety injection system subsequently injects a 2000 ppm boron solution.

A peak core power less than the nominal full power value is attained.

For Unit 2, as shown in Figure 15.4-11a the core attains criticality with the RCCAs inserted (with

the design shutdown assuming one stuck RCCA) shortly after boron solution at 2000 ppm (which is bounding for higher boric acid concentrations) enters the reactor coolant system. A

peak core power less than the nominal full power value is attained.

The calculation assumes the boric acid is mixed with, and diluted by the water flowing in the

reactor coolant system prior to entering the reactor core. The concentration after mixing

depends upon the relative flow rates in the reactor coolant system and in the safety injection

system. The variation of mass flow rate in the reactor coolant system due to water density

changes is included in the calculation as is the variation of flow rate in the safety injection

system due to changes in the reactor coolant system pressure. The safety injection system flow

calculation includes the line losses in the system as well as the pump head curve.

WBN 15.4-37 It should be noted that the safety injection accumulators are actuated in Case (a) due to low

RCS pressure (Figure 15.4-11b). Once the accumulators actuate, 2400 ppm boron is delivered

to the core and the transient is terminated before a significant return to power is achieved.

Once the transient is terminated and the plant is stabilized, emergency operating procedures

may be followed to recover from the MSLB event.

For Unit 1, Figures 15.4-12a through 15.4-12c show the responses of the salient parameters for

Case (b) which corresponds to the case discussed above with additional loss of offsite power at

approximately the time of transient initiation. For Unit 2, Figures 15.4-12a through 15.4-12c

show the responses of the salient parameters for Case b which corresponds to the case

discussed above with additional loss of offsite power at the time the safety injection signal is

generated. The injection of borated water is conservatively delayed to 37 seconds based on the

assumed 10 second diesel generator delay time plus the 27 seconds associated with the valve

lineup for the offsite power available case (Case a). In this case criticality is achieved later and

the core power increase is slower than in the similar case with offsite power available. The

ability of the emptying steam generator to extrac t heat from the reactor coolant system is reduced by the decreased flow in the reactor coolant system. For both these cases the peak

power remains well below the nominal full power value.

Unlike Case (a), Case (b) does not result in the actuation of the safety injection accumulators.

Therefore, due to the fact that less boric acid solution is delivered to the core, Case (b) results

in a more limiting return to power than Case (a).

It should be noted that following a steam line break only one steam generator blows down

completely. Thus, the remaining steam generators are still available for dissipation of decay

heat after the initial transient is over. In the case of loss of offsite power this heat is removed to

the atmosphere via the steam line safety valves.

Following blowdown of the faulted steam generator, the plant can be brought to a stabilized hot standby condition through control of auxiliary feedwater flow and safety injection flow as

described by plant operating procedures. The operating procedures call for operator action to

limit RCS pressure and pressurizer level by terminating safety injection flow, and to control

steam generator level and RCS coolant temperatur e using the auxiliary feedwater system. Any action required of the operator to maintain the plant in a stabilized condition is in a time frame in

excess of ten minutes following safety injection actuation.

Margin to Critical Heat Flux

A DNB analysis was performed for the limiting case. The limiting statepoints are presented in

Table 15.4-7. It was found that all cases had a minimum DNBR greater than the limiting value.

15.4.2.1.3 Conclusions

The analysis shows that the criteria stated earlier in this section are satisfied. In addition, the

pressure differential across the steam generator tubes that has been calculated for a postulated

main feedwater line break is more limiting (i.e., dictates a minimum tube wall thickness) than the

pressure differential for a postulated main steam line break. Therefore, steam generator tube

rupture is not expected to occur (see Section 4.19.7.6 of Reference [34]).

WBN 15.4-38 Although DNB and possible clad perforation following a steam pipe rupture are not necessarily

unacceptable and not precluded in the criterion, the above analysis, in fact, shows that no

violation of the DNB design basis occurs for any rupture assuming the most reactive RCCA

stuck in its fully withdrawn position.

If it is assumed that there is leakage from the r eactor coolant system to the secondary system in the steam generators and that offsite power is lost following the steam line break, radioactivity

will be released to the atmosphere through the relief or safety valves. Environmental

consequences of a postulated steam line break are addressed in Section 15.5.4.

15.4.2.2 Major Rupture of a Main Feedwater Pipe

15.4.2.2.1 Identification of Causes and Accident Description

A major feedwater line rupture is defined as a break in a feedwater pipe large enough to prevent

the addition of sufficient feedwater to the steam generators to maintain shell-side fluid inventory

in the steam generators. If the break is postulated in a feedline between the check valve and

the steam generator, fluid from the steam generator may also be discharged through the break.

Further, a break in this location could preclude the subsequent addition of auxiliary feedwater to

the affected steam generator. (A break upstream of the feedline check valve would affect the

nuclear steam supply system only as a loss of normal feedwater.)

Depending upon the size of the break and the plant operating conditions at the time of the

break, the break could cause either a reactor coolant system cooldown (by excessive energy discharge through the break), or a reactor coolant system heatup. Potential reactor coolant

system cooldown resulting from a secondary pipe rupture is evaluated in Section 15.4.2.1.

Therefore, only the reactor coolant system heatup effects are evaluated for a feedline rupture.

A feedline rupture reduces the ability to remove heat generated by the core from the reactor

coolant system because of the following reasons:

1. Feedwater to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

2. Liquid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

3. The break may be large enough to prevent the addition of any main feedwater after trip.

An auxiliary feedwater system is provided to a ssure that adequate feedwater is available such that:

1. No substantial overpressurization of the reactor coolant system occurs; and

2. Liquid in the reactor coolant system is sufficient to cover the reactor core at all times.

WBN 15.4-39 The following provides the necessary protection for a main feedwater rupture:

1. A reactor trip on any of the following conditions:

a. High pressurizer pressure

b. Overtemperature T

c. Low-low steam generator water level in one or more steam generators

d. Safety injection signals from any of the following:

i) Low steamline pressure

ii) Low pressurizer pressure

iii) High containment pressure

2. An auxiliary feedwater system to provide an assured source of feedwater to the steam generators for decay heat removal.

15.4.2.2.2 Analysis of Effects and Consequences

The discussion of the analysis for a main feedwater break inside primary containment presented

below is based on a reactor trip generated by steam generator low-low water level. Evaluations

that were performed using the MONSTER

[37] Code show a high containment pressure signal is generated in less than 1.0 second. In the analysis presented below, steam generator level

decreases to its trip setpoint in 19.1 seconds for Unit 1 and 37.1 seconds for Unit 2. Thus, the

following analysis is conservative and is being retained although containment pressure is the

signal that will actually be used to generate a reactor trip for this event.

Method of Analysis

A detailed analysis using the LOFTRAN

[11] Code is performed in order to determine the plant transient following a feedline rupture. The code describes the plant thermal kinetics, reactor

coolant system including natural circulation, pressurizer, steam generators and feedwater system, and computes pertinent variables including the pressurizer pressure, pressurizer water

level, and reactor coolant average temperature.

WBN 15.4-40 Two cases are analyzed. One case assumes that offsite electrical power is maintained

throughout the transient. Another case assumes the loss of offsite electrical power at the time

of reactor trip, and RCS flow decreases to natural circulation. Both cases assume a double-

ended rupture of the largest feedwater pipe at full power. Major assumptions used in the

analysis are as follows:

1. For Unit 1, the unit is initially operating at a power level equivalent to 100.6% of the uprated NSSS power. For Unit 2, the unit is initially operating at full power including

applicable uncertainty.

2. Initial reactor coolant average temperature is 6.0ºF above the nominal value (bounds an instrument uncertainty of

+/-5ºF and instrument bias of -1ºF), and the initial pressurizer pressure is 50 psi below its nominal value (bounds an instrument uncertainty of

+/-50 psi and instrument bias of -20 psi).

3. The pressurizer power-operated relief valves and the safety relief valves are assumed to function. No credit is taken for pressurizer spray. For Unit 1, the initial pressurizer level

is at the nominal programmed value (62% of span) plus 8% uncertainty. For Unit 2, the

initial pressurizer level is at the nominal programmed value plus 8% uncertainty.

4. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

- High pressurizer pressure

- Overtemperature T - High pressurizer level

- High containment pressure

5. Main feedwater to all steam generators is assumed to stop at the time the break occurs (all main feedwater spills out through the break).

6. The initial blowdown quality from the affected steam generator is assumed to be 15%

due to effects as the inventory passes back through the preheater. At the time of reactor

trip, the frothing and oscillations within the steam generator are reduced and saturated

liquid (0% quality) is blown out the break until all the liquid is gone. Subsequent

blowdown, prior to the time of steamline isolation, is assumed to be saturated liquid

(100% quality).

7. For Unit 1, no credit is taken for the low-low water level trip on the affected steam generator until the steam generator level reaches the low-low steam generator water

level setpoint, assumed to be 0% of the narrow range span. This assumption minimizes

the steam generator fluid inventory at the time of trip, and thereby maximizes the

resultant heatup of the reactor coolant. For Unit 2, no credit is taken for the low-low

water level trip on the affected steam generator until the steam generator level reaches

0% of the narrow range span. This assumption minimizes the steam generator fluid

inventory at the time of trip, and thereby maximizes the resultant heatup of the reactor

coolant.

WBN 15.4-41 8. A double-ended break area of 1.118 ft 2 for Unit 1 and of 0.223 ft2 for Unit 2 is assumed.

9. No credit is taken for heat energy deposited in reactor coolant system metal during the RCS heatup.

10. No credit is taken for charging or letdown.

11. Steam generator heat transfer area is assumed to decrease as the shellside liquid inventory decreases.

12. The core residual heat generation is based on the 1979 version of ANS 5.1 [Ref. 33]

based upon long term operation at the initial power level. The decay of U-238 capture

products is included as an integral part of this expression.

13. The auxiliary feedwater is actuated by the low-low steam generator water level signal.

The analysis addresses either TDAFWP failure with and without offsite power or

MDAFWP failure with and without offsite power. The assumptions for the limiting case (MDAFWP failure) are as follows:

a. The motor driven pump which feeds two intact steam generators is assumed to fail.

b. After steamline isolation, all flow from all pumps is initially assumed "lost" to the faulted steam generator. After the faulted steam generator pressure drops below

360 psig, a valve automatically restrict s MD pump flow to the faulted steam

generator, thus allowing some delivery (assumed to be 60 gpm) to an intact loop.

c. Operator action to isolate the affected steam generator is assumed to occur no later than 12 minutes from the time of the first low steam generator level signal.

d. After isolation of the faulted steam generator, the TDAFWP supplies flow to the 3 remaining steam generators while the operating MD pump supplies flow to 1

steam generator.

A 60 second delay was assumed following the low-low steam generator water level signal to allow time for startup of the emergency diesel generators and the auxiliary

feedwater pumps.

14. Both maximum and minimum reactivity feedback cases are analyzed for both the TDAFWP and MDAFWP failure cases.

WBN 15.4-42 Results For Unit 1, the MDAFWP failure case with maximum reactivity feedback and without offsite

power available was found to be the limiting case, in addition the corresponding with offsite

power cases are presented herein.

Figures 15.4-13a, 15.4-13b, and 15.4-13c show the calculated plant parameters following a

feedline rupture for the case with offsite power. Figures 15.4-14a, 15.4-14b, and 15.4-14c show

the calculated plant parameters following a feedline rupture with loss of offsite power. The

calculated sequence of events for both cases analyzed is presented in Table 15.4-9.

For Unit 1, the system response following the feedwater line rupture is similar for both cases

analyzed. Results presented in the figures show that pressures in the RCS and main steam

system remain below 110% of the respective design pressures. Pressurizer pressure increases

until reactor trip occurs on low-low steam generator water level. Pressure then decreases, due

to the loss of heat input, until steamline isolation occurs. Coolant expansion occurs due to

reduced heat transfer capability in the steam generators. Addition of the safety injection flow

aids in cooling down the primary side and helps to ensure that sufficient fluid exists to keep the

core covered with water.

For Unit 2, the system response following the feedwater line rupture is similar for both cases

analyzed. Results presented in the figures show that pressures in the RCS and main steam

system remain below 110% of the respective design pressures. Pressurizer pressure increases

until reactor trip occurs on low-low steam generator water level. Pressure then decreases, due

to the loss of heat input, until steamline isolation occurs. Coolant expansion occurs due to

reduced heat transfer capability in the steam generators. The pressurizer relief valves open to

maintain primary pressure at an acceptable value. The calculated relief rates are within the

relief capacity of the pressurizer relief valves. Addition of the safety injection flow aids in cooling

down the primary side and helps to ensure that sufficient fluid exists to keep the core covered

with water.

The reactor core remains covered with water throughout the transient, and the auxiliary

feedwater system flow capacity is sufficient to preclude bulk boiling in the RCS throughout the

transient.

15.4.2.2.3 Conclusions

Results of the analysis show that for the postulated feedline rupture, the assumed auxiliary

feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the reactor coolant system, and to prevent the water level in the RCS from dropping to the top of the

core.

WBN 15.4-43 15.4.3 STEAM GENERATOR TUBE RUPTURE

15.4.3.1 Identification of Causes and Accident Description

The accident examined is the complete severance of a single steam generator tube. The

accident is assumed to take place at power with the reactor coolant contaminated with fission

products corresponding to continuous operation with a limited amount of defective fuel rods.

The accident leads to an increase in contamination of the secondary system due to leakage of

radioactive coolant from the reactor coolant system. In the event of a coincident loss of offsite

power, or failure of the condenser dump system, discharge of radioactivity to the atmosphere takes place via the steam generator power-operated relief valves (and safety valves if their

setpoint is reached).

The steam generator tube material is Alloy 690 in Unit 1 and Inconel-600 in Unit 2 and is a

highly ductile material; thus, it is considered that the assumption of a complete severance of a

tube is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is

subject to continual surveillance and an accumulation of minor leaks which exceed the limits

established in the Technical Specifications is not permitted during the unit operation.

The operator is expected to readily determine that a steam generator tube rupture (SGTR) has

occurred, identify and isolate the faulty steam generator on a restricted time scale in order to

complete the required recovery actions to stabilize the plant, minimize contamination of the

secondary system, and ensure termination of radioactive release to the atmosphere from the

faulty unit. The recovery procedure can be carried out on a time scale which ensures that break

flow to the secondary system is terminated before water level in the affected steam generator

rises into the main steam pipe. Sufficient indications and controls are provided to enable the

operator to carry out these functions satisfactorily.

Assuming normal operation of the various plant control systems, the following sequence of

events is initiated by a tube rupture:

1. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side there is a

steam flow/feedwater flow mismatch alarm as feedwater flow to the affected steam

generator is reduced due to the additional break flow which is now being supplied to that

steam generator from the primary side.

2. Continued loss of reactor coolant inventory leads to a reactor trip signal generated by low pressurizer pressure or by overtemperature T. Resultant plant cooldown following reactor trip leads to a rapid change of pressurizer level, and the safety injection signal, initiated by low-low pressurizer pressure, follows soon after the reactor trip. The safety

injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

3. The steam generator blowdown liquid monitor, the condenser vacuum exhaust radiation monitor and/or main steamline radiation monitor will alarm, indicating a sharp increase in

radioactivity in the secondary system. The steam generator blowdown liquid monitor will automatically terminate steam generator blowdown to the cooling tower and divert flow

to the condensate demineralizer.

WBN 15.4-44 4. The reactor trip automatically trips the turb ine and if offsite power is available the steam dump valves open permitting steam dump to the condenser. In the event of a coincident

Loss of Offsite Power (LOOP), the steam dum p valves would automatically close to protect the condenser. The steam generator pressure would rapidly increase resulting in

steam discharge to the atmosphere through the steam generator power operated relief

valves (and safety valves if their setpoint is reached).

5. Following reactor trip, the continued action of auxiliary feedwater supply and borated safety injection flow (supplied from the refueling water storage tank) provide a heat sink

which absorbs some of the decay heat. This reduces the amount of steam bypass to the

condenser, or in the case of loss of offsite power, steam relief to atmosphere.

6. Safety injection flow results in increasing RCS pressure and pressurizer water level, and the RCS pressure trends toward an equilibrium value where the safety injection flow rate

equals the break flow rate.

In the event of an SGTR, the plant operators must diagnose the event and perform the required

recovery actions to stabilize the plant and terminate the primary to secondary break flow. The

operator actions for SGTR recovery are provi ded in the plant Emergency Operating Procedures.

Operator actions are described below.

l. Identify the ruptured steam generator.

High secondary side activity, as indicated by the condenser vacuum exhaust radiation monitor, steam generator blowdown liquid monitor, or main steam line radiation monitor, typically will provide the first indication of an SGTR event. The ruptured steam generator can be identified by an unexpected increase in steam generator narrow range level, a

Radiation Protection survey, or a chemistry laboratory sample. For an SGTR that results

in a reactor trip at high power, the steam generator water level as indicated on the

narrow range scale will decrease significantly for all of the steam generators. The

auxiliary feedwater flow will begin to refill t he steam generators, distributing flow to each of the steam generators. Since primary to secondary break flow adds additional liquid

inventory to the ruptured steam generator, the water level will increase more rapidly than

normally expected in that steam generator.

This response, as displayed by the steam generator water level instrumentation, provides confirmation of an SGTR event and also

identifies the ruptured steam generator.

2. Isolate the ruptured steam generator from the intact steam generators and isolate feedwater to the ruptured steam generator.

Once the steam generator with a tube rupture has been identified, recovery actions begin by isolating steam flow from and stoppi ng feedwater flow to the ruptured steam generator. In addition to minimizing radiological releases, this also reduces the

possibility of overfilling the ruptured steam generator with water by l) minimizing the

accumulation of feedwater flow and 2) enabling the operator to establish a pressure

differential between the ruptured and intact steam generators as a necessary step

toward terminating primary to secondary break flow.

WBN 15.4-45 3. Cool down the RCS using the intact steam generators.

After isolation of the ruptured steam generator, the RCS is cooled as rapidly as possible to less than the saturation temperature corresponding to the ruptured steam generator

pressure by dumping steam from only the intact steam generators. This ensures adequate subcooling will exist in the RCS after depressurization of the RCS to the

ruptured steam generator pressure in subsequent actions. If offsite power is available, the normal steam dump system to the condenser can be used to perform this cooldown.

However, if offsite power is lost, the RCS is cooled using the steam generator power

operated relief valves to release steam from the intact steam generators.

4. Depressurize the RCS to restore reactor coolant inventory.

When the cooldown is completed, safety injection flow will increase RCS pressure until break flow matches safety injection flow. Consequently, safety injection flow must be

terminated to stop primary to secondary break flow. However, adequate reactor coolant

inventory must first be assured. This includes both sufficient reactor coolant subcooling

and pressurizer inventory to maintain a reliable pressurizer level indication after safety

injection flow is stopped. Since break flow from the primary side will continue after

safety injection flow is stopped until RCS and ruptured steam generator pressures

equalize, an "excess" amount of inventory is needed to ensure pressurizer level remains

on span. The "excess" amount required depends on RCS pressure and reduces to zero

when RCS pressure equals the pressure in the ruptured steam generator.

The RCS depressurization is performed using normal pressurizer spray if the RCPs are running. However, if offsite power is lost or the RCPs are not running for some other

reason, normal pressurizer spray is not available. In this event, RCS depressurization

can be performed using the pressurizer power operated relief valve or auxiliary pressurizer spray.

5. Terminate safety injection to stop primary to secondary break flow.

The previous actions will have established adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that safety injection flow is

no longer needed. When these actions have been completed, safety injection flow must

be stopped to terminate primary to secondary break flow. Primary to secondary break

flowwill continue after safety injection flow is stopped until RCS and ruptured steam

generator pressures equalize. Charging flow, letdown, and pressurizer heaters will then

be controlled to prevent repressurization of the RCS and reinitiation of break flowinto the

ruptured steam generator.

Following safety injection termination, the plant conditions will be stabilized, the primary to

secondary break flow will be terminated, and a ll immediate safety concerns will have been addressed. At this time a series of operator actions are performed to prepare the plant for

cooldown to cold shutdown conditions. Subsequently, actions are performed to cooldown and

depressurize the RCS to cold shutdown conditions and to depressurize the ruptured steam

generator.

WBN 15.4-46 15.4.3.2 Analysis of Effects and Consequences

An SGTR results in the transfer of contaminated reactor coolant into the secondary system and

subsequent release of a portion of the activity to the atmosphere. Therefore, an analysis must

be performed to assure that the offsite radiological consequences resulting from an SGTR are

within the allowable guidelines. One of the major concerns for an SGTR is the possibility of

steam generator overfill since this could potentially result in a significant increase in the offsite

radiological consequences. Therefore, an analysis was performed to demonstrate margin to

steam generator overfill, assuming the limiting single failure relative to overfill. The results of

this analysis demonstrated that there is margin to steam generator overfill for a design basis

SGTR for Watts Bar Units 1 and 2. A thermal and hydraulic analysis was also performed to

determine the input for the offsite radiological consequences analysis, assuming the limiting

single failure relative to offsite doses without steam generator overfill. Since steam generator

overfill does not occur, the results of this analysis represent the limiting case for the analysis of

the radiological consequences for an SGTR for Watts Bar. The results of the thermal and

hydraulic analysis for the offsite radiologica l consequences analysis are discussed as follows.

Thermal and Hydraulic Analysis

A thermal and hydraulic analysis has been performed to determine the plant response for a

design basis SGTR, and to determine the integrated primary to secondary break flow and the

mass releases from the ruptured and intact steam generators to the condenser and to the

atmosphere. This information has been used to calculate the quantity of radioactivity released

to the environment and the resulting radiological consequences.

The plant response following an SGTR was analyzed with the LOFTTR2 program until the

primary to secondary break flow is terminated.

The reactor protection system and the automatic actuation of the engineered safeguards systems were modeled in the analysis. The major

operator actions which are required to terminate the break flow for an SGTR were also

simulated in the analysis.

Analysis Assumptions

The accident modeled is a double-ended break of one steam generator tube located at the top

of the tube sheet on the outlet (cold leg) side of the steam generator. The time of reactor trip

was calculated by modeling the Watts Bar Units 1 and 2 reactor protection system. It was

assumed that the reactor is operating at full power at the time of the accident and the initial

secondary mass was assumed to correspond to operation at nominal steam generator mass, minus an allowance for uncertainties. It was also assumed that a loss of offsite power occurs at

the time of reactor trip and the highest worth control assembly was assumed to be stuck in its

fully withdrawn position at reactor trip.

WBN 15.4-47 The limiting single failure was assumed to be the failure of the power operated relief valve on

the ruptured steam generator. Failure of this valve in the open position will cause an

uncontrolled depressurization of the ruptured steam generator which will increase primary to

secondary break flowand the mass release to the atmosphere. It was assumed that the

ruptured steam generator power operated relief valve fails open when the ruptured steam

generator is isolated, and that the valve was subsequently isolated by locally closing the

associated block valve.

The major operator actions required for the recovery from an SGTR are discussed in Section

15.4.3.1 and these operator actions were simulated in the analysis. The operator action times

which were used for the analysis are presented in Table 15.4-20. It is noted that the power

operated relief valve on the ruptured steam generator was assumed to fail open at the time the

ruptured steam generator was isolated. Before proceeding with the recovery operations, the

failed open power operated relief valve was assumed to be isolated by locally closing the

associated block valve. It was assumed that the ruptured steam generator power operated

relief valve is isolated at 11.0 minutes after the valve was assumed to fail open. After the

ruptured steam generator power operated relief valve was isolated, the additional delay time of

7.15 minutes (Table 15.4-20) was assumed for the operator action time to initiate the RCS

cooldown.

Transient Description

The LOFTTR2 analysis results are described below. The sequence of events for this transient

is presented in Table 15.4-21.

Following the tube rupture, reactor coolant flows from the primary into the secondary side of the

ruptured steam generator since the primary pressure is greater than the steam generator

pressure. In response to this loss of reactor coolant, pressurizer level decreases as shown in

Figure 15.4-97a. The RCS pressure also decreases as shown in Figure 15.4-97b as the steam

bubble in the pressurizer expands. As the RCS pressure decreases due to the continued

primary to secondary break flow, automatic reactor trip occurs at approximately 172 seconds for

Unit 1 and 109 seconds for Unit 2 on an overtemperature T trip signal.

After reactor trip, core power rapidly decreases to decay heat levels. The turbine stop valves

close and steam flow to the turbine is term inated. The steam dump system is designed to

actuate following reactor trip to limit the increase in secondary pressure, but the steam dump

valves remain closed due to the loss of condenser vacuum resulting from the assumed loss of

offsite power at the time of reactor trip.

Thus, the energy transfer from the primary system causes the secondary side pressure to increase rapidly after reactor trip until the steam

generator power operated relief valves and (safety valves if their setpoints are reached) lift to

dissipate the energy, as shown in Figure 15.4-97c. The loss of offsite power at reactor trip

results in the termination of main feedwater and actuation of the auxiliary feedwater system. It was assumed that auxiliary feedwater flow is initiated to all steam generators at 60 seconds after reactor trip.

WBN 15.4-48 The RCS pressure and pressurizer level decrease more rapidly after reactor trip as energy

transfer to the secondary shrinks the reactor coolant and the leak flow continues to deplete

primary inventory. The decrease in RCS inventory results in a low pressurizer pressure SI

signal at approximately 310 seconds for Unit 1 and 155 seconds for Unit 2. After SI actuation, the RCS pressure and pressurizer level begin to increase and approach the equilibrium values

where the safety injection flow rate equals the break flow rate.

Since offsite power is assumed lost at reactor trip, the RCPs trip and a gradual transition to

natural circulation flow occurs. Immediately following reactor trip the temperature differential

across the core decreases as core power decays (see Figures 15.4-97d and 15.4-97e);

however, the temperature differential subsequently increases as the reactor coolant pumps coast down and natural circulation flow develops. The cold leg temperatures trend toward the

steam generator temperature as the fluid residence time in the tube region increases. The hot

leg temperatures reach a peak and then slowly decrease as steady state conditions are

reached until the ruptured steam generator is isolated and the power operated relief valve is

assumed to fail open.

Major Operator Actions

1. Identify and Isolate the Ruptured Steam Generator

Unit 1

Auxiliary feedwater to the ruptured steam generator is isolated at either 13.5 minutes after initiation of the SGTR or at 30% narrow range span (NRS), whichever time is

greater. Since the time to reach 30% NRS occurs first, auxiliary feedwater is isolated at

13.5 minutes. Steam release from the ruptured steam generator is assumed to be

isolated at either 15.0 minutes after the initiation of the SGTR or when the narrow range

level reaches 30%, whichever time is greater. Since the time to reach 30% narrow

range level is less than 15.0 minutes, it was assumed that the ruptured steam generator

is isolated at 15.0 minutes. The ruptured steam generator power operated relief valve is

also assumed to fail open at this time. The failure causes the ruptured steam generator

to rapidly depressurize as shown in Figure 15.4-97c which results in an increase in

primary to secondary break flow. The depressurization of the ruptured steam generator

increases the break flow and energy transfer from primary to secondary which results in

a decrease in the ruptured loop temperatures as shown in Figure 15.4-97e. The intact

steam generator loop temperatures also slowly decrease, as shown in Figure 15.4-97d

until the RCS cooldown is initiated. The shrinkage of the reactor coolant due to the

decrease in the RCS temperatures results in a decrease in the pressurizer level and

RCS pressure as shown in Figures 15.4-97a and 15.4-97b. When the depressurization

of the ruptured steam generator is terminated, the pressure begins to increase as shown

in Figure 15.4-97c.

WBN 15.4-49 Unit 2

The ruptured steam generator is assumed to be isolated at either 15 minutes after initiation of the SGTR or when the narrow range level reaches 30%, whichever time is

greater. Since the time to reach 30% narrow range is less than 15 minutes, it was

assumed that the ruptured steam generator is isolated at 15 minutes. The failure causes

the ruptured steam generator to rapidly depressurize as shown in Figure 15.4-97c which

results in an increase in primary to secondary break flow. The depressurization of the

ruptured steam generator increases the break flow and energy transfer from primary to secondary which results in a decrease in the ruptured loop temperatures as shown in

Figure 15.4-97e. The intact steam generator loop temperatures also slowly decrease, as

shown in Figure 15.4-97d until the RCS cooldown is initiated. The shrinkage of the

reactor coolant due to the decrease in the RCS temperatures results in a decrease in the

pressurizer level and RCS pressure as shown in Figures 15.4-97a and 15.4-97b. When

the depressurization of the ruptured steam generator is terminated, the pressure begins

to increase as shown in Figure 15.4-97c.

2. Cool Down the RCS to establish Subcooling Margin

After the block valve for the ruptured steam generator power operated relief valve is closed, there is a 7.15 minute operator action time assumed prior to initiation of

cooldown. The depressurization of the ruptured steam generator due to the failed-open

power operated relief valve affects the RCS cooldown target temperature since it is

determined based on the pressure at that time. Since offsite power is lost, the RCS is

cooled by dumping steam to the atmosphere using the intact steam generator power

operated relief valves. The cooldown is continued until RCS subcooling at the ruptured

steam generator pressure is 20ºF for Unit 1 and 65ºF for Unit 2 plus an allowance for

instrument uncertainty. Because of the lower pressure in the ruptured steam generator

when the cooldown is initiated, the associated temperature the RCS must be cooled to is

also lower which has the net effect of extending the time required for cooldown.

The reduction in the intact steam generator pressures required to accomplish the cooldown is shown in Figure 15.4-97c, and the effect of the cooldown on the RCS

temperature is shown in Figure 15.4-97d. The pressurizer level and RCS pressure also

decrease during this cooldown process due to shrinkage of the reactor coolant, as

shown in Figures 15-4-97a and 15.4-97b.

3. Depressurize RCS to Restore Inventory

After the RCS cooldown, a 2.45 minute operator action time is assumed prior to the RCS depressurization. The RCS is depressurized to assure adequate coolant inventory prior

to terminating safety injection flow. With the RCPs stopped, normal pressurizer spray is

not available and the RCS is depressurized by opening a pressurizer power operated

relief valve. The depressurization is initiated and continued until the criteria in the

emergency operating procedures are satisfied. The RCS depressurization reduces the

break flow as shown in Figure 15.4-97g and increases safety injection flow to refill the

pressurizer as shown in Figure 15.4-97a.

WBN 15.4-50 4. Terminate SI to Stop Primary to Secondary Break Flow

The previous actions establish adequate RCS subcooling, a secondary side heat sink, and sufficient reactor coolant inventory to ensure that safety injection flow is no longer

needed. When these actions have been completed, the safety injection flow must be

stopped to prevent repressurization of the RCS and to terminate primary to secondary

break flow. The safety injection flow is terminated at this time if the safety injection

termination criteria in the emergency operating procedures are satisfied.

After depressurization is completed, an operator action time of 4.07 minutes is assumed prior to initiation of safety injection termination. When termination requirements are

satisfied, actions proceed to close off the safety injection flow path. After safety injection

termination, the RCS pressure begins to decrease as shown in Figure 15.4-97b. The

intact steam generator power operated relief valves are opened to dump steam to

maintain the prescribed RCS temperature to ensure that subcooling is maintained.

When the power operated relief valves are opened, the increased energy transfer from

primary to secondary also aids in the depressurization of the RCS to the ruptured steam

generator pressure. The differential pressure between the RCS and the ruptured steam

generator is shown in Figure 15.4-97f. Figure 15.4-97g shows that the primary to

secondary break flow continues after the safety injection flow is stopped until the RCS

and ruptured steam generator pressures equalize.

The ruptured steam generator water volume for the transient is shown in Figure 15.4-97h. The mass of water in the ruptured steam generator is also shown as a function of

time in Figure 15.4-97i.

Mass Releases

The mass releases are determined for use in evaluating the site boundary and low population

zone radiation exposure. The steam releases from the ruptured and intact steam generators, the feedwater flows to the ruptured and intact steam generators, and primary to secondary

break flow into the ruptured steam generator are determined for the period from accident

initiation until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after the accident and from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident. The releases

for 0-2 hours are used to calculate the radiation doses at the site boundary for a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

exposure, and the releases for 0-8 hours are used to calculate the radiation doses at the low

population zone for the duration of the accident.

The operator actions for the SGTR recovery up to the termination of primary to secondary break

floware simulated in the LOFTTR2 analysis. Thus, the steam releases from the ruptured and

intact steam generators, the feedwater flows to the ruptured and intact steam generators, and

the primary to secondary break flowinto the ruptured steam generator are determined from the

LOFTTR2 results for the period from the initiation of the accident until the break flowis

terminated.

WBN 15.4-51 Following the termination of break flow, actions are taken to cooldown the plant to cold

shutdown conditions. The power operated relief valves for the intact steam generators can be

used to cool down the RCS to the RHR system operating temperature of 350ºF for Unit 1 and

375ºF for Unit 2, at the maximum allowable cooldown rate of 100ºF/hr. The steam releases and the feedwater flows for the intact steam generators for the period from break flowtermination

until two hours are then determined from a mass and energy balance using the calculated RCS

and intact steam generator conditions at the time of break flowtermination and at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. The

RCS cooldown is continued after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> until the RHR system in-service temperature of 350ºF

for Unit 1 and 375ºF for Unit 2 is reached.

Depressurization of the ruptured steam generator can be performed to the RHR in-service

pressure of 395 psia for Unit 1 and 414.7 psia for Unit 2 via steam release from the ruptured

steam generator power operated relief valve. The RCS pressure is also reduced concurrently

as the ruptured steam generator is depressurized. Therefore, the analysis assumes that the

continuation of the RCS cooldown and depressurization to RHR operating conditions are

completed within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident since there is ample time to complete the operations

during this time period. The steam releases and feedwater flows from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> are then

determined for the intact and ruptured steam generators from a mass and energy balance using

the conditions at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and at the RHR system in-service conditions.

After 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, plant cooldown to cold shutdown as well as long-term cooling can be provided by

the RHR system. Therefore, the steam releases to the atmosphere are terminated after RHR

cut-in, assumed to be reached at 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

For the time period from initiation of the accident until break flow termination, the releases are

determined from the LOFTTR2 results for the time prior to reactor trip and following reactor trip.

Since the condenser is in service until reactor trip, any radioactivity released to the atmosphere

prior to reactor trip would be through the condenser vacuum exhaust. After reactor trip, the

releases to the atmosphere are assumed to be via the steam generator power operated relief

valves. The mass release rates to the atmosphere from the LOFTTR2 analysis are presented in

Figure 15.4-97j and 15.4-97k for the ruptured and intact steam generators, respectively, for the

time period until break flow termination. The mass releases calculated from the time of leakage

termination until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and from 2-8 hours were also assumed to be released to the

atmosphere via the steam generator power operated relief valves. The mass releases for the

SGTR event for the 0-2 hour and 2-8 hour time intervals considered are presented in Table

15.4-22.

In addition to the mass releases, information is developed for use in performing the offsite

radiation dose analysis. The time dependent fraction of rupture flow that flashes to steam and

is assumed to be immediately released to the environment is presented in Figure 15.4-97e. The

break flow flashing fraction is conservatively calculated assuming that 100% of the break flow comes from the hot leg side of the steam generator, whereas the break flow actually comes

from both the hot leg and cold leg sides of the steam generator. The water above the steam

generator tubes reduces the iodine content of the atmospheric release by scrubbing the steam

bubbles as they rise from the rupture to the water surface. However, if partial tube uncovery

were to occur, the increase in iodine release would be negligible. This result for tube uncovery

is described in References [39] and [40]. Reference [41] provides NRC approval of References

[39] and [40] and states that no further evaluation of steam generator tube uncovery is required.

WBN 15.4-52 15.4.3.3 Conclusions

A steam generator tube rupture will cause no s ubsequent damage to the reactor coolant system or the reactor core. An orderly recovery from the accident can be completed even assuming

simultaneous loss of offsite power. The results of the thermal and hydraulic analysis are used

to evaluate the environmental consequences of the postulated SGTR. The results of the

environmental consequences analysis are presented in Section 15.5.5.

15.4.4 SINGLE REACTOR COOLANT PUMP LOCKED ROTOR

15.4.4.1 Identification of Causes and Accident Description

The accident postulated is an instantaneous seizure of a reactor coolant pump rotor such as is

discussed in Section 5.5.1.3.5.

Flow through the affected reactor coolant loop is rapidly reduced, leading to initiation of a

reactor trip on a low flow signal.

Following initiation of the reactor trip heat stored in the fuel rods continues to be transferred to

the coolant causing the coolant to expand. At the same time, heat transfer to the shell side of

the steam generators is reduced, first because the reduced flow results in a decreased tube

side film coefficient and then because the reactor coolant in the tubes cools down while the

shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The

rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the

steam generators causes an insurge into the pressurizer and a pressure increase throughout

the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the

pressurizer safety valves, in that sequence. The two power-operated relief valves are designed

for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect as well as the pressure reducing effect of the

spray is not included in the analysis.

The consequences of a locked rotor are very similar to those of a pump shaft break. The initial

rate of reduction of coolant flow is greater for the locked rotor event. However, with a failed

shaft, the impeller could conceivably be free to spin in the reverse direction as opposed to being

fixed in position as assumed for a locked rotor. The effect of such reverse spinning is a slight

decrease in the endpoint (steady-state) core flow when compared to the locked rotor. Only one

analysis is performed, representing the most limiting condition for the locked rotor and pump

shaft break accidents.

WBN 15.4-53 15.4.4.2 Analysis of Effects and Consequences

Method of Analysis

Two digital-computer codes are used to analyze this transient. The LOFTRAN

[11] Code is used to calculate the resulting loop and core flow transient following the pump seizure, the time of

reactor trip, based on the loop flow transients, the nuclear power following reactor trip, and the

reactor coolant system peak pressure. The thermal behavior of the fuel located at the core hot

spot is investigated using the FACTRAN

[12] Code, using the core flow and the nuclear power calculated by LOFTRAN. The FACTRAN Code includes a film boiling heat transfer coefficient.

One reactor coolant pump seizure has been analyzed for a locked rotor/shaft break with four

loops in operation.

The accident is evaluated without offsite power available. For the evaluation, power is assumed

to be lost to the unaffected pumps instantaneously after reactor trip. At the beginning of the

postulated locked rotor accident, i.e., at the time the shaft in one of the reactor coolant pumps in

assumed to seize, the plant is assumed to be in operation under the most adverse steady-state

operating conditions, i.e., maximum steady-state power level, maximum steady-state pressure, and maximum steady-state coolant average temperature.

When the peak pressure is evaluated, the initial pressure is conservatively estimated as 70 psi

above nominal pressure (2250 psia) to allow for errors in the pressurizer pressure measurement

and control channels. This is done to obtain the highest possible rise in the coolant pressure

during the transient. To obtain the maximum pressure in the primary side, conservatively high

loop pressure drops are added to the calculated pressurizer pressure. The pressure response

shown in Figure 15.4-15 is at the point in the reactor coolant system having the maximum

pressure.

Evaluation of the Pressure Transient

After pump seizure, the neutron flux is rapidly reduced by control rod insertion effect. Rod

motion is assumed to begin 1.2 seconds after the flow in the affected loop reaches 87% to

nominal flow. No credit is taken for the pressure reducing effect of the pressurizer relief valves, pressurizer spray, steam dump or controlled feedwater flow after plant trip.

Although these systems are expected to function and would result in a lower peak pressure, an

additional degree of conservatism is provided by ignoring their effect.

The pressurizer safety valves are full open at 2580 psia and their capacity for steam relief is as

described in Section 5.2.2.

WBN 15.4-54 Evaluation of DNB in the Core During the Accident

For this accident, DNB is assumed to occur in the core and, therefore, an evaluation of the

consequences with respect to fuel rod thermal transients is performed. Results obtained from

analysis of the 'hot spot' condition represent the upper limit with respect to clad temperature and

zirconium water reaction.

Film Boiling Coefficient

The film boiling coefficient is calculated in the FACTRAN Code using the

Bishop-Sandberg-Tong film boiling correlation

[19]. The fluid properties are evaluated at film temperature (average between wall and bulk temperatures).

The program calculates the film coefficient at every time step based upon the actual heat

transfer conditions at the time. The neutron flux, system pressure, bulk density and mass flow

rate as a function of time are used as program input.

For this analysis, the initial values of the pressure and the bulk density are used throughout the

transient since they are the most conservative with respect to clad temperature response. For

conservatism, DNB was assumed to start at the beginning of the accident.

Fuel Clad Gap Coefficient

The magnitude and time dependence of the heat transfer coefficient between fuel and clad (gap

coefficient) has a presounded influence on the thermal results. The larger the value of the gap

coefficient, the more heat is transferred between pellet and clad. Based on investigations on the

effect of the gap coefficient upon the maximum clad temperature during the transient, the gap

coefficient was assumed to increase from a steady state value consistent with initial fuel

temperature to 10,000 BTU/hr-ft 2-ºF at the initiation of the transient. Thus the large amount of energy stored in the fuel because of the small initial value is released to the clad at the initiation

of the transient.

Zirconium Steam Reaction

The zirconium-steam reaction can become signifi cant above 1800 ºF (clad temperature). The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium

steam reaction.

T1.986 45,500 exp- 10 x 33.3 =

dt)w d(6 2 WBN 15.4-55 where:

w = amount reacted, mg/cm 2 t = time, sec T = temperature, ºK The reaction heat is 1510 cal/gm

Results The calculated sequence of events is shown on Table 15.4-1. The transient results without

offsite power available are shown in Figures 15.4-14a through 15.4-14c. The peak reactor

coolant system pressure reached during the transient is less than that which would cause

stresses to exceed the faulted condition stress limits. Also, the peak clad surface temperature

is considerable less than 2700 ºF. It should be noted that the clad temperature was

conservatively calculated assuming that DNB occurs at the initiation of the transient. The

results of these calculations (peak pressure, peak clad temperature, and zirconium-steam

reaction) are also summarized in Table 15.4-10.

15.4.4.3 Conclusions

1. Since the peak reactor coolant system pressure reached during any of the transients is less than that which cause stresses to exceed the faulted condition stress limits, the

integrity of the primary coolant system is not endangered.

2. Since the peak clad surface temperature calculated for the hot spot during the worst transient remains considerably less than 2700ºF, and the amount of zirconium-water

reaction is small, the core will remain in place and intact with no consequential loss of core

cooling capability.

15.4.5 FUEL HANDLING ACCIDENT

15.4.5.1 Identification of Causes and Accident Description

The accident is defined as dropping of a spent fuel assembly onto the fuel storage area floor

resulting in the rupture of the cladding of all the fuel rods in the assembly despite many

administrative controls and physical limitati ons imposed on fuel handling operations. Dropping a fuel assembly in the spent fuel pool has been analyzed and will not result in criticality.

[43]

15.4.5.2 Analysis of Effects and Consequences

For the analyses and consequences of the postulated fuel handling accident, refer to Section

15.5.6.

WBN 15.4-56 15.4.6 RUPTURE OF A CONTROL ROD DRIVE MECHANISM HOUSING (ROD CLUSTER CONTROL ASSEMBLY EJECTION)

15.4.6.1 Identification of Causes and Accident Description

This accident is defined as the mechanical failure of a control rod mechanism pressure housing

resulting in the ejection of a rod cluster control assembly (RCCA) and drive shaft. The

consequence of this mechanical failure is a rapid positive reactivity insertion together with an

adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.6.1.1 Design Precautions and Protection

Certain features in Westinghouse pressurized water reactors are intended to preclude the

possibility of a rod ejection accident, or to limit the consequences if the accident were to occur.

These include a sound, conservative mechanical design of the rod housings, together with a

thorough quality control (testing) program during assembly, and a nuclear design which lessens

the potential ejection worth of RCCAs and minimizes the number of assemblies inserted at high

power levels.

Mechanical Design

The mechanical design is discussed in Section 4.2. Mechanical design and quality control

procedures intended to preclude the possibility of a RCCA drive mechanism housing failure are

listed below:

1. Each full length control rod drive mechanism housing was completely assembled and shop tested at 4100 psi.

2. The mechanism housings were individually hydrotested after being attached to the head adapters in the reactor vessel head, and checked during the hydrotest of the completed

reactor coolant system.

3. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops. Moments by the design

earthquake are acceptable within the allowable primary working stress range specified

by the ASME Code,Section III, for Class 1 components.

4. The latch mechanism housing and rod travel housing are each a single length of forged Type-304 stainless steel. This material exhibits excellent notch toughness at all

temperatures which will be encountered.

WBN 15.4-57 A significant margin of strength in the elastic range together with the large energy absorption

capability in the plastic range gives additional assurance that gross failure of the housing will not

occur. The joints between the latch mechanism housing and head adapter, and between the

latch mechanism housing and rod travel housing, are threaded joints reinforced by canopy type rod welds. Administrative regulations require periodic inspections of these (and other) welds.

Nuclear Design

Even if a rupture of a RCCA drive mechanism housing is postulated, the operation of a plant

utilizing chemical shim is such that the severi ty of an ejected RCCA is inherently limited. In general, the reactor is operated by compensating for fuel depletion and xenon oscillations with

changes to the boron concentration. Typically the control rods are not deeply inserted. Further, the location and grouping of control RCCA banks are selected during the nuclear design to

lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its

normal position during full power operation, a less severe reactivity excursion could be expected

to occur.

However, it may be occasionally desirable to operate with larger than normal insertions. For

this reason, a rod insertion limit is defined as a function of power level. Operation with the

RCCAs above this limit guarantees adequate shutdown capability and acceptable power

distribution. The position of all RCCAs is continuously indicated in the control room. An alarm

will occur if a bank of RCCAs approaches its insertion limit or if one RCCA deviates from its

bank. Operating instruction requirements are as specified in Technical Specifications 3.1.5, 3.1.6 and 3.1.7.

Reactor Protection

The reactor protection in the event of a rod ejection accident has been described in Reference

[14]. The protection for this accident is provided by high neutron flux trip (high and low setting)

and high rate of neutron flux increase trip. These protection functions are described in detail in

Section 7.2.

Effects on Adjacent Housings

Disregarding the remote possibility of the occurrence of a RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential

cracking would not cause damage to adjacent housings leading to an increase in severity of the

initial accident.

WBN 15.4-58 Effects of Rod Travel Housing Longitudinal Failures

If a longitudinal failure of the rod travel housing should occur, the region of the position indicator

assembly opposite the break would be stressed by the reactor coolant pressure of 2250 psia.

The most probable leakage path would be provided by the radial deformation of the position

indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the steel tube.

If failure of the position indicator coil assembly should occur, the resulting free radial jet from the

failed housing could cause it to bend and contact adjacent rod housings. If the adjacent

housings were on the periphery, they might bend outward from their bases. The housing

material is quite ductile; plastic hinging without cracking would be expected. Housings adjacent

to a failed housing, in locations other than the periphery, would not be bent because of the

rigidity of multiple adjacent housings.

Effect of Rod Travel Housing Circumferential Failures

If circumferential failure of a rod travel housing should occur, the broken-off section of the

housing would be ejected vertically because the driving force is vertical and the position

indicator coil stack assembly and the drive shaft would tend to guide the broken-off piece

upwards during its travel. Travel is limited by t he missile shield, thereby limiting the projectile acceleration. When the projectile reached the missile shield it would partially penetrate the

shield and dissipate its kinetic energy. The water jet from the break would continue to push the

broken-off piece against the missile shield.

If the broken-off piece of the rod travel housing were short enough to clear the break when fully

ejected, it would rebound after impact with the missile shield. The top end plates of the position

indicator coil stack assemblies would prevent the br oken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to

occur, the low kinetic energy of the rebounding projectile would not be expected to cause

significant damage.

Possible Consequences

From the above discussion, the probability of damage to an adjacent housing must be

considered remote. However, even if damage is postulated, it would not be expected to lead to

a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control

rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical.

Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip

signal; however, this is already taken into account in the analysis by assuming a stuck rod

adjacent to the ejected rod.

WBN 15.4-59 Summary The considerations given above lead to the conclusion that failure of a control rod housing, due

either to longitudinal or circumferential cracking, would not cause damage to adjacent housings

that would increase severity of the initial accident.

15.4.6.1.2 Limiting Criteria

Due to the extremely low probability of a RCCA ejection accident, some fuel damage could be

considered an acceptable consequence.

Comprehensive studies of the threshold of fuel failure and of the threshold of significant

conversion of the fuel thermal energy to mechanical energy, have been carried out as part of

the SPERT project by the Idaho Nuclear Corporation

[15]. Extensive tests of UO 2 zirconium clad fuel rods representative of those in pressu rized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different

design have exhibited failures as low as 225 cal/gm. These results differ significantly from the

TREAT[13] results, which indicated that this threshold decreases by about 10% with fuel burnup.

The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for

irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This

ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for

irradiated rods; catastrophic failure, (large fuel dispersal, large pressure rise) even for irradiated

rods, did not occur below 300 cal/gm.

In view of the above experimental results, criteria are applied to ensure that there is little or no

possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These

criteria are:

1. Average fuel pellet enthalpy at the hot spot to be below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.

2. Peak reactor coolant pressure less than that which would cause stresses to exceed the faulted condition stress limits. This criteria is generically addressed in Reference [16].

3. Fuel melting will be limited to less than the innermost 10% of the fuel pellet at the hot spot even if the average fuel pellet enthalpy at the hot spot is below the limits of criterion

1 above.

It should be noted that the UFSAR included an additional criterion that the average clad

temperature at the hot spot must remain below 3000ºF. The elimination of this criterion as a

basis for evaluating the RCCA Ejection accident results is consistent with the revised

Westinghouse acceptance criteria for this event.

[48]

WBN 15.4-60 15.4.6.2 Analysis of Effects and Consequences

Method of Analysis

The calculation of the RCCA ejection transient is performed in two stages: first an average core

channel calculation and then a hot region calculation. The average core calculation is performed

using spatial neutron kinetics methods to determine the average power generation with time

including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity.

Enthalpy and temperature transients in the hot spot are then determined by multiplying the

average core energy generation by the hot channel factor and performing a fuel rod transient

heat transfer calculation. The power distribution calculated without feedback is pessimistically

assumed to persist throughout the transient.

A detailed discussion of the method of analysis can be found in Reference [16].

Average Core Analysis

The spatial kinetics computer code, TWINKLE

[17], is used for the average core transient analysis. The computer code includes a detailed multiregion, transient fuel-clad-coolant heat

transfer model for calculation of pointwise Doppler and moderator feedback affects. In this

analysis, the code is used as a one dimensional axial kinetics code since it allows a more

realistic representation of the spatial effects of axial moderator feedback and RCCA movement

and the elimination of axial feedback weighting factors. However, since the radial dimension is

missing, it is still necessary to employ very conservative methods (described below) of

calculating the ejected rod worth and hot channel factor. Further description of TWINKLE

appears in Section 15.1.9.

Hot Spot Analysis

In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel

factor. During the transient, the heat flux hot channel factor is linearly increased to the transient

value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that

the hot spot before and after ejection are coincident. This is very conservative since the peak

after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection

the power in this region will necessarily be depressed.

The hot spot analysis is performed using the detailed fuel and clad transient heat transfer

computer code, FACTRAN

[12]. This computer code calculates the transient temperature distribution in a cross-section of a metal clad UO 2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The

zirconium-water reaction is explicitly represent ed, and all material properties are represented as functions of temperature. A parabolic radial power distribution is used within the fuel rod.

WBN 15.4-61 FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer

before DNB, and the Bishop-Sandburg-Tong correlation

[19] to determine the film boiling coefficient after DNB. The DNB heat flux is not calculated; instead the code is forced into DNB

by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated

by the code; however, it is adjusted in order to force the full-power, steady-state temperature distribution to agree with the fuel heat transfer design codes presently in use by Westinghouse.

Further description of FACTRAN appears in Section 15.1.9.

System Overpressure Analysis

Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood

of fuel dispersal into the coolant. The pressure surge may, therefore, be calculated on the basis

of conventional heat transfer from the fuel and prompt heat generation in the coolant.

The pressure surge is calculated by first performing the fuel heat transfer calculation to

determine the average and hot spot heat flux versus time. Using this heat flux data, a thermal

hydrauliccalculation is conducted to determine the volume surge. Finally, the volume surge is

simulated in a plant transient computer code. This code calculates the pressure transient taking

into account fluid transport in the reactor coolant system and heat transfer to the steam

generators. No credit is taken for the possible pressure reduction caused by the assumed

failure of the control rod pressure housing.

Calculation of Basic Parameters

Input parameters for the analysis are conservatively selected on the basis of values calculated

for this type of core. The more important parameters are discussed below. Table 15.4-12

presents the parameters used in this analysis.

The system overpressure is generically addressed in Reference [16].

Ejected Rod Worths and Hot Channel Factors

The values for ejected rod worths and hot channel factors are calculated using either three

dimensional static methods or by synthes is method employing one-dimensional and two-dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is

taken for the flux flattening effects of reactivity feedback. The calculation is performed for the

maximum allowed bank insertion at a given power level, as determined by the rod insertion

limits. Adverse xenon distributions and part length rod positions are considered in the

calculation.

Appropriate margins are added to the ejected rod worth and hot channel factors to account for

any calculational uncertainties.

WBN 15.4-62 Reactivity Feedback Weighting Factors

The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels

where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that

indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution, and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting

factors determined. These weighting factors take the form of multipliers which when applied to

single channel feedbacks correct them to effective whole core feedbacks for the appropriate flux

shape. In this analysis, since a one dimensional (axial) spatial kinetics method is employed, the

axial weighting is not necessary. In addition, no weighting factor is applied to the transient fuel

temperature to obtain an effective fuel temperature as a function of time accounting for the missing

spatial dimension. These weighting factors have also been shown to be conservative compared

to three-dimensional analysis.

[16]

Moderator and Doppler Coefficient

The critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the nuclear

code in order to obtain moderator temperature coefficients which are conservative compared to

actual design conditions for the plant. For exampl e, a positive moderator temperature coefficient (PMTC) of +5 pcm/ºF was applied to both beginning-of-life rod ejection cases, although a PMTC is

precluded by the plant Technical Specifications at hot full power conditions. As discussed above, no weighting factor is applied to these results.

The Doppler reactivity defect is determined as a function of power level using a one-dimensional, steady-state computer code with a Doppler weighting factor of 1.0. The resulting curve is

conservative compared to design predictions for this plant. The Doppler weighting factor should

be larger than 1.0 just to make the present calculation agree with design predictions before

ejection. This weighting factor will increase under accident conditions, as discussed above.

Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction eff typically yield values no less than 0.70% at beginning-of-life and 0.50% at end-of-life for the first cycle. The accident is sensitive to if the ejected rod worth is equal to or greater than as in zero power transients. In order to allow for future cycles, conservative estimates of of 0.48% at beginning-of-cycle and 0.44% at end-of-cycle were used in the analysis.

WBN 15.4-63 Trip Reactivity Insertion

The trip reactivity insertion assumed is given in Table 15.4-12 and includes the effect of one stuck

RCCA. These values are reduced by the ejected rod reactivity. The shutdown reactivity was

simulated by dropping a rod of the required worth into the core. The start of rod motion occurred

0.5 seconds

after the high neutron flux trip point was reached. This delay is assumed to consist of

0.2 seconds

for the instrument channel to produce a signal, 0.15 seconds for the trip breaker to

open and 0.15 seconds for the coil to release the rods. A curve of trip rod insertion versus time

was used which assumed that insertion to the dashpot does not occur until 2.7 seconds after the

start of fall. The choice of such a conservative insertion rate means that there is over 1 second

after the trip setpoint is reached before significant shutdown reactivity is inserted into the core.

This is a particularly important conservatism for a full-power accident. For Unit 1, the rod ejection

transient was evaluated using the thermal design flow rate based on 10% steam generator tube

plugging. For Unit 2, the rod ejection transient was evaluated using the thermal design flowrate.

For Unit 1, the minimum design shutdown margin available for this plant at HZP may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, and adverse xenon distribution and positioning of the part-length rods, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an additional 1% k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

For Unit 2, the minimum design shutdown margin available for this plant at HZP may be reached

only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown by about an

additional 1% k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Depressurization calculations have been performed for a typical four-loop plant assuming the maximum possible size break (2.75 inch diameter) located in the reactor pressure vessel head.

The results show a rapid pressure drop and a decrease in system water mass due to the break.

The safety injection system is actuated on low pressurizer pressure within one minute after the break. The reactor coolant system pressure continues to drop and reaches saturation (1100 to 1300 psi depending on the system temperature) in about two to three minutes. Due to the large thermal inertia of the primary and secondary system, there has been no significant decrease in the reactor coolant system temperature below no-load by this time, and the depressurization itself has caused an increase in shutdown margin by about 0.2% k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated safety injection flow starting one minute after the break is

much more than sufficient to ensure that the core remains subcritical during the cooldown.

Results Cases are presented for both beginning and end-of-life at zero and full power.

WBN 15.4-64 In the full-power cases, Control Bank D was assumed to be inserted to its insertion limit. In the

zero-power cases, Control Bank D was assumed to be fully inserted, and Control Banks B and C

were assumed to be at their insertion limits.

The results for these cases are summarized in Table 15.4-12. In all cases the maximum fuel

pellet average enthalpy is well below that which could cause sudden cladding failure, the

maximum clad average temperature is below the point of clad embrittlement, and fuel melting, if

any, is limited to less than 10% of the fuel cross-section at the hot spot.

The nuclear power and hot spot fuel and clad temperature transients for the worst cases (beginning-of-life full power and end-of-life zero power) are presented in Figures 15.4-24 through

15.4-27.

Fission Product Release

It is assumed that fission products are released from the gaps of all rods entering DNB. In all

cases considered, less than 10% of the rods entered DNB based on a detailed three-dimensional

THINC analysis.

[16] Although limited fuel melting at the hot spot was predicted for the full power cases, in practice melting is not expected since the analysis conservatively assumed that the hot

spots before and after ejection were coincident.

Pressure Surge

A detailed calculation of the pressure surge for an ejection worth 1 dollar at beginning-of-life, hot

full power, indicates that the peak pressure does not exceed that which would cause the faulted

condition stress limits to be exceeded.

[16] Since the severity of the present analysis does not exceed this "worst case" analysis, the accident for this plant will not result in an excessive

pressure rise or further damage to the reactor coolant system.

Lattice Deformations

A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to

move in the vertical direction, differential expansion between separate rods cannot produce

distortion. However, the temperature gradients across individual rods may produce a differential

expansion tending to bow the midpoint of the rods toward the hotter side of the rod. Calculations

have indicated that this bowing would result in a negative reactivity effect at the hot spot since

Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation

at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be

observed.

WBN 15.4-65 In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than

sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow

away from that region. However, the heat from t he fuel is released to the water relatively slowly, and it is considered inconceivable that cross-flow will be sufficient to produce significant lattice

forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically

postulated, the large void fraction in the hot spot region would produce a reduction in this ratio at

the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no

conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

15.4.6.3 Conclusions

Even on a worst-case basis, the analyses indicate that the described fuel and clad limits are not

exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since

the peak pressure does not exceed that which would cause stresses to exceed the faulted

condition stress limits, it is concluded that there is no danger of further, consequential damage to

the reactor coolant system. The Reference [16]

analyses have demonstrated that the number of fuel rods entering DNB amounts to less than 10%, thus satisfactorily limiting fission product

release.

The environmental consequences of this accident is bounded by the loss of coolant accident. See

Section 15.5.3, "Environmental Consequences of a Loss of Coolant Accident." The reactor

coolant system integrated break flow to containment following a rod ejection accident is shown in

Figure 15.4-28.

Following reactor trip, requirements for operator action and protection system operation are similar to those presented in the analysis of a small loss of coolant event described in Section 15.3.1.

REFERENCES

1. Bordelon, F. M., Massie, H. W., and Zordan, T. A., "Westinghouse ECCS Evaluation Model - Summary," WCAP-8339 (Nonproprietary), July 1974. (Unit 1 only)

2. Deleted by UFSAR Amendment 2.

3. Deleted by UFSAR Amendment 2.

4. Deleted by UFSAR Amendment 2

5a. Hsieh, T., and Raymund, M., "Long Term Ice Condenser Transient Analysis (LOTIC Code)," WCAP-8355-A, Supplement 1, April 1976 and WCAP-8354-P-A, Supplement 1 (Proprietary), April 1976. (Unit 1 only)

5b. Hsieh, T., and Raymund, M., "Long Term Ice Condenser Transient Analysis (LOTIC II)," WCAP-8355 Supplement 1, May 1975 and WCAP-8354 (Proprietary), July 1974. (Unit 2

only)

6. Deleted by UFSAR Amendment 2.

WBN 15.4-66 7. Deleted in initial UFSAR.

8. Deleted in initial UFSAR.

9. Moody, F. S., "Transactions of the ASME, Journal of Heat Transfer," Figure 3, Page 134, February 1965. (Units 1 and 2)

10. Deleted in initial UFSAR.

11. Burnett, T. W. T., et. al., "LOFTRAN Code Description," WCAP-7907-P-A (proprietary) and WCAP-7907-A (non-proprietary), April 1984. (Units 1 and 2)

12. Hunin, C., "FACTRAN, A FORTRAN IV Code for Thermal Transients in a UO 2 Fuel Rod," WCAP-7908, July 1972. (Units 1 and 2)

13. Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO 2-Core Simulated Fuel Elements," ANL-7225, January - June 1966, p. 177, November 1966.

(Units 1 and 2)

14. Burnett, T. W. T, "Reactor Protection System Diversity in Westinghouse Pressurized Water Reactors," WCAP-7306, April 1969. (Units 1 and 2)

15. Taxelius, T. G., "Annual Report - Spert Project, October 1968, September 1968," Idaho Nuclear Corporation IN-1370, June 1970. (Units 1 and 2)

16. Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Revision

1-A, January 1975. (Units 1 and 2)

17. Barry, R. F., and Risher, D. H., Jr., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A, January 1975 (Proprietary) and WCAP-8208-A, January 1975 (Non-Proprietary). (Units 1 and 2)

18. Deleted in initial UFSAR.

19. Bishop, A. A., et al., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965. (Units 1 and 2)

20. Anderson, F. D., et al., "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, March 1962. (Unit 1)

21. Branch Technical Position CSB 6-2, "Control of Combustible Gas Concentrations in Containment Following a Loss-of Coolant Accident." (Unit 1)

22. Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for July - August 1968," ORNL-TM-2368, November 1968. (Unit 1)

WBN 15.4-67 23. Cottrell, W. B., "ORNL Nuclear Safety Research and Development Program Bi-Monthly Report for September - October 1968," ORNL-TM-2425, p. 53, January 1969. (Unit 1)

24. Bell, M. J, et al., "Post-LOCA Hydrogen Generation in PWR Containments," Nuclear Technology 10, 420-422, (1971). (Unit 1)

25. American Nuclear Society Standary ANSI/ANS-5.1-1979, "Decay Heat Power in Light-Water Reactors," August 29, 1979. (Unit 1)

26. Row, T. H., and Zittel, H. E., "Radiation and Thermal Stability of Spray Solutions," Nuclear Technology 10, 436-443, (1971). (Unit 1)

27. Allen, A. O., "The Radiation Chemistry of Water and Aqueous Solutions," Princeton, N.

J., Van Nostrand, 1961. (Unit 1)

28. Deleted in initial UFSAR.

29. Deleted in initial UFSAR.

30. C. W. Stewart, et al., "VIPRE-01: A Thermal-Hydraulic Code for Reactor Cores,"

Volume 1-3 (Revision 3, August 1989), Volume 4 (April 1987), NP-2511-CCM-A, EPRI.

31. Deleted in initial UFSAR. (Units 1 and 2)

32. USNRC Regulatory Guide 1.7, Revision 2, November 1978, "Control of Combustible Gas Concentrations in Containment Following a Loss of Coolant Accident". (Unit 1)

33. "American National Standard for Decay Heat Power in Light Water Reactors," ANSI/ANS-5.1-1979, August 1979. (Units 1 and 2)

34. Rupprecht, S. D, et. al., "Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study with the NOTRUMP Code," WCAP-11145-P-A (Proprietary), WCAP-

11372 (Non-Proprietary), October 1986.

35. U.S. Nuclear Regulatory Commission, Code Federal Regulations, Title 10 - Energy, Chapter 1, Part 50, Section 50.46(c), "Acceptance Criteria for Emergency Core Cooling

Systems for Light Water Nuclear Power Reactors," as amended through the Federal

Register, V53, N180, pp. 35996 - 36005, September 16, 1988. (Units 1 and 2)

36. Deleted by UFSAR Amendment 2. (Unit 1 Only) and "Westinghouse Methodology for Implementation of 10 CFR 50.46 Reporting", WCAP-13451 October 1992." (Unit 2 Only)

37. Devault, R. M., Smith, J. D., and Studer , P. G., "MONSTER - A Multi-Compartment Containment System Analysis Program Us er Manual," System I.D. 262303, March 1993. (Units 1 and 2)

WBN 15.4-68 38. Deleted by UFSAR Amendment 6.

39. Letter from Walsh, L. A., Westinghouse Owners Group, to Jones, R. C.,

U.S. Nuclear Regulatory Commission, "Steam Generator Tube Uncovery Issue," OG 25, March 1992. (Units 1 and 2)

40. "Report on the Methodology for the Resolution of the Steam Generator Tube Uncovery Issue," WCAP-13247 (Proprietary), March 1992. (Units 1 and 2)

41. Letter from Jones, R. C., U.S. Nuclear Regulatory Commission, to Walsh, L. A., Westinghouse Owners Group, "Steam Generator Tube Uncovery Issue," March 10, 1993. (Units 1 and 2)

42. Watts Bar "Design Basis Events Design Criteria", Document WB-DC-40-64. (Units 1 and

2)

43. "Criticality Analysis Summary Report For the Watts Bar Nuclear Plant," Document Number PFE-R07, Tennessee Valley Authority Nuclear Fuels Department (L38961015802). (Units 1 and 2)

44. USNRC Regulatory Guide 1.157, "Best-Esti mate Calculations of Emergency Core Cooling System Performances," May 1989. (Units 1 and 2)

45. Boyack, B., et al., 1989, "Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break

Loss-of-Coolant-Accident," NUREG/CR-5249. (Units 1 and 2)

46. "Code Qualification Document for Best Estimate Loss of Coolant Accident Analysis,"

WCAP-12945-P-A, Volume I (Revision 2) and Volumes 2 through 5 (Revision 1), March

1998 (Westinghouse Proprietary). (Units 1 and 2)

47. "Best Estimate Analysis of the Large Break Loss of Coolant Accident for the Watts Bar Nuclear Plant," WCAP-14839-P Revision 1, June 1998. (Units 1 and 2)

48. Letter from W. J. Johnson of Westinghouse to R. C. Jones of the NRC, "Use of 2700ºF PCT Acceptance Limit in Non-LOCA Accidents," NS-NRC-89-3466, October 1989.

(Units 1 and 2)

49. "Realistic Large-Break LOCA Evaluation Methodology Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM)", WCAP-16009-P-A, January 2005 (Westinghouse Proprietary) (Unit 2 Only)

50. "Emergency Core Cooling System Analysis Methods", SECY-83-472, Information Report from W. J. Dircks to the Commissioners, November 17.1983. (Unit 2 Only)

51. "Westinghouse Improved Performance Anal ysis and Design Model (PAD 4.0),"WCAP-15063-P-A, Revision 1 with Errata (Proprietary), July 2000. (Unit 2 Only)

°°°°°

°°

°°

°°°°°°

WBN 15.5-2 Assumptions used for the conservative analysis are the same as the realistic assumptions

except the secondary side source terms at the Tec hnical Specification limit of 0.1 µCi/gm I-131 dose equivalent are assumed.

The steam releases to the atmosphere for the loss of AC power are in Table 15.5-1.

The gamma, beta, and thyroid doses for the loss of AC power to the plant auxiliaries at the

exclusion area boundary and low population zone are in Table 15.5-2 for the realistic and

conservative analyses. These doses are calculated by the FENCDOSE computer code.

[16] The doses for this accident are less than 25 rem whole body, 300 rem beta and 300 rem thyroid.

This is well within the limits as defined in 10 CFR 100.

The whole body, beta, and thyroid doses to control room personnel from the radiation sources

discussed above are presented in Table 15.5-2. The doses are calculated by the COROD

computer code.

[17] Parameters for the control room analysis are found in Table 15.5-14. The dose to whole body is below the GDC 19 limit of 5 rem for control room personnel, and the

thyroid dose is below the limit of 30 rem.

Dose equations in TID-14844

[23] were used to determine the dose. Dose conversion factors in ICRP-30[25] were used to determine thyroid doses in place of those found in TID-14844.

15.5.2 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED WASTE GAS DECAY TANK RUPTURE

Two analyses of the postulated waste gas decay tank rupture are performed:

(1) a realistic analysis, and (2) an analysis based on Regulatory Guide 1.24.

[2] The parameters used for each of these analyses are listed in Table 15.5-3.

The assumptions for the Regulatory Guide analysis are:

1. The reactor has been operating at full power with 1% defective fuel for the RG 1.24 analysis.

2. The maximum content of the decay tank assumed to fail is used for the purpose of computing the noble gas inventory in the tank. Radiological decay is taken into account

in the computation only for the minimum time period required to transfer the gases from

the reactor coolant system to the decay tank. For the Regulatory Guide 1.24 analysis, noble gas and iodine inventories of the tank are given in Table 15.5-4. For the realistic

analysis, source terms are based on ANSI/ANS-18.1-1984 methodology.

[14]

3. The tank rupture is assumed to occur immediately upon completion of the waste gas transfer, releasing the entire contents of the tank through the Auxiliary Building vent to the

outside atmosphere. The assumption of the release of the noble gas inventory from only

a single tank is based on the fact that all gas decay tanks will be isolated from each other

whenever they are in use.

WBN 15.5-3 4. The short-term (i.e., 0-2 hour) dilution factor at the exclusion area boundary given in Appendix 15A is used to evaluate the doses from the released activity. Doses are based

on the dose models presented in Appendix 15A. The gamma, beta, and thyroid doses for

the gas decay tank rupture at the exclusion area boundary and low population zone are

given in Table 15.5-5 for both the realistic and Regulatory Guide 1.24 analyses.

5. The whole body, beta, and thyroid doses to control room personnel from the radiation sources discussed above are presented in Table 15.5-5. The doses are calculated by the

COROD computer code.

[17] Parameters for the control room analysis are found in Table 15.5-14. The dose to whole body is below the GDC 19 limit of 5 rem for control room

personnel, and the thyroid dose is below the limit of 30 rem.

Dose equations in TID-14844

[23] were used to determine the dose. Dose conversion factors in ICRP-30[25] were used to determine thyroid doses in place of those found in TID-14844.

15.5.3 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED LOSS OF COOLANT ACCIDENT

The results of the analysis presented in this section demonstrate that the amounts of radioactivity

released to the environment in the event of a loss-of-coolant accident do not result in doses

which exceed the reference values specified in a 10 CFR 100.

The analysis is based on Regulatory Guide 1.4.

[3] The parameters used for this analysis are listed in Table 15.5-6. In addition, an evaluation of the dose to control room operators and an

evaluation of the offsite doses resulting from recirculation loop leakage are presented.

Fission Product Release to the Containment

Following a postulated double-ended rupture of a reactor coolant pipe with subsequent

blowdown, the emergency core cooling system k eeps cladding temperatures well below melting, and limits zirconium-water reactions to an insignificant level, assuring that the core remains intact

and in place. As a result of the increase in cladding temperature and rapid depressurization of

the core, however, some cladding failure may occur in the hottest regions of the core. Thus, a

fraction of the fission products accumulated in the pellet-cladding gap may be released to the

reactor coolant system and thereby to the primary containment.

In this analysis, based on Regulatory Guide 1.4,[3] a total of 100% of the noble gas core inventory and 25% of the core iodine inventory is assumed to be immediately available for leakage from

the primary containment. Of the halogen activity available for release, it is further assumed that

91% is in elemental form, 4% in methyl form, and 5% in particulate form. For Unit 1, as an

assumption specific to the LOCA analysis, it is conservatively assumed that 100% of the tritium

in the TPBARs is released to containment as discussed in section 15.5.8.

The core inventory of iodines and noble gases is listed in Table 15.1 Unit 1 (15.1 Unit 2).

WBN 15.5-4 Primary Containment Model

The quantity of activity released from the containment was calculated with a single volume model

of the containment. If it is assumed that there are no sources of activity following the initial

instantaneous release of fission products to the containment, the equation which describes the

time dependent activity or quantity of material in a component is:

)t(ijP)t(ij A ij dt)t(ij dA+= (1) where:

A ij is the activity or quantity of material i in component j. P ij is the rate at which activity or material i is added to component j, and ij the rate at which activity or material i is removed or lost from component j.

If both and P are independent of time, then for one material and one component one obtains the solution:

)e1(PeAA t t o+= (2) where A o is the initial activity. However, in general, P is time dependent and in some cases 4 is also time dependent.

The addition of material to the component, P ij (t), may come from two sources: (1) flow from another component in the system may add material to the component, (2) material may be

produced within the component by radioactive decay. Thus, the addition rate for material i to

component j can be expressed as:

where: )t(c);t(A)t(c)t(Pjijjijjjijj njjj)1(ij= is the transfer coefficient of i from component jj to j, and i(2)ii nii-iiijii-i P(t) = A(t); is the rate of production of i from ii in component j. Note that ii-i is not normally a function of time or component.

ij ij(1)ij (2)P(t) = P(t) + P(t) (3)

WBN 15.5-5 Similarly, the loss from a component can be due to: (1) loss within the component (such as

radioactive decay), (2) flow out of the component to other components, and (3) removal from the

system. Thus, the loss rate from component j for material i can be expressed as:

()ij()()(t) = + (t) +iijij t23 (4) where i is the removal rate inside the component due to radioactive decay (neither time nor component dependent), )t(f);t(f)t(jjijjjij njjj)2(ij= is the transfer coefficient of material i from component j to jj, and

()t)3(ij is the removal from the system.

A computer program Source Transport Program (STP) has been developed to solve equation (1) for each isotope and for two halogen forms (i.e., elemental and or organic). From this, the

isotopic concentration airborne in the containment as a function of time and the integrated

isotopic leakage from the containment for a given time period can be obtained. Parameters used

in the loss-of-coolant accident analysis are listed in Table 15.5-6.

Modeling of Removal Process

For fission products other than iodine, the only removal processes considered are radioactive

decay and leakage.

The fission product iodine is assumed to be present in the containment atmosphere in elemental, organic, and particulate form. It is assumed that 91% of the iodine available for leakage from the

containment is in elemental (i.e., I 2 vapor) form, 4% is assumed to be in the form of organic iodine compounds (e.g., methyl iodine), and 5% is assumed to be absorbed on airborne

particulate matter. In this analysis it was conservatively assumed that the organic form of iodine

is not subject to any removal processes other than radioactive decay and leakage from the containment. The elemental and particulate forms of iodine are assumed to behave identically.

WBN 15.5-6 The effectiveness of the ice condenser for elemental iodine removal is described in Section

6.5.4. For the calculation of doses, the ice condenser was treated as a time dependent removal

process. The time dependent ice condenser iodine removal efficiencies for the Regulatory Guide

1.4 analysis

are given in Table 15.5-7.

Ice Condenser

The ice condenser is designed to limit the leakage of airborne activity from the containment in

the event of a loss-of-coolant accident. This is accomplished by the removal of heat released to

the containment during the accident to the extent necessary to initially maintain that structure

below design pressure and then reduce the pressure to near atmospheric. The addition of an

alkaline solution such as sodium tetraborate enhances the iodine removal qualities of the melting

ice to a point where credit can be assumed in the radiological analyses.

The operation of the containment deck fans (air return fans) is delayed for approximately 10

minutes following a Phase B isolation signal resulting from the loss-of-coolant accident.

This delay in fan operation yields an initial inlet steam-air mixture into the ice condenser of

greater than 90% steam by volume which results in more efficient iodine removal by the ice

condenser.

As a result of experimental and analytical effo rts, the ice condenser system has been proven to be an effective passive system for removing iodine from the containment atmosphere following a

loss-of-coolant accident.

[4]

With respect to iodine removal by the ice condenser, the following assumptions were made:

1. The ice condenser is only effective in removing airborne elemental and particulate iodine from the containment atmosphere.

2. The ice condenser is modeled as a time dependent removal process.

3. The ice condenser is no longer effective in removing iodine after all of the ice has been melted using the most conservative assumptions.

WBN 15.5-7 Primary Containment Leak Rate

The primary containment leak rate used in the Regulatory Guide 1.4 analysis for the first 24

hours is the design basis leak rate guaranteed in the technical specifications regarding

containment leakage and it is 50% of this value for the remainder of the 30 day period. Thus, for

the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the accident, the leak rate was assumed to be 0.25% per day and the

leak rate was assumed to be 0.125% per day for the remainder of the 30 day period.

The leakage from the primary containment can be grouped into two categories: (1) leakage into

the annulus volume and (2) through line leakage to rooms in the Auxiliary Building (see Figure

15.5-1). The environmental effects of the core release source events have been analyzed on the

basis that 25% of the total primary containment leakage goes to the Auxiliary Building.

The leakage paths to the Auxiliary Building are tested as part of the normal Appendix J testing of

all containment penetrations. An upper bound to leakage to the Auxiliary Building was estimated

to be 25% of the total containment leakage. Selecting an upper bound is conservative because

an increasing leakage fraction to the Auxiliary Building results in an increasing calculated offsite

dose. This upper bound was also selected on the basis that it is large enough to be verified by

testing. The periodic Appendix J testing will assure that leakage to the Auxiliary Building remains

below 25%. The remaining 75% of the leakage goes to the annulus.

Bypass Leakage Paths

There are no bypass paths for primary containment leakage to go directly to the atmosphere

without being filtered. For further details see the discussion on Type E leakage paths in Section

6.2.4.3.1.

Auxiliary Building Release Path

The Auxiliary Building allows holdup and is nor mally ventilated by the auxiliary building ventilation system. However, upon an ABI signal following a loss-of-coolant accident, the normal

ventilation systems to all areas of the Aux iliary Building are shutdown and isolated. Upon Auxiliary Building isolation, the Auxiliary Buildi ng gas treatment system (ABGTS) is activated to provide ventilation of the area and filtration of the exhaust to the atmosphere. This system is

described in Section 6.2.3.2.3.

WBN 15.5-8 Fission products which leak from the primary cont ainment to areas of the Auxiliary Building are diluted in the room atmosphere and travel via ducts and other rooms to the fuel handling area or

the waste packaging area where the suctions for t he Auxiliary Building gas treatment system are located. The mean holdup time for airborne activity in the Auxiliary Building areas other than the

fuel handling area is greater than one hour with the Auxiliary Building isolated and both trains of

the ABGTS operating. It has been conservatively assumed in the estimation of activity release that activity leaking to the Auxiliary Building is directly released to the environment for the first

four minutes and then through the ABGTS filter system, with a conservatively assumed mean

hold-up time of 0.3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> in the Auxiliary Building before being exhausted. In the Regulatory

Guide 1.4 analysis the ABGTS filter system is assumed to have a removal efficiency of 99% for

elemental, organic, and particulate iodines. Minor leakage into the ABGTS and EGTS ductwork

allows some unfiltered Auxiliary Building air to be released to the environment. This leakage, quantified by testing, is modeled in the LOCA analysis as indicated in Table 15.5-6 and does not

significantly impact doses.

The Auxiliary Building internal pressure is maintained at less than atmospheric during normal

operation (see Section 9.4.2 and 9.4.3), thereby preventing release to the environment without

filtration following a LOCA. The annulus pressure is maintained more negative than the Auxiliary

Building internal pressure during normal operation and after a DBA. Therefore, any leakage

between the two volumes following a LOCA is into the annulus.

Shield Building Releases

The presence of the annulus between the primary containment and the Shield Building reduces

the probability of direct leakage from the vessel to the atmosphere and allows holdup, dilution, sizing, and plate-out of fission products in the Shield Building. The major factor in the

effectiveness of the secondary containment is its inherent capability to collect the containment

leakage for filtration of the radioactive iodine prior to release to the environment. This effect is

greatly enhanced by the recirculation feature of the air handling systems, which forces repeated

filtration passes for the major fraction of the primary containment leakage before release to the

environment. Seventy-five percent of the primar y containment leakage is assumed to go to the

annulus volume.

WBN 15.5-9 The initial pressure in the annulus is less than atmospheric. However, the dose analysis

conservatively assumes the annulus is at atmospheric pressure at event initiation. After

blowdown, the annulus pressure will increase rapidly due to expansion of the containment vessel

as a result of primary containment atmosphere temperature and pressure increases. The

annulus pressure will continue to rise due to heating of the annulus atmosphere by conduction

through the containment vessel. After a delay, the EGTS operates to maintain the annulus

pressure below atmospheric pressure.

The EGTS is essentially an annulus recirculation system with pressure activated dampers which allow part of the system flow to be exhausted to atmosphere to maintain a "negative" annulus

pressure. The system includes absolute and impregnated charcoal filters for removal of

halogens. The EGTS combined with ABGTS ensures that all primary containment leakage is

filtered before release to the atmosphere.

The EGTS suction in the annulus is located at the top of the containment dome, while nearly all

penetrations are located near the bottom of the containment (see Section 6.2), thereby

minimizing the probability of leakage directly from the primary containment into the EGTS.

Transfer of activity from the annulus volume to the EGTS suction is assumed to be a statistical process similar mathematically to the decay process, (i.e., the rate of removal from the annulus

is proportional to the activity in the annulus). This corresponds an assumption that the activity is

homogeneously distributed throughout the mixing volume. Because of the low EGTS flow rate (compared to the annulus volume), the thermal convection due to heating of the containment

vessel, and the relative locations of the EGTS suctions (at the top of the dome) and the EGTS

recirculation exhausts (at the base of the annulus), a high degree of mixing can be expected. It

is conservatively assumed that only 50% of the annulus free volume is available for mixing of

activity in the Regulatory Guide 1.4 analysis.

Tables 15.5-8 and 15.5-8A list the EGTS exhaust and recirculation flow rates as a function of

time after the LOCA, which were used for calcul ation of activity releases for the Regulatory Guide 1.4 analysis. Table 15.5-8 flow rates are as a result of a postulated single failure loss of

one train of EGTS concurrent with the LOCA. Table 15.5-8A flow rates are as a result of an

alternate single failure scenario resulting in one pressure control train in full exhaust to the shield

building exhaust stack while the other train remains functional. Both EGTS fans are in service

until operator action is taken to place one fan in standby between one and two hours post

accident. The flow path of fission products which are drawn into the air handling systems is

shown schematically in Figure 15.5-1 where:

L 0 Represents the flow of activity from primary containment to the annulus

L 1 Represents the flow of activity from pr imary containment to the Auxiliary Building

L Represents the flow of activity from the annulus into the EGTS

K Represents the ratio of EGTS recirculation flow to total EGTS flow rate

WBN 15.5-10 n f Represents the appropriate filter efficiency

Effectiveness of Double Containment Design

The analysis has demonstrated clearly the benefits of the double containment concept. As

would be expected for a double barrier arrangement, the second barrier acts as an effective

holdup tank, resulting in substantial reduction in the two-hour inhalation and whole body

immersion doses. The expected offsite doses for the 30-day period at the low population zone

are also substantially reduced, since the holdup process is effective for the duration of the

accident.

The EGTS exhaust flow rate is dependent on the rate of air inleakage to the annulus. In fact, after about 30 minutes following blowdown of the reactor vessel the EGTS exhaust flow is

approximately equal to the air inleakage rate. Studies

[5] made of leak rates from typical concrete buildings of this type have resulted in leak rates from 4% to 8% per day at a pressure differential

of 14 inches of water. Although the pressure differential in this case will be much lower than this

value, it has been assumed that a shield building inleakage flow of 250 cfm exists throughout the

30-day period for the single failure scenario which results in loss of one EGTS train concurrent

with a LOCA. The inleakage flow for the single failure scenario which results in one pressure

control train in full exhaust to the shield building exhaust stack (while the other train remains

functional) was conservatively assumed to be greater since the resulting annulus pressure is

more negative than the original single failure scenario loss of one EGTS train. The long term

inleakage flow rates of 957 - Unit 1; 832 - Unit 2 cfm (until operator action to place one fan in

standby) and 694 - Unit 1; 604 - Unit 2 cfm thereafter are used in the dose analysis. This

inleakage flow includes leakage past ventilation sy stem primary containment isolation valves assuming that a single isolation valve fails in the open position.

In order to evaluate the effectiveness of the Shield Building, the following case was analyzed:

50% Mixing Case

At the beginning of the accident, the EGTS starts exhausting filtered fission products to the

environs (see Tables 15.5-8 and 15.5-8A). At approximately 114 seconds (for the loss of one

EGTS train) the annulus pressure becomes less than minus 0.25 inch water gauge, and the

effluents are filtered for the duration of the accident. At approximately 60 seconds (for the single

failure scenario which results in one pressure control train in full exhaust to the shield building

exhaust stack while the other train remains functional) the annulus pressure becomes less than

minus 0.25 inches w.g., and the effluents are filtered for the duration of the accident. All of the primary containment leakage going to the shield building is assumed to be uniformly mixed in

50% of the annulus free volume.

WBN 15.5-11 Emergency Gas Treatment System Filter Efficiencies

The EGTS takes suction from the annulus, and the exhaust gases are drawn through two banks

of impregnated charcoal filters in series. Sufficient filter capacity is provided to contain all

iodines, inorganic, organic, and particulate available for leakage. Since the air in the annulus is

dry, filter efficiencies of greater than 99% are attainable as reported in ORNL-NSIC-4

[6]. Heaters and demisters have been incorporated upstream of the filters resulting in a relative humidity of

less than 70% in the air entering the filters which further ensures high filter efficiency.

In the Regulatory Guide 1.4 analysis however, an overall removal efficiency of 99% for

elemental, organic, and particulate iodine is assumed for the two filter banks in series.

Discussion of Results

The gamma, beta, and thyroid doses for the LOCA at the exclusion area boundary and the low

population zone are given in Table 15.5-9. These doses are calculated by the FENCDOSE

computer code

[16]. The doses are based on the atmospheric dilution factors and dose models given in Appendix 15A. The doses for this accident are less than 25 rem whole body, 300 rem

beta, and 300 rem thyroid. The doses are well within the 10 CFR 100 guidelines and reflect the

worst case values in consideration of both single failure scenarios.

Loss of Coolant Accident - Environmental Consequences of Recirculation Loop Leakage

Component leakage in the portion of the emergency core cooling system outside containment

during the recirculation phase following a loss of coolant accident could result in offsite exposure.

The maximum potential leakage for this equipment is specified is Table 6.3-6. This leakage

refers to specified design limits for components and normal leakage is expected to be well below

those upper limits. Recirculation is assumed in the analysis to start at 10 minutes after the loss

of coolant accident. At this time the sump temperature is approximately 160ºF (Figure 6.2.1-3).

The enthalpy of the sump is approximately 130 BTU/lb. The enthalpy of saturated liquid at 1.0

atmosphere pressure and 212ºF is greater than 130 BTU/lb. Therefore, there will be no flashing

of the leakage from recirculation loop components, and an iodine partition factor of 10 - Unit 1;

0.1 - Unit 2 is assumed for the total leakage.

WBN 15.5-12 The analysis of the environmental consequences is performed as follows:

Core iodine inventory given in Table 15.1 Unit 1 (15.1 Unit 2) is used. The water volume

is comprised of water volumes from the reactor coolant system, accumulators, refueling water

storage tank, and ice melt. All the noble gases are assumed to escape to the primary

containment. Ninety-seven percent of tritium was assumed to remain liquid and accumulate in

the sump, while 3% was assumed to go airborne to the containment. An alternate analysis was

also performed assuming 100% of the tritium goes airborne into the containment. Radioactive

decay was taken into account in the dose calculation. The major assumptions used in the

analysis are listed in Table 15.5-12. The offsite doses at the exclusion area boundary and low

population zone for the analysis are given in Table 15.5-13 and reflect the worst case values in

consideration of 3% airborne tritium or 100% airborne tritium. The atmospheric dilution factors

and dose models discussed in Appendix 15A are used in the dose analysis. The whole body, beta, and thyroid doses to control room personnel from the radiation sources discussed above

are presented in Table 15.5-13. The doses are calculated by the COROD computer code.

[17] Parameters for the control room analysis are found in Table 15.5-14. The dose to whole body is

below the GDC 19 limit of 5 rem for control room personnel, and the thyroid dose is below the

limit of 30 rem.

Dose equations in TID-14844

[23] were used to determine the dose. Dose conversion factors in ICRP-30[25] were used to determine thyroid doses in place of those found in TID-14844.

Loss of Coolant Accident - Control Room Operator Doses

In accordance with General Design Criterion 19, the control room ventilation system and shielding have been designed to limit the whole body gamma dose during an accident period to 5

rem, the thyroid dose to 30 rem and the beta skin dose to 30 rem.

The doses to personnel during a post-accident period originate from several different sources.

Exposure within the control room may result from airborne radioactive nuclides entering the

control room via the ventilation system. In addition, personnel are exposed to direct gamma

radiation penetrating the control room walls, floor, and roof from:

1. Radioactivity within the primary containment atmosphere

2. Radioactivity released from containment which may have entered adjacent structures

3. Radioactivity released from containment which passes above the control room roof

Further exposure of control room personnel to radiation may occur during ingress to the control

room from the exclusion area boundary and during egress from the control room to the exclusion area boundary.

WBN 15.5-13 In the event of a radioactive release incident, t he control room is isolated automatically by a safety injection system signal and/or by radiati on signal from beta detectors located in the air intake stream common to the air intake ports at either end of the Control Building. These

redundant signals are routed to redundant controls which actuate air-operated isolation dampers

downstream of the beta detectors. Operation of the emergency pressurizing fans with inline

HEPA filters and charcoal adsorbers is also initiated by these signals. Simultaneously, recirculation air is rerouted automatically through the HEPA filters and charcoal adsorbers.

Approximately 711 cfm of outside air, the emergency pressurization air, flows through a duct

routed to the emergency recirculation system upstream of the HEPA filters and charcoal

adsorbers. This flow of outside air provides the control room with a slight positive pressure relative to the atmosphere outside and to surrounding structures. In addition, the equivalent of

51 cfm of unfiltered outside air enters through the main control room doors and other sources.

Isolation dampers located in each intake line may be selectively closed by control room

personnel. The selection between the two would be based on the objective of admitting a

minimum of airborne activity to the control room via the makeup airflow.

The control room ventilation flow system is shown in Figure 9.4-1.

To evaluate the ability of the control room to meet the requirements of General Design Criterion 19, a time-dependent model of the control room was developed. In this model, the outside air

concentration enters the control room via the isolation damper bypass line and the HEPA filters

and charcoal absorbers. The concentration in the room is reduced by decay, leakage out, and

by recirculation through the HEPA filters and charcoal absorbers. Credit for filtration is taken

during two passes through the charcoal absorbers. Using these assumptions, the following

equations for the rate of change of the control room concentrations are obtained:

M - M V R - M (L/V) - L/V )

K-(1 C = dt dM c 1 o (1) dN dt = R V (1-K) M - (L/V) N - N c 2 (2)

WBN 15.5-14 C(t) = M(t) + N(t) (3) Where:

M(t) = Once-filtered time-dependent concentration

N(t) = Twice-filtered (or more) time-dependent concentration

C(t) = Total time-dependent concentration in control room

C o = Concentration of isotope entering air intake

K 1 = Filter efficiency for a particular isotope during first pass

K 2 = Filter efficiency for a particular isotope during second pass

L = Flow rate of outside air into control room and leakage out of control room

R c = Recirculated air flow rate through filters

= Decay constant V = Control room free volume

These equations are readily solvable if C o is constant or a simple function of time during a time interval. Since C o consists of a number of terms involving exponentials, it was assumed to be constant during particular time intervals corresponding to the average concentration during each

interval as described below. Solving equations (1), (2), and (3) yields:

(4) )

e-eL(-)e-(1 V W L R+)e-(1)K-(1 L x V W C)K-)(1 K-(1 = C(t)t W-t W-t W-n c t W-2 m o 2 1 m n n m Where:

m c W = (L + R + V)V n W = (L + V)V WBN 15.5-15 The value of C o used in equation (4) is determined as follows:

oi i t ti+1i C = (/Q)R dt (t-t)ii+1 (5)

C oi = Average concentration of activity outside control room during ith time period (Ci/m 3). (/Q)i = Atmospheric dilution factor (sec/m

3) during the ith time period.

R = Time dependent release rate of activity from containment (Ci/sec).

The atmospheric dilution factors were determined using the accumulated meteorological data on

wind speed, direction, and duration of occurrence obtained from the Watts Bar plant site applied

to a building wake dilution model. The dilution factors are calculated by the ARCON96

methodology

[8] and are the maximum values for each time period. The worst case is Unit 1 exhaust to intake 2. These factors are applied for the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, at which time it is assumed

that the operator selects intake 1 which has more favorable dilution factors. The values used in

the analysis are given in Table 15.5-14.

Equation (4) is used to determine the concentration at any time within a time period and upon

integrating and dividing by the time interval gives the average concentration during the time

interval due to inflow of radioactivity with outside air as shown:

i 0 T i C = C(t)dtT-0 (6)

Where:

T = t - t i-1 t = Time after accident t i-1 = Time at end of previous time period

Further contributions to the concentration during the time period are due to the concentrations

remaining from prior time periods. These contributions are obtained from the following

equations:

WBN 15.5-16 C R(i+j) = M R(i+j) + N R(i+j) (7) M ) + /V R + (L/V =

dt dMj)R(i+cj)R(i+ (8) R(i+j)c2R(i+j)R(i+j) dN dt = (R/V) (1-K) M - (L/V + )

N (9)

With initial conditions:

R(i+j)R0(i)M(0) = M = (Once-filtered concentration at end of the ith time period.)

R(i+j)R0(i) N(0) = N= (Twice-filtered, or more, concentration at end of the ith time period.)

Solving equations (8) and (9) and substituting certain initial condition relations, equation (7)

becomes:

R(i+j)R0(i)-WR0(i)2-W-W C = Ce -M K (e-e)(t-ti) N(t-ti) N(t-ti)M (10)

Integrating equation (10) for each of the prior time periods gives the contribution from these time

periods to the present time period. The average concentration is determined for these

contributions using the method of equation (6).

Filter efficiencies of 95% for elemental and particulate iodine and 95% for organic iodine were

deemed appropriate for the first filter pass. Since the concentrations of iodine in the main control

room are such reduced as a result of this filtration, the efficiencies were reduced for the second

pass to 70% for elemental and particulate iodine, and 70% for organic iodine.

To account for the unfiltered inleakage, a bypass leak rate (BPR) of 51 cfm was added to the

makeup flow (L in equation (1)) of 711 cfm, and the filter factor for the first pass was decreased

by the ratio L/(L+BPR). The filter efficiencies for the second pass are not affected by the

unfiltered inleakage.

The filter efficiency for noble gases and tritium (Unit 1 Only) was taken as zero for all cases.

WBN 15.5-17 The above equations were incorporated into computer program COROD

[17] together with appropriate equations for computing gamma dose, beta dose, and inhalation dose using these

average nuclide concentrations and time periods. The whole body gamma dose calculation

consists of an incremental volume summation of a point kernel over the control room volume.

The principal gammas of each isotope are used to compute the dose from each isotope. The

dose computations for beta activity were based on a semiinfinite cloud model. Doses to thyroid

were based on activity to dose conversion factors. (The equations and various data are given

below.) The doses from these calculations are presented in Table 15.5-9. Gamma dose

contributions from shine through the control room roof due to the external cloud and from shine through the control room walls from adjacent structures and from containment are computed

using an incremental volume summation of a point kernel which includes buildup factors for the

concrete shielding.

For the calculation of shine through the control room roof, an atmospheric, rectangular volume

several thousand feet in height and several control room widths was used. The control room roof

is a 2 foot 3-inch-thick concrete slab and is the only shielding considered in this calculation. The

average isotope concentrations at the control bay for each time period were used as the source

concentrations. For the shine from adjacent structures, the shielding consists of the 3-foot-thick

(5 feet in certain areas) control room walls. The doses are calculated similarly to the shine dose

through the roof. The average isotope concentrations at the control bay intake for each time

period are also used for these calculations.

The shine from the spreading room below the control room is also computed in the same manner

as adjacent structures.

Shielding for this computation consists of the 8-inch-thick concrete floor. The summation of the

incremental elements is performed over the volu me of each room or structure of interest.

In addition to the dose due to shine from surrounding structures and from the passing cloud, the

shine from the reactor containment building also contributes to the gamma whole body dose to

personnel. This contribution is computed in the same manner as the methods used above. Due

to the location of the Auxiliary Building between the Reactor Buildings and the control room and

the thicker control room auxiliary building wall near the roof, the minimum ray path through

concrete from the containment into the control room below 10 feet above the control floor, is 8 feet. All nuclides released to containment are assumed uniformly distributed and their

time-dependent concentrations were used to compute the dose. The dose computed from this source is small.

Several doors penetrate the control room walls, and the dose at these areas would be larger

than the doses calculated as described above. The potential shine at these doors and at other

penetrations has been evaluated. As a result, hollow steel doors filled with no. 12 lead shot have

been incorporated into the design of the shield wall between the control room and the Turbine

Building. These doors provide shielding comparable to the concrete walls. Shine through other

penetrations was found to be negligible.

WBN 15.5-18 Another contribution to the total exposure of control room personnel is the exposure incurred

during ingress from and egress to the exclusion area boundary. The doses due to ingress and

egress were computed based on the following assumptions:

1. Five minutes are required to leave the control room and arrive at car or vice versa.

2. The distance traveled on the access road to the site exclusion boundary is estimated to be 1500 meters. The average car speed is assumed to be 25 mph.

3. One one-way trip first day, one round-trip/day 2nd through 30th days.

The control room occupancy factors used in this calculation were taken from Murphy and

Campe[9]. These are:

100%

occupancy 0-24 hours 60% occupancy 1-4 days 40% occupancy 4-30 days.

All atmospheric dilution factors were conservatively based on 5th percentile wind velocity

averages.

It was also assumed that initially the makeup air intake would be through the vent admitting the

highest radioisotope concentration, but that the main control room personnel would switch intake

vents 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident in order to admit a lower amount of airborne activity to the MCR

via the makeup air flow.

The whole body, beta, and thyroid doses from the radiation sources discussed above are

presented in Table 15.5-9. The dose to whole body is below the GDC 19 limit of 5 rem for

control room personnel, and the thyroid dose is below the limit of 30 rem.

Dose Equations, Data, and Assumptions

The dose from gamma radiation originating within the control room is given by:

()()++++µµ=======11 m1 n1 q 2 q 2 n 2 m 2 q 2 n 2 ma ekk1k ik1i 4zyxzyxzyxexpfE TCOT10x696.1D WBN 15.5-19 Where:

D = Absorbed dose in flesh in mrads TCOT ik = Total concentration integrated over time period i of isotope k in curies/m 3 E k = Energy of gamma from isotope k in MeV

f k = Number of gammas of isotope k given off per disintegration

µe = Mass attenuation coefficient for flesh determined at the energy of gamma in cm 2/gram µ = Linear attenuation coefficient for air determined at the energy of gamma in inverse meters x m ,y n ,z q = Coordinate distances from the dose point to the source volume element (m,n,q) in meters x, y, z = Dimensions of source element (m,n,q)

= Number of time periods

= Number of isotopes

= Number of gammas from an isotope

= Number of intervals in the x direction

= Number of intervals in the y direction

= Number of intervals in the z direction The control room radiation dose from gamma radiation originating outside of the control room

and penetrating concrete walls is given as:

()()()*µµ*++++µµ=======zyx)sect(BsectexpzyxzyxexpfEo10x696.1Dccccc 2 q 2 n 2 m 2 q 2 n 2 ma1q1n1m ekk 1 ik C1k1i 4)tt(1ii WBN 15.5-20 Where:

µc = Linear attenuation coefficient of concrete determined at the energy of gamma in inverse meters t c = Concrete shield thickness in meters

= Angle between a vector normal to the shield and a vector from the dose point to the source point B c (µc t c sec) = Buildup factor for concrete C o ik = Average concentration of isotope k outside the control room during time period i in curies/m 3

t i-1 ,t i = Times at the beginning and end of time period i in hours

Other parameters are defined as previously noted.

The dose from beta radiation is given by the semi-infinite cloud immersion dose:

Bi=1 ik=1ikik D = (0.230) (/Q)

Q Ef Where:

D B = Dose due to beta in rem

/Q = Atmospheric dispersion factor during time period in sec/m 3 Q i = Accumulated activity release of isotope i during time period

E ik = Average energy of beta k of isotope i

f ik = Number of k betas of isotope i per disintegration WBN 15.5-21 For beta dose in the control room, equation (12) becomes:

Bi=1i=1 ij 1ikikjj-1 D = (0.230)

C E f (t-t) Where:

C ij = Average concentration of isotope i during time period j

Inhalation Dose (Thyroid)

The inhalation dose for a given period of time has the general form:

)t - t( (DCF) )

Q( (B) /Q)( =

D1j-J i n1=i I j Where:

D I = Thyroid inhalation dose, rem

/Q = Site dispersion factor during time period, sec/m 3 B = Breathing rate during time period, m 3/hr Q ij = Average activity release rate during time period j of iodine isotope i

DCF i = ICRP-30 Dose conversion factor for iodine isotope i, rem/microcurie inhaled

t j = Total time at end of period j, hours

For inhalation dose within the control room, equation (13) becomes:

())tt()DCF(CBD1jji n1i ij I==

WBN 15.5-22 In this expression C ij , the average concentration of isotope i during time period j, has replaced the following factor:

(/Q) Q ij The C ij's are those determined by equations (4) and (6). The breathing rate factor B j , was taken to be 3.47 x 10

-4 m 3/sec, 1.75 x 10

-4 m 3/sec, and 2.32 x 10

-4 m 3/sec for the time intervals of 0-8 hours, 8-24 hours, and 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> - 30 days, respectively.

15.5.4 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED MAIN STEAM LINE BREAK The postulated accidents involving release of steam from the secondary system will not result in a release of radioactivity unless there is a leakage from the reactor coolant system to the

secondary system in the steam generator. An acceptable primary to secondary leakage rate for

the main steam line break (MSLB) accident is 1 gallon per minute (gpm) for the faulted steam

generator loop and 150 gallons per day (gpd) for each unfaulted steam generator.

A calculation determines the off site and main control room doses resulting from a MSLB

incorporating the above primary-to-secondary criteria. The calculation determined that 1 gpm (at standard temperature and pressure) primary-to-secondary leakage in the faulted steam

generator results in site boundary doses within 10 CFR 100 guidelines and control room doses

within the 10 CFR 50, Appendix A, General Design Criteria (GDC)-19 limit. The calculation

uses TVA computer codes STP, FENCDOSE, and COROD. The STP output is input to

COROD, which determines control room operator dose and FENCDOSE, which determines the

30-day low population zone (LPZ) and the 2-hour exclusion area boundary (EAB) dose.

Two methods for determining the resultant dose for a MSLB in accordance with the Standard

Review Plan 15.1.5, Appendix A methodology are:

1. A pre-accident iodine spike where the iodine level in the reactor coolant spiked upward to the maximum allowable limit of 14

µCi/gm I-131 dose equivalent just prior to the initiation of the accident.

2. The reactor coolant at the maximum steady state dose equivalent I-131 of 0.265

µCi/gm with an accident initiated iodine spike consisting of a 500 times increase on the rate of iodine release from the fuel.

WBN 15.5-24 8. Iodine partition factor from steaming of steam generator water:

i. non-defective steam generators initial inventory and primary-to-secondary

leakage,100.

ii. faulted steam generator initial inventory and primary-to-secondary leakage, 1.0.

9. Atmospheric dilution factors, /Q, are in Table 15A-2 for Offsite and Table 15.5-14 for control room personnel.

10. Main Control room related assumptions are in Table 15.5-14.

For Unit 2, assumptions for the MSLB accident:

1. RCS letdown flow of 124.39 gpm.

2. RCS letdown demineralizer efficiency is 1.0 for iodines.

3. ANSI/ASN-18.1-1984 spectrum scaled up to 0.265 or 14 Ci/gm equivalent iodine. 4. Two cases were used. In the first, pre-accident iodine spike of 14 Ci/gm I-131 dose equivalent in the RCS. In the second case, an accident initiated spike which increases

the iodine concentration at the equilibrium into the reactor coolant from the fuel rods. 5. Primary side to secondary side leakage of 150 gpd (standard temperature and pressure) per steam generator in the intact loops. 6. The primary-to-secondary leakage mass release to the Environment is 1 gpm (standard temperature and pressure) from the faulted loops. 7. Steam generator secondary inventory released as steam to the atmosphere:

a) total from the non-defective steam generators (0-2 hrs), 433,079 lbm

b) total from the non-defective steam generators (2-8 hrs), 870,754 lbm

c) total from the faulted steam generator (0-30 mins), 96,100 lbm

8. Iodine partition coefficients from steaming of steam generator water:

i. non-defective steam generators initial inventory and primary-to-secondary leakage, 100. ii. faulted steam generator initial inventory and primary-to-secondary leakage, 1.0

9. Atmospheric dilution factors, x/Q, are in Table 15A-2 for offsite and Table 15.5-14 for control room personnel. 10. Main control room related assumptions are in Table 15.5-14.

15.5.5 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED STEAM GENERATOR TUBE RUPTURE

Thermal and hydraulic analysis has been performed to determine the plant response for a design

basis steam generator tube rupture (SGTR), and to determine the integrated primary to

secondary break flow and mass releases from the ruptured and intact steam generators (SGs) to

the condenser and the atmosphere (Section 15.4.3). An analysis of the environmental

consequences of the postulated SGTR has also been performed, utilizing the reactor coolant

mass and secondary steam mass releases determined in the base thermal and hydraulic

analysis (See Reference [38] in Section 15.4). Table 15.5-18 summarizes the parameters used

in the SGTR analysis.

WBN 15.5-26 15.5.6 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED FUEL HANDLING ACCIDENT (FHA)

Unit 1

The analysis of a postulated fuel handling accident (FHA) is based on Regulatory Guide (RG)

1.183, Revision 0, "Alternate Radiological Source Terms for Evaluating Design Basis Accidents

At Nuclear Power Plants." The total effective dose equivalent (TEDE) acceptance criterion of

10 CFR 50.67(b)(2) and Regulatory Position C.4.4 of RG 1.183 applies to the offsite and Main

Control Room doses.

Two FHA cases are analyzed. One case is an accident in the spent fuel pit/Auxiliary Building

with no Auxiliary Building Isolation (ABI) and with unfiltered releases through the Auxiliary

Building vent. A second case is an accident in the containment with unfiltered release for 12.7

seconds through the Shield Building vent until the containment is isolated, with the remainder

released unfiltered through the Auxiliary Building vent (no ABI and no filtration). The Auxiliary Building X/Q values are greater than those for the Shield Building. As a result, no credit is

taken for isolation of the containment. Dispersion coefficients used in the analysis are given in

Tables 15A-2 and 15.5-14. In addition, Main Control Room data used in the analysis are listed

in Table 15.5-14. Other input parameters used in the analysis are listed in Table 15.5-20.

The analysis assumes that all of the fuel rods in a fuel assembly rupture. Thus, the fission

product inventory of the damaged fuel assembly was determined by dividing the total core

inventory by the number of fuel assemblies in the core. The values for individual fission product

inventories are calculated assuming full power operation at the end of core life immediately

preceding shutdown with a radial peaking factor of 1.65 for the Tritium Production Core (TPC)

assembly. The peaking factor is not applied to tritium since the maximum inventory of tritium is

used in the analysis. The source terms used in the analysis are for the once burned, twice

burned, and three-times burned assemblies for the Tritium Production Core (TPC). Only the

worst case results are reported. The analysis assumes a decay time of 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> prior to the

movement of spent fuel.

A release of tritium is assumed in the analysis, even though the FHA does not involve a

temperature excursion that would result in boiling of the water covering the fuel assemblies.

Tritium Producing Burnable Absorber Rods (TPBARs) are installed in once and twice burned

fuel assemblies, but they are not installed in fuel assemblies that are burned three times.

Following a FHA in the spent fuel pool, all 24 TPBARs in a TPC once or twice burned fuel

assembly are assumed to break and release their tritium contents. Each TPBAR contains 1.2

grams of tritium.

WBN 15.5-27 Twenty-five percent of the tritium released is assumed to be released to the environment

following the FHA through evaporation of water. Tritium was assumed to evaporate at a

constant rate over 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. One hundred percent of the tritium released from the TPBARs

following a FHA will not be released to the environment, because the event does not involve

temperatures that would result in boiling of the water covering the fuel assemblies. The water

tritium concentration is conservatively assumed to be 60 Ci/gm. At this concentration, the total tritium inventory would be 84,490 Ci and the amount released to the environment would be

21,123 Ci.

For the FHA analysis, the release from the fuel gap and the fuel pellet are assumed to occur

instantaneously with the onset of the projected damage. In addition, the releases to the

environment are assumed to occur in a linear ra mp manner over the duration of two hours for the event.

For the offsite dose, dose conversion factors (DCF) from Table 5-1 of EPA 400-R

001, Manual of Protective Action Guides and Protective Actions for Nuclear Incidents were

utilized to calculate the offsite TEDE. These values represent the sum of the committed

effective dose equivalent (CEDE) and deep dose equivalent (DDE) DCFs. A breathing rate of

3.33E-4 m 3/s is used to determine the CEDE DCF that was used for the overall DCF given in Table 5-1. The total amount of each isotope released is multiplied by each isotope's DCF and by the appropriate X/Q value to obtain the TEDE dose. All isotopes are then summed together

to determine the overall TEDE dose at the exclusion area boundary (EAB) and low population

zone (LPZ).

For the Main Control Room dose, the computer code COROD determines dose due to: 1) time

dependent concentration of airborne activity in the Control Room; and 2) shine through the

Control Room roof, Control Room ends, Aux iliary Building, Turbine Building, and Cable Spreading Room. COROD calculates the TEDE by adding 100% of the calculated gamma

dose, 1% of the beta dose, and the CEDE dose. The gamma and beta doses are calculated as

outlined in section 15.5.3. COROD calculates the CEDE dose by utilizing dose conversion

factors (DCF) from Table 5-4 from EPA 400-R-92-001, Manual of Protective Action Guides and

Protective

Actions for Nuclear Incidents, which has a breathing rate of 3.33E-4 m3/sec embedded in the

DCF. The DCF is then multiplied by the total concentration of the isotope to determine the

CEDE.

The radiological consequences of the FHA are shown in Table 15.5-23. The results for Control

Room, EAB, and LPZ doses are within the appropriate acceptance criteria of 10 CFR

50.67(b)(2) and Table 6 of RG 1.183.

Unit 2 WBN 15.5-28 The analysis of the fuel handling accident considers two cases. The first case is for an

accident in the spent fuel pool area located in the Auxiliary Building. This case is evaluated using the Alternate Source Term based on Regulatory Guide 1.183[11], "Alternate Source Term (AST)." The second case considered is an open containment case for an accident inside containment where there is open communication between the containment and the Auxiliary Building. This evaluation is also based on the AST and Regulatory Guide 1.183. An FHA could occur with the containment closed and the reactor building purge operating. This scenario is bounded by Case 2. The parameters used for this analysis are listed in Table 15.5-20a.

The bases for evaluation consistent with Regulatory Guide 1.183 are:

1. The accident occurs 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> after plant shutdown. Radioactive decay of the fission product inventory during the interval between shutdown and placement of the first

spent fuel assembly into the spent fuel pit is taken into account.

2. Damage was assumed for all rods in one assembly.

3. The assembly damaged is the highest powered assembly in the core region to be discharged. The values for individual fission product inventories in the damaged assembly are calculated assuming full-power operation at the end of core life immediately preceding shutdown. Nuclear core characteristics used in the analysis are given in Table 15.5-21. A radial peaking factor of 1.65 is used.

4. All of the gap activity in the damaged rods is released to the spent fuel pool and consists of 8% I-131, 10% Kr-85, and 5% of other noble gases and other halogens.

5. Noble gases released to the Auxiliary Building spent fuel pool are released through the Auxiliary Building vent to the environment.

6. The iodine gap inventory is composed of inorganic species (99.85%) and organic species (0.15%).

7. The overall inorganic and organic iodine spent fuel pool decontamination factor is 200.

8. All iodine escaping from the Auxiliary Building spent fuel pool is exhausted unfiltered through the Auxiliary Building vent.

9. The release path for the containment scenario is changed to include 12.7 seconds of unfiltered release through the Shield Building vent, with the remainder of the unfiltered release through the Auxiliary Building vent.

10. No credit is taken for the ABGTS or Containment Purge System Filters in the analysis.

WBN 15.5-29 11. No credit is taken for natural decay either due to holdup in the Auxiliary Building or after the activity has been released to the atmosphere.

12. The short-term (i.e., 0-2 hour) atmospheric dilution factors at the exclusion area

boundary and low population zone given in Table 15A-2 are used.

13. The TEDE values for the Exclusion Area Boundary and Low Population Zone are

calculated using dose conversion factors taken from EPA-400-R-92-001, "Manual of

Protective Action Guides and Protective Actions of Nuclear Incidents," May 1992. A

breathing rate of 3.33E-4 m3/sec was used for calculating the TEDE.

14. The TEDE values for the Main Control Room are calculated using the 100% of the

gamma dose calculated using a point kernel integration, 1% of Beta dose, and

conversion factors taken from EPA-400-R-92-001, "Manual of Protective Action Guides

and Protective Actions of Nuclear Incidents," May 1992. A breathing rate of 3.33E-4

m3/sec was used for calculating the TEDE. FSAR Section 15.5.3 provides a discussion

of the COROD calculation methods for gamma and beta dose.

Fuel Handling Accident Results The evaluation for the FHA at the spent fuel pool is a bounding analysis for a dropped assembly in containment when the containment is open. The release point for the containment purge system is the Unit 2 shield building stack. The X/Qs are lower for this release point than

for the normal auxiliary building exhaust. The offsite doses were calculated utilizing

FENCDOSE [16], while the control room doses were calculated utilizing the COROD computer

code [17]. The TEDE dose is given in Table 15.5-23 for the control room, exclusion area

boundary, and low population zone. The dose to control room personnel is less than the limit of

10 CFR 50.67(b)(2)(iii) of 5 rem TEDE, and the dose to the exclusion area boundary and low

population zone are less than the limit of 10 CFR 50.67(b)(2)(i) and (ii), as modified by

Regulatory Position C.4.4 of Regulatory Guide 1.183 of 6.3 rem TEDE.

15.5.7 ENVIRONMENTAL CONSEQUENCES OF A POSTULATED ROD EJECTION ACCIDENT This accident is bounded by the loss-of-coolant accident (LOCA). See Section 15.5.3 for the

loss-of-coolant accident.

WBN 15.5-31 REFERENCES

1. Styrikovich, M. A., Martynova, 0. I., Ka tkovska, K. YA., Dubrovski, I. YA., Smrinova, I.

N., "Transfer of Iodine from Aqueous Solutions to Saturated Vapor," translated from

Atomnaya Energiya, Vol. 17, No. 1, pp. 45-49, July 1964.

2. Regulatory Guide 1.24, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Pressurized Water Reactor Gas Storage Tank Failure," Division of

Reactor Standards, U.S. Atomic Energy Commission, March 23, 1972.

3. Regulatory Guide 1.4, "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors,"

Directorate of Regulatory Standards, U.S. Atomic Energy Commission, June 1974.

4. D. D. Malinowski, "Iodine Removal in the Ice Condenser System," WCAP-7426, April 1970.

5. NAA-SR 10100, Conventional Buildings for Reactor Containment.

6. ORNL-NSIC-4, Behavior of Iodine in Reactor Containment Systems, February 1965.

7. Branch Technical Position CSB 6-2, "Control of Combustible Gas Concentrations in Containment Following a Loss-of-Coolant Accident."

8. Ramsdell, J. V. Jr. and C. A. Simonen, "Atmospheric Relative Concentration in Building Wakes." Prepared by Pacific Northwest Laboratory for the U. S. Nuclear Regulatory

Commission, PNL-10521, NUREG/CR-6331, Revision 1, May 1997.

9. K. G. Murphy and Dr. K. M. Campe "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19," 13th AEC Air Cleaning Conference, August 1974.

10. Deleted in initial UFSAR.

11. Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents At Nuclear Power Reactors", July 2000.

12. Regulatory Guide 1.77, "Assumptions Used for Evaluating a Control Rod Ejection Accident for Pressurized Water Reactors," Directorate of Regulatory Standards, U.S.

Atomic Energy Commission, May 1974.

WBN 15.5-32

13. D. B. Risher, Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Revision 1, December 1971.

14. ANSI/ANS-18.1-1984, "Radioactive Source Terms for Normal Operations of Light Water Reactors," December 31, 1984.

15. WCAP-7664, Revision 1, "Radiation Analysis Design Manual-4 Loop Plant," RIMS Number NEB 810126 316, October 1972.

16. Computer Code FENCDOSE, Code I.D. 262358.

17. Computer Code COROD, Code I.D. 262347.

18. Deleted by UFSAR Amendment 4.

19. Deleted by UFSAR Amendment 4.

20. NRC Safety Evaluation for Watts Bar Nuclear Plant Unit 1, Amendment 38, for Steam Generator Tubing Voltage Based Alternate Repair Criteria for Outside Diameter Stress Corrosion Cracking (ODSCC) dated February 26, 2002. (Unit 2 Only)

21. NRC Generic Letter 95-05, "Voltage-Based Repair Criteria for Westinghouse Steam Generator Tubes Affected by Outside Diameter Stress Corrosion Cracking", dated

August 3, 1995. (Unit 2 Only)

22. TVA Letters to NRC "Technical Specification Change No. WBN-TS-99-014 - Steam Generator Alternate Repair Criteria for Axial Outside Diameter Stress Corrosion

Cracking (ODSCC)," dated April 10, 2000, September 18, 2000, August 22, 2001, November 8, 2001 and January 15, 2002. (Unit 2 Only)"

23 J.J. Dinunno, et, al "Calculation of Distance Factors for Power and Test Reactor Sites", TID-14844, March 1962."

24. NUREG/CR-5009, "Assessment of the Use of Extended Burnup Fuel in Light Water Power Reactors," February 1988.

25. International Commission on Radiation Protection (ICRP) Publication 30, "Limits for Intakes of Radionuclides by Workers," 1979.

µ

WBN 15A-1 APPENDIX 15A DOSE MODELS USED TO EVALUATE THE ENVIRONMENTAL CONSEQUENCES OF ACCIDENTS

15A.1 INTRODUCTION

This Appendix identifies the models used to calculate the offsite radiological doses that would

result from releases of radioactivity due to various postulated accidents. The postulated

accidents are:

1. Waste Gas Decay Tank Rupture

2. Steam Generator Tube Rupture

3. Steam Line Break

4. Loss of A. C. Power

5. Loss of Coolant Accident

15A.2 ASSUMPTIONS

The following assumptions are basic to both the model for the gamma and beta doses due to

immersion in a cloud of radioactivity and the model for the thyroid dose due to inhalation of

radioactivity.

1. Direct radiation from the source point is negligible compared to gamma and beta radiation due to submersion in the radioactivity leakage cloud.

2. All radioactivity releases are from the appropriate point of discharge.

3. The dose receptor is a standard man as defined by the International Commission on Radiological Protection (ICRP).

[1]

4. Radioactive decay from the point of release to the dose receptor is neglected.

5. Isotopic data such as decay rates and decay energy emissions are taken from Table of Isotopes.[2]

15A.3 GAMMA DOSE AND BETA DOSE

The gamma and beta dose delivered to a dose receptor is obtained by considering the dose

receptor to be immersed in a radioactive cloud which is infinite in all directions above the ground

plane, i.e., an "infinite semispherical cloud." The concentration of radioactive material within

this cloud is taken to be uniform and equal to the maximum centerline ground level

concentration that would exist in the cloud at the appropriate distance from the point of release.

WBN 15A-2 E A i )Q/(X 0.23 = Dose Beta i i R t*** Gamma Dose = 0.25 (X/Q

) i A E t R i i*** The beta dose is a result of external beta radiation and the gamma dose is a result of external

gamma radiation. Equations describing an infinite semispherical cloud were used to calculate

the doses for a given time period as follows :

[5]

and

where:

i R A = activity of isotope i released during a given time period, curies (X/Q)t = atmospheric dilution factor for a given time interval t, sec/m 3 E i = average beta radiation energy emitted by isotope i per disintegration, mev/dis

i E = average gamma radiation energy omitted by isotope i per disintegration, mev/dis 15A.4 THYROID INHALATION DOSE

The thyroid dose for a given time period t, is obtained from the following expression

[6]: where:

D = thyroid inhalation dose, rem

(X/Q)t = site dispersion factor for time interval t, sec/m 3

B = Breathing rate for time interval t, m 3/sec Q i = total activity of iodine isotope i released in time period t, curies

(DCF)i = dose conversion factor for iodine isotope i, rem/curies inhaled

The isotopic data and "standard man" data are given in Table 15A-1. The atmospheric dilution

factors used in the analysis of the environmental consequences of accidents are given in

Chapter 2 of this report and are reiterated in Table 15A-2 of this appendix.

D = (X/Q

) B i Q DCF ti i***

WBN 15A-3 The gamma energies, E, on Table 15A-1 include the X-rays and annihilation gamma rays if they are prominent in the electromagnetic spectrum. Also the beta energies E, include conversion electrons if they are prominent in the electromagnetic spectrum. The beta energies are averaged quantities in the sense that the continuous beta spectra energies are computed as

one-third the maximum beta energies.

REFERENCES

1. "Report of ICRP Committee II on Permissible Dose for Internal Radiation (1959)," Health Physics, Vol. 3, pp. 30, 146-153, 1970.

2. Leaderer, C. M., et. al., Table of Isotopes, 6th edition, 1968.

3. Nuclear Data Sheets, Oak Ridge National Laboratory (ORNL) Nuclear Data Group, Vol.

7, Number 1, Academic Press, New York, January 1972.

4. Radioactive Atoms - Supplement 1, ORNL-4923, Martin, M. J., NTIS, November 1973.

5. Regulatory Guide 1.4 "Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors," USAEC, June 1974.

6. J. J. Dinunno, et. al, "Calculation of Distance Factors for Power and Test Reactor Sites", TID 14844, March 1962.