Revision as of 13:52, 29 October 2019

Text

Rev 1 to Applications Topical Rept for BWR Design & Analysis.
	ML17289B153
Person / Time
Site:	Columbia
Issue date:	12/31/1992
From:	Thomsen D, Vosburgh R, Whitcomb D; WASHINGTON PUBLIC POWER SUPPLY SYSTEM, WISCONSIN PUBLIC SERVICE CORP.
To:	;
Shared Package
ML17289B152	List: ML17289B150; ML17289B153;
References
	WPPSS-FTS-131, WPPSS-FTS-131-R01, WPPSS-FTS-131-R1, NUDOCS 9302160189
	Download: ML17289B153 (336)
	v • d • e

{{#Wiki_filter:APPLICATIONS TOPICAL REPORT FOR BWR DESIGN AND ANALYSIS WPPSS-FTS-131, Rev. I December 1992 WASHINGTON PUBLIC POWER 4y]5 SUPPLY SYSTEM 3000 George Washington Way P.O. Box 968 Richland, Washington 99352 9302160i89 930i27 PDR P ADOCK 05000397 PDR

0 APPLICATIONS TOPICAL REPORT FOR BAR DESIGN AND ANALYSIS WPPSS FTS 13 1 I Rev 1 December 1992 Principal Engineers S. H. Bian B. M. Moore Contributing Engineers A. G. Gibbs T. C. Hoang J. D. Teachman W. C. Wolkenhauer Y. Y. Yung Approved: D. H. Thomsen Supervisor, Fuel ngineering Date: R. 0. Vosburgh Supervisor, Safety Analysis D. L. Whitcomb Manager, Nuclear Engineering sl l', Date: D. L. L'arkin Manager, Engineering Services

This report was prepared by the Washington Public Power Supply System (the Supply System) for submittal to the Nuclear Regulatory Commission, NRC. The information contained herein is accurate to the best of the Supply System's knowledge. The use of information contained in this document by anyone other than the Supply System, or the NRC is not authorized and with respect to any unauthorized use, neither the Supply System nor its officers, directors, agents, or employees assume any obligation, responsibility, or liability or makes any warranty or representation concerning the contents of this document or its accuracy or completeness.

Xi 0 H

ACKNOWLEDGEMENTS The Supply System acknowledges the support provided by R. E'. Engel and J. M. Sorensen of S. Levy, Incorporated, and J. M. Gibbs of MCE Technical Services during the preparation of this report.

~ ~

l.3.3.

0 4 XV I

CONTENTS I ABSTRACT ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ o ~ ~ ~ ~ ~ ~ ~ iX REVISION HISTORY Xl

1.0 INTRODUCTION

         . .  .  . .  .  . . . . . . . . .  . .  .  .  .  . 1-1 1.1  RELOAD ANALYSIS OVERVIEW             . . . . . . .  . .  .  .  .  . 1-1 1.2  METHODOLOGY IMPLEMENTATION AND UPDATING .             .  .  .  .  . 1-2 2.0  COMPUTER CODES AND ANALYSIS TECHNIQUES                                 ~  2 1 2.1  CODE DESCRIPTIONS                                                ~   2 2 2.1.1        Reactor Physics Codes                               ~   2 3 2.1.2        Core Neutronics Linkage Codes                           2 7 2.1   ~ 3    System and Core Thermal-Hydraulics Codes                2-8 2.1.4        Other Codes                                            2-11 2.2  STATISTICAL COMBINATION            OF UNCERTAINTIES METHODOLOGY                                                         2-14 2.2.1        Event Acceptance Criteria and Limits                   2-15 2.2.2        Response Surface Methodology                           2-16 3.0  DESIGN ANALYSIS REQUIREMENTS                                          ~   3  1 3.1 FUEL THERMAL-MECHANICALDESIGN P
                                                                            ~   3  1 3.1.1        Fuel System Description                             ~   3-1 3.1   ~ 2    Design Bases                                        ~   3  2 3 ~ 1~3      Mechanical Design Evaluations                       ~   3 2 3.1 '        Test, Inspection, and Surveillance Programs                                            ~   3  3 3.2  NUCLEAR DESIGN                                                   ~   3  3 3.2.1        Reload Fuel Description                             ~   3  3 3.2 '        Design Bases                                            3-4 3.2.3        Nuclear Design Evaluations                 ~  ~  ~      3-4 3.2.4        Reload Fuel Design Methodology                          3-4 3.2.5        Nuclear Input Parameters Used in the Safety Analysis                                                3-4 v

3.3 THERMAL-HYDRAULIC DESIGN ~ ~ ~ 3 5 3.3.1 Thermal-Hydraulic System Description 3-5 3.3.2 Design Bases 3-5 3.3.3 Thermal-Hydraulic Design Evaluations ~ ~ ~ 3 6 4.' SAFETY ANALYSXS REQUXREMENTS . . . . . . . . . . . . . . 4-1 4.1 SAFETY ANALYSIS CATEGORXES . . . . . . . . . . . . 4-1 4.1.1 Normal Operation and Anticipated Operational Occurrences 4-1 4.1.2 ,Accidents 4-5 4.1.3 . Special Events 4-8 4;2 SAFETY ANALYSIS CRXTERIA AND LXMITS 4-10 4.2.1 Normal Operation& Anticipated Operational Occurrences . ... . . ... . . . . . . . . 4-11 4.2.2 Accidents . . . . . . . ., . . . . . . . . 4-12 4.2.3 Special Events . . . . . . . . . . . . . . 4-13 5.0 RELOAD ANALYSIS

5.1 INTRODUCTION

5.1.1

5. 1.2

Reload Analysis Process

Relationship to Plant Safety Analysis

4

5~1 1 5~1 1

5. 1-1 0

                 . Requirements                                     ~ ~ ~, ~  5~1 3 5.1.3      Reload Evaluation Requirements..                 ~ ~ ~  ~  5 .1-4 5.1.4 Safety Limits Used in the Analysis Process 5.1-4 5.1.5 Process for Identifying Potentially Limiting Events..                                                   5.1-9 5.2 RELOAD:.ANALYSIS REQUXREMENTS . . . . . . . . . . 5.2-1 5.2.1 Anticipated Operational. Occurrences Assessment                                                 5.2-2
       -5.2.2 Accident Assessment                                             5.2-5 5:2.3, Special Events Assessment                    ~ ~     ~ ~       5.2-8 5.2.4 Potentially Limiting Events for Reload
               ~

Analyst.s;. 0

                                                            ~ ~   ~ ~        5.2-10 5.3 EVENT ANALYSIS PROCESS                                              5.3.1-1 5.3.1 Event Analysis Overview                                      5.3.1-1 5.3.2 Loss of Feedwater Heating                                    5.3.2-1
                                     -Vi

5.3.3 Generator Load Rejection Without, Bypass 5.3.3-1 5.3.4 Control Rod Withdrawal Error at Power . 5.3.4-1 5.3.5 Fuel Loading Error Mislocated Fuel Assembly 5.3.5-1 5.3.6 Fuel Loading Error Rotated Fuel Assembly 5.3.6-1 5.3.7 Feedwater Controller Failure Maximum Demand 5.3.7-1 5.3.8 Recirculation Flow Controller Failure Incieasing Flow 5.3.8-1 5.3.9 Contxol Rod Drop Accident 5.3.9-1 5.3.10 Loss of Coolant Accident . . . . .' ~ . 5.3.10-1 5.3.11 Shutdown Margin ~ ~ ~ 5.3.11-1 5.3.12 Standby Liquid Control System Capability ~ ~ ~ ~ ~ ~ ~ ~ 5.3.12-1 5.3.13 ASME Code Overpressure Protection Analysis 5.3.13-1 5.3.14 Stability 5.3.14-1 6.0 DOCUMENTATION REQUIREMENTS . . . . . . . . . . . . . . . 6-1 6.1 RELOAD

SUMMARY

REPORT . . . . . . . . . ., . . . . . 6-1 6.2 CORE OPERATING LIMITS REPORT . . . . . . . . . . . 6-1 6.3 TECHNICAL SPECIFICATIONS ... . . . . . . . . . . . 6-2 7.0 LOADING PATTERNS . . . . . -. " '- . . . . . 7-1 7.1 CHANGES IN REFERENCE LOADING PATTERN . . . . . . . 7-1 7.1.1 End-of-Cycle Exposure and Axial Exposure Distribution ~ 7 1 7.1.2 Number and Location of Reload Fuel Assemblies ~ 7 2 7.1.3 Type, Number, and Location of Exposed Fuel Assemblies . . . . . . . . . . . . . . . . . 7-2 7.2 RE-EXAMINATION OF A RELOAD ANALYSIS . . . . . . . 7-2 8o0 I CONCLUS ONS ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

                                                       *
                                                         ~  v ~    ~  ~   ~  ~  ~   ~  ~ 8 1

APPENDIX A STATISTICAL COMBINATION OF UNCERTAINTIES METHODOLOGY APPLICATION . . . . . . . . . . . A-1 APPENDIX B HOT CHANNEL METHODOLOGY . . . . . . . . . . . B-1 APPENDIX C GENERATION OF KINETICS DATA . . . . . . . . . C-1

ABSTRACT This report documents the ability of the Supply System to perform reload analyses that'nsure successful reload fuel designs and core configurations. These analyses'also ensure compliance with all regulatory requirements and conformance with industry practice. The reload analysis begins with an energy utilization plan and a reference core design for the next reactor cycle. An integrated set of computer codes and a range of analysis techniques, such as the statistical combination of uncertainties, make it possible to evaluate limiting events. These evaluations provide the bases for any changes in operating limits and technical specifications and ensure that WNP-2 will operate safely with each fuel reload and each new core configuration. The Supply System will document the results of each reload analysis in a reload summary report.

~ U 0

REVISION HIS'POD I I ( This Applications Topical Report for BWR Design and Analysis has ( the following revision history: I ( Rev. 0: September 1991 I Rev. 1: December 1992 I I Changes from the previous revision are flagged by a vertical bar in, the outside margin. I

Z3.3. gJ 't

SECTION 1 ' INTRODUCTION The Washington Public Power Supply System (WPPSS or Supply System) operates the Washington Nuclear Project No. 2 (WNP-2). Designed by General Electric, WNP-2 is a BWR/5 boiling water reactor (BWR) with a licensed core thermal power of 3323 MWt. A power uprate to 3486 MWt is scheduled for 1994. The Supply System has developed a methodology for the reactor safety analysis. This report describes the application of that methodology to the fuel reload design. 1~1 RELOAD ANALYSIS OVERVIEW The reload analysis begins with development of the following: utilization plan that establishes operational . an energy goals for the reload a prediction of the end-of-cycle core condition for the current operating cycle a reference fuel cycle. These sources provide information for a tentative fuel design and reference loading pattern, which are then evaluated with the lattice physics codes and a three-dimensional core simulator code. After the fuel design and reference loading pattern have been determined, a safety analysis evaluates potentially limiting events. These events have been divided into three categories that reflect the probability of occurrence and analysis requirements: o normal operation and anticipated operational occurrences o accidents o special events. 1-1

Screening identifies the potentially limiting events in three categories. reload analysis. each of the These events are then re-evaluated during each 0 Analyses of limiting events provide the bases for any changes in ) core operating limits or technical specifications. The Supply ) System's lattice physics methods, three-dimensional simulator code, ) and transient analysis methods are used, for evaluating all three ) categories of events. Analyses of the consequences of rod drop ( accidents and loss of coolant accidents (LOCA) rely, in addition, ( on the fuel vendor's generic analysis results. H Cycle-specific reload summary reports document the results of reload analyses, which provide the basis for any changes in core operating limits or technical specifications. Figure 1-1,provides an overview of the reload analysis process. 1' METHODOLOGY IMPLEMENTATION AND UPDATING Implementation of the reload analysis methodology will require amending the technical specifications so they reference this

topical report in addition to the various fuel vendor topical reports. This reload analysis methodology will also be updated as required to reflect changes in design and technology, and all Supply, System documents will reflect these changes.. ~ Approved: copies of this report will be issued in loose leaf binders. Revisions will be issued as page changes. Page change records will provide traceability to previous versions and identify firmly which methodology was in place when a specific analysis was done. Furthermore, every page of the report will include ( information to indentify the applicable revision number. 1-2

Energy Utlllxntlon Plan End af Cycle Prediction Reference Fuel Cycle Fuel Oesign Lattice Physics and ECCS Analysis and Reference Methods 30 Simulator Loading Pattern Anticipated Operational Special Accidents Occurrences Analyses Load Reiectiolt w/0 arp ass atwtdown Margin Loss ot Cootanl Accident Loss ot Feedwater Heating aLCS CapaMity Controt Rod Drop Aociden\ Feedwator control/or Faittrro Ovorpressuro protection Fwl Loading Error Accidera Control Rod Y/Ahdrawal Error ala bsty Reciro. Row Controller Faihre. Core Control Rod Drop Transient Analysis Operating Methods Limits Analysis Methods Application of Reload Reactor Analysis Summary Methods Report Figure 1-1. Reload Analysis Overview 1-3'

 'I I

I

               'I 4 It I ~ ~

I lI

SECTION 2 ' COMPUTER CODES AND ANALYSIS TECHNIQUES The reload analysis ensures that the reload fuel design and core configuration satisfy regulatory requirements. To meet these requirements, the reload analysis draws on a number of computer codes and analytical techniques for the design analysis and safety analysis. Uncertainties in the results may be evaluated using either a deterministic approach or the statistical combination of uncertainties (SCU) method. Together the design analysis and safety analysis accomplish the following: establish an operating limit minimum critical power ratio (MCPR) that ensures the fuel cladding integrity limit will not be exceeded as a result of an anticipated operational occurrence or a fuel loading error demonstrate that the protection against fuel failure (PAFF) limits will not be exceeded as a result of an anticipated operational occurrence 0 establish maximum average planar linear heat generation rate (MAPLHGR) limits that ensure the consequences of a LOCA satisfy the requirements of 10CFR50.46 demonstrate that the reload core design has sufficient shutdown margin demonstrate that the core can be shut down without the control rods demonstrate that the consequences of a control rod drop accident fall within regulatory bounds demonstrate that the results of the Code overpressure protection analysis meet the requirements of 10CFR50.55a. 2-1

2~1 CODE DESCRXPTXONS The Supply System methodology uses a suite of computer codes and associated models and'ode inputs to analyze .the limiting events associated with the design and safety analyses." The Supply System codes consolidate core physics, system thermal-hydraulics, and core thermal-hydraulics into an integrated system. These codes are comparable to those used by nuclear steam supply system (NSSS) and reload fuel suppliers, and have been extensively validated by comparison to plant data, experimental 't'est facility data, and benchmark analytical'alculations. 'he. methodology draws

->>

particularly heavily on the. Reactor Analysis Support Package (RASP) system of computer codes developed by the Electric Power Research Institute (EPRI) [Reference 1]. Several utilities use RASP for a range of applications, including o 0 o o fuel cycle core design management plant reload licensing support development of analytical bases to support changes in., plant 0 design and configuration, protection system setpoints, and

 *I~ '

technical specifications. C 1

t The Supply System 'supplements the RASP .codes".with a "number of special purpose codes.'hese codes have been implemented by the A

Supply System and are integrated with specific facets of the fuel ) supplier methodology. The RASP codes and special purpose:codes can ) also be used to perform other analyses that. support operations. Figure 2-1.- shows 'the computer:=codes and c'ode sequence. V All computer codes are maintained and contiolled by the .NRC-approved ( Supply System quality assurance program 2~2

2.1.1

    ~ ~         Reactor Physics Codes The       reactor physics codes model steady-state core conditions;

, simulate slow transients that can be analyzed with quasi-steady-state methods; and provide neutronics input for dynamic analyses. These codes include 0 MICBURN-E, a pin cell code, to treat gadolinia isotopic

depletion 0 CASMO-2E, a lattice physics code 4 0 SIMULATE-E, a three-dimensional core simulator code 0 ,. NORGE-B, a linking code for transferring data from CASMO-2E to

          ,SIMULATE-E and to the core neutronics linkage code, SIMTRAN-E.

MICBURN-E and SIMULATE-E were developed by EPRI [References 2, 3]. NORGE-B was developed by EPRI and modified by the Supply System t'Reference 4]. CASMO-2E was developed by Studsvik Energiteknik AB ( [Reference 23]. I

2. 1. 1 ~ 1 MICBURN-E 4

MICBURN-E is a multigroup, pin-cell physics code for analysis of light water reactor fuel rods with homogeneous mixtures of uranium (UO~) and gadolinia (Gd~O~) ., MICBURN-E,uses integral. transport theory to calculate neutron flux distributions and eigenvalues; 1 it employs a time-dependent analysis method to calculate fuel rod lt isotopic distributions as a function of burnup. In the reload analysis, MICBURN-E generates burnable absorber data for input to CASMO-2E. ,The resulting files contain effective microscopic absorption cross sections tabulated as a function of burnup for a pseudo-burnable absorber. nuclide equivalent to the

,constituent absorber nuclides of the gadolinia.

2-3

2 1~1 2 CASMO 2E CASMO-2E is a multigroup,'wo-dimensional transport theory code used for burnup calculations on fuel assemblies or simple pin cells. This code uses transmission probabilities to solve the neutron transport equation within a two-dimensional representation of the fuel assembly. In BWR applications, CASMO-2E treats cylindrical fuel 'ods of varying composition in a square pitch array; with allowance for fuel rods loaded with gadolinia. It also handles fuel assembly channels, water gaps between fuel =" assemblies,.; - incore instrumentation, and cruciform control rods. Input data to h CASMO-2E includes the following: h h o comp'osition data"for the fuel and structure h o burnable absorber data produced by MICBURN-E 0 assembly and control rod dimensions o internal fuel rod arrangement o average fuel temperature from ESCORE analyses. o power density CASMO-2E performs the following sequence of calculations: o a'resonan'ce calculation a pin cell calculation for each type of fuel rod in the

assembly o

one-dimensional'pectrum calculation 0 a two-dimensional power distribution and k calculation o a 'calculation of assembly-averaged; two-group cross sections and kinetics parameters. h 0

For each lattice design, CASMO-2E also calculates neutronics data as a function of the following BWR parameters: 0 exposure history 0 exposure-averaged relative moderator density 0 instantaneous relative moderator density o control rod presence o control rod history o . fuel temperature ~ ~ o moderator temperature o xenon concentration 4 h ~ o samarium concentration o boron concentration.. CASMO-2E provides the cross section data used, by SIMULATE-E in, the core analysis and the inverse neutron velocities and delayed neutron fraction used by SIMTRAN-E. In addition, CASMO-2E produces the local peaking factor distribution and incore detector response. CASMO-2E has been qualified for use in the reload analysis [Reference 5]. 2 1~1~3 NORGE 3 '1

~,

NORGE-B is a ..data handling and processing ..code used for E transferring data from CASMO-2E to SIMULATE-E and through SIMTRAN-E to the transient analysis codes. NORGE-B provides SIMULATE-E with the following: 4 o partial cross sections in the form of two-dimensional interpolating tables and polynomial fits o ". "additional. polynomial fits for -.isotopic fission yields and neutrons per fission. NORGE-B provides SIMTRAN-E with the following: o two-group inverse neutron velocities o the total effective delayed neutron yield. 2-5

2. 1 ~ 1~4 SIMULATE-E SIMULATE-E is a coarse-mesh, three-dimensional, nodal-diffusion code used for steady-state core analysis. It models the reactor core as a matrix of neutronically coupled nodes, each a six-inch axial segment of a fuel assembly. The core analyses use cubic nodes. For each node, SIMULATE-E uses two-group macroscopic cross section data to solve the coarse-mesh diffusion theory equations in one energy group. Fast and thermal neutron flux distributions are determined from the neutron source based 'on the steady-state balance of the slowing-down and thermal-capture reaction rates.

SIMULATE-E uses the FIBER steady-state thermal-hydraulic model to predict the flow distribution for a'iven power distribution. Calculations from the pressure drop analysis provide active- and bypass flow 'distributions. The.- thermal-hydraulic analysis performed at the beginning of each void iteration provides information about the void distribution. The void distribution determines the nodal cross section values, which in turn determine the thermal power distribution. The relative moderator density of the active coolant is calculated from the thermal power distribution using the void quality profile model. ,"Iterative calcul'ations of the neutron flux, thermal power,. and moderator density'istributions continue until they are consistent. ' Input to SIMULATE-E includes the cross section data provided .by NORGE-B, a description of the- core -loading pattern,'he power level, the coolant inlet subcooling and flow rate, and the control rod positions. SIMULATE-E develops the three-dimensional macroscopic cross section data processed by SIMTRAN-E for" input to RETRAN-02. -'SIMULATE-E also gives k-effe'ctives, nodal -power distributions, and nodal exposures.'IMULATE-E has been qualified 'for use.in the- reload analysis [Reference 5]. 2 6

2.1.2

  ~ ~    Core Neutronics Linkage Codes The core neutronics linkage codes, SIMTRAN-E and STRODE, translate SIMULATE-E data into, a form that can be used by RETRAN-02.

SIMTRAN-E was developed by EPRI [Reference 6]. STRODE was developed by the Supply System. 2~1 2~1 " SIMTRAN;E P SIMTRAN-E is a'ata handling and processing code used for transferring data from SIMULATE-E and NORGE-B to .RETRAN-02. SIMTRAN-E reads data from the kinetics parameter tables produced by NORGE-B and from two SIMULATE-E cases. .The first SIMULATE-E case models the reactor at the operating state that will represent the initial- conditions for the RETRAN-02 -transient analysis.. The 4 second SIMULATE-E case represents the same. state, but, with the control rods fully inserted and the void .and power reactivity feedbacks disabled to allow a calculation of the scram reactivity. (Applications to transients that do not cause a scram do not require the second SIMULATE-E case.) SIMTRAN-E radially collapses the three-dimensional cross section and kinetics parameter data read from the SIMULATE-E, cases,to one dimension'by using appropriate weighting functions. Depending on the particular cross section involved, the weighting function is either the volume, the product of the volume and.the flux, or the product of 'the volume and the adjoint flux. ~ SIMTRAN-E then generates several perturbations of the moderator density and fuel temperature about the values obtained from the -initial SIMULATE-E case...The axial shape of these perturbations is specified as input., SIMTRAN-E expands the perturbations to r three dimensions and generates the. corresponding perturbed cross sections and kinetics parameters;: These three-dimensional perturbations then are collapsed to one dimension as in the base case. The resulting changes in each cross section and each kinetics parameter are represented as polynomial functions of the moderator density 2-7

and the square root of the fuel temperature. These polynomial fits are subsequently used by RETRAN-02. 2~1~2 a2 STRODE STRODE takes SIMULATE-E data processed through SIMTRAN-E and adjusts the polynomial fits before the data are input to RETRAN-02. This adjustment eliminates differences in core average feedback that otherwise result because SIMULATE-E and RETRAN-02 calculate moderator densities differently. STRODE uses the results from parallel SIMULATE-E. and RETRAN-02 cases to quantify the differences between axial'oderator density distributions predicted by the two codes given identical variations in core pressure. STRODE uses the differences between the=axial arrays to modify hhe'" polynomial coefficients 'associated .with changes in moderator density to obtain consistent moderator, density reactivity feedback between SIMULATE-E and RETRAN-02. The .STRODE output data is in the same form as that of SIMTRAN-E and is used directly as input'to RETRAN-02. STRODE also corrects the delayed neutron fractions in the one-dimensional data, which are based on the cross section libraries used by CASMO-2E. Delayed neutron fractions in the CASMO-2E cross section library (obtained from ENDF/B-III) are lower. than those in the more recent cross section library (ENDF/B-V). The STRODE adjustment makes the one-dimensional data consistent. with the more 1 recent data.' E

                                                             ~  r
 ~ 1~3  System and core Thermal-Hydraulics codes RETRAN-02,      the system thermal-hydraulic code, and VIPRE-.,Ol, the core thermal-hydraulic code, evaluate core-vide transients for the reload analysis.        Both codes were developed" by EPRI [References 7,8].

2~1~3~1 RETRAN-02 RETRAN-02 is a neutronic and thermal-hydraulics transient analysis code- for modelling, nuclear power plants under both normal and

                         ,p accident conditions. This code can be used either with a point- or with a one-dimensional kinetics representation of the core.

In the reload analysis, RETRAN-02 ana3.yzes dynamic plant transients using one-dimensional neutron kinetics and the core and system-wide n thermal-hydraulic models. The RETRAN-02 code solves one-dimensional, two-group, diffusion theory neutron kinetics equations d using the space-time factorization method. SIMTRAN-E and STRODE provide the neutronics input to RETRAN-.02. J 4 RETRAN-02 is a variable nodalization code requiring user input to specify the system model, which consists of control volumes, heat slabs, and a flow path network. The RETRAN-02 models in 'this analysis were developed by the Supply System. They were qualified by comparing model predictions with experimental data. Data sources included plant startup tests and the Peach Bottom-2 turbine trip tests. The RETRAN-02 model has been qualified for use in the . reload and plant safety analysis [Reference 9]. RETRAN-02 solves conservation of mass, ,momentum, and energy equations for the fluid mixture. Relative velocities of liquid and vapor are calculated with an, algebraic slip model that uses a drift flux approach. Channel friction is. calculated using a two-phase friction multiplier to the single-phase friction factor. Heat . transfer is calculated with a time-dependent, one-dimensional heat conduction equation. Fill junctions or time-dependent: volumes specify the boundary conditions for system thermal-hydraulic calculations. s t g RETRAN-02 component models..represent, valves, pumps, and steam separators. Valve opening and closing characteristics are simulated using a table of valve-flow-area versus time. Pump characteristics are simulated with a set of pump curves. Steam

                                        ,2-9

separators are modelled with the bubble rise model. Control systems and component trips can also be modelled with RETRAN-02. 2~1 3~2 VIPRE-01 VIPRE-01 analyzes steady-state and transient reactor core thermal-hydraulic conditions. This code also evaluates the MCPR, fuel and cladding temperatures, and coolant conditions. VIPRE-Ol can be used for the steady-state or transient analyses of BWR cores with geometries ranging from a single fuel assembly or flow channel up to an entire core.. Possible simulations include transient variation of inlet flow, inlet enthalpy, system pressure, average power, local pin power, and power shape. The transients VIPRE-01 evaluates can range from those found under normal operating conditions to those that develop during moderately severe accidents. Transients occurring entirely within the core can be simulated by VIPRE-01 alone. Transients involving primary system effects outside the core must first, however, be simulated with a syst: em code, such as RETM-02 that can provide core g boundary conditions to VIPRE-01. VIPRE-01 predicts three-dimensional velocity, pressure, thermal-energy fields, and fuel rod temperatures for single-phase and two- 'phase flow. This code. also solves the finite difference equations for mass, momentum, and energy conservation for an interconnected array of channels assuming incompressible, thermally expandable, homogeneous flow. The equations are solved with an implicit numerical method that places no restriction on the time step or node size. Although the formulation is homogeneous, it includes models for subcooled boiling and vapor/liquid slip in two-phase flow. The Supply System uses VXPRE-01 to predict changes in the, critical power ratio (bCPR) during transients; these changes establish the operating limit." 0 MCPR 2-10

2. 1. 4

  ~ ~     Other Codes The    reload analysis also uses a number of supplementary codes to perform specific functions.         These codes include ESCORE, FICE, RQDDK-E, TLIM, CALTIP, RBLOCK, and STARS.         ESCORE, RODDK-E, and STARS were developed by EPRI [Reference 10, 11, 12].         RBLOCK was developed by the Yankee Atomic Electric Company [Reference          13].

The remaining codes were developed by the Supply System. 2 1 4 ' ESCORE ESCORE predicts'he steady-state, thermal-mechanical performance of fuel rods. In the reload analysis, ESCORE provides the fuel and clad temperature distributions used in the lattice physics calculations. Escore models 0he fuel rod as-a series of discrete axial segments; independent radial thermal equilibrium calculations are performed for each one. The results for each axial segment are coupled through the assumption of the complete mixing of the fill gas and fission gases within the free volume of the fuel rod. Models within ESCORE describe the fuel pellet and cladding behavior as they are influenced by irradiation history. -Fuel pellet models include a steady-state, radial-temperature predictor with flux or power depression, thermal expansion, relocation, densification, swelling, fission gas production and release, and elastic and non-elastic deformation. Cladding models include a steady-state temperature predictor with power deposition, thermal and elastic expansion, creep, and growth.,- The fuel pellet is assumed to be a right circular cylinder that responds to thermal- and fission-induced volumetric changes. The fuel cladding conforms elastically and plastically to the calculated conditions of pellet-cladding contact. The internal pressure of the fuel rod is calculated from the amount of fill gas, 2-11

the amount of fission gas released, and the free volume of the fuel rod. The fuel temperature depends on the fuel-pellet-to-cladding gap conductance calculated as a function of the gap-gas conductivity and open-gap size or contact load. 2 ' ' ' FICE FICE is a data handling and processing code used to transfer data from CASMO-2E to the thermal limits code, TLIM, and the traversing incore probe (TIP) calculational code, CALTIP. FICE provides the following data to TLIM: I o the local peaking functions needed'or the critical.. power ratio (CPR) correlation (the reload'nalysis currently uses tl the ANFB correlation) 0 the maximum local peaking factors- needed for calculation of linear heat generation rates (LHGR).- ( Local peaking functions for the ANFB correlation are based on ( Siemens Power Corporation'(SPC, formerly known as Advanced Nuclear ) Fuels, or ANF) methodology. They are used to account for the local peaking factor, the bundle geometry, and 'the spacer--effects. FICE provides to CALTIP data tables that can be used for interpolating detector signal rate responses. P 2.3. 4 3 RODDK-E provides'rapid estimation of relative control- rod I'he RODDK-E code worths. RODDK-E uses "a'wo-dimensional; FLARE-based .source 1 t

, iteration method to solve the neutron balance, and a FLARE-based source normalization method*to reproduce 'a more detailed'SIMULATE-E
. neutron source distribution. RODDK-E also predicts'the'relative E

order of control rod worths', which facilitates'-the selection of control rods for analysis with the more detailed SIMULATE-E code. SIMULATE-E provides more accurate and more detailed'ssessments of control rod worth, which reduces some of the uncertainty in the results obtained from RODDK-E. 2 12

2 ~ 1. 4 ~ 4 TLIM TLIM is used to evaluate the thermal margins associated with the ,results of a SIMULATE-E case. Thermal margins evaluated by TLIM include the following: o, CPR 0 LHGR 0 average planar linear .heat generation rate (APLHGR). 2 1 4.5 CALTIP CALTIP calculates expected .TXP. responses for a given core configuration. The. core configuration is first modeled with the t SIMULATE-E code; CALTIP reads the resulting nodal fluxes, exposures, and other variables from the SIMULATE-E restart file. I CALTIP then uses the nodal variables to obtain nodal detector signal rates by interpolating in tables generated by the FICE code from CASMO-2E results. The nodal detector signal rates are then combined and normalized to produce the predicted signal rates for each TIP measurement. CALTIP reads the measured TIP data, compar'es each measurement with the corresponding predicted value, and prints a statistical summary of the results.

                                                                         't 2 ~1~4~6      RB LOCK t

RBLOCK predicts the response of the rod block monitor (RBM) system for specified failure combinations of local power range monitors (LPRM) or LPRM strings. It also identifies the most limiting 'notch position, where a rod,block would be predicted to occur for a given limiting failure combination., The RBLOCK code uses individual t LPRM responses calculated by the .CALTIP code. Xt also uses "TLIM calculations for the MCPR and .maximum linear heat generation rate t ~ (MLHGR) as ta function of notch position.

RBLOCK generates an output summary to assist in evaluating, compliance with the event acceptance limits for control rod withdrawal errors. 2-13

2~1~4~7 STARS STARS applies the SCU methodology to determine the overall probability distribution for an analysis result in a specific event. The variable'f interest 'is an uncertain quantity with statistical properties estimated by STARS from a response surface/Monte Carlo analysis. The response surface provides a fit to the results of a systems simulation code or code package, such as RETRAN-02/VIPRE-01. STARS can develop a second-order response surface, with all cross terms, for up to nin'e parameters. It can also be'sed to-establish selected cubic and quartic dependencies. The Supply"System-safety analysis uses a second order response surface fit with .four or fewer parameters. ) Evaluation of a response surface is based. on a central'omposite experimental design technique that identifies a reasonable number of cases to be run with the systems simulation code. Additional data points may be added later to reduce the fitting error. STARS can use up to 350 data'oints to evaluate the response surface 0 polynomial fitting coefficients, which are determined by a least 4 .squares. analysis. I 2.2 STATISTICAL COHBXNATXON"OF UNCERTAXNTXES METHODOLOGY'. lw 1 The safety analysis must consider uncertainties in models, .model inputs, instrumentation systems, and the operating state.. The approach usually taken assumes that all significant uncertainties J are simultaneously at their most adverse points given the possible

  ,'I              'I range of conditions; The plant usually'-has sufficient margin. to accommodate this approach. "Occasionally;- however,"          this. approach can lead to core operating 'limits or -technical 1
                                                               'specification setpoints that result in undesirable plant restrictions.In these cases, the safety analysis uses the SCU methodology to define a set of more operationally acceptable setpoints while retaining a sufficient level of conservatism.
                                      2-14 0

The SCU methodology used by the Supply System is based on the approach in the EPRI setpoint analysis guidelines [Reference 14]. This approach consists of the following: o identifying the event acceptance critexia and limits that will be used to evaluate the analysis results o developing a response surface and applying the methodology. 2.2.1 Event Acceptance Criteria and Limits The SCU methodology xequixes determining which part of a system will receive the greatest challenge from a specific event. The SCU analyses must then indicate a 95% pxobability that the consequences of such an event will be less severe than predicted. Furthermore, the methods of arriving at the probability figure must be sufficiently conservative to ensure a 95% degree of confidence that the figure is correct.- In the reload analysis, this degree of confidence is obtained by using deterministic inputs for all parameters except those treated statistically in the development of the response surface or the model uncertainty.. The SCU analysis of anticipated operational occurrences may be used to establish two core operating limits: the operating limit MCPR and the operating limit LHGR. The operating limit MCPR ensures a greater than 95% probability that the MCPR for the fuel cladding integrity (greater than 99.94 of the fuel rods in the core will not be expected to experience boiling transition) will not fall below the, specified limit. The operating limit LHGR ensures a greater than 95% pxobability that PAFF limits (less than 1% plastic strain of the cladding,and fuel centerline melt temperature) will not be exceeded. In the safety analysis,.the SCU methodology is applied to the operating limit MCPR. The PAFF limits are obtained from the C fuel vendor's analysis.. 2-.15

2.2.2 Response Surface Methodology ( The statistical simulation of an event requires a large number of ( cases to be run to obtain the desired accuracy. Response surface ( methodology provides an efficient way of reducing the number of ( system and core thermal hydraulic analyses required to make an ( accurate statistical statement about the event analysis results. b Development of a response surface approximating key results of event, analysis codes requires five steps: o quantifying the model uncertainty o"'electing and quantifying the, parameters for the response surface o'eveloping the'response surface o 'imulating an event using the. response surface o

        convolving     the response surface for, the event. with the model uncertainty.

Quantifying the model uncertainty requires establishing the effect of modelling and input uncertainties on key results of the event analysis. -Analysis models are run with perturbed inputs to quantify the effect of specific changes on output., The results are statistically combined to characterize overall model uncertainty. These results are later combined with the results of the response surface analysis to provide an. overall probabilistic statement. Selecting and "quantifying parameters . requires screening to

determine. their relative impact. on the analysis. The parameters tha't provide the greatest relative improvement in the evaluation are used for the response.,surface.. Typically, no more than four parameters are used. The Supply System will attempt to limit the 'umber to one or two." '. 1I Developing a response surface requires defining the specific system

and core thermal-hydraulic cases that must be run to obtain the desired degree of accuracy. A.response surface is a polynomial fit,

                                        '. 2-16

to a set of experimental design .cases; this fit approximates the results of the syst: em and core thermal-hydraulic analysis model for a specific output parameter over a limited range of interest. The polynomial fitting coefficients that define the response surface are determined by a least squares fitting technique. As part of the fitting process, the fitting exror, which represents the uncertainty introduced into the analysis by the use of the response surface, is determined. I Once a response surface ',has been defined,, the event'an be

simulated using Monte Carlo techniques. These techniques select a random sample of each independent parameter based, on its . statistical characteristics. - The dependent, variable is then calculated from the response surface. Each set of random, samples forms one history for statistical evaluation of the - dependent variable. Sufficient histories (typically 100,000) will accurately quantify the probability of a . given result for a dependent

variable. Convolving the response surface with the model uncertainty establishes an overall probability..distribution for the analysis results. This probability distribution is then used to demonstrate compliance with the event acceptance limits. The computer codes used in the Supply System, reload analysis make three contributions to the SCU evaluation:, 0 perturbation analyses that establish the model uncertainties sensitivity studies that identify the parameters,to be treated statistically in the development of"the response surface 0 analyses that determine the:shape of the response surface. A cornerstone in the SCU methodology is the STARS code. .This code calculates and evaluates the response surface fitting coefficients based on the experimental'esi'gn, performs the, Monte Carlo assessment of the response surface, and convolves the response surface with the model uncertainty. 2-17

Appendix A gives more detail about the application of SCU methodology in the Supply System safety analysis.

I Fud Sctrptw LOCA ESCORE MICBURN-E ECCS Resuts Methods t Fud Scppter CROA CRDA GAS MO-2E Reaks Methods t NORGE-8 FICE ROD DK-E Fuel Scppter I Satety Ant I SIMULATE-E SLCS I Methods SIMTRAN-E Capabtty with FIBWR Fud Cbddng Fuel ScTtptrs I CALTIP TUM Fuel T4l Irtepty Ltnt STRODE Fud MCPR PAFF R BLOCK Laadng Operating Urnts. Error Leant Loss ct Overpresstse Feedrrrtsr RETRAN-02 Prttectiort Hmthg Fud Scpptcr Rod ,'ap Conchctmce Wthctawal

               'ethods                                    Error Recto Florv VIPRE-01       Cortrotrs
                                      ,

FaLse CLR w/o bp STARS FWCF Figure 2-1. Code Sequence for WNP-2 Reactor Analysis Methodology

SECTION 3i0 DESIGN ANALYSIS REQUIREMENTS This section discusses design criteria, technical bases, supporting analyses, and test results for the thermal-mechanical, nuclear, and thermal-hydraulic design of reload fuel. As described below, fuel design analyses involve efforts by both the Supply System and the fuel vendor. I 3.1 PUEL THERMAL-MECHANICAL

DESIGN The thermal-mechanical design description includes the following: 0 a fuel system description 0 the design bases 0 a description of mechanical design evaluations a summary of supporting test, inspection, and surveillance programs. The fuel vendor develops the thermal-mechanical design for the reload fuel. 3.1.1 Fuel System Description The fuel system description includes the following: 0 a description of the fuel assembly and its component parts, including fuel rods, water rods, tie plates, and spacers 0 fuel assembly drawings with dimensions of all components 0 reference design values for all parameters identified in the standard review plan. The fuel vendor supplies the fuel description as part of the generic licensing of the fuel design. Reference 15 is an example of a fuel vendor report with this information. All fuel designs currently being used by the Supply System for reload fuel have been approved by the NRC. 3-1

3.1.2 Design Bases The design bases provide the criteria for acceptable fuel assembly performance during normal operation, anticipated operational occurrences, and postulated accidents. Design bases are developed for both the fuel rods and the fuel assembly. Fuel rod designs must comply with regulatory requirements for the following: 0 "rod internal pressure 0 cladding strain 0 cladding temperature 0 fuel temperature 0 cladding fretting wear cladding fatigue cladding coxrosion 0 hydriding 0 cladding collapse 0 fuel enthalpy. Fuel assembly designs must comply with xegulatory requirements for the following: o 'structural" integrity' corrosion hydriding 0 dimensional compatibility 0 hydraulic loads dimensional 'stability 0 shipping and handling loads 0 fuel coolability. 3.1.3 Mechanical Design-Evaluations, . Design evaluations ensur'e that all bases for a proposed reload fuel design and core configuration have been satisfied. The results of these evaluations are documented in the reload summaxy report. Licensing topical reports submitted to the NRC describe the models 3-2

~,

used in specific design analyses.

~ ~

The results . of design evaluations are used to set core operating limits. 3.1.4 Test, Xnspection, and Surveillance Programs Testing, inspection, and surveillance programs ensure the operational acceptability of proposed reload fuel designs. These programs are described in generic topical reports submitted by the fuel vendor to the NRC. Reference 16 is an example of such a report. 3.2 NUCLEAR DESXGN The nuclear design description includes the following: a reload fuel description

0 the design bases a description of nuclear design evaluations a description of the reload fuel design methodology the nuclear input parameters used in 0he safety analysis.

The reload summary report and the licensing topical reports that support it provide the nuclear design bases necessary to approve the proposed reload fuel design. 3.2.1 Reload Fuel Description The reload fuel description includes the following: the enrichment distribution in the assembly 0 the amount and location of burnable poison in the assembly the moderator distribution within each fuel assembly. The reload summary report documents this information for each reload. 3-3

3.2.2 Design Bases Nuclear design bases ensure that functional and regulatory requirements for nuclear design are satisfied. Nuclear designs must comply with regulatory requirements for the following:

                                                                           'I o      fuel burnup o   .. reactivity coefficients                                      ~ If o      control of power distribution o      shutdown margin o      criticality criteria for fuel      storage o      stability.

3.2.3 'uclear.,Design Evaluations Design evaluations ensure that all nuclear design bases for the proposed reload fuel and core configuration have been satisfied. 3.2.4 Reload Fuel Design Methodology The description of the reload core design methodology documents the

~'approa'ch to-the   reload core design. The .description includes a reference -core design for the proposed reload and all analyses required for licensing.

3.2.5'uclear Input Parameters Used, in the Safety Analysis Nuclear input parameters are an important aspect of a safety analysis. These parameters include -o: core kinetics characteristics I '"o

scram reactivity, =,-.

0 core power distributions 0 core neutron cross sections and their dependencies on the fuel temperature and coolant void level.

                                     ,3  4

Each safety analysis model requires a slightly different. set of input parameters. These parameters are evaluated for core conditions that make the consequences of a particular event most 'severe. 3.3 THERMAL-HYDRAULIC DESIGN The thermal-hydraulic design description includes the following: a thermal-hydraulic system description 0 the design bases p 0 a description of thermal-hydraulic design evaluations... The reload summary report and the licensing -topical reports-that, support it provide the thermal limits necessary to approve the F proposed reload fuel design. ws 3.3.1. Thermal-Hydraulic System Description The thermal-hydraulic system description includes the following: o a list of key hydraulic parameters, such as base rod flow area, hydraulicdiameter, and heated'urface area- of the reload fuel o component loss coefficients that permit hydraulic modelling of the reload fuel in a mixed core'ith co-resident fuel

assemblies. 3.3.2 Design Bases Thermal-hydraulic design bases'nsure'- that 'hermal-hydraulic functional and regulatory requirements are "satisfied. :Thermal-following:'W hydraulic designs must meet regulatory 'requirements .; for the o thermal and hydraulic compatibility o bypass flow analysis 3-5

0 water-rod analysis 0 stability. The thermal design .basis is that greater than 99.94 of the fuel rods are not expected'o experience boiling transition during normal operation or anticipated operational occurrences. Core operating limits that satisfy, this design basis are derived using transient analysis'hCPR methods and a .reactor statistical safety limit methodology [Reference 17]. t Hydraulic compatibility between. reload fuel assemblies and resident fuel assemblies must be demonstrated whenever reload fuel differs hydraulically from "resident fuel." Furthermore,- bypass-flow and water-rod analy's'es must demonstrate that both, the bypass region and the water rods will. remain sufficiently cool during expected operating conditions. The design bases. are that water in. the ( bypass region and in the water rods will remain subcooled during normal operation. 3.3.3 'Thermal-Hydraulic Design Evaluations Design evaluations ensure that all bases for-a proposed reload fuel design and core configuration have been satisfied. Reload summary "reports" document the results of design evaluations and address regions of instability. The "thermal-hydraulic analyses are performed on a cycle-by-cycle basis. Technical specifications implemented at WNP-2 .define regions of instability and preclude operation of the reactor in these regions.

                                   "3-6
                                                                        ~,

SECTION 4 ' SAFETY ANALYSIS REQUIREMENTS Safety analyses determine the safety- margin during normal operation, anticipated operational occurrences, accidents, and special events. They also .-ensure that,'any proposed changes. to plant configuxation satisfy all safety requirements, licensing commitments, and regulatory guidelines and requirements. Furthermore, safety analyses identify any. changes in. operating limits or technical specifications that will be required as a result of 'changes in plant configuration.- Previous safety analyses demonstrate that.WNP-2 can operate safely in its current configuration. The--Supply System methodology will be used to evaluate any changes,to..that configuration, such as the insertion of reload fuel. t 4 ' SAFETY ANALYSIS CATEGORIES Safety analyses evaluate a wide spectrum of plant.,events and conditions. Different acceptance criteria and limits are applied to events with different probabilities of occurrence.. For convenience, 'these events:and conditions have been, divided. into categories that xeflect the probability of occurrence and analysis requirements: o normal operation and anticipated operational occurrences ... o . accidents ~ II o - special events. 4.1.1 Normal Operation and Anticipated Operational Occurrences Normal operation encompasses all modes of planned plant operation, including startup, operation, shutdown, and refueling. Furthermore, all events that require analysis are assumed to initiate from some mode of normal operation. Normal operation therefore provides the initial conditions for the transient safety

analysis, which evaluates the anticipated operational occurrences with parameters that pose the most significant challenge to the fuel or reactor coolant pressure boundary capabilities. Zn the Supply System methodology, these occurrences fall into eight categories: 0 decrease in reactor coolant temperature 0 increase in reactor pressure decrease in reactor coolant flow rate 0 reactivity and power distribution anomalies increase in reactor coolant inventory decrease in reactor coolant inventory , 0 increase in reactor coolant flow 0 increase in reactor coolant temperature. These occurrences include all those identified in applicable regulatory requirements and guidelines. Each occurrence is discussed below. 4.1.1.1 Decrease in Reactor Coolant Temperature

~ ~
    'vents that directly decrease the reactor coolant temperature are those that either increase the flow of cold water or .reduce the temperature of water being delivered to the reactor vessel.

Reducing the reactor coolant (moderator) temperature increases core reactivity, which in turn increases core power. The resulting negative moderator void reactivity shifts power towards the bottom of the core. These changes will lead to a new steady-state power level, which will require corrective action by the operator. Sufficiently high levels of thermal power or neutron flux will cause a scram. Events in this category include o loss of* feedwater heating o inadvertent high pressure core spray (HPCS) startup o inadvertent residual heat removal (RHR) shutdown cooling operation. 4-2

4.1.1.2

 ~ ~  ~    Increase in Reactor Pressure Events    that increase reactor pressure significantly are usually initiated    by a sudden>> reduction .in steam               flow. The     increased pressure    collapses the   voids in the core, which increases core reactivity. This causes      an increase in the core power level, which further increases core       pressure. A .scram will terminate this event. Safety analysis      events in this categoryinclude ,

o digital-electric-hydraulic (DEH) pressure regulator. failure in the closed position 0 load rejection I'enerator o turbine trip ll o closure of the'main-steam-line isolation'alve. . o loss of the condenser vacuum. 4.1.1.3 Decrease in Reactor Coolant Flow Rate Events that reduce recirculation flow also reduce the reactor coolant flow rate, which increases core voids and decreases core reactivity. The decrease in reactor coolant flow increases the water level because of the swelling of moderator voids. . The increase in core voids decreases the power level. Under, certain conditions, the increase in 'water level,may cause a turbine and feedwater trip, which will, in turn,'nitiate a reactor scram and require'operation of the high pressure makeup systems. Events in >> this category include l lh 0 recirculation pump trip (RPT) 0 recirculation flow control failure in the decreasing flow . r, position. 4.1.1.4 Reactivity and Power Distribution Anomalies Localized 'reactivity increases and anomalies in the power distribution are usually due to operator errors involving,control rod movement. The effects of the changes vary. A large reactivity

addition may require a reactor scram or rod block to terminate the event. Lack of corrective action will lead to a new steady-state operating condition. Events in this category include o control rod withdrawal error at low power o control rod withdrawal error at full power. 4.1.1.5 '"Increase in Reactor Coolant Inventory Events that lead to a feedwater flow rate higher than the steam production rate increase the amount of water (coolant inventory) in the reactor vessel, and may initiate a turbine and feedwater trip on high water level. , A turbine trip will, in turn, result in increased core pressure, with a concomitant void collapse and reactivity increase. The resulting increase, in power level will be i terminated by the reactor scram initiated by the turbine trip. A feedwater trip may also lead to conditions that actuate the high pressure makeup systems. The one event in this category is the feedwater controller failure. 4.1.1.6 Decrease in Reactor Coolant Inventory Events that lead to a steam production rate that is higher than the feedwater flow rate decrease the water level in the reactor vessel. If the feedwater flow is sufficient to maintain the vessel water at a new level, a new steady-state operating condition will be established until operator action is taken. Otherwise, the event will be terminated by a scram on low water level. Events in this category include inadvertent opening of the safety relief valve 0 DEH pressure regulator failure in the open position 0 loss of feedwater flow

4.1.1.7

  ~    ~   Xncrease   in Reactor Coolant  Plow Events    that increase recirculation flow also increase the reactor coolant flow rate, which decreases coolant temperature and vo1ds.

These changes cause an increase in core reactivity and an increase in, power level. A slow increase in coolant flow may lead to a new steady-state operating condition, which can be terminated by operator action. A rapid increase'ill initiate a scram onhigh neutron flux. Events in this category include o 'ecirculation flow control failure in the .increasing flow position o startup of an idle recirculation 'pump. 4.1.1.8 Increase in'Reactor Coolant Temperature The one event in this category is the"failure of the RHR shutdown cooling system. This event increases the reactor coolant temperature, which leads to a slow increase in pressure. The shutdown cooling system is assumed to be isolated. Operator action must establish an alte'mate coolant path through the.low pressure coolant injection line. n I 4.1.2 Accidents " * '- 4 ~ I g ~ y ( g g Accidents are postulated events that, would affect one or more of the radioactive material barriers; 'hese events are not expected to occur'during the lifetime of the plant. They. are, however, used to establish design bases for some systems. Accidents fall into eight categories: o control rod drop accidents 1 l'i o main steam line breaks o instrument line pipe breaks o LOCAs o fuel handling accidents o recirculation pump seizures or shaft breaks

o radwaste system failures. o 'uel loading errors. Each of these categories is discussed below. 4.1.2.1 Control Rod Drop Accident Rapid removal 'of a high-worth'ontrol: rod may create a power excursion'ignificant enough .to 'ffect the fuel cladding . and reactor coolant pressure boundary..The postulated control rod drop 'ccident is the dropping of a'.fully inserted and decoupled contxol rod at maximum -velocity. The 'control rod is assumed to be the maximum-worth rod consistent with the constraints on the control rod patterns. This type of accident creates a sudden burst of power, which is initially limited by the Doppler reactivity. A control rod scram initiated on high neutron flux will terminate the event. 4.1.2.2 Main Steam Line Break Accident Some systems that penetrate the primary and.secondary containment are connected to the reactor coolant pressure boundary. The postulated main steam line break is a break in a steam line outside the primary 'containment, where-it releases the maximum amount.:of reactor coolant directly to the" environment. The break causes rapid depressurization of'the reactor and an increase in the void fraction;"which shuts down the nuclear reaction. The main steam isolation valves will then close and terminate the-event. 4.1.2.3 Instrument Line Break A number of instrument: lines that penetrate the primary containment connect directly to the reactor= coolant pressure boundary. The postulated instrument line break is the complete severance of an instrument line outside the primary containment and upstream from the isolation valve. " A break in this. location cannot be isolated and may release a significant amount.. of: reactor coolant to the

                                   ""4 6

environment. The reactor will continue to operate until the break

   ~
                             ~

is detected. ~ The reactor must be shut down and the system depressurized to minimize releases until the break is repaired. 4.1.2.4 Loss of Coolant Accident A number of pipes penetrate the reactor coolant pressure boundary. The analysis of the postulated LOCA includes the evaluation of a spectrum of pipe break sizes and locations. These breaks cause coolant to leak from the reactor and be discharged into the primary containment. Depressurization along with a low-water level will initiate a reactor scram,.close the containment isolation valves, and activate the emergency core cooling system (ECCS) and other required equipment.'.3..2.5 Fuel Handling Accident Accidents can release radioactivity directly to the secondary containment when the primary containment is not intact. The greatest potential for a release of this type occurs during refueling, when the head is off the reactor vessel and the primary containment is open. The postulated fuel handling accident is the dropping of a fuel assembly onto the core or .onto fuel in the fuel storage pool in a way that maximizes damage to the exposed fuel. This type of accident will activate the secondary containment isolation system and the standby gas treatment. system. 4.1.2.6 Recirculation Pump Seizure or Shaft Break Failure of a recirculation pump rapidly reduces the core coolant flow. The postulated recirculation pump failure is. that of a pump seizing or a 'shaft breaking. The level swell caused by the rapid decrease of coolant flow trips the main and feedwater turbines and produces a stop valve closure scram and an RPT. The bypass and safety/relief valves will Jceep the. vessel pressure within the

American Society of Mechanical Engineers (ASME) Code limits I;Reference 18]. 4.1.2.7 Radwaste System Failures The postulated radwaste system failures lead to the maximum amount of radioactivity being released directly to the environment. The plant will continue to operate until the failure is detected. Operator action will be required to isolate the system and minimize releases. 4.1.2.8 Fuel Loading Error The postulated fuel assembly loading error is that of placing one fuel assembly in the wrong location or rotating it. For this analysis, the following assumptions have been made: 0 Only one fuel assembly is incorrectly loaded. 0 The loading error is not detected before startup through the core verification process. The loading error is not detected after startup by the process instrumentation.: o The plant is capable of operating at thermal limits throughout the operating cycle. The fuel loading error is a highly localized event that significantly affects only the misloaded assembly and adjacent assemblies. Although fuel loading errors are classed as accidents, the Supply System applies to this type of error the stringent operational criterion of ensuring that fuel cladding integrity limits are met. 4.1.3 Special Events Special event .analyses ensure compliance with specific regulatory and licensing requirements not considered in the analyses, of normal operation, anticipated operational occurrences, and accidents.'ix 4 8

categories typically evaluated in a BWR reload analysis include the, following: 0 shutdown margin 0 standby liquid control system capability 0 Code overpressure protection analysis 0 stability 0 shutdown from outside the control room-0 anticipated transients without scram. The special events are described below. 4.1.3.1 Shutdown Margin The shutdown margin analysis demonstrates that the core can be made subcritical with sufficient'margin when the highest-worth control rod is in the full-out position and the remaining control rods are fully inserted. For this analysis, the core is assumed to be at cold conditions, with no xenon present, and at the most, reactive stage in the operating cycle. 4.1.3.2 Standby Liquid Control System Capability.. The standby liquid control system capability analysis demonstrates that the core can be made subcritical by actuating the standby liquid control system. The analysis verifies that the core becomes subcritical at all power conditions with minimum, control rod inventory and no xenon present. t 4.1.3.3 Code Overpressure Protection Analysis The Code overpressure protection analysis confirms conformance with the ASNE Code requirement for protecting. against overpressure [Reference 18]. The Code overpressure protection analysis usually simulates the most severe of the pressurization events among those anticipated operational occurrences that lead to an indirect scram not associated with the event initiator. 4-9

4. 1.3. 4 Stability

( Stability evaluations are performed using the fuel vendor's NRC ( approved analysis methods to identify stability regions of ( increased concern. The safety analysis evaluates three types of hydrodynamic stability: plant, core, channel. 4.1.3.5 Shutdown from Outside the Control Room This evaluation ensures that the reactor can be shut down from outside the control room. It employs an operator procedure for reaching cold shutdown state using only equipment outside the control room. 4.1.3.6 Anticipated Transients Without Scram The postulated anticipated transient without scram is an anticipated transient that reaches a reactor protection system (scram) setpoint or requires a manual scram without enough ( insertable control rods to shut the reactor down. In this context, ( anticipated transients are defined as those conditions of operation ( expected to occur one or more times during the life of the plant. The Supply System uses an.RPT, a standby liquid control system, and alternate rod insertion (ARI) to protect WNP-2 against failure to scram. 4.2 SAFETY ANALYSIS CRITERIA AND LIMITS ( As noted i'n Section 4.1, three categories of events require a safety analysis. The Code of Federal Regulations. (CFR) specifies the requirements for analyzing these events. The General Design Criteria (GDC), Appendix A, 10CFR50, list many of the requirements. These requirements vary widely because of the differences in the nature of different events and the difference in the probabilities of occurrence. Table 4-1 lists the. boundaries, criteria, and limits for the three types of events. Table 4-2 lists specific 4-10

events and limits.

                 ~
                        ~  The   discussion below summarizes the federal requirements.
     ~
               ~

.4.2.1 Normal Operatio'n 6 Anticipated Operational Occurrences Normal operation and anticipated operational occurrences require criteria and limits for the following: 0 site 0 fuel cladding integrity 0 reactor coolant pressure boundary integrity Site requirements are less limiting than those for fuel cladding integxity and reactor coolant pressure boundary integrity. Therefore, it is unnecessary to deal with site requirements as long as requirements fox the last two categories are satisfied. 4.2.1.1 Fuel Cladding Integrity The GDC-10 governs fuel cladding integrity limits. It xequires that the reactor core and associated coolant, control, and protection systems be designed with a margin sufficient to ensure that specified acceptable fuel design limits (SAFDL) are not exceeded'uring normal operation or anticipated opexational occurxences. The SAFDLs place limits on cladding stress or strain, fuel temperature, fuel enthalpy, and cladding overheating. The SAFDL fox cladding stress and strain is defined as follows: The cladding steady-state primary and secondary stresses shall meet the requirements of the ASME Code [Reference 18]. The, cladding EOL steady-state strain shall be below the 1.04 design limit, and shall not exceed 1.04'during anticipated operational occurrences. The SAFDL for fuel tempexature is the maximum LHGR that will not lead to fuel centerline melting. This limit is,a function of exposure. 4-11

The SAFDL for fuel enthalpy is less than 170 cal/gm radially averaged at any axial location for reactivity insertion events initiated from low power. In the Supply System reload analysis, this SAFDL is used only to estimate the number of fuel rods assumed to fail in the control rod drop accident analysis. The SAFDL associated with cladding overheating is that greater than 99.94 of the fuel'..rods are ..not expected to experience boiling

transition. ~

4.2.1.2 Reactor Coolant Pressure Boundary Integrity The GDC-15 requires that the reactor coolant system and associated auxiliary, control, and protection systems be designed with sufficient margin'o ensure, that design, limits for .the reactor coolant- pressure boundary will not be exceeded during normal operation or. anticipated operational occurrences. The ASNE Code specifies a peak pressure of less than 137S psig within the reactor coolant pressure boundary [Reference 18].

4.2.2 Acci'dents C r Postulated accidents require criteria and limits for the following: 4 l1 0 site 0 reactor coolant pressure boundary integrity 0 primary containment integrity.: Site requirements are less limiting than those for reactor coolant pressure boundary integrity and, primary containment integrity. Therefore, it is unnecessary to deal:with site requirements as long as requirements for the last two categories are satisfied. 4.2.2.1 Reactor Coolant Pressure Boundary Integrity The GDC-14

designed, requires that the reactor coolant pressure boundary be fabricated, erected, and tested to ensure an extremely 4-12 0'

low probability of abnormal leakage, rapidly propagating failure, or gross ruptuxe. The ASME Code specifies limits [Reference 18]. The GDC-28 requires that reactivity contxol systems be designed to limit the amount and rate of reactivity increase to ensure that postulated reactivity accidents will cause no damage to the reactor coolant pressure boundary greater than limited local yielding. Current regulatory guidelines limit -the calculated peak radial average enthalpy to 280 cal/gm at any axial location in the fuel and the peak reactor vessel pressure to less than the emergency stress limits allowed by the ASME Code [Reference 18]. 4.2.2.2 Primary Containment Xntegrity The 10CFR50.44, GDC-16, and GDC-50, specify containment design criteria. The ECCS capability cx'iteria and performance limits ensure that other containment integrity limits will be satisfied by ensuring that postulated containment loads and core damage are bounded by previous assumptions in the plant safety analysis. The GDC-35 specifies that the ECCS must be capable of transferring heat from the reactor core following any LOCA at a rate sufficient to ensure negligible fuel and fuel cladding damage that could interfere with effective core cooling. The 10CFR50.46 specifies the following ECCS limits: a peak cladding temperature < 2200'F 0 a maximum cladding oxidation < 174 0 core-wide metal-watex reaction. <14 o the'maintenance of a eoolable geometry o assurance of long term cooling. 4.2.3 Special Events Special events require critexia and limits for the following: 4-13

o fuel cladding integrity o reactor coolant pressure boundary integrity 4.2.3.1 Fuel Cladding Integrity The GDC-12 requires that the reactor core and associated coolant, control, and protection systems be designed to ensure that power oscillations that= could damage fuel are not possible or can be reliably and readily detected and suppressed. The GDC-19 requires that equipment be placed at appropriate locations outside the control room w'ith a design capability for achieving hot shutdown with a potential for cold shutdown. The GDC-26 requires two independent reactivity control systems of different design. principles. One of the systems must use control rods and must ensure that the SAFDLs will not be exceeded during normal operation or anticipated operational occurrences. This system must also allow an appropriate margin for malfunctions, such as stuck control rods. The second system must ensure that the SAFDLs will not be exceeded during planned, normal power changes, ( incl'uding'enon burnout. One of the systems must also be capable ) of holding the reactor core subcritical under cold conditions. The GDC-27 requires that the reactivity control systems have a combined capability, with appropriate margin for stuck control rods, sufficient to control reactivity changes under postulated ) accident conditions. 4.2.3.2 Reactor Coolant Pressure Boundary Integrity The 10CFR50.55a specifies that ASME Code pressure limits [Reference 18] apply to Code overpressure protection analysis. The 1OCFR50.62 identifies design features required for antic'ipated transients without scram. This regulation also mandates that sufficient information be provided to the NRC to demonstrate the suitability of these design features. 4-14

Table 4-1 SAFETY ANALYSIS BOUNDARIES, CRITERIA, AND LIMITS NORMAL OPERATI N AND ANTICIPATFD PFRATIONAI. OCCURRFNCF ~BUNDARY CRITERIA I.IMIT Site Limits on Release to iVumerical Limits for Unrestricted Areas Release of Radioactive (10CFR20) iMteriais (10CFR20) r Releases as Low as Numerical Guides and Dose Reasonably Achievable Objectives (1OCFR5034a) (10CFR50, Appendbc I) II ~ Fuel Cladding SAFDLs (GDC-10) Fuel Cladding Integrity Limit {Standard Review Plan, SRP 4.4) I Fuel Chdding Plastic Strain Design Limit (SRP 42) " Peak Fuel Enthalpy Limit {SRP 43) Fuel Centerline Melt Limit (SRP 43) Reactor Coolant Pressure Reactor Coolant Pressure ,iVudear System Design Limits for, Boundary Boundary Design Limits Upsets (IOCFR5085a) (GDC-15) . r e e 4 e 4-1S

Table 4-1 (contmued) SAFETY ANALYSIS BOUNDARIES, CRITERI, AND LIMITS

                                                            ~Ag lDRN'g
                                      'uidehne BOUNDARY                       RITF.RI                                        ~LIMIT Site                         Site Limits                                                Dose Values (10CFR100.10)                                    (10CFR100.11)

Operator Exposure Limits Exposure Limits for Plant (GDC-19) Operators (GDC-19) Reactor Coolant Pressure Reactor Coolant Pressure Containment Design Boundary Boundary Design (GDC-14) Linuts for Accidents (IOCFR50$ 5a)

                        ~
                          '

Reactivity Insertion Lhnits Peak Fuel Enthalpy (GDC-28) Limit (SRP 42) Primary Containment Containmeut Design Nudear System Design for Boundary (GDC-16&50 & 10CFR50.44) Accidents (IOCFR50$ 5a) Emergency Core Cooling Emergency Core Cooling System CapabiTity System Performance Limits (GDC-35) (10CFR50.46) 4-16

Table 4-1 (continued) SAFETY ANALYSIS BOUNDARIES, CRITERIA, Ai(D LIMITS E IAI. FVFNTS ~BO DARY CRITERIA ~I,IMIT Fuel Cladding Reactivity Control Shutdown Margin Limit System Design (SRP 43) (GDC-26&27) Shutdown Ca pabiTity Cold Reactor Shutdown from (GDC-19) Outside Control Room (GDC-19) Reactor Power Oscillation Control Suppression of Reactor (GDC-12) Power OsciBations " (GDC-12) ~ Reactor Coolant Pressure Reactor Coolant System Design (GDC-15) ASVK Code Lunits (10CFR5085a) Boundary Anticipated Transients Umits Associated IVith Plant Systems IVithout Scram Criteria Perfonnance (IOCFR50.62) (10CFR50.62) h'-17

Table 4-2 SAFETY ANALYSIS EVENTS AND LIMITS NTI IPATFD PFRATI NAI. CURRE tCF FVFNT LIMIT Loss of Feedwater Ileating Inadvertent High Pressure Core Spray Startup SAFDL Inadvertent RIIR Shutdown Coohng Operation SAFDL Pressure Regulator Failure-Closed 'AFDL/Pressure Generator Load RC/ection SAFDL/Pressure Turbiue Trip SAFDL/Pressure Main Steam Line Isolation Valve Closure SAFDL/Pressure 4 h Loss of Condenser Vacuum SAFDL/Pressure Recirculation Pump Trip SAFDL Recirculation How Controller Failure. Decreasing How SAFDI Control Rod withdrawal Error-Low Power SAFDL Control Rod withdrawal Error at Power SAFDL Feedwater Controller Failure SAFDL/Pressure Inadvertent Safety Rehef Valve Opening SAFDL Pressure Regulator Failure-Open SAFDL Loss of Feedwater How SAFDL Loss of ac Power SAFDL/Pressure Recirculation Flow Controller Failure-Increasing How SAFDL Startup of Idle Recirculation Pump SAFDL Failure of RHR Shutdown Cooling Not Applicable Note: The SAFDLs require o less than 1% fuel rod cladding strain o no fuel centerline melt o peak fuel enthalpy less than 170 cal/gm o greater than 99.9% of the fuel rods not expected to experience boiling transitioa. Complying with the SAFDLs makes it unnecessary to address the site limits for normal operation and anticipated o perational occurrences. 4-18

                                              'able 4-2 (continued)

SAFETY ANALYSIS EVENTS AND LIMITS ACCIDENTS F.VFNT I.MilT Control Rod Drop Accident Offsite and Onsite Doses

                                                                        "
                                                                          'eak       Fuel Eathal py Reactor Vessel Pressure
                                                            ~  i Main Steam Line Break                                                    ~      Offsite aad Oasite Doses
                                                                           '

Iastrument Line Break Offsite aad Onsite Doses f Fuel Handliug Accident Offsfte aad Oasite Doses Loss of Coolant Accidents Offsite aad Oasite Doses ECCS Acceptance Criteria Containmeat Design Limits Recirculation Pump Seizure or Shaft Break Offsite and Oasite Doses

                                                                             ~  I*   i Radwaste System Failures                                                        Offsite aad Onsite Doses Fuel Loading  Error                                                             Fuel Chddiag Integrity d

4-19

Table 4-2 (continued) SAFETY. ANALYSIS EVENTS AND I liMTS F CIAL VFNT F.VENT LIMT Shutdown Margin Shutdown i~ Standby Liquid Control System CapabiTity Cold Reactor Shutdown Overpressure Protection Analysis Pressure StabiTity Shutdown from Outside Control Room Reactor Shutdown from Outside the Control Room 'nticipated Transients without Scram 10CFR50.62

 ~ Code of Federal Reguhtions, 10CFR50, Appendix A (GDC-12) requires that the reactor core and the associated coolant control and protection systems be designed to easure that power oscillations, which can result in coaditions exceeding SAFDL limits, are not possible or can be reHably and readily detected and suppressed.

F

                                                           . 4-20

SECTION 5 0 RELOAD ANALYSIS The reload analysis'ses approved fuel designs from the fuel supplier and, for some reload fuel analyses, integrates fuel supplier analysis methods into the Supply System reload analysis methodology. This section discusses the following: h 0 the reload analysis process I ' tl 'I 0 the relationship between the reload analysis and the plant safety analysis requirements 0 the reload evaluation requirements o the safety limits used in the analysis process 0 the process used to identify events that are-not.limiting for purposes of the reload analysis. 5~1 INTRODUCTION A reload is defined as replacement of depleted or exposed fuel assemblies with sufficient fresh fuel assemblies or other high reactivity (reinsert) fuel assemblies to enable another cycle of operation to proceed. The reload analysis demonstrates that plant safety analysis requirements have been satisfied for the reload fuel assemblies in the new core configuration. 5.1. 1 Reload Analysis Process Figure 5.1-1 provides an overview of the Supply System reload analysis. The first task in the reload analysis is to establish an energy utilization plan. The energy utilization plan indicates the expected operating cycle length, the target plant capacity factor, and the anticipated end-of-cycle exposure for the current operating cycle. Fuel cycle studies are then performed, and a reference fuel cycle is developed that specifies the number of reload fuel assemblies necessary to economically satisfy the energy utilization

plan. Once the" Supply System has chosen the number of fuel assemblies, the fuel lattice design and fuel fabrication can begin. The next step in, the reload analysis process is to establish a reference loading pattern that will serve as the basis for the reload fuel design and safety analyses. The reference loading pattern identifies the type and location of all fuel assemblies that .will be used in the reactor core during the next operating cycle. Xmportant characteristics that influence the reference loading pattern are the predicted end-of-current-cycle core exposure, exposure distribution, and operating history. Section 7.0 discusses parameters;that must be checked if the core characteristics at the end of the cycle differ from those predicted and/or if the actual loading pattern differs from the reference loading pattern. The next step in=-the reload analysis is to identify the potentially limiting events in the plant safety analysis. This process requires identifying and listing current safety analysis events applicable to the reload analysis. The relationship between 0he safety analysis and the reload analysis is described in more detail in Section 5.1.2. The reload evaluation. requirements are described in -Section 5.1.3. The reload analysis limits are established using 'fuel vendor;, design analyses and current plant safety analysis requirements. .Section 5.1.4 describes the methodology used to obtain the limits. The reload analysis limits make it possible to

identify potentially limiting events by eliminating non-limiting

.,events. from the'list of applicable events. Section 5.1.5 describes the process for identifying non-limiting events. 1% The potentially limiting events are the subject of the event analyses. Event analysis requirements are described in more detail in Section 5.2. Specific event analysis techniques and their bases are described in Section -5.3. 5 ~ 1-2

The results of the reload analysis are documented- in the reload summary report. (Section 6.0 provides an outline of a reload summary report.) The reload summary report is used to update the <'lant safety analysis," define the required core operating limits, and provide- the basis for any license amendment requests. The core operating limits are based on .the results of the event analyses. Section 6.0 describes how the core-'operating limits are identified. In some cases, the -results of"the analysis may lead to a change in plant technical specifications. Any-plant. technical'pecification change requires a license amendment request. Section 6.0 discusses considerations associated with technical specification'hanges.;,. 4 The final step in the reload analysis is confirming the suitability of the'ctual loading pattern. Section 7.0 gives more. details about the confirmation process. 5.1.2 Relationship to Plant Safety Analysis Requirements Section 4.0 described the safety analysis requirements with respect to event analyses. The introduction of 'reload fuel. into the. core ca'n change the results of some of the event analyses performed -for previous cycles. Any such changes must be evaluated. Not all events included in the 'plant safety-.'analysis ..are significantly impacted by the introduction'= of reload fuel. ""Some 4 events in each category may, however, require reanalysis-'if the changes to the nuclear and thermal hydraulic characteristics of the 'core are significant. I A screening process identifies and eliminates the non-applicable and non-limiting events. Section 5.1.5 'describes the, process ",of identifying potentially limiting events. Section 5.2 describes the application and results of the screening process.

-3

The remaining events are the subject of analysis for the reload h ( fuel and- core design. Reload fuel evaluation requirements are described in Section 5.1.3. 5.1.3 Reload Evaluation Requirements The reload analysis updates the plant safety analysis. To ensure a complete assessment, each event in the plant safety analysis must it k Ih be evaluated to determine the extent to which challenges the safety limits. Potentially--limiting. anticipated .operational occurrences are generally analyzed to establish the core operating limits for the reload fuel and core configuration. Accidents may be reanalyzed to establish operating limits for reload fuel or to assess the event consequences if,.the bounding conditions are not satisfied. Special events. are. analyzed to demonstrate conformance to specific regulatory requirements. Considerations used to determine the need ( for and extent of event analyses are described in Section 5.2.

           'h I

Event limits are a fkey.,consideration in determining which events require reanalysis for reloads. , Section 5.1.4 describes the specific event limits and the process used to establish them. 5.1;4 Safety Limits Used in the Analysis Process h Section 4.0 describes criteria and limits applied to event analysis These criteria and limits are as applicable to the reload analysis t as they are to the current plant safety analysis. h They serve two purposes: 0 They provide the figures of merit for the reload analysis results. f h 0 They are used in event screening to assess the relative severity of- the events in each-category. 5 ~ 1-,4

Applicable limits for the events in each category are provided in Table 5.1-1; the bases are discussed in Sections 5.1.4.1 through 5.1.4.3. It is only necessary to check event analyses results against the most restrictive limits for the event. 5.1.4.1 Anticipated Operational Occurrences Three sets of limits apply to anticipated operational occurrences: 0 onsite and offsite dose limits associated with the release of radioactive materials 0 design limits for the reactor coolant pressure boundary 0 SAFDLs. The onsite and offsite dose limits are not used in the reload analysis because the SAFDLs are more limiting. Onsite and.offsite dose limits are based on the assumption of a'limited number of fuel failures in the core, consistent with plant technical specification requirements. No significant number of fuel failures will occur as long as the SAFDLs are not exceeded. Therefore, previous dose assessments remain applicable, and no further evaluations are required for the reload analysis. The reactor coolant pressure boundary design limits are based on the requirements in the ASME Code [Reference 18]; These requirements specify a peak vessel pressure limit of 1375 psig. Four limits apply to SAFDLs: 0 the fuel cladding integrity limit 0 the fuel cladding plastic strain design limit 0 the fuel centerline melt limit 0 the peak fuel enthalpy design limit. The process of establishing these limits is described below. 5 ~ 1-5

5.1.4.1.1 Fuel Cladding Integrity Limit The fuel cladding integrity limit ensures that greater than 99.9% of the fuel rods in the core would not be expected to experience boiling transition. The Supply System reload analysis will use the fuel vendor methodology and, approved critical power or critical heat flux correlations to establish a MCPR that satisfies this requirement. Currently, the Supply System uses only the approved ANFB CPR correlation [Reference 19]. Future developments in approved vendor CPR correlations will be evaluated by the Supply Syst: em and any changes to the CPR correlation used by the Supply System will be reflected in appropriate changes to the technical specifications. 5.1.4.1.2 Fuel Plastic Strain Design/Fuel Centerline Melt Limits The fuel plastic strain limit is the LHGR that produces a permanent fuel cladding deflection of 1:. The fuel centerline melt limit is the LHGR required to reach the fuel melting temperature at the centerline of a fuel pellet. The Supply System methodology uses the fuel vendor's thermal-mechanical methods to establish the LHGR limits for fuel plastic strain and fuel centexline melt limits. These limits are expressed as a function of exposure. To evaluate current fuel designs,= these two limits have been combined into a single set of PAFF limits that use the more limiting LHGR. 5.1.4.1.3 Peak Fuel Enthalpy Design Limit The safety analysis identifies a peak fuel enthalpy design limit for energy deposition from reactivity insertion events initiated from low power. In the Supply System methodology, this limit is an axially averaged peak fuel enthalpy of 170 cal/gm. It is used only to determine the numbex'f fuel rods predicted to fail as a result of a control rod drop accident. This limit does not apply to other events analyzed in the reload analysis process. 5~1 6

5. 1. 4. 2

 ~ ~   ~   Accidents
               ~

In the plant safety analysis, four sets of limits apply to accidents: 0 offsite guideline dose values and operator exposure limits 0 reactor coolant pressure boundary integrity limits primary containment integrity limits 0 for the fuel loading error, the fuel cladding integrity limit. The offsite guideline dose values and operator exposure limits are not used in the reload analysis because they are less restrictive than the limits established from bounding analyses for accidents. Section 5.2 discusses the basis for bounding in the event analyses. Two sets of limits apply to the reactor coolant pressure boundary: nuclear system design limits for accidents, which are based on ASME Code requirements for emergency or faulted conditions 0 peak fuel enthalpy limits for reactivity insertion accidents. The nuclear system design limits for accidents are not used'because bounding analyses exist in the current'lant safety analysis. Section 5.2 discusses the basis for the current safety analysis being bounding. A peak fuel 'enthalpy of 280 cal/gm is-the limit for reactivity insertion accidents. The results of analyses for the limiting reactivity insertion event demonstrate that the ASME Code limits for the reactor coolant pressure boundary will not be exceeded for a peak fuel enthalpy of 280 cal/gm. Two sets of limits apply to the primary containment integrity: o containment design limits o ECCS limits. Containment, design

limits for accidents are based on the ASME Code requirements. The containment must be capable of accommodating the

5. 1-7

amounts of hydrogen that may be released during a LOCA. The containment design limits ,are not used in the reload analysis because the ECCS limits are more restrictive. The ECCS performance limits are o a peak cladding temperature < 2200 'F o a maximum cladding oxidation < 17< o core wide metal water reaction < 14 o... the maintenance of a eoolable geometry o assurance of long term cooling. The first three limits are of primary significance in the reload analysis process.. These three limits ensure that a short-term LOCA will preserve a eoolable.geometry consistent with long-term cooling requirements. Assurance of long term cooling is provided by demonstrating that the geometry, is refloodable. The fuel cladding integrity limit is used as the figure of merit for a fuel loading error. The fuel integrity limit is the MCPR at which greater than 99.94 of the fuel rod in the core would not be expected to experience ,boiling transition. This limit is consistent with commitments in the current plant safety analysis and represents a conservative limit for this event.

5. 1. 4. 3 Special Events Evaluations in Section 5.2 show that four special events require reanalysis in. each reload analysis:

4 o shutdown margin demonstration o.. standby liquid control system capability o stability. o . Code overpressure protection. Each of these events has its own limit. 5 '-8

The shutdown margin demonstration must provide assurance that the shutdown margin requirement in the plant technical specification will be satisfied during plant startup tests. The shutdown margin demonstration analysis 'assumes that the highest worth control rod is fully withdrawn. The standby liquid control system capability analysis demonstrates that the plant can attain a cold shutdown condition without the control rods. Xn the analysis "of this event, it is'assumed that all the control rods remain't the same location or'-at their initial location throughout the event. I I r Stability evaluations using the fuel vendor's NRC approved analysis methods identify st'ability regions of increased concern. 'lant technical specifications place monitoring and - operational constraints on plant operating conditions to ensure compliance with stability limits. For overpressure protection, the peak reactor vessel pressure must be less than the ASME Code emergency condition limit (1204 of design pressure, or 1500 psig); For conservatism, the .'Supply System applies the ASME 'Code upset condition .limit'(110%:of .design pressure, or 1375 psig) 'instead. 5.1.5 Process for identifying Potentially Limiting Events Xn the reload analysis, it is only necessary to analyze events that 'can establish core operating limits', result 'in the need-.for:a technical specification change, or demonstrate compliance with technical specifications. The Supply 'ystem methodology has developed a process for identifying potentially limiting- events. The steps in this process are shown on Figure 5.1-2 and- described below. The results of applying'his process are'escribed in Section 5.2. 5.1-9

The process begins by identifying and eliminating all events in the current plant safety analysis that are not associated with fuel, core, or reactor system design. The second step is to identify and eliminate all plant capability demonstrations in the current plant safety analysis. The safety analysis evaluates some special events that demonstrate plant capability to accommodate events or failure combinations not considered in the plant design basis. These events do not need to be considered in the reload analysis as long as changes in fuel and core design do not significantly alter the plant capability to accommodate these events. The third step is to identify and eliminate all non-limiting events. The current plant safety analysis demonstrates that a number of events are not limiting. As long as the reload fuel and core design do not change the relative severity of'these events, they may be eliminated from consideration in the reload analysis. The fourth step is to identify and eliminate all events that fit within the bounding analyses in the current plant safety analysis. These 'events are not-significantly affected by reload fuel and core design. As long. as. the bounding assumptions are applicable, the reload analysis does not need to analyze these events. Any events not eliminated with these steps are considered potentially limiting. These events are the subject of the analyses documented in the reload summary report. 5.1 10

Table 5.1-1 RELOAD ANALYSIS LIMITS

LIMIT VALUE Antici ated 0 rational Occurrences Specified Acccptablc Fuel MCPR R Fuel Cladding Integrity Limit Design Limits (SAFDLs) LHGR 6 PAFF Limits Reactor Coolant Prcssure 6 1375 psig Pressure Boundary 'ASME Code upset condition limit) Accidents Reactivity Insertion Peak Fuel Enthalpy a 280 caVgm Emergency Core Cooling Peak Clad Temperature 6 2200 'F System Performance Local Oxidation 6 Wide Metal Water Reaction S I Fo 17'ore Fuel Loading Error MCPR > Fuel Cladding Integrity Limit S~eeinl Evenee Shutdown Margin Shutdown Margin h Tech. Spec. Limit Demonstration Standby Liquid Control Cold Reactor Shutdown System Capability Stability Suppression of Reactor Power Oscillations Ovcrprcssure Protection Prcssure 6 1375 psig (This more conservative ASME code upset condition limit, 110% of design pressure, is enforced by the Supply System in place of the ASME Code emergency condition limit, 120% of design pressure).

lant Operational Current Core Safety Analysis Goals and Performance and Fuel Design Requirements Energy Reference Current Utilization Safety Current Plant Fuel Cycle Analysis Plan Design, Operation, and Safety Analysis Fuel Design and Fabrication Fuel Design and Procurement End of Current Reference Reload Fuel Loading " Analysis Activities Cycle Prediction . 'attern Applicable Analyses for Reload Fuel Fuel Supplier Reload Fuel Design and Analysts Limits Analysis Identification of Potentially Limiting Events WNP-2 Reactor Reload Fuel Analysis Methodology Event Analyses'ore Operating Reload Summary Limits Report Figure 5.1-1. Reload Analysis Process Overview 5.1-12

All Events Contained In Current Safety Analysis Identify and Eliminate Events Not Associated with Fuel, Core, or Reactor Systems Design Identify and Eliminate Plant Capability Demonstrations Identify and Eliminate All Non-Limiting Events Identify and Eliminate All Bounded Analyses

                     ,:::::::.':::::,Poteritjal!y.::,Llmiti'n'g::;::,::,,::;;,::,;.::,",,

':::::::::::;::: ':::::::'::::::::::;::Events;:;for:.:,::.;:;:;::.:::,:::.:.,::.:::.:,:::.:;::;.::,:::.:.:::.::.:.:: .,

                                                                                                                                           "
                    "::::::::::::   Redo'ad':F'uel:::.A'nal'ysls':::;::::::::.

Figure 6.1-'2. Process for Identifying Potentially Limiting Events 5.1-13

I 4 t P,

                                                '                        'I
                            'I
    \                   t "I 'I                                       I        4 4
             '

I' I t V I

I t P

-\

Pl I

                          -I                                                        I I

t I I'- Il 4 I 4 P I'

                                                                'I,
                                                                               ,i I

5 2 RELOAD ANALYSIS REQUIREMENTS The reload analysis demonstrates that all plant safety analysis requirements have been satisfied for the new fuel assemblies and core configuration. Satisfying safety analysis requirements may require establishing new core operating limits or technical specifications. Reviewing the current safety analysis will ensure that necessary analyses and evaluations of the reload fuel and core configuration have been performed. The review is necessary because the reloaded core may have different nuclear and thermal hydraulic characteristics than the core configurations previously evaluated. As noted in Section 5.1, not all events evaluated in the plant safety analysis are significantly affected by the introduction of reload fuel. Section 5.1.5 describes the screening process used to identify potentially limiting events. The application of this process is described in more detail below. For. convenience, events are grouped by safety analysis categories: 0 anticipated operational occurrences 0 accidents o special events. Event evaluations apply only to the current plant design. Plant design changes, such as those that significantly affect system or equipment performance characteristics, may affect the relative event severity. Any such changes require assessment to determine if they affect safety analysis requirements. The Supply System assessment of plant changes will be consistent with the requirements of lOCFR50.59. 5.2-1

5.2.1 Anticipated Operational Occurrences Assessment Anticipated operational occurrences are characterized by nuclear system parameter variations that pose the most significant challenge to the fuel or reactor coolant pressure boundaries. These parameter variations fall into eight categories: P o decrease in reactor coolant temperature 0 increase in reactor pressure 0 decrease in reactor coolant flow rate reactivity and power distribution anomalies 0 increase in reactor coolant inventory 0 decrease in reactor coolant inventory 0 increase in reactor coolant flow 0 increase in reactor coolant temperature. Events in each of these categories are assessed below. 5.2.1.1 Decrease in Core Coolant Temperature The events in this category are 0 loss of feedwater heating 0 inadvertent HPCS startup I 0 inadvertent RHR shutdown cooling operation. The current plant safety analysis demonstrates that the loss of feedwater heating is the most limiting event in this category and has the potential to establish core operating limits. Therefore, the loss of feedwater heating event is analyzed in the reload analysis. 5.2.1.2 Increase'in Reactor Pressure The events in this category are o Digital Electro-Hydraulic (DEH) pressure regulator failure in l the closed position 5 ~ 2-2

. 0 generator load rejection turbine trip closure of the main-steam-line isolation valve o loss of the condenser vacuum. The current plant safety analysis demonstrates that the generator load rejection without bypass is the most limiting event in this category and has the potential to establish core operating limits. Therefore, the generator load rejection without bypass is analyzed in the reload analysis. 5.2.1.3 Decrease in Reactor Coolant Plow Rate The events in this category are an RPT a recirculation flow control failure in the decreasing flow position. The events in this category are relatively benign because the reduction in core flow reduces core reactivity and leads to a reduction in power prior to any system trips or actuations. The current plant safety analysis demonstrates that the events in this category are non-limiting. 5.2.1.4 Reactivity and Power Distribution Anomalies The events in this category are 0 control rod withdrawal error at low power control rod withdrawal error at full power. The current plant safety analysis demonstrates that the control rod withdrawal error at full power is the most limiting event in this category and has the potential to establish core operating limits. Therefore, the control rod withdrawal error at full power is analyzed in the reload analysis.

5.2.1.5 Zncrease in. Reactor Coolant,Znventory One event in this category is the feedwater controller failure. Other events that cause. an increase. in reactor coolant inventory have been discussed in Sections 5.2.1.1 and 5.2.1.2. Feedwater controller;failure in the maximum, demand position has the potential to establish core operating limits and is thexefore analyzed in the reload analysis process. 5.2.1.6 .Decrease, in Reactor Coolant Znventory The'events in this category are e 0 inadvextent opening of the safety relief valves 0 DEH pressure regulator failure in the open position 0 loss of feedwater flow 4 I These events axe characterized by a steam and feedwater flow mismatch which results in a mild depressurization, a decrease in 'core power level, a decrease in water .level, and a decrease in core coolant temperature prior to any system trips or actuations. The current plant safety analysis demonstrates that the events in this category are non-limiting. 5 2.1.7" ".Zncrease in. Reactor Coolant. Plow The events in this category are r, 0 recirculation flow control failure in the, increasing flow position 0 startup of an idle recirculation loop pump. The current plant safety analysis demonstrates that, the slow

increase. in reactox coolant flow associated with a recirculation flow controller failure may be the transient that establishes the MCPR operating limit when the reactor is operating at Q.ow power and low flow. Therefore, recixculation, flow controller failure .in the

                                                                      ~,i 5 2-4

increasing flow position is analyzed from low power and low flow

  ~                        ~     ~

conditions in the reload analysis.

      ~   ~

S.2.1.8 Increase in Reactor Coolant Temperature The one event in this category is the failure of the RHR shutdown cooling system. The current plant safety analysis demonstrates that this event is non-limiting. S.2.1.9 Anticipated Operational Occurrences Assessment Summary Evaluation of anticipated operational occurrences indicates that the following five events require re-evaluation during the reload analysis: 0 loss of feedwater heating

0 generator load rejection without bypass control rod withdrawal error at full power feedwater controller failure in the maximum demand position 0 recirculation flow controller failure in the increasing flow position. 5.2.2 Accident Assessment Accidents are postulated events that affect one or more of the radioactive material barriers. The following events are analyzed: 0 control rod drop accident 0 main steam line break 0 instrument. line pipe break 0 LOCA 0 fuel handling accident recirculation pump seizure or shaft break 0 radwaste system failures 0 'fuel loading error. Analyses for each of these events are described below. 5; 2-5

5.2.2.1 Control Rod Drop Accident The control rod drop accident bounds the consequences of reactivity insertion events in the safety analysis. In the current plant safety analysis, analysis of the consequences of a control rod drop accident -are based on the results of. vendor generic parametric analysis. Four input parameters (see Section 5.3.9.3) to the generic analysis can change as a result of the reload fuel and core configuration. Therefore, the control rod drop accident requires reevaluation in the reload analysis-process. 5.2.2.2 - Main Steam Line Break The main steam line break bounds the consequences of postulated pipe breaks outside the'primary containment., The consequences of this event are based on the maximum reactor coolant activity that can exist= during normal plant operation. The amount of reactor coolant activity is limited by plant technical specifications, which are not changed to reflect the reload fuel or core configuration. Therefore, the main steam line break accident does not require reevaluation in the reload analysis. 0 5.2.2.3 Instrument Line Break The instrument line break bounds the consequences of pipe breaks .outside the primary containment that are not automatically isolated. The. consequences of. this accident are based on the maximum reactor coolant activity that can exist during normal plant operation. The amount of reactor coolant activity is limited by plant technical specifications, which are not changed to reflect the reload fuel or core configuration. Therefore, the instrument line break does not require reevaluation in the reload analysis. 5.2.2.4 Loss 'of Coolant Accident The LOCA bounds the consequences, of pipe breaks inside the primary containment. In the current plant safety analysis, the analysis of 5.2-6

the consequences of a LOCA are based on the results of a conservative system analysis by the vendor. Howevex, five input parameters to the systems analysis can be changed by the reload fuel and core configuration {see Section 5.3.10). Thexefore, the LOCA requires xeevaluation in the reload analysis. Furthermore, introduction of a nev fuel type, e.g., a nev lattice design or enrichment, requires a nev fuel heatup analysis. An appropriate MAPLHGR must also be established, for that fuel type. 5.2.2.5 Fuel Handling Accident The refueling accident bounds the consequences of an accident that can release radioactivity directly to the secondary containment when the primary containment is not intact. The consequences of this accident are based on an inventory of fission products in,the fuel and the number of fuel rods calculated to fail as a result of the accident. These parameters are not usually expected to change significantly because of a change in the fuel or core configuration. The refueling accident will not, be reanalyzed in the reload analysis unless there is a significant change in the fission product inventory of the reload fuel or, in the number of fuel rods predicted to fail. 5.2.2e6 Recirculation Pump Seizure or Shaft Break The current plant safety analysis demonstrates that a recirculation pump seizure or shaft break vill not affect any core operating limits nor the basis for any. technical specifications. Therefore, the recirculation pump seizure or shaft break is not evaluated in the reload analysis. h 5.2.2.7 Radwaste System Failures A conservative inventory of radwaste system radioactivity has been established for safety analysis purposes. This inventory is not affected by the xeload fuel design. Therefore, radwaste system failures are not reevaluated in the reload analysis. 5.2-7

5.2.2.8 Fuel Loading Error Placing a fuel assembly in the wrong location or rotating it the wrong way may impact the MCPR operating limits. Therefore, these fuel loading errors are analyzed in the reload analysis. 5.2.2.9 Accident Assessment Summary The evaluation of accidents indicates that the following four events require examination during the reload analysis: 0 control rod drop accident a 0 LOCA 0 fuel loading error mislocated fuel assembly 0 fuel loading error rotated fuel assembly. 5.2.3 Special Events Assessment Special event analyses satisfy regulatory or licensing requirements not considered 'n the accident or anticipated operational occuxrence categories. The following events are analyzed: o shutdown maxgin o standby liquid control system capability .. 0 Code overpressure protection analysis o stability ' "o 'shutdown from "outside the control"room 'o'nticipated transients without, scram..- Analyses for'these events are described below. 5.2.3.1 Shutdown Margin The shutdown margin analysis demonstrates that the core can be made subcritical with sufficient margin when .the;highest-,worth control rod is in the full-out position and th'e remaining control rods are fully inserted. For this analysis, the core is assumed to be at 5 ~ 2'-8

cold conditions with no xenon present and at the most reactive stage in the operating cycle. Because the shutdown margin depends on the reload fuel and core design, it is evaluated in the reload analysis. 5.2.3.2 Standby Liquid Control System Capability The standby liquid control system capability analysis demonstrates that the core can be made subcritical by actuating the standby liquid control system. The analysis verifies that 0he core becomes subcritical at all power conditions with minimum control rod inventory and no xenon present. Because the standby liquid control system capability depends on the reload fuel and core design, it is analyzed in the reload analysis, 5.2.3.3 Code Overpressure Protection Analysis The Code overpressure protection analysis demonstrates conformance to the ASME Code requirement for demonstrating protection against overpressure. The reload fuel and core design affect overpressure protection. Therefore, the Code overpressure protection analysis is performed for each reload analysis. 5.2.3.4 Stability The stability evaluations are performed using the fuel vendor's NRC approved analysis methods to identify stability regions of increased concern. Stability margins depend on nuclear and thermal hydraulic parameters that may change with each reload. Plant technical specifications contain requirements that restrict plant operation to certain regions within the power-flow map. These requirements are consistent with the General, Electric Company recommendations in Service Information Letter (SIL) 380, with the NRC recommendations in NRC Bulletin 88-07 and Bulletin 88-07, Supplement 1, and with recommendations of the BWR Owner's Group. Furthermore, NNP-2 has a stability monitoring system. Technical 5.2-9

specification action statements are provided to ensure compliance with the event acceptance limits associated with stability. 5.2.3.5 Shutdown from Outside the Control Room The evaluation of shutdown from outside the control room ensures that the plant can be shut down with equipment outside the control room. This capability is not significantly impacted by the reload fuel and core design. Therefore, shutdown from outside the control room is not evaluated in the reload analysis. 5.2.3.6 Anticipated Transients, Without Scram An anticipated txansient without a scram is a postulated transient that reaches a reactor protection system (scram) setpoint or requires a manual scram without insextable control rods to insert to shut the reactor down. This capability has been evaluated in the current plant safety analysis using conservative analysis assumptions. Therefore, anticipated transients without a scram are not evaluated in the reload analysis. 5.2.3.7 Special Events Assessment Summary The evaluation of special events-indicates that the following four events require examination during the reload analysis: 0 shutdown margin 0 standby liquid control system capability Code overpressure protection analysis stability. 5.2.4 Potentially Limiting Events for Reload Analysis The screening process indicates that thirteen events require reevaluation in each reload analysis. Table 5.2-1 lists these events and their event categoxy. 5 ' 10

Table 5.2-1 Events Requiring Reevaluation in the Reload" Analysis (Rearranged hy Category) Antici ated 0 erational Occurrences Loss of Feedwater Heating Generator Load Rejection without Bypass C R Control Rod withdrawal Error Feedwater Controller Failure Maximum Demand Recirculation Flow Controller Failure 'Increasing Flow

*\

Accidents Control Rod. Drop Accident Loss of Coolant Accident Fuel Loading Error - Mislocated Fuel Assembly Fuel Loading Error Rotated Fuel Assembly S ecial Events ~ R Shutdown Margin Demonstration Standby L'iqui'd Control Syst: em Capability

R ~ Code Overpressure Protection Analysis Stability. C I I C, CC I I C

I I, C

                                   '
                          ~            'I      h
                           \

5 2-11

~ ~ 5.3 EVENT ANALYSXS PROCESS The categorization of events in Section 5.2 is consistent with recommendations in the EPRZ guidelines for BWR event analysis [Reference 20]. The event analysis methodology establishes the requirements for specific event analyses. Section 5.3.1 provides an overview of the methodology. Sections 5.3.2 through 5.3.13 summarize the analysis process for specific events. 5.3.1 Event Analysis Overview The Supply System event analysis methodology is conservative to ensure that analysis uncertainties are not underestimated. Conservatism in the analysis process is imposed by the way inputs are selected and uncertainties are treated. The description of each event analysis follows an outline that ensures consistent coverage and a comprehensive basis for development. Each description provides an understanding of the assumptions and phenomena that can impact analysis results significantly if they are changed by the reload fuel and core design. Each event analysis description contains the following: 0 an event description, including initial conditions, operational assumptions, required operator response, and event acceptance limits analysis considerations, including key phenomena, systems considerations, and component performance characteristics 0 a discussion of the methodology and computer codes used in the event analysis steps in the licensing analysis methodology 0 a description of the sensitivity studies used to justify the methodology o typical analysis results.

The scope and content of each item are described below. 5.3.1.1 Event Description The event description provides an overview of the event sequence from its starting point until a stable condition is reached.. Xt ensures that the event is 'appropriately. simulated. The event description discusses'he -response of=- the., plant, systems to the i;n'itiating event, including the effects of all assumed system trips or initiations. The event description specifies the initial conditions assumed for the event, system operational considerations, the anticipated operator -response.to the event, and 4 event acceptance l'imits. II The initial conditions define the plant operating state used as the starting point for the event, analysis. Operational considerations identify the plant operating mode used in the analysis, any additional failures that must be considered in the analysis, and system trips and equipment initiations that will probably be encountered during the event. I 0 Operator response describes the actions that will be taken by plant operators to attain'a stable operating state. Operator response should not be considered a viable option unless information and time are suffici'ent for the necessary tasks. E Event acceptance limits identify the figures of merit used to demonstrate the acceptability of event consequences. The event acceptance limits are consistent with'.the- reload analysis limits listed in Table 5.1-1. This table lists only limits specifically challenged by the event'dentified; k 5.3.1.'2 Analysis Consideration Many factors may impact event analyses. These include 0 key event phenomena 5 3~1 2 0

o systems performance considerations component performance characteristics. The importance of each of these is discussed below. l'n event, analysis, it, is important to understand the, phenomena that have a significant impact on the event. Different. approaches and different modelling, options may,be used to simulate the phenomena

                                                              >> II of interest; which approach .is chosen depends in, part on the relative importance of each to the event.                    ~
                                                                '

The interaction of -plant systems may have a significant impact on an event and its consequences. Systems considerations identify all systems that may significantly impact event analyses; these system require simulation in the event analysis. 1 I "I

The performance characteristics of individual components may also t

significantly impact event consequences. Component performance characteristics include instrument setpoints, valve, opening and closing times, instrumentation delay times,,and pump coastdown t characteristics. 5.3.1.3 Methodology/Xntegration..of Codes and Analysis 4 The Supply System methodology uses an integrated set of computer codes and a variety of analysis techniques, such as SCU methods. The codes and techniques are described in Section 2.0. I 5.3.1.4 . Licensing Analysis Process..-. The licensing analysis process identifies..key assumptions and modelling considerations used in the event analyses. Included are assumptions about the plant operating. state and the. system and V component simulations that must be included. 5~3 ~ 1-3

5.3.1.5 Sensitivity Studies/Justification of Process This section identifies the sensitivity studies that provide the basis for the licensing analysis process. Xt also discusses the results of these studies. The studies typically consider uncertainties associated with event definition, the plant operating state, instrumentation that measures specific parameters or initiates protective action, r and analytical models. 4

5. 3. 1. 6 . Typical Results This section describes. the results of applying the reload analysis methodology to WP-2 Cycle 8. The analysis results are compared with results from the fuel. vendor analysis for Cycle 8. This allows a'comparison of the results obtained using-the Supply System methodology with . the results obtained using an approved methodology.

                 .I ~     ,'I ~
    '

5.F 1-4

5.3.2

 ~ ~     Loss   of Peedwater Heating 5.3.2.1      Event Description Loss of feedwater heating results in a core power increase and power 'distribution shift due to an increase                in core inlet subcooling. Feedwater heating can be lost in at least two ways:

II a steam extraction line to one of the heaters is closed 0 feedwater flow bypasses one or more feedwater heaters. The first case produces a gradual cooling of the feedwater. In the second- case, the feedwater bypasses the heaters and no heating of the bypass feedwater occurs. In either case, the reactor vessel receives cooler feedwater. The maximum number of feedwater heaters that can be tripped or bypassed by a single event represents the most severe situation. Because of the mixing of feedwater and recirculation flow, the rapid decrease in feedwater temperature results in a gradual increase in core inlet subcooling. This causes a relatively slow power increase and shift in the power distribution toward the bottom of the core. As a result of the core power increase, the vessel steam flow increases. This results in an increase in nuclear system pressure due to the larger steam line pressure drops. A scram on average power range monitor {APRM) high neutron flux or APRM thermal power may occur depending on the magnitude of the power increase. The increase in inlet subcooling tends to mitigate the decrease of the MCPR caused by the core power increase. Table 5.3.2-1 shows the expected sequence of events for the loss of feedwater heating.

                                 ,5 ~ 3.. 2-1

5.3.2.1.1 Initial Conditions and Operational Assumptions, The following plant operational conditions and assumptions form the principal bases for the analysis of the loss of feedwater heating event:

o. The. reactor is .in steady state condition before and after the event.

o The xenon concentration remains the same before and after the event. ' 0 The critical eigenvalue is constant during the event.;-. 0

The 'maximum change'n feedwater temperature identified in the plant, safety analysis,-100'F,,occurs instantaneously. 0= The plant..is operating. in the manual flow,control mode. 5.3. 2. 1. 2 Operator Actions Xf the core power increase does not cause reactor scram, the reactor will settle out at a higher steady state power level. An APRM neutron flux 'or thermal power -monitor alarm will alert-the operator to insert control rods or reduce core flow-,to. get back into the normal range of the gower/flow operating map. The operator 'ust determine, from plant procedures, the maximum allowable turbine-generator output with feedwater heaters out of service. If'eactor scram-'occurs, the'perator must. monitor the 4 reactor water level and pressure controls and the turbine generator auxiliaries during'coastdown. 5.3.2.1.3 Event Acceptance Limits The acceptance limits for this event. are a MCPR > fuel cladding integrity limit and the LHGR 5 PAFF limits. Compliance to the fuel cladding integrity "limit 'is demonstrated by ensuring, that the

~ =

1

5.3 '-2 0'

operating limit MCPR is greater than or equal to the MCPR which ensures that greater than 99.94 of the fuel rods in the core are not expected to experience boiling transition (safety limit) plus the change in CPR during the event. Compliance to the PAFF limits is demonstrated by ensuring that the change in fuel design limit ratio (LPDLRX) is less than that assumed in the fuel vendor's mechanical design analysis (e.g., References -15, 16)," where=FDLRX is the ratio of LHGR to the LHGR limit. 5.3.2.2 Analysis Considerations k This section describes the key analysis-considerations applicable' to the loss of feedwater heating event. Zt includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences;'(2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.2;2.1 Key Phenomena Described below are the'ey,phenomena related to the loss of feedwater,-heating event, Consideration .of these phenomena is necessary. in,.the simulation of this event to, accurately model the plant response. h Feedwater Phenomena As the colder feedwater flow, r is mixed with the recirculation flow, the core .inlet,.enthalpy decreases and core power increases. The feedwater flow increases slightly to maintain a N. the reactor water level. Recirculation Phenomena 1n this analysis the recirculation flow rate is held constant. 4

                                                                'I Pressu e Vessel     Phenomena     As  the colder feedwater enters the reactor pressure vessel,      it  mixes with the recirculation flow in
                                ,5.3.2.3

the downcomer region. Further mixing occurs in the'essel lower plenum. This mixing phenomena determines the core inlet temperature corresponding to a change in feedwater temperature. The vessel pressure increases due to the increase in core power. Core henomena The reduction of core inlet =temperature and the corresponding reduction of the core average void fraction causes a positive reactivity insertion. "This causes'an increase. in power level which increases'ore heat flux arid gener'ates additional steam voids. If the core power level does'ot reach the pre-established scram setpoint, the increased steam voids and Doppler reactivity will limit the power" increase 'and -a'new'-equi'librium power level will be established. If scram occurs, the power. increase, will be rapidly terminated. 5.3.2.2.2 Systems Considerations'he event is initiated by a rapid reduction of feedwater temperature resulting from the limiting single failure in the P feedwater or steam extraction systems. All other systems are assumed to operate 'as designed and. to continue to function throughout the event. Safety systems are assumed to initiate at their pre-established setpoints. The important systems are: (1) the core and fuel 'system', including the nuclear .and thermal hydraulic coupling; (2) the steam and-:feedwater systems; (3) the recirculation system; and" (4) the- reactor -protection and,scram systems, including the APRM flux=or.thermal"power .scram.. Other ( systems which may be activated as .a 'result. of= a scram or operator ( action are not required because'they have no effect until after. the challenge or nearest approach to SAFDLs has-occurred.'.3.2.2.3 Component Performance Characteristics Modeling of the NSSS components outside of the reactor core is simplistic because of the slow nature of the transient. The core response is calculated at a steady state condition to ensure that 5' 3.2-4

~;

the core inlet enthalpy and its maximal effects on core power and power distribution are accounted for. I 5.3.2.3 Methodology/Integration of Codes and Analysis The loss of feedwater heating event is simulated with the use of reactor physics codes (lattice physics and three-dimensional simulator) by calculating the core, response at a steady state condition at the event terminating point (i.e., thermal equilibrium consistent with the maximum feedwater temperature change). This method provides an accurate calculation of the core power level and enables an assessment of the radial and axial power distribution shifts that occur.. - ~ 1 Analysis of the loss of feedwater heating event utilizes the sIMULATE-E three-dimensional BWR simulator code for calculation of core response to a reduction in inlet temperature. The lattice physics input to SIMULATE-E is provided by CASMO-2E. The MICBURN-E code is used to determine the gadolinia cross sections used "in CASMO-2E and ESCORE provides the fuel temperature distribution. (See Section 2 and Figure 2-1 .for an overview of the overall WNP-2 reactor analysis methodology computer code sequence.) n SIMULATE-E calculates the reactor power, power distribution, and fuel assembly flow rates as .a function..of core inlet temperature and.core flow. The SIMULATE-E analysis, represents the reactor in equilibrium for the initial. conditions and after the change in feedwater temperature. TLIM uses the, results of the SIMULATE-E I cases to calculate the CPR.and the LHGR during the event for I comparison to the event acceptance limits. 5~3 2-5

5. 3.2. 4 Licensing Analysis Process The loss of feedwater heating transient is analyzed assuming a 100'F decrease in the feedwater temperature caused by the failure of plant feedwater heaters. The plant is designed such that the maximum change in feedwater temperature, considering the limiting

single failure in the feedwater system, is less than 100'F. Therefore, this transient disturbance is treated as an anticipated operational occurrence. In the licensing analysis process, any scram setpoints reached as a result of the event are conservatively ignored. In the analysis of the loss of feedwater. heating event, two } SIMULATE-E cases are run for each exposure point. The first. case represents the initial conditions and the second case represents the post event steady state conditions. A control rod pattern is developed for the first case to achieve criticality which causes at least one fuel assembly in the core to be near MCPR and one fuel assembly to be near maximum LHGR operating limits. In some cases, it may be the same fuel assembly that satisfies these criteria. The xenon concentration and the k-effective value resulted from this control rod pattern are held constant during the second case. The feedvater temperature for the second case is 100'F less than ( that for the first case. SIMULATE-E calculates a nev reactor pover level due to the 100'F feedwater temperature drop via,,the power search option'while the critical eigenvalue is maintained constant. The core pressure increases as pover increases and is calculated by SIMULATE-E. The inlet subcooling is .calculated by SIMULATE-E via the heat balance option. 'LIM reads the SIMULATE-E restart file and calculates MCPR and maximum LHGR for each case.; The dCPR is determined using the following equation: I hCPR' SLMCPR * ( ICPR/FCPR 1.0 )

                                                    "'         5'   2 1
                                     '  '-6

where SLMCPR = MCPR safety limit ICPR = initial MCPR (first case) and FCPR = final MCPR (second case). 't I I The bFDLRX is calculated by: I

                                                                             *
      ~

d,FDLRX =. FDLRXf , FDLRX; 5 3. 2-2 If ~ ~ where FDLRX, = final FDLRX and FDLRX; = initial FDLRX I ,I l I I I Two different analyses can be used to perform the loss of feedwater heating analysis: bounding analysis and specific analysis. Th'e ( bounding analysis is used to generate the conservative hCPR and hFDLRX values for the loss of feedwater heating event. In this bounding analysis, the event is assumed to be initiated from 100% V power and a lower than allowed flow at the exposure point where, the cycle hot excess reactivity is maximum. ..The lower than allowed ( flow 'is the flow at 1004 power. which is thesmaller of either 80: rated flow or a flow,5% below the maximum rod line flow at which the reactor can be operated., This condition is, the worst loss of feedwater h'eating condition for the loss of feedwater heating MCPR [ and-FDLRX=responses'at any given cycle. The bCPR and bFDLRX values 'alculated from this= bounding analysis are the loss of feedwater heating- dCPR and dFDLRX. I I V V' The specific analysis is used when the bounding analysis results are overly conservative. In this specific analysis, the event is assumed to be initiated. from the- rated power and flow conditions (1004 power/1004 flow) and the cycle exposure is varied from the beginning of cycle to the end of cycle with an incremental exposure

                                           .5~F  2-7

of 1000 MWD/MT. The largest hCPR and hFDLRX from these exposure points are selected as the loss of feedwater heating bCPR and hFDLRX. I 5 3 2 5 Sensitivity Studies/Justification of Process This section describes the sensitivity studies performed to provide the basis for the licensing analysis process. The sensitivity studies are intended to cover the primary uncertainties related to the loss of feedwater heating event. These include: (1) operating state; (2) instrumentation; (3) methodology; and (4) event definition. These sources of uncertainty, as they relate to this event, are described in more detail below. 5.3.2.5.1 Primary Uncertainties 0 eratin State Uncertainties include both fuel assembly and system uncertainties. System uncertainties are those related to feedwater flow and temperature, the TIP system, core flow rate, core pressure, core/assembly power and power distribution, etc. Fuel assembly uncertainties are those related to individual fuel assemblies, such as local peaking factor, assembly flow rate, .heat

 'transfer correlations, etc.

P In the reload analysis process, the magnitudes of the operating state uncertainties are not expected to change during the event. In 'the short period of time between initiation of the event and a return to reactor equilibrium, it is not expected that the error in any plant parameter would significantly change. Thus, if the reactor dome pressure reading is 5 psia higher than actual at initiation of the event,'t is assumed to be 5 psia high at the termination of the event. With'ssentially no change in the uncertainty of the plant parameters during the loss of feedwater

  'heating event, the primary'pproach .is to account for the uncertainty in the plant operating state assumed in the event analysis. The uncertainties in the plant operating state are included in the event acceptance limit.

5 ' '-8

Instrumentation Uncertainties are the uncertainties in the instrument system or sensor performance associated with the specific value at which an instrument trip signal is generated. In 'the analysis of the-"los's of feedwater heating event, no protection system intervention is assumed to occur (high neutron flux and thermal power trips are conservatively ignored). Therefore, no consideration of instrumentation uncertainties is necessary. Methodolo Related Uncertainties are associated with the technique used to analyze this- event. The licensing analysis methodology uses SIMULATE-E to calculate the change in reactor. parameters. The major 'uncertainty in this method is in using a steady state simulation t'.o analyze this ,transient. Because the, loss of feedwater heating event takes place very slowly, the core remains in a quasi steady state condition. .The use of a,steady st:ate code such as SIMULATE-E is therefore reasonable. The conservatism introduced into the analysis process by the event definition, as described below, bounds the effect of the steady state analysis. Event: Definition Uncertainties, are introduced through the assumptions of the event scenario. 'or the loss. of feedwater heating event', 'the -primary conservatisms, and uncertainties are introduced by: the assumption of the magnitude of the temperature reduction, and the assumption of constant xenon concentration. Each of these parameters is discussed in more detail below. Other uncert:ainties introduced by .the.use of rated power and flow as the initial conditions of the event:, have .been, covered .in the event sensitivity analyses (Section 5.3.2.5.2). 4 1 l The'ajor conservatism in the initial conditions is the

                                                                  ~ ~     p magnitude of the decrease in feedwater,temperature.            The loss of feedwater heating analysis methodology assumes, an instantaneous                 100'F feedwater temperature'ecrease.          .Operat:ing experience, indicates that the temperature change'n:the majority.,of lossof feedwater heating events is significantly less. The relatively,few events that   have occurred and which have approached        the magnitude assumed 5 '   2 9

in the licensing basis analysis have, been terminated by operator action or protection. system operation before any design limits were challenged. The maximum drop in -feedwater temperature due to any single failure for NNP-2 has been evaluated to be about 34'F. Based on the results of the sensitivity analyses (Section 5.3.2.5.2) for a'0'F feedwater temperature drop, the analysis has 0.044 BCPR and 0.069 dFDLRX conservatism relative to the, assumed worst case (100'F) feedwater heater'ailure.. The 60'F -loss -of feedwater,heating is considered to be a more reasonable. maximum bound on the NNP-2 feedwater system design and operation. Therefore, the use of an instantaneous reduction of 100'F in feedwater temperature represents 1 a significant conservatism in the event analysxs. The analysis of the loss of feedwater heating event, assumes ( constant xenon concentration throughout the event. Based on the results of the sensitivity, analyses (Section 5.3.2.5.2) for an equilibrium xenon concentration with respect to a 100'F feedwater ( temperature drop, the analysis has 0.015 dCPR and 0.010 dFDLRX conservatism. 5.3.2.5.2 'Event Sensitivity Analysis Results Sensitivity analyses were performed to evaluate the magnitude of the effect of the -principal conservatisms and uncertainties

associated with the loss of feedwater heating event. The sensitivity studies cover: (1) the effect of time in cycle exposure and core reactivity;. (2) the effect of control rod ['atterns; (3) the effect .of core flow (4) the effect of .the magnitude of'the feedwater 'temperature reduction; (5) the effect of r constant xenon 'concentration'ssumption." .The results of; these sensitivity studies are described'in .more detail below. I ,I Table'.3.2-2 provides a summary of the 20 cases run to support, the )licensing analysis process for. the loss of feedwater.heatingevent. ('he 'irst 12 cases were 'run 'sing the control rod patterns developed at the rated power and rated flow. Cases 13-18 were run 5 3."2-10

~ '

using the control rod patterns developed at the rated power and 804 rated flow. The remaining NSSS operating parameters are consistent with normal plant operation. With the initial core power being at the rated power, the final core power increases to about 1144 rated power and the final core pressure is about 15 psi higher than the initial core pressure due to a 100'F feedwater temperature drop. Case 19 was run to determine the effect of, the magnitude of the feedwater temperature reduction. Case 20 was run to study the effect of initial xenon concentration. The effect of time in cycle exposure and core reactivity on hCPR and dFDLRX is investigated.. With the cycle exposure varied from 0.0 to 2.0 GWD/MT, the same control rod pattern used for Cases 1-6 produced a negligible change in bCPR and a change of 0.036 in bFDLRX. The same control rod pattern used for Cases 13-16 produced a change of 0.005 in dCPR which is small and a change of 0.010 in hFDLRX. The largest BCPR and BFDLRX for Cases 1-6 and for Cases 13-16 occurred at 0.0 GWD/MT which is the most reactive exposure point where the hot excess reactivity with all rods out is maximum. Therefore, the most reactive cycle exposure point is selected for the Bounding Analysis to provide assurance that the calculated hCPR and dFDLRX values are the largest. The effect of control rod patterns on dCPR is determined to be insignificant. The control rod patterns used for Cases 7-8 and Cases 9-10 are not the same and are different from that used for Cases 1-6. The largest difference in ECPR for these cases is 0.005 which is very small. The values of=hFDLRX for .these cases vary from 0.197 at the most reactive state (0.0 GWD/MT) to 0.135 at 4.0 GWD/MT where the amount of hot excess reactivity, is small. The significant changes in dFDLRX are due to the effect of cycle exposure and core reactivity rather than the effect of control rod patterns. All control 'rods- for Cases 11-12 and Cases 17-18 were fully withdrawn to maintain, criticality. No fuel assemblies in the core can be put near MCPR and maximum LHGR operating-limits due to the lack of hot excess reactivity. The values of r3FDLRX for these

cases are significantly less than that "at the most reactive - exposure (0.0 GWD/MT). Although 'hCPR at 5.1 GWD/MT (Cases 11-12) is 0.012 larger than dCPR at 0.0 GWD/MT (Cases 1-2), the final MCPR [ at 5.1 GWD/MT is larger than the final MCPR at 0.0 GWD/MT by 0.147 which is significantly larger than the increase of 0.012 in DCPR [ due to the higher MCPR initially (the difference in the initial MCPR values is 0. 173) . Nevertheless, 'this .BCPR value is included in the evaluation process to conservatively determine the largest bCPR among those values calculated throughout the cycle of interest when the Specific Analysis is'mployed. I The is demonstrated by comparison of, the effect of core 'flow Analysis' results shown for Specific Analysis (1004 rated flow) with the results shown for Bounding (804 rated flow).. As the core flow is decreased,- the values of'CPR and bFDLRX are effectively increased: bCPR increases by 0.028 and 0.023 at the most reactive state (0.0 GWD/MT) and at 2.0 GWD/MT, respectively. dZDLRX increases by 0.018 at 2.0 GWD/MT and is virtually unchanged at 0.0 GWD/MT. Consequently, the use of 80: rated flow at the most reactive exposure point in the Bounding Analysis provides an increase of 0.016 in 'dCPR when compared with the largest hCPR obtained from the Specific Analysi's. The use of"804 rated flow at the most 'reactive 'exposure point in the Bounding Analysis also provides assurance that bFDLRX is at least as large as the largest AFDLRX obtained from the Specific Analysis., Therefore, the use of 1004 r'ated power and 80~O rated flow (1104 rod line) at the exposure I point where the cycle hot excess reactivity is maximum .is conservative for ACPR and AFDLRX. I" Case 19 was run to -quantify the effect of a'maller drop in feedwater 'temperature.'- Based on"the design of the Number 6 heaters in the feedwater system, a dr'op"of "60'F would be-expected if both Number 6 heaters were lost. Due to feedback mechanisms associated with the extraction system on the heaters, the actual drop in feedwater is less than 60'F when both of these heaters are lost. For the purpose of this analysis, a 60'F drop in feedwater 5 .2-3.2

temperature was analyzed. The 60'F change bounds the 34'F dxop that would result if both Number 6 heaters were lost or if an entire string were to fail. Results for the case with a 60'F drop in feedwater temperature -show that dCPR and bFDLRX are reduced by 0.044 and 0.069 compared to the base case, respectively. This demonstrates that the assumed change in feedwatex temperature during the event adds,a significant amount of .conservatism to the results. <<4

                                ~      ~         ~ '

Case 20 was run to quantify the effect of the initial xenon concentration assumption. In this case, the steady state equilibrium xenon concentration corresponding to a 100'F feedwater temper'ature drop is calculated. The results show that dCPR and hFDLRX axe reduced by 0.015 and 0.010 compared to the base case, respectively. This case.- demonstrates .that:..the assumed initial xenon concentration during the loss of.feedwater heating event adds an additional amount'of conservatism to the results. 5.3.2.6 Typical'Results The licensing analysis process for evaluating the loss of feedwater heating'vent is described in Section .5.3.2.4. The Bounding Analysis is conservatively used for a 100'F feedwater temperature drop. The Specific Analysis is applied when the Bounding Analysis results are.overly'conservative., These methods have been usedto a'nalyze the loss of feedwater heating event fox Cycle 8. Based on this methodology, the -ACPR. is reported as 0.12 and dFDLRX is reported as 0.196. From the reload >>report. supplied by SPC for Cycle 8, the bounding dCPR is 0.07. Therefore, it is concluded n that the Supply System licensing analysis process is reasonable yet conservative based on the evaluation of. the analysis consexvatisms and uncextainties and the'.comparison with the SPC, results. I

5. ~ 3. 2-.13

Table 5.3.2-1 Secgxence of Events for Loss of Peedwater Heating 1 Maximum feedwater temperature reduction is assumed to occur instantaneously. l'nitial effect of reduced temperature feedwater starts to raise core power level and steam flow. Turbine control valves open to control pressure. APRM or thermal power alarm setpoint reached. P Ef the core power does not reach the scram setpoint, new steady state opera'ting condition is achieved.- Xf core power reaches scram setpoint, the APRNs will initiate a reactor scram. The NSSS will follow the same sequence as for a scram from normal power level. ~ ~

                                                             ~ I
                                   '.3.a-l4

, Sensitivity Table 5.3.2-2 Results of Loss of Feedwater Heating Analysis Cycle Final core Exposure Final core Power Pressure FH hT

                                                                                       'P Cases      ~GWD                MW,. MWt       S rated.             Psia      ,

r ECPR dPDLRZ Specific Analysis<*'-2 4 0.088 " 0"'.197 0.0 3781.2 113.8 -1050.0.. 100 3-4 1.0 3775.0 113.6 1049.8 100 0. 088 0. 168 E 5-6 2.0 3779.0 113. 7 1050.0 100 0. 086 0. 161 7-8 3.0 3778;9 ; 113.7 ,, 1050.0,. 100 0.083 0.164 9-10 4.0 3776.8 113. 1049.9 100 0.084 0. 135 11-12 5.1 3787.3 114. 7 0 1050,.2 ., 100 0."100 '. 112 Bounding Analysis<*' 13-14 15-16

0. 0

2.0

3799.~ 3801.6 3 114.3 114.4 1046.8 1046.9 100 100

                                                                                          '. 116 0.111

0. 196 0.186 17-18 4.0 3802.1 114.4 1046.9 100 0.096 0.154 19 0.0 3615.3 108.8 1040.8 60 0.072 0.127 20+ 0.0 3751 ' 112 ' 1045.2 100 0.101 0.186 (a) Initial conditions: S ecific Anal sis Boundin Anal sis Core Power, MWt 3323 3323 Core Flow, Mlbm/hr 108.5 86.8 Percent rated flow 100.0 80.0 Core Pressure, psia 1035.0 1031.2 (b) Equilibrium xenon concentration is used.

                                                     -  5.3   '-15

5. 3. 3

 ~ ~     Generator Load Rejection without Bypass 5.3.3.1     Event Description The   generator load rejection without bypass (LRNB) event is the postulated complete loss of electrical load to the turbine generator coupled with the assumed failure of the turbine bypass system. Fast closure of the turbine control valves is initiated whenever electrical grid disturbances          occur which result in significant loss of load on the generator. The turbine control valves are required to close rapidly to prevent overspeed of the turbine generator rotor due to the loss of load. The rapid closure of the turbine control valves causes a sudden reduction of steam flow which results in a nuclear system pressure increase. Neutron flux increases rapidly because of the core void reduction caused by the pressure increase.         Turbine control valve fast closure initiates a scram trip signal and a prompt RPT, which results in a rapid reactor shutdown. The reactor vessel pressure increase is limited by the action of the relief valves. The neutron flux increase is limited by the scram and the prompt RPT. The peak fuel surface heat flux increases initially due to the neutron flux increase then decreases following reactor shutdown.          Long term reactor water makeup is provided by the feedwater system or high pressure makeup systems.       Heat rejection is through the relief valves to the suppression pool.

Table 5.3.3-1 shows the expected sequence of events for the generator load rejection without bypass transient. 5.3.3.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and assumptions form the principal bases for the analysis of the generator load rejection without bypass event: 0 The plant is operating at the safety analysis power level and 1064 rated core flow. 5.3.3-1

o The remaining NSSS operating parameters are consistent with normal plant operation. o A generator load rejection initiates the transient which results in a control valve fast closure at. the fastest design rate. 0 A reactor scram is initiated by the control valve fast closure. o The pressure relief function is available to limit the pressure increase. The bypass system is assumed to fail in the closed position. o All of the remaining plant control systems function normally. 0 The system trips and initiation signals are consistent with the technical specifications. 0 The prompt RPT system is initiated by the control valve fast closure and trips both recirculation pumps.

5. 3. 3. 1. 2 Operator Actions No restart is assumed and the reactor is to be cooled down. The operator is expected to take the following actions as appropriate:

o . Control the reactor pressure. o 'scertain that all control rods are in. Monitor and maintain reactor water level. 0 Cool down the reactor consistent with plant procedures. 5.3.3.1.3 Event Acceptance Limits The acceptance limits for this event are MCPR > fuel cladding integrity limit; LHGR 5 PAFF limits; and reactor pressure < the (-ASME Code limit for the reactor coolant pressure boundary. Compliance to the fuel cladding integrity limit is demonstrated by ensuring that the operating limit MCPR is greater than or equal to (the fuel cladding integrity MCPR limit (which ensures that greater than 99.94 of the fuel rods in the core are not expected to experience boiling transition) plus the change in CPR, hCPR, during

the event. Compliance .to the PAFF-limit is ensured by meeting the LHGR limit requirements for transient "occurrences in the fuel vendor mechanical design topical reports (e.g. Reference 16). 'Compliance with the'SME Code limit for the reactor coolant pressure boundary is demonstrated by ensuring that the peak reactor vessel pressure is less than 1375 psig. 5.3.3.2 Analysis, Considerations This section describes the -key analysis 'considerations applicable to the generator load rejection. without bypass event. It includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course..of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.3.2.X, Key Phenomena Described below are the key phenomena related to the generator load rejection without bypass event. Consideration of these phenomena is necessary in the simul'ation of this event to accurately model the plant response. *. 4 ~ The generator load rejection without, bypass involves the reactor core, the entire reactor coolant pressure boundary, and the main steam system. The event is characterized'y rapidly changing conditions with complex interactions associated with the key

                                                         'I phenomena.

I Steam Line Phenomena The event begins'with 'closure of the'turbine control valves which causes a pressure 'increase at'he'urbine inlet that is rapidly transmitted to"the"reactor pressure vessel by pressure wave phenomena in the steam lines. The relief valves 'open at pre-established setpoints allowing a steam release path for.

4

                                   ,5 ~ 3. 3-3

pressure relief. Nodalization of the steam lines is necessary to ensure accurate simulation of the system pressure response. Pressure Vessel Phenomena The propagation of the pressure wave from the steam lines to the core is an important phenomenon.= The attenuation of the pressure wave by the reactor vessel internal components is a particularly important phenomenon in modeling the timing of the core moderator void changes. Recirculation Phenomena Following the'generator load rejection, a v turbine generator overspeed will occur which is limited by" the fast closure of the turbine control valves. Modeling of the recirculation flow coastdown phenomena'following RPT is important to ensure that the changing recirculation flow is correctly calculated. The recirculation system modeling includes consideration of the downcomer phenomena, including the annular flow region above and through the jet pumps. The changing performance of the jet pumps at varying pressure and drive flow is included. The external recirculation loop flow is represented so that flow into the vessel as a function of time is accurately simulated. I ~ Core Phenomena The phenomena importa'nt in the core region are. the reactivity effects that contribute to changes in neutron flux level and hence energy generation and power input to the coolant. The primary reactivity feedback effects are steam void reactivity, fuel temperaturet Dopplei r'eactivity, 'and control rod reactivity. The steam void reactivity contributes to the initial positive

reactivity as a result of steam void collapse as 'the pressure sr

                                                                                 ~
            ~
              'ncrease from the steam system reaches the core.
                                         *

L. ~ g *1 ~

During the generator load rejection transient, the collapsing moderator voids cause an increase 'in power level which in turn increases fuel temperature and moderator voids to the point that power would reach a new- level. 'owever, with steam flow restricted, system pressure and core power continue to'rise until 5 '+3-4 0

a rapid scram of control rods and trip of recirculation pumps initiated by the turbine control valve fast closure terminate the power increase and result in reactor shutdown. 5.3.3.2.2 Systems Coasideratioas For the generator load rejection transient, the initiating event is the action that causes the generator load rejection to occur. All other systems normally operating are assumed to function as designed. Safety systems that are designed to actuate are assumed to actuate at their pre-established setpoints. The steam bypass system is assumed not to function. The important systems to be considered are: (1) the reactor protection system including the turbine control valve fast closure scram; (2) the control rod drive (scram) system; (3) the steam system including control valves and relief valves; (4) the recirculation system, including the prompt RPT; (5) the steam separation system inside the vessel; and (6) the fuel and core system, including the nuclear and thermal hydraulic coupling. Other systems called upon for long term operation are not required to be part of this analysis because their action occurs much later in the transient, following the time of challenge or nearest approach to the event acceptance limits. 5.3.3.2.3 Component Performance Characteristics The generator load rejection transient analysis requires detailed modeling of the NSSS in order to ensure that all systems that J influence reactor system pressure, steam flow, core flow, and core inlet enthalpy are properly considered. The selection of conservative or licensing basis component performance characteristics is based, on a buildup of conservative assumptions established by past, practices and licensing requirements. Turbine Control Valve Closure Characteristics The turbine control valve closing characteristics are fundamental to the generator load 5o3 ~ 3-5

P rejection transient, The turbine control valve closure characteristics are specified by the turbine manufacturer and are designed to provide adequate protection to the turbine from potential overspeed conditions.'he closing characteristics are designed to ensure rapid closure" and are verified during plant startup testing. The fastest specified closure time is used in the analysis. The turbine control valve closure is simulated as linear from its actual operating position to fully closed. Relief Valve Characteristics The relief valves are used to prote'ct the reactor coolant pressure boundary against overpressure events. The technical or design specifications establish limiting conditions for the relief valve setpoints. The maximum values are I ) used in the licensing basis analysis in order to ensure a conservative evaluation of the system pressure'esponse. Rec'rcu ation Pum Coastdown Cha acteristics The recirculation pumps receive a trip signal from the same source as the turbine control valve fast closure scram signal which opens breakers to the recirculation pumps power supply. This provides additional negative moderator void reactivity insertion to reduce. the magnitude of the transient neutron'lux rise. I

                                                            'he   '-

rate of reactivity insertion is strongly influenced by the timing of pump coastdown which directly 'influences the amount- of core recirculation flow driven through the jet pumps. The breaker time, in terms of number of cycles to trip power, and the inertia of the pumps are specified in plant design and confirmed during plant startup testing. The slowest pump coastdown consistent with design specifications is used in the analysis. Xn addition, the maximum instrumentation and signal processing'elay times are used in the analysis. r I I Turbine

Control Valve Fast Closure Scram Si nal Scram on turbine control valve fast closure is" assumed in the generator load I

rejection analysis. The turbine control valve fast closure scram signal is generated from hydraulic oil pr'essure associated with the disc dump valve. The maximum design specification time between the Ill 5.3. 3-6 I

~ I

start of the turbine control valve fast closure and the hydraulic oil pressure switch actuation is used in the analysis.

  ~                ~

,Reactor Protection"~S 'stem Si nal Dela s The reactor protection system includes the collection of a number of analog and digital signals, conditioning of, these signals, comparison to pre-established setpoint limits, and activation of nuclear system trips. The signal processing and trip initiation involves delay times which impact transient response. The'lant technical specifications identify, the allowable reactor protection system response times and are used in the analysis. f Control Rod Drive Insertion Time The control rod drive system e-provides the primar'y mechanism, for negative reactivity insertion for terminating the transient., The control rod drives are inserted in the scram mode by the control rod hydraulic control system. The control rod scram time is determined from surveillance test data. Pressure Switches in the H draulic Oil S stem The pressure switches in the hydraulic oil system are assumed to initiate 'a reactor, scram for this. event. The design specifications 'that maximize the scram initiation time are used in the analysis. The specific values for the parameters associated with the component performance in the licensing. basis model are given in Table 4.1 in Reference 9. The table also compares the values for the licensing and nominal conditions. C I' I 5.3.3.3 . Methodology/Integration of Codes and Analysis P The primary analysis model in the simulation of the generator 1oad rejection without bypass event is the system thermal hydraulic model, RETRAN-02. RETRAN-02 is used to calculate the changes 'in system and core average nuclear andthermal hydraulic parameters throughout the course of the event. The RETRAN-02 analysis results I are used in the assessment, of the fuel thermal margin, the increase xn nodal, power~ and the peak reactor vessel pr essure. I 5.. 3 3.-7

The analysis of the generator load rejection without bypass is performed using the following codes in the sequence shown on Figure 2-1: (1) ESCORE (2) MICBURN E (3) CASMO-2E; (4) NORGE B; (5) SIMULATE E (6) SIMTRAN E (7) STRODEI (8) RETRAN 02 I (9) FICEI (10) VIPRE-01; and (11) STARS (when limiting) . ESCORE is used to ); provide the fuel rod temperature distribution used in CASM0-2E. MICBURN-E provides the gadolinia cross sections used in CASM0-2E. CASMO-2E is used to perform the lattice physics analysis to generate the cross sections for SIMULATE-E and the inverse neutron velocity and'total effective delayed neutron yield for SIMTRAN-E. NORGE-B is used to transfer the CASMO-2E data to SIMULATE-E and SIMTRAN-E. SIMULATE-E develops the three-dimensional macroscopic cross section data to be processed by SIMTRAN-E. SIMTRAN-E collapses the three-dimensional cross section data to one dimension ), and transfers the other nuclear parameters to RETRAN-02. STRODE is used to adjust. the moderator density feedback behavior and delayed neutron fraction data for input to RETRAN-02. RETRAN-02 is used to perform the transient analysis. VIPRE-01 is used to determine the dCPR during the transient based on the local peaking factors provided by FICE. STARS, if required, is used to perform the statistical assessment to demonstrate compliance with the fuel cladding integrity or PAFF limits. Fuel-pellet gap conductance ( calculated by the vendor's approved methods is 'used in RETRAN-02 and VIPRE-01. 5.3.3.4 '-. Licensing Analysis Process

In the analysis of the generator load rejection without bypass, the following analysis assumptions are applied:

(a) The scram times are based on plant surveillance .data. A statistical analysis is performed for this event, scram time statistics are included in development of the response surface as described in Appendix A. (b) Scram initiation time delay is the maximum technical specification value. 5 ~ 3'-8

(c) RPT time delay is the maximum technical specif ication value. An analysis is also performed without 'RPT to establish the appropriate operating limit for plant operation with RPT out of service. (d) Relief valve'pening setpoints, are consistent with technical specifications. (e) The analysis is performed at'nd of cycle conditions,

with all control rods fully withdrawn. The end-of-cycle conditions maximize the void feedback. The all-rods-out condition minimizes the negative insertion reactivity.

(f) The analysis is performed at"the most limiting point on the power/flow operating map, consistent with .the licensing basis assumption on maximum power level {i.e., safety analysis power level, 1064 core flow) . (g) Feedwater temperature is determined by, the RETRAN code, consistent with the sys'em heat balance at the licensing power level.'f the plant is allowed to- operate with final feedwater temperature. reduction to extend the operating cycle, the limiting feedwatei temperature is calculated using a consistent" set,of nuclear. input parameters. {h) The turbine contxol valves (TCV) operate in the partial arc mode and have a full stroke closure time, from fully open to fully closed, of 0.15 seconds. The closure time from their normal operational position is assumed to be proportional to the full stroke time. The normal operational positions are two TCVs at 1004 open, one TCV at about. 504'pen, and one TCV at about 10%-12% open. A composite stroke time for a single equivalent TCV is conservatively calculated to be 0.10 seconds. l4 ~ ~ ) System actuations caused by low reactor water level trip setpoints, including main steam line isolation valve closure and,.high pressure, makeup initiation, are not included in the simulation. These trips, should they occur, will be after the 'time of challenge or nearest approach to the-event acceptance limits.; 5.3.3.5 Sensitivity Studies/Justification of Process

                                    ~  ~

H RETRAN-02 and VXPRE-01 'analyses were performed to determine the sensitivity- of the calculated,.results to changes in input assumptions. The parameters considered in the sensitivity analysis were:

5.3 '-9

(a) Nuclear Model Parameters Void reactivity Doppler reactivity Prompt moderator heating Scram reactivity Scram speed (b) Core Thermal Hydraulics Parameters Correlation parameters Core pressure drop Core bypass flow fraction

                     'Fuel pin nodalization Initial core  power (c) Recirculation System Parameters Recirculation loop inertia Recirculation pump head Jet pump inertia Steam separator   inlet inertia Steam "separator  outlet inertia Jet  pump pressure drop Prompt RPT (d)   Steam Line Model Parameters Steam  line inertia Steam  line pressure drop  .

(e) Vessel and Loop Geometry Parameters Vessel steam dome volume I ~ g ~ Steam lane volume I There are several objectives for sensitivity studies, including: supporting verification of the licensing model; demonstrating conservatism in the licensing model; and "quantifying the impact of uncertainties in model parameters, input parameters, and modeling options. defined as BCPR/ICPR (where ICPR is the initial CPR), is used 1l

 , RCPR,-

as the figure of merit in the.. sensitivity .studies. The model parameter values used in the sensitivity studies and the calculated changes in RCPR are shown in Table 5.3.3-2 and Table 5.3.3-3 for the 8x8 and 9x9-9X fuels respectively. All parameters, except 5~3 3-10

those marked with an asterisk, are included in the model uncertainty evaluation and are discussed in Appendix A. The base case is analyzed with the conservative technical specification scram times. When normal scram time is used, the calculated RCPR is reduced by 0.022 for both Sx8 and 9x9 fuels at EOCS, the largest change found in the sensitivity study. Therefore, scram time is used as a response surface independent variable in the SCU analysis (See Appendix A). The RPT inoperable case establishes the limits for plant operation with RPT out of service. Therefore, this parameter-is not considered in the model uncertainty evaluation. *. I 5.3.3.6 Typical Results The base case analyzed is for technical specification scram time, 106< rated core flow and with RPT operable. Plots of core power in terms of percent. of nuclear boiler rated (4NBR), core average heat flux, core inlet flow, reactor vessel steam dome pressure, vessel steam flow, reactor vessel water level, and feedwater flow are provided on Figures 5.3.3-1 through 5.3.3-7. A comparison of the Supply System and fuel supplier (Siemens Power Corporation) calculated results for WNP-2 Cycle 8 are provided in Table 5.3.3-4. The Supply System calculated RCPRs are than the SPC results. slightly'igher For the case with conservative technical specification scram time at 106% core flow with RPT, the Supply System calculates RCPRs of 0.186 for the SxS fuel 'and 0.193 for the 9x9-9X fuel, compared to 0.174 for the SxS fuel and 0.180 for the'x9-9X fuel calculated by SPC. For the case with technical ( specification scram time at 106% core flow without'RPT,"the Supply System calculates RCPRs of 0.237 for the SxS fuel and 0.244 for the 9x9-9X fuel, compared to 0.'219'for the SxS fuel and 0.231 for the 9x9-9X fuel calculated by SPC. Thus, the Supply System. results are consistently more conservative than those of the vendor. , ; [

Table 5.3. 3-1 Sequence of Events for Generator Load Rejection Without Bypass Time SEC

Events 0.0 Generator load rejection initiates fast closure of the turbine control valves.

0 ' Fast turbine control valve closure initiates signals for reactor scram, bypass valve operation, and RPT. 0 ' Turbine bypass valves fail to open. I 0.10 Turbine control valves are fully closed.

0. 19 Recirculation pump motor circuit breakers open causing decrease in core flow.

0.28 Control rods insertion starts. 1.39 Group 1 relief valves open to mitigate system pressure increase.

l. 69 Group 5 relief valves open to mitigate system pressure increase.

                ,Relief valves cycle closed/open to maintain system pressure.

Reactor vessel water level reaches L8 setpoint and feedwater pumps are tripped. Low level (L2) reactor vessel water level is reached. High pressure coolant inventory makeup systems are P initiated. RETRAN simulation results. These events are beyond the RETRAN simulation time. 5 '.3-12

Table 5.3.3-2 Results of Generator Load Rejection without Bypass Sensitivity Studies for Sz8 Fuel l&CPR Nuclear Model Parameters Void Coefficient (134) "+0. 018 Doppler (-10%) +0.004 Prompt Moderator Heating (-254) +0.010 Scram Reactivity (-104) +0.003 Scram Speed (normal scram time) -0.022 (1) *+ Core Thermal Hydraulics Parameters (See Appendix A) Code Correlation +0.007 Correlation (kappa1+0.20')'ode (CGL+304) +0.000 Code Correlation (CDB+204) +0.000 Code Correlation (CHN+204) +0.000 Core Pressure Loss Coefficients (-20<a) -0.004 Initial Core Bypass Flow (-204) +0.005 Fuel Pin Radial Nodes (+504) +0.002 Core power (+44) +0.000 Recirculation System Parameters Recirculation Loop Inertia (+1004) +0.006 Recirculation Pump Head (-10%) +0.003 Jet Pump Inertia (+1004) +0.003 Separator Liquid Outlet Inertia (1004) +0.003 Separator Inlet Inertia (-30%) -0.003 Jet Pump Loss Coefficient (-204) +0.003 No RPT +0.051 (2)

Steam Line Model Parameters Steam Line Inertia (+7%) +0.005 Pressure Loss Coefficient (-204) +0.006 Vessel and Loop Geometry Parameters Vessel Dome Volume (-54) +0.004 Steam Line Volume (-54) -0.004 (1) Scram time is a response surface independent variable.

(2) This case establishes the limits for plant operation with RPT out of service. Not considered in model uncertainty evaluation. Normal scram times are rod insertion times based on NNP-2 measured values (See Appendix A, Section A.2) and are approximately 2 standard deviations above the mean measured scram times. The normal scram'times are listed in the Core Operating Limits Report (COLR). All other cases were run with the technical specification scram speed (listed in the plant technical specifications) which provides a very conservative upper bound. 5.3 ~ 3 13

Table 5.3.3-3 Results of Generator Load Rejection Without Bypass Sensitivity Studies .for 9x9-9Z Fuel MCPR Nuclear Model Parameters Void Coefficient (134) +0.019 Doppler (-104) +0.005 Prompt Moderator Heating (-254) +0.012 Scram Reactivity (-104) +0.003 Scram Speed (normal scram time) -0.022 (1) *+ Core Thermal Hydraulics Parameters (See Appendix A) Code Correlation (kappal+0.20) +0.008 Code Correlation (CGL+304) +0.003 Code Correlation (CDB+20%) +0.000 Code Correlation (CHN+204) +0.000 Core Pressure Loss Coefficients (-.204) -0.001 Initial Core Bypass Flow (-204) +0.006 Fuel Pin Radial Nodes (+504) +0.003 Core power (+44) +0.000 Recirculation System Parameters Recirculation Loop Inertia (+1004) +0.006 Recirculation Pump Head (-10l) +0.004 Jet Pump Inertia {+100<) +0.002 Separator Liquid Outlet Inertia (1004) +0.001 Separator Inlet Inertia (-30%) -0.004 Jet Pump Loss Coefficient (-204) +0.004 No RPT +0.051 (2)

Steam Line Model Parameters Steam Line Inertia (+74) +0.005 Pressure Loss Coefficient {-20l,.) +0.007 Vessel and Loop Geometry Parameters Vessel Dome Volume (-54) +0.005 Steam Line Volume {-54) -0.001 (1) Scram time is a response surface independent variable.

(2) This case establishes the limits for plant operation with RPT out of service. Not considered in model uncertainty evaluation. Normal scram times are rod insertion times based on WNP-2 measured values {See Appendix A, Section A.2) and are approximately 2 standard deviations above the mean measured scram times. The normal scram times are listed in the Core Operat:ing Limits Report (COLR). All other cases were run with the technical specification scram speed (listed in the plant: technical specifications) which provides a very conservative upper bound. 5.3.3-14

Table 5.3.3-4 Comparison of Supply System Results to SPC Results for Generator Load Rejection Without Bypass Technical S ecification Scram Time 1064 Core Flow RPT Supply System Fuel Vendor Result Result Maximum Neutron Flux (4 Rated) 434 352 Maximum Core Average Heat Flux-(4 Rated) 132 119 RCPR (for 8x8 fuel) 0. 186 0. 174 ACPR 0.229 0.211 RCPR (for 9x9 fuel) 0.193 0. 180 hCPR 0.239 0. 220 Technical S ecification Scram Time 1064 Core Flow no RPT Supply System Fuel Vendor Result Result Maximum Neutron Flux (4 Rated) 654 544 Maximum Core Average Heat Flux (O'ated) 151 128 RCPR (for 8x8 fuel) 0. 237 0.219 ACPR 0.311 0.280 RCPR (for 9x9 fuel) 0.244 0. 231 b,CPR 0.323 0.300 5 ' '-15

                                '4 500
                        . NNP-2.EOCS LRNB
                                        ~  ', ~ '   H 7tI p 400 cY z   300 No Ql CD GJ CL e 200 0

O 100 0' 2 3 Time (sec) Figure 5.3.3-1 LRNB Results, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOCB LRNB 340 320 ioo K CO Z 80 X LL zI 60 40 20 0 0 3 Time (sec) Figure 5.3.3-2 LRNB Results, RPT Operable, Tech. Spe'c. Scram Time

VfNP-2 EOC8 LRNB l 4 4 ~ c 120 Core inlet Flow 300 K CQ

   ~o'0 4)-  3 I

p CQ 60 40 0-3'ime (sec) Figure 6.3.3-3 LRNB Results, RPT Operable, Spec. Scram Time 'ech.

WNP-2 EOCS LRNB

                                                 'U 1,250 StBBfYl DofAB Pl'8ssUfB 1,200

.+ 1,150 CL 1,100 1,050 1000 0 2 Time (sec) Figure 5.3.3-4 LRNB Results, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOCS LRNB 4 4 200 Vessel Steam Flow CC 100:

  ~O Ol 0

EL E 50 K 0. (50) 0 Time (sec) Figure 5.3.3-5 LRNB Results, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 LRNB '40 35 25 20 0 2 3 Time (sec) Figure 5.3.3-6 LRNB Results, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOCS LRNB 120

   '00 EY

~~ 80 gO 0 ~ 60 cd 0 40 20 0 0 Time (sec) Figure 5.3.3-7 LRNB Results, RPT Operable, Tech. Spec. Scram Time

5.3.4 Control Rod Withdrawal Error at Power ,5.3.4.1 Event Description The control rod withdrawal error is initiated by an operator erroneously selecting and continuously withdrawing a control rod. Due to the positive reactivity insertion, both the core average power and the local power in the vicinity of the erroneously withdrawn control rod increase. The core average and local power increase continues until the RBM acts to inhibit further withdrawal, or the control rod reaches its fully withdrawn position. The turbine contxol valves will open to compensate for the incxeased steam flow until a new steady-state operating condition is reached. 5.3.4.1.1 Initial Conditions and Operational Assumptions The number of possible control rod withdrawal error events is extremely large due to the number of control rods in the core and the wide range of exposures and power levels during an operating cycle. In order to encompass all of the possible control rod withdrawal errors which could conceivably occur, a limiting analysis is defined such that a conservative assessment of the consequences is provided. The conservative assumptions axe: (a) The postulated error is a continuous withdrawal of the rod which is expected to cause the maximum change in ACPR. (b) The core is operating at rated conditions. (c) The reactor is in its most reactive state and devoid of all xenon. This insures that the amount of excess reactivity which is controlled by the movable control rods is maximum. (d) Furthermore, the operator has selected the control xod pattern in-such- a way as to approachthermal limits in the 36 fuel assemblies (6x6 array) in the vicinity of the control rod to be withdrawn. It should be emphasized that this control rod configuration is not consistent 5.3 4-1

with normal operating control rod patterns and is highly unlikely. (e) The operator ignoxes all warnings during the transient, including RBM system alarms which must be reset in order to continue rod withdrawal. (f) Failures have occurred in the local power range monitor (LPRM) strings that provide input to the RBM system (i.e., the four LPRM strings nearest to the control rod being withdrawn). Three failure combinations are included in the rod withdrawal error analysis: (1) the limiting single LPRM instrument, (2) the limiting LPRM string, and (3) the limiting set of two LPRM strings. (g) One of the two RBM instrument channels is assumed to be bypassed and out of service. .The A and C elevation LPRM chambers input to one channel while the B and D elevation LPRM chambers input to the other. The channel with the greatest response is assumed to be bypassed. These conservative assumptions provide a .high degree of assurance that. the transient, as analyzed, bounds all control rod withdrawal error events that could reasonably be expected to occur. 5.3.4.1.2 Operator Actions As indicated above, the operator is assumed to have set up a very unlikely control rod pattern in which. the "error" rod is that xod which could cause the most serious event consequences, and the remaining rod pattern enhances the response to withdrawal of the error rod. The operator proceeds to withdraw the error rod until it is blocked by the RBM or is fully withdrawn. The operator fails to stop the withdrawal on either high '-LPRM alarms or RBM alarms which xequire acknowledgement and should result in no further rod withdrawal.'he licensing analysis is based on highly abnormal control rod patterns and operating'conditions and assumes. that the operator ignores all alarms and warnings and continues to withdraw the control xod. 8 1

5.3.4.1.3

  ~ ~ ~ ~   Event Acceptance Limits The acceptance    limits for this   event are a MCPR > fuel cladding integrity limit and"the LHGR < PAFF limits. Compliance to the fuel cladding integrity limit is demonstrated by ensuring that the operating limit MCPR is greater than or equal to the fuel cladding integrity limit MCPR (which ensures that greater than 99.94 of the fuel rods in the core are not expected to experience boiling transition) plus the DCPR during the event. Compliance to the PAFF limits is demonstrated by ensuring that the change in fuel design limit ratio (bFDLRX) is less than that assumed in the fuel vendor's mechanical design analysis (e.g., References 15, 16).

5.3.4.1.4 Analysis Considerations This section describes the key .analysis considerations applicable to the control rod withdrawal error at power event. It includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.4.2.1 Key Phenomena The event begins with the continuous withdrawal of a control rod. This action results in a significant change in local power and power distribution and a relatively mild change in core average power and system conditions. Therefore, accurate simulation of the core phenomena is the key to the analysis of the control rod withdrawal error event. The phenomena important in the core region are the reactivity effects that contribute to changes in the local neutron flux and the fuel energy generation for coolant heating. The primary 5.3.4-3

reactivity effects are the reactivity insertion due.to control rod withdrawal and the feedback effects of void and Doppler reactivity. During the control rod withdrawal error event, the withdrawal of the control rod is responsible for the initial positive reactivity insertion. This causes an increase in local power and core average power level which " increases fuel temperature and generates additional steam voids.-*The local and core average power increase continues unti'l" the control rod movement is terminated by the control rod'"reaching its full out"position or by action of the RBM system. 'The 'increase'd steam voids and Doppler .reactivity- will limit the power increase and, upon termination of the control rod movement, a new equilibrium power-level. will.be established. The control rod withdrawal error is simulated with the use of a reactor physics - code- (lattice physics. and three-dimensional

simulator) by calculating the core response at a series of quasi-steady state points. The amount of control rod movement is dependent on the RBM signal and trip setpoints which is dependent on the measurement of neutron flux by the 4 LPRM strings surrounding the control rod'eing withdrawn. The analysis, is generally performed at 6 'inch increments which, correspond to two control rod notch positions so that the location of the rod block position can be determined.

                                                 '$ ~

En evaluating the core phenomena, the,. reactor is initialized at full power with zero xenon condition with the control rods adjusted to have a critical core condition.

The error rod-- is fully inserted.' L t Zn the vicinity 'of the. error 'rod,> at least one fuel assembly is close to the core wide MCPR and one fuel assembly is close to the LHGR operating limits prior to the control rod withdrawal. During the quasi-steady state evaluations,'he critical eigenvalue is maintained and core and local power are allowed to change due to the reactivity insertion from the control rod being,.withdrawn. The xenon concentration is maintainedat its.zero condition. Because

                              '5 ~ 3 ~ 4 4

this 'is a localized "reactivity insertion event, ,the 36 fuel

                                                     ~         ~

assemblies surrounding the error rod are evaluated to establish the

         ~                            ~                                                ~

limiting fuel

~ ~

assemblies~ from both an MCPR and LHGR standpoint during the event. The qua'si-steady state analyses are used to calculate changes in MCPR and maximum LHGR . during the event. The results of the analysis are then used to demonstrate a compliance to the SAFDLs (fuel cladding integrity.-and .PAFF- limits). Because .this is a highly localized transient, fuel densification is considered in the evaluation of the" maximum LHGR. A 2.2O power spiking penalty is applied to the control rod withdrawal error maximum LHGR .to account for the fuel densification effect. The evaluation of this event employs, the use of the three- s dimensional simulator code, and the external system effects are treated as code inputs for the quasi-steady state evaluations. Use of the quasi-steady-state approach is justified on the basis of the slow reactivity insertion rate., The core has sufficient time to equilibrate (both neutron flux and heat flux, are in phase). Conservatism in the event. conditions is sufficient so that code inputs that reflect external system operation can simplified. k be

                                        ~I V

The core power increase results in a slight. increase in steam flow 4 which slightly increases reactor pressure and core pressure drop. Feedwater flow- increases".. to maintain reactor water, level, considering the increased steam flow. In .the manual flow control mode, recirculation pump speed is held constant; therefore, the K increase in core pressure drop will result in a slight decrease in core flow. These effects are considered to be second order and do not contribute significantly to the analysis .of the control rod withdrawal error.'.3.4.2.2

             .Systems'-              Considerations The   control rod withdrawal-.error event is-initiated by                        an operator error in selecting and withdrawing a control rod from                            an abnormal
                                                    ;.5, ~ 3 4-5

control rod pattern. '-

                                  'All'ystems     are assumed to operate as designed and continue to function throughout the event. The RBM system is assumed to initiate at its pre-selected setpoints.              The RBM failures assumed            in the analysis are described in Section 5.3.4.1.1(f)       and  (g).

5~3~4~2~3 Component Performance Characteristics I The RBM system minimizes'he 'consequences of a control rod withdrawal error by blocking the motion of the control rod before the safety limits are exceeded. The RBM has three trip levels that "remove the .rod withdrawal permission. The trip levels may be adjusted and are nominally separated in increments of 84 of reactor power. The highest trip level is set so"that the fuel cladding integrity safety limit is II not exceeded. The lower two trip levels are intended to provide a warning to the operator. Typical settings are 1064, 984, and 904 of initial steady-state operating power at 1004 core flow. The highest level trip is controlled by a technical specification. The trip levels are automatically varied with reactor coolant flow for protection at lower flows. The variation is set to ensure that event acceptance limits are not exceeded at the indicated coolant flow. The operator may encounter up to three trip points depending on the core power at the start of a given control rod withdrawal. The two lower'oints'ay be reset by manual operation of a push button. The reset p'ermissive is actuated (and-.indicated by a light 'n the RBM panel) when the, RBM reaches 24 power less than the trip setpoint. Th'e operator should'"then assess the local power and 'ither reset or select.a new rod for withdrawal. The highest power trip setpoint may not" be'eset. during -control- rod withdrawal operations. The RBM processes "LPRM signals. from the four'PRM 'strings that surround the rod selected for withdrawal. . There are two RBM channels; an A.channel utilizing the 8. LPRM signals from the A and h 5 ' 4-6

C elevations, and a B channel utilizing the 8 LPRM signals from the and 0 elevations.

B ~ 5.3.4.3 Methodology/Integration of Codes and Analysis Analysis of the control rod withdrawal error primarily utilizes the steady-state SIMULATE-E three-dimensional simulator code for the calculation of core response to the withdrawn rod. Lattice physics input to'SIMULATE-E is through the ESCORE, MICBURN-E, CASM0-2E, and NORGE-B path. TLIM reads the SIMULATE-E restart file and calculates MCPR and maximum LHGR,.as a function of the notch position of the withdrawn rod. CALTIP reads the SIMULATE-E restart file and provides a calculation of the response of every LPRM in the core. The RBLOCK code calculates the RBM output signal based on the LPRM signals that are calculated by CALTIP. RBLOCK calculates the MCPR and the maximum LHGR at the position of the rod block for a large number of LPRM failure combinations. The maximum change in these fuel parameters is utilized in determining the adequacy of the operating limits relative to the event acceptance limits. (See Section 2 and Figure 2-1 for an overview of the overall WNP-2 reactor analysis methodology computer code sequence.) 5.3.4.4 Licensing Analysis Process, This section describes the licensing analysis process. Section 5.3.4.5 -provides a discussion of sensitivity .analyses and other factors that justify the appropriateness of this process. (a) The NNP-2 reactor core for the cycle of interest is modeled with SIMULATE-E at rated, power and flow. (b) The cycle exposure point that has the maximum hot excess reactivity with all rods out is found. (c) The xenon concentration is set to zero. (d) An error rod is selected based on the maximum average power level of the four bundles which are associated with that rod. (e) A control rod pattern is developed to achieve criticality which causes at least one fuel assembly in the vicinity

                                ,.5 ~ 3 ~ 4-7

of the error rod (within a 6 by,6 fuel assembly array) to be at or near NCPR and one fuel assembly to be near maximum LHGR operating limits. In some cases, the same fuel assembly that satisfies these criteria. it may'e The errox'od is fully inserted. (f) Quasi-steady state calculations are .made at several control rod positions as the control rod is stepped out of the core from the fully inserted position, and the power is adjusted to achieve criticality. (g) The response of each RBM channel is calculated for each

            'control rod posit'ion. -Calculations include results with failure of any single LPRN string, any pair of LPRM strings, and all combinations of a single LPRM failure in each'of the two levels of the. RBM channels.,

(h) The limiting NCPR and maximum LHGR are determined for the worst mode of LPRM failures and the assumption that the most', responsive RBM channel (typically channel B) is inoperative. The limiting values are associated with the rod position where the RBM blocks the rod at the

            ;technical specification trip setpoint (typically 1.06) or at the fully withdrawn position if a block does not occur.

Sensitivity Studies/Justification of

                      '.3.4.5 Process The  following sensitivity studies for Cycle 4 were performed to~

( determine the sensitivity of the control rod withdrawal .error analysis to various parameters and provide justification for the licensing analysis process:. (1) effects. of control rod pattern, which led to'the selection of. the limiting control rod pattern; (2) ( the effect of xenon inventory, -which led to the selection of the zero xenon state; (3) the effect of time in cycle exposure and core reactivity, which led to the selection of'most reactive state;.(4) N the effects of core'ower and flow,=which led to the selection of ( the rated power and flow case; '(5) the effects of LPRN and RBN ( failure modes, which--led to -the selection of. limiting cases to,be considered; (6) effects of. error rod .location, which led .to 0he selection of rod location for the position of maximum four bundle average powex; and (7) the effects'f,.core pressure and . inlet subcooling increasing during the event. .The, results of, these sensitivity studies are described in more detail below. 5 3 4-8

As a result of the sensitivity studies, it was determined that the most sensitive parameter with respect to the control rod withdrawal error analysis is the selection of the control rod pattern. In the licensing analysis process, it is required that at least one fuel assembly in the 6x6 fuel assembly array surrounding the error rod be on or near estimated NCPR limits, and one fuel assembly in the 6x6 fuel assembly array surrounding the error rod be on or near LHGR limits. Control rod patterns that result in an increase in power in the vicinity of'the erroneously withdrawn control rod create large control rod worths and increase the event consequences. This results because the neutronic coupling is increased as the limiting fuel assemblies are moved closer to the control rod to be withdrawn. In addition, the core is required to be in a xenon free condition while maintaining criticality. The xenon free assumption results in the most reactive core conditions and largest control rod inventory, which leads to a more conservative power distribution in the vicinity of the fully inserted control rod. The requirements associated with the selection of the limiting control rod pattern lead to unrealistic control rod patterns that are not expected during normal operation because of the excessive power peaking that would result. To demonstrate the conservatism of the selection of the limiting control rod pattern, two different control rod patterns were evaluated: . (1) using the licensing analysis process and (2) using a,conservative control rod pattern based on equilibrium xenon conditions. For the first case, complete withdrawal of the control rod,led to a hCPR of 0.23. For the second case, complete withdrawal of the contxol rod led to a ACPR of 0.15. In the second case, the control rod pattern was developed based on the expected control rod patterns anticipated during normal operation based on an equilibrium xenon condition; however,- they were made conservative by having a fully inserted control rod that couldbe erroneously withdrawn and adjusting the remaining contxol rods to increase the fuel assembly powers in the vicinity of the fully inserted control rod. 5, 3 4-9

The xenon inventory assumption has a very strong influence on the development of the control rod pattern because of the relatively large amount of negative reactivity associated with equilibxium xenon conditions. Once the control rod pattern has been established, the effect of xenon is relatively insignificant. The same rod patterns were used in the evaluation of the control rod withdrawal error for both the xenon free and equilibrium xenon conditions, ignoring the criticality'requirements. For these two cases, a difference in bCPR of less than 0.01 was seen over the entire range of control rod withdrawal. Therefore, the selection of the xenon free condition for analysis is conservative because the rod pattern developed with a xenon free condition gives about 0.08 higher bCPR than the rod pattern developed with an equilibrium xenon condition. This shows that the xenon condition is only important. in establishing the control rod pattern. I The cycle exposure that has the greatest hot excess reactivity is used in the control rod withdrawal error analysis because it is associated with the greatest fuel assembly power with all control rods out and the=largest contxol rod inventory-during the operating cycle; therefore, it provides the greatest amount of flexibility in ( establishing the control rod pattern. To determine the effect, of the most reactive state assumption, sensitivity studies were performed that demonstrated that exposure has a relatively large effect on the event consequences. Two cases were run using the same control rod patterns, for two different, exposures: (1) at 0.2 GWD/MT, most reactive exposure and (2) 2 GWD/MT. For these cases, the dCPR was within 0.10 for all control rod withdrawal positions, with the most reactive core exposure being more limiting. Core power and flow conditions were investigated to determine the sensitivity of. the initial core operating state to the consequences of the control rod withdrawal error event. Four separate cases were analyzed to determine the effects of, the -operating. state on the event consequences: (1) rated power and coreflow; (2) 904 "5.3i4 10

power and 874 rated core flow; (3) 904 power and 1004 rated core flow; and (4) 1054 steam flow (104.24 power) and rated core flow. All of the cases were run with the same contxol rod pattern except for the 904 power and '1004 core flow case. For the 904 power and 1004 core flow case," control rods were inserted to satisfy the criticality constraints. As the core flow is 'reduced along, the 1004, rod line, the RBM setpoint at which the control rod block will be initiated is decreased, because of the flow referencing circuitry. For example, a rod'lock setpoint of 1064 at rated core flow,,will have a rod block 'setpoint of about'8< at 874 core flow. Comparison of the control rod withdrawal error analysis at the 90~ power and 87> core flow case with the'ated power and flow case, results in an

increase of 0.002 in bCPR. Therefore, the change along, a constant rod line is insignificant. F i As the core flow is increased, the. RBM setpoint at which the contxol rod block will be initiated is effectively increased. For a constant operating power, the increased core flow case will have a higher bCPR. This phenomenon is demonstrated by comparison of, the 90~ power/87% flow case (1004 rod line) with the 904 power/1004 flow case (90% rod line). The BCPR,for the higher flow case is 0.09 greater than the low flow case. However, the operating.MCPR for the higher flow case is 0.12 greater than the low flow, case. Therefore, the increase .in MCPR operating margin due to thehigher flow more than compensates'or the increase in bCPR due to .the higher RBM 'setpoint. Consequently, the use of high rod line, is

           'I appropriate.                                              il As  the p'ower level isreduced while operating at. a constant, core
'flow,"ontrol rod withdrawn "in error can be, withdrawn further

'efoxe a control rod block will occur. 's.a result, the .control rod withdrawaal error for a,reduced power, level at, the same core flow will have higher hCPR. This phenomenon is demonstrated by comparison of the rated power and flow case with the 90% power and 1004 flow case. The hCPR for the lower power and flow case is

about 0.09 greater than for 'the rated power and flow case. However, the operating MCPR for the reduced power case is 0.20 greater for the 90% power and rated core flow case than for the rated power and flow case. Therefore, the operating MCPR increases faster 'than the 'change in bCPR, -and the use of higher power is conservative. 1 t Comparison of the- rated power and flow case to the 104.24 power case shows the -change 'in hCPR'for .all RBM setpoints is less than

+0.01. The rated power and flow case is 'used .in -the licensing analysi.'s 'rocess because    it       provides additional control. rod inventory that can be used-in'the 'sele'ct'i'on of the limiting, control rod pattern. Therefore, the above sensitivity -studies show that
                "

the use'f rated power and flow case-for. licensing is appropriate. r The'assumed availability of specific LPRM inputs to the RBM system directly affects the results of the analysis of the control rod withdrawal error. There is a wide variability in the RBM response for different failure potential combinations, and no single failure combination within the constraints of the system design can, be demonstrated to be the most - limiting for all combinations of -.

'control rod'patterns and potential LPRM failure combinations., This results'because of differences in the RBM response to different location   'f control rod errors and .'a different. sensitivity to the axial
               'he control rod bei;ng .'withdrawn. To ensure.. a
                    ~

conservative assessment of the possible'LPRM failure combinations, the response of each RBM channel is calculated for each control rod position. Calculations include results with failure of any single LPRM string, any pair of LPRM strings, and all combinations of a 'single LPRM failure in each of the two 'levels of the RBM channels. The limiting MCPR and LHGR are 'determined for the worst mode'f LPRM failures'. and the assumption .that the .most .responsive RBM channel (typically channel B) is inoperative. The limiting values

are assoc'iated with the- rod position 'where -the: RBM blocks the rod at the technical specification trip setpoint (typically 1.06) or at the 'fully withdrawn position i:f a'lock. does not occur. This

                              -.S ~   3. 4-12

I process ensures that there is only a very low probability that a ( moxe limiting failure combination could occur. I In .the licensing analysis process, the error rod location is selected based on the maximum average power level of, the four bundles which are associated with that rod. The maximum average power level of the four bundle array is selected to ensure .that a very reactive core cell, is used for the location of the control rod to be erroneously withdrawn., -To assess the conservatism. of this assumption, the second highest average power. level of the four bundle array in the same sequence (Sequence A) was analyzed in a manner consistent with .the remaining licensing analysis process P requirements. The change, in,.dCPR for the second highest average power level of the four bundle array was 0.07 .less than for the maximum power level of the four bundle array near the expected RBM setpoint. Therefore, the highest average powex level of the four bundle array is used. I t I's the control rod error progresses, there is a small increase in reactor pressure and inlet subcooling. Analyses. were performed both- with the assumption .of-constant pressure and inlet subcooling, and with. the calculated change in pressure and inlet subcooling during the event. It was.determined that there was a difference of less than 0.01 change in bCPR in these cases. Therefore, the assumption of constant pressuxe.and,inlet subcooling is used .in the licens'ing analysis, process... I 5.'3.4.6 'Typical Results I

                                                                              /   tt The:  licensing analysis process for evaluating the control rod withdrawal erxor. event is described,in, Section 5.3.4.,4.                     This process has been used to analyze the control,rod withdrawal error for Cycle 8. 'able -5.3;4-1 provides the input parameters and initia'l. conditions used in -the evaluation. of the control rod
                                        .

It J error fox Cycle 8. The, specific control rod pattern 'ithdrawal used in the analysis is shown on Figure, 5.3.4-1. , The analysis results are provided in Table 5.3.4-2. A comparison of the xesults

                                , 5~3 ~ 4-13

of the WNP-2 reactor analysis methodology to those of the fuel supplier (SPC) for Cycle 8 is shown in Table 5.3.4-3. Therefore, it is concluded that the Supply System licensing analysis process is reasonable yet conservative based on the evaluation of the analysis conservatisms and uncertainties and the comparison with the SPC results.

                               ~ g
                                                               ~
                                                                 'I 5.3 4-14

Table 5. 3. 4-1 Input Parameters and Initial Conditions for the Cycle 8 Control Rod Withdrawal Error Analysis Thermal Power (MWt) 3323'.0 Cycle Exposure (GWD/MT) Core Average Exposure at BOC8 (GWD/MT) 15.78 Xenon Concentration None Maximum Initial LHGR for 9x9 (kW/ft) 11.42 MCPR 1~ 23* Location of MCPR Assembly 35-30 Location of Maximum Worth Control Rod 30-27 Core Coolant Flow Rate (Mlbm/hr) 108.5 Reactor Coolant Pressure (psia) 1035 Core Coolant Inlet Enthalpy (Btu/ibm) 526.9 Control Rod Pattern Figure 5.3.4-1 RBM Trip Setpoint 106

Value used for analysis purposes

                               .5 '  ',15

Table 5.3.4>>2 ) Results of the Cycle 8 Control Rod Withdrawal Error Analysis Supply System Methodology Rod Block Monitor AFDLRX 103 0. 10* 0.108

        . 104                   0 ~ 14                0.134 105                   0. 16                 0.136
       '106                     0. 16                 0. 136 107                   0. 18                 0  138 108                   0 ~ 21                0. 138 109                   0.27                  0. 138 Table 5.3.4-3 Results of the Cycle 8 Control Rod withdrawal Error Analysis supply System Methodology Compared to Fuel Supplier Methodology Rod  Block Monitor        Supply System         Fuel, Supplier D~cp                  AcpR 105                   0. 16                  0. 14 106                   0. 16                  0. 16 107                   0. 18                  0. 18 5~3   4-16

02 06 10 14 18 22 26 30 34 38 42 46 50 54 58 I 59 55 30 30 04 04 04 04 04 47 36 36 43 - 04 12 '8 12 04

04 39 36 36 35 - 04 04 12 00 12 04 04 31 - 32 32 27 - 04 04 0 12 04 04 23 36 36 19 04 04 12 08 12 04 04 36 36 04 04 04 04 04

" 07 Fully Withdrawn Control 30 Rod 30 Error Rod Figure 5.3.4-1. Control Rod Positions for the Control Rod Withdrawal Error Analysis 5.3 ~ 4 17

5.3'.5 Fuel Loading Error Mislocated Fuel Assembly 5.3.5.1 Event Description The mislocated fuel assembly fuel loading error is the postulated occurrence of the loading of a fuel assembly in an improper location. This causes a discrepancy between the design core configuration and the actual core configuration. It is assumed that the loading error is not detected during the coxe loading and verification process and that the plant operates throughout the cycle as constrained by th0 core operating limits for the design core configuration. Three erxors must take place for this event to occur. First, a fuel assembly must be loaded into the wrong location. Then, the fuel assembly intended for that location must itself be placed in an impxoper location or not loaded in the core, creating an accounting discrepancy. Finally, the loading error must be overlooked during the final core configuration verification. The consequences of the fuel loading error mislocated fuel assembly are dependent upon the exposure and enrichment differences between the fuel assembly that has been incorrectly loaded and the fuel assembly that has been designed to be in the location. The event with the most severe consequences can occur at any exposure at which an assembly is at its peak reactivity and has been mislocated in an unmonitored location designed for a low reactivity assembly. It is then assumed that the operator has the capability for developing a control rod pattern that places fuel assemblies in the core on the core operating limits. Because of the low probability of this event, it is considered an accident in the safety analysis process, and no other events or equipment failures are assumed to occur while the plant is operating with a fuel assembly loading error. However, the fuel cladding integrity limit has been adopted as the figure of merit for this event.

5.3.5.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and assumptions form the principal bases for the analysis of the fuel loading error mislocated fuel assembly event: (a) A mislocated fuel assembly fuel loading error with the worst consequences has occurred and gone undetected..

                     'r r

{b) The plant is operating at'rat'ed conditions. (c) The remaining NSSS operating parameters are consistent with normal plant operation. {d) All of the plant control systems function normally. 5.3. 5. 1. 2 Operator Actions The operator is assumed to follow normal plant operating procedures because there is no information,to indicate the existence of a fuel assembly loading error. 5.3.5.1.3 Event Acceptance Limits The "acceptance . limit'or this .event is MCPR > fuel cladding

'integrity safety'limit. Compliance with this limit is demonstrated

)'y ensuring that the operating limit MCPR is greater than or equal II to the MCPR .which ensures that greater, than 99.94 of the fuel rods in the core are not expected to experience boiling transition plus the 'bCPR.: r I, I 5.3.5.2 Analysis Considerations r This section, describes the key.analysis considerations applicable to the fuel loading error - mislocated fuel assembly event. It includes: (l) a description of the phenomena occurring during the event. that have a significant impact on the event consequences; (2) a- discussion of the system, performance characteristics that can significantly affect the course of the. event; and (3) a discussion 5' 5-2

of the performance characteristics of the important components as they relate to .the event consequences. 5.3.5.2.l. Key Phenomena The fuel assembly mislocation can result in a significant change in the local power distribution. Two potentially significant situations exist: (1) misloading a fuel assembly into a monitored location designed for a higher reactivity fuel assembly; 'and (2) misloading a fuel assembly into an -unmonitored location, designed for a lower reactivity fuel assembly. Zn the first case, the readings of the adjacent local power range monitors (LPRMs) decrease. Because there- are no LPRMs "in the symmetrical locations, the operator assumes that they have the same characteristics as the monitored locations. Should the operator select a control rod p'attern that increases power based on the monitored LPRM readings, the assemblies in 0he corresponding symmetrical locations could exceed design limits. Zn the second case, the power in the mislocated fuel assembly is

inferred from 'the 'LPRMs in the correctly loaded symmetrical locations. Therefore, the mislocated fuel assembly is operating at higher power than assumed in the core design.- The core .operating limits for thi.s assembly can 'be exceeded if the operator, selects a control rod pattern that increases power in'he'- monitored; and symmetrical location to the core operating limits based .on the assumed core configuration. From analyses performed by the Supply System, it has been shown that this will be" the most limiting, case because of the coupling effect, of placing a highly reactive fuel assembly near another 'highly reactive fuel'assembly.

5.3.5.2.2 Systems Considerations All systems are assumed to be in normal power operational modes and continue to operate throughout the'perating cycle..

                                              ~
                                                                  ~

5'.,3 5-3

5.3.5.2.3 Component Performance Characteristics Because the mislocated fuel assembly can be in an unmonitored location, it is assumed that it will not be detected by the core monitoring system. Therefore, control rod patterns may be selected that would put the limiting fuel assemblies in the core on thermal limits. This causes the mislocated fuel"assembly to exceed normal

                             ~                         K operating" thermal limits.

1 5.3.5.3 'ethodology/Integration of Codes and Analysis The fuel loading error mislocated'uel assembly utilizes the SIMULATE-E three-dimensional BWR simulator- code as the primary analysis code. SIMULATE-E is used to ca'lculate the reactor power, P power distribution, fuel assembly flow rates for both the correctly loaded core and the core containing the mislocated fuel assembly. The lattice physics'nput to SIMULATE-E is provided by CASMO-2E through NORGE-B. The MICBURN-E code is used to determine the gadolinia cross sections used in CASMO-2E while ESCORE provides the fuel temperature distribution. TLIM, based on SIMULATE-E input, is used for the thermal limits evaluation. (See Section 2 and Figure 2-1 for an overview of the overall WNP-2 reactor analysis methodology computer code sequence.) t 5.3.5 icensing Analysis Process

                     ~  .      r The mislocated assembly analysis is pexformed on the basis of the final design depletion through the cycle with control rods present.

Based on sensitivity analysis,. it has been shown that the worst mislocated fuel assembly will occur when a high reactivity assembly is loaded in an unmonitored location. Also, based on sensitivity studies, it has- been shown that the worst mislocated high reactivity fuel assembly xesults occur in the early part of a cycle with'control rods present. selection of the-high reactivity assembly is made by selecting The any assembly that may have a high reactivity at any time in the 5'.3 '-4 0

cycle. Then a cycle depletion is performed using the same control rod patterns as the final design depletion for each assembly type that will lead in reactivity (at any time in the cycle) in its mislocated position. The selection of the misIocated position is chosen by two methods. The first method finds the highest four assembly average CPR in an unmonitored location based on each depletion step in the, final design (note: this location varies throughout the cycle). The high reactivity assemblies are then mislocated into the highest CPR position within the highest four assembly average CPR. The second method is to find the lowest CPR unmonitored location at each depletion step in the final design, and the high reactivity assemblies are loaded face adjacent to the low CPR locations (note: this location varies throughout the cycle). The mislocated assemblies are then loaded into each of the identified locations and the cycle is depleted as noted above. The bCPR is then determined at each depletion step for each mislocated assembly using the following equation: MCPR~~~ - MCPR~ d,CPR = SL x 5 3.5-1 where SL is the fuel cladding i'ntegrity limit MCPR-, MCPRL. is the core wide MCPR for the final design depletion and MCPRM is the core wide MCPR for the mislocated'ase " The 'largest hCPR from all the mislocated assemblies at all depletion steps is selected as l the mislocated bCPR. t 5.3.5.5 Sensitivity Studies/Justification of.'Process I ~ The fuel loading error mislocated fuel assembly, analysis provides the maximum'onsequences for any loading 'error in the core. No further uncertainties are considered. In 'establishing the process used in Section 5.3.5.4, analysis was performed for a mislocated assembly in Cycle 4. In Table 5.3.5-1, the following cases are identified. Case 1 has a once-burned high'reactivity assembly at

                               ,. 5; 3 ~ 5;.5

a high CPR location.'ase 2 has a high reactivity, assembly face adjacent'to a'low CPR location. Case 3 has a fresh high reactivity assembly at a high CPR location. Case 4 has a fresh high reactivity assembly face adjacent to a low CPR position. Case 5 has a low reactivity assembly at a low CPR position next to a LPRN location. Case 6 has a once-burned high reactivity assembly next to a low CPR position with all control rods out for both the base case and the mislocated .case.. Case. 7,has a fresh high reactivity assembly at a high CPR location with all control rods out for both the base case and the mislocated case. As can be seen from Table 5.3.5-1, the worst, mislocated assembly ( for Cycle 4 using the Supply System codes and the SPC CPR correlation ANFB gives a 'value of DCPR of 0.10. Since Case 5 gave such low values compared to the other cases, it was concluded that this case need not be considered each cycle. Also, since Cases 6 and 7 gave results no worse than Cases 1 through 4, it was concluded that for future cycles only mislocated high reactivity assemblies at a high CPR location and face adjacent to a low CPR location would be investigated and these would only be investigated with the target rod patterns. 0 5.3.5.6 Typical Results Using the method described in Section 5.3.5.4, analysis was performed for a mislocated assembly in Cycle 8. In Table 5.3.5-2, the following Cases are identified. Case 1 has a fresh high reactivity assembly at a high CPR location. Case 2 has a fresh high reactivity assembly face adjacent to a low CPR location. Case 3 has a once-burned high reactivity assembly with the lowest exposure in Cycle 7 at a high CPR location in Cycle 8. Case 4 has this same once burned high reactivity assembly face adjacent to a low CPR location. Case 5 has a once-burned high reactivity assembly with the highest exposure in Cycle 7 at, a high CPR location in Cycle 8. Case 6 has this same once burned high reactivity assembly face adjacent to a low CPR location. 5~3 ~ 5-6

As can be seen from Table '5.3.5-2., the worst mislocated assembly for Cycle 8 using the Supply System codes and the SPC CPR 'Correlation ANFB gives a value of bCPR of 0.14. A comparison of Supply Syst: em results to those of SPC is shown in Table 5.3.5-3. The initial MCPR and MLHGR are. the lowest and highest values, respectively, that appear in the base case. The final MCPR and, MLHGR are the lowest and highest values; .respectively, that could be found for any of the mislocated cases run. As can be seen the Supply "System results are very similar to those of SPC. I T t Ih

                               -5 '.5-7

Table 5.3.5-i hCPR for Mislocated Fuel Assembly in Cycle 4 posese h PR A PR hCPR(ARG) hCPK(AK ) (GWD/M) Case I Case2- Case 4 Case 6 Case 7 1,2 0.08 0.01 .01 0.08 0.1 0.01 ll. 10 Table 5.3.5-2 hCPR for Mislocated Fuel Assembly in Cycle 8 hCPR n PR 4CPR (GWD/hfl) Case I Case S Case 6

           -.00 0           31       0.0013                                  0,0162 0.062          0.0083 14         14

0. 20

0. 69 0.0881 0.1134 0.1228 0.06 2 0.0691 4.8 0.1323 0.1213 O.Vll 52385-8

Table 5.3.5-3 Compari'son of MCPR and MLHGR Results Initial MCPR Final MCPR Xnitxal MLHGR Final MLHGR SPC 1. 342 1 212 ll. 64 14. 47 Supply System 1.345 1.221 12. 59 14. 55 5 ' ' 9

S.3.6

 ~ ~    Puel Loading Error>>-Rotated Fuel Assembly S.3. 6.1   Event Description The   rotated fuel 'assembly fuel loading error is the postulated occurrence of the loading of a fuel assembly in an improper orientation (rotated 90'r 180'rom its intended orientation).

This causes a discrepancy between the design core configuration and the actual core configuration. Zt is assumed that the loading error is not detected and that the plant operates throughout the cycle as constrained by the core operating limits for the design core configuration. Two errors must take place for this event to occur. A fuel assembly must be loaded in the wrong orientation and the loading error must be overlooked during the final core configuration verification. The consequences of the rotated fuel assembly fuel loading error are dependent upon the lattice design. WNP-2 is a C lattice core design with uniform water gaps between fuel assemblies and essentially symmetrical fuel rod enrichments adjacent to all water gaps. Because of the channel fastener at the top of the channel, a rotated fuel assembly will be slightly tilted. This causes the water gap thickness outside of the channel, and therefore, the local power distribution within the fuel assembly, to vary axially. The power distribution change will affect the actual CPR of the rotated fuel assembly. The core monitoring system assumes correct assembly orientation so the calculated thermal margin will be incorrect. Because of the low probability of this event, it is considered an accident in the safety analysis process, and no other events or equipment failures are assumed to occur while the plant is operating with a fuel assembly loading error. However, the fuel cladding integrity limit has been adopted as the figure of merit for this event. 5 '.6-1

5.3.6.1.1 The Initial 'Conditions and Operational Assumptions following plant operational conditions and assumptions form the 0 principal bases for the analysis of the. fuel loading error rotated fuel assembly event: (a) A rotated fuel assembly fuel loading error with the worst consequences has occurred and gone undetected. (b) The plant is operating at rated conditions. (c) The remaining NSSS operating parameters are consistent with-normal" plant operation. ~

I (d) 4 All'of the plant control systems function normally.

)~

Pq 5;3.6.1.2 Operator Actions The operator is assumed to follow normal plant operating procedures because there is no information to indicate the existence of 'a fuel assembly loading error. 5.3.6.1.3 Event Acceptance Limits 0 The acceptance limit 'for this event is MCPR > fuel cladding integrity safety limit. Compliance with this limit is demonstrated by ensuring that the operating limit MCPR is greater than or equal-to the MCPR which 'ensures'that greater than 99.94 of the-fuel'rods in the core are not expected"to experience boiling .transition plus the change in CPR. A r 5.3.6.2 Analysis Considerations This section describes the key analysis considerations applicable to the fuel loading error rotated fuel assembly event. 0 lt includes: (1) a'descript'ion of the phenomena occurring during the event that have a significant impact, on the event consequences P

        'I (2) a discussion of         the'ystem    performance characteristics that can significantly affect the course of the event;. and (3) a discussion 5 ~ 3,. 6-.2
                                                                     'I
                                                                            ~ '

of the performance characteristics of the important components as they relate to the event consequences. 5.3.6.2.1 Key Phenomena This event is the insertion of a fuel assembly in its correct location but rotated 90'r 180'rom its proper orientation. The fuel assembly rotation can result in a significant change in the local power distribution within the rotated assembly and a slight increase in the fuel assembly power. The water gap surrounding the rotated fuel assembly minimizes its impact on neighboring fuel assemblies. Therefore, only 0he phenomena associated with the rotated assembly and the feedback effects from neighboring assemblies are important for the analysis of the event. 5.3.6.2.2 Systems Considerations All systems are assumed to be in normal power operational modes and continue to operate throughout the operating cycle. 5.3.6.2.3 Component Performance Characteristics Because of the possibility of a rotated fuel assembly in an unmonitored location, ~ it is assumed that it will not be detected by the core monitoring system. Therefore, control rod patterns may be selected that would place a correctly loaded fuel assembly on thermal limits which would result in the rotated fuel assembly exceeding normal operating thermal limits. 5.3.6.3 Methodology/Integration of Codes and Analysis The fuel loading error rotated, fuel assembly utilizes the CASMO-2E lattice physics code as the primary analysis code. CASMO-2E is used to calculate the local peaking factors for both the correctly loaded fuel assembly and the rotated fuel assembly. The MICBURN-E code is used to determine the gadolinia cross 5 3 ' 3

sections used in CASMO-2E while ESCORE provides the fuel temperature distribution. FICE is used to determine the local peaking functions for both the correctly load assembly and the rotated assembly for the thermal limits evaluation. TXIM is used for the thermal limits evaluation. (See Section 2 and Figure 2-1 for an overview of the overall WP-2 reactor analysis methodology computer code sequence.) 5.3.6.4 Licensing Analysis Process=- The rotated assembly analysis is performed on the basis of.CASM0-2E lattice physics calculations of the local peaking factors for the correctly oriented and rotated assembly using the final design depletion through the cycle with control rods present. The rotated assembly CASMO-2E calculation is based on the displacement of the assembly due to the channel fastener at the top of the channel. For conservatism, it is assumed that the whole assembly is displaced by the same amount when in actuality the assembly will be tilted with only the top of the assembly being displaced by the full amount. 'I The CPR calculation for the rotated assembly is then performed for the limiting assembly types in =terms of local peaking and reactivity through the cycle. The dCPR is determined using the following equation: MCPR~~~ - MCPRq~~ ACPR = SL x 5 3 6-1 Rot where fuel cladding integrity limit MCPR, MCPR~ is the core wide MCPR for the final design depletion and MCPR<< is the core wide MCPR for the rotated assembly case. The largest bCPR from the worst possible rotations at all exposures in the cycle is selected as the rotated assembly ECPR. 5 3 6-4

5.3.6.5

    ~ ~  ~  Sensitivity Studies/Justification of
                ~  ~ ~

Process In the licensing analysis process, it is assumed that the maximum water gap exists over the full length of the rotated fuel assembly. This is a very conservative assumption that dominates any uncertainties in the analysis process. If it is determined that the assumption of the maximum water gap leads to core operating limits that are unnecessarily restrictive, analyses vill be performed using a variable vater gap to reduce the conservatism in the analysis process. If the variable water gap approach is taken, appropriate uncertainty analyses will be performed to establish their impact on the analysis results. 5.3.6.6 Typical Results ~ From the method described- in Section 5.3.6.4, analysis was performed for a rotated assembly in Cycle 8. Table 5.3.6-1 shows the results for the highest bCPR at each exposure point in the cycle. As can be seen from Table 5.3.6-1, the highest dCPR for a rotated assembly in Cycle 8 is 0.20. The Siemens Nuclear Power Corporation does not perform a rotated assembly analysis for WNP-2. As can be seen from results of the other event analyses, .this event is not limiting for the cycles evaluated. However, it will continue to be evaluated each cycle as necessary. 5.3.6-5

Table 5.3.6 Rotated Assembly dCPR Exposure dCPR (GWD/MT) 0.0 0 ~ 19 0.2 0 '9 0.5 0.18 1~0 0. 17 1.5 0. 17 2.0 0. 16 2.5 0.18

  ,  2.5           0. 14 3.0           0. 16 3.5         .,0 20
                      ~

4.0 0 '9 4.0 0.18 4.5 0 ~ 17 4.8 0 ~ 18

    '5. 1       .:  0.17 5 '."6-6

5.3.7 Peedwater Controller Pailure Maximum Demand I 5.3.7.1 Event Description The feedwater controller failure (FWCF) transient event is initiated by the failure of a control device which results in the feedwater controller being-forced -to its upper limit which creates the maximum feedwater system=flow demand. The increased feedwater I flow mixes with the recirculation'flow.,and results in a gradual increase in core inlet subcooling. The increased feedwater flow also results in an increase in. reactor vessel water level. The H gradual increase in core inlet.subcooling causes a relatively slow power increase and a shift in power distribution towards the bottom of the core. As a result of the power increase, the vessel steam flow increases which results in a slight increase in system pressure due to the larger steam line pressure drops as the pressure regulator system controls the turbine inlet pressure. The K power increase continues until the reactor vessel high water level trip setpoint (L8) is reached. High reactor vessel water level initiates closure of the main turbine stop valves (turbine'rip) and a trip of the feedwater system. Closure of the turbine stop valves initiates a reactor scram, a bypass valve opening signal, and prompt RPT. Following the turbine trip, the neutron flux increase is limited by the reactor scram and the prompt RPT. The peak neutron flux and surface heat flux are reached following the turbine trip. The relief valves are opened in the pressure relief mode and close sequentially as the pressure is reduced by the action of the relief valves and the turbine bypass valves. Tables 5.3.7-1 and 5.3.7-2 show the expected sequence of events for the feedwater controller failure maximum demand transient at two different power levels. I 5.;3.7-1

5.3.7.1.1 Initial Conditions and Operational Assumptions. The following plant operational conditions and assumptions form the principal bases for the analysis of the feedwater controller failure maximum demand event: (a) The plant is operating at the safety analysis power level and 1064 rated core flow. (b) The remaining NSSS operating parameters are consistent with normal plant operation. 4 (c) The feedwater controller fails during maximum flow demand resulting in maximum feedwater pump -runout. (d) The plant is operating in the manual flow control mode; (e) The system trips and initiation signals are consistent with technical specifications.

(f) High reactor pressure vessel water level trips the main turbine stop valves and the feedwater pumps. (g) Position switches on the turbine stop valve initiate reactor scram, and prompt RPT. The turbine bypass valves receive their opening signal from the pressure regulator system upon receipt" of the turbine trip signal. (h) All of the remaining plant control systems function normally. 5~3 7~1~2 Operator Actions No restart is assumed and the reactor is to be cooled down. The operator is expected to take the following actions as appropriate: (a), .Observe that the high water level feedwater pump trip and scram has terminated the" event.

..(b) Switch . the feedwater controller from automatic to manual control in order to try to regain a correct output signal. (c) Identify causes of the failure and report all key plant parameters during the event. (d) Cool down the reactor. consistent with plant procedures. 5~3 "7-2

5.3.7.1.3

  ~ ~ ~  ~
             . Event Acceptance Limits The acceptance       limits. for this event are         MCPR    > fuel cladding integrity limit;      LHGR, 5 PAFF    limits;  and  reactor pressure < the ASME     Code    limit   for the reactor, coolant pressure boundary.

Compliance to the fuel cladding integrity limit is demonstrated by ensuring that the operating limit MCPR is greater than or equal to the fuel cladding integrity MCPR limit (which ensures that greater than 99.94 of the fuel rods in the core are,not expe'cted to 1 experience boiling transition) plus the change in CPR during the event. Compliance to the PAFF limit is ensured by meeting the LHGR limit requirements for transient occurrences in the fuel vendor mechanical design topical reports (e.g., Reference 16). 5.3.7.2 Analysis Considerations tt This section describes the key analysis considerations applicable to the feedwater controller 'failure maximum demand event. It includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.7.2.1, Key Phenomena Described below are the key phenomena related .,to the feedwater controller failure - maximum demand event. Consideration of these phenomena, is necessary in the simulation. of this event in order to accurately model the plant response.

                                                            'i The feedwater       controller failure is      a  relatively      complex event because    of its two distinct phases. The first phase is similar to a core coolant temperature decrease transient where the change in inlet subcooling due to the increased feedwater flow results in a relatively slow change in the key operating parameters. The major
                                 ,.5 '   7-3

complexity during this phase is modeling of the core-power and the power distribution shifts. The second phase is very dynamic and is characterized by rapidly changing conditions with complex interactions similar to a turbine trip with bypass from a higher power level. Feedwate P enomena The event begins with a rapid increase in feedwater flow. As the additional feedwater is mixed with the recirculation flow, the core inlet subcooling is increased which increases core power. Because the duration of this phase-is short compared to the time constant of the feedwater system, changes in feedwater heating are 'eglected. Therefore, the feedwater phenomena are modeled as a step increase in feedwater flow to the vessel until the high reactor vessel water level trip point is reached. Following the feedwater system trip, the feedwater flow coasts down to zero for the remainder of the event. Steam Line Phenomena During the initial phase of the event, the steam flow increases as the core power increases. The turbine inlet and bypass valves open to maintain turbine inlet pressure. The steam line pressure slowly 'increases. The final phase of the event is initiated by the reactor vessel high water level trip of the turbine stop valves and feedwater flow. The turbine stop valve closure causes a pressure increase at the turbine inlet that is rapidly transmitted to the reactor pressure vessel by pressure wave phenomena in the steam lines.-. The relief valves open at pre-established setpoints allowing a steam ( release path for pressure relief.'odalization of the steam lines is necessary to ensure accurate simulation of the system pressure ( response. Pressure Vessel Phenomena During the initial phase of the event, the additional feedwater flow enters the reactor pressure vessel and is mixed with the recirculation flow in the downcomer annulus. Xn the final phase of the event, the propagation of the pressure wave from the steam lines to the core is an important phenomenon.

The attenuation of the pressure wave by the reactor vessel internal components is a particularly important phenomenon in modeling the timing of the core moderator void changes. Recirculation Phenomena The flow control valve remains in a fixed position. Following the turbine trip, the reduced core flow, due to prompt RPT, will help increase core steam voids which helps to mitigate the reactivity insertion due to the pressure increase. The recirculation 'system modeling includes consideration of the downcomer phenomena, including the annular flow region above and through the jet pumps. The changing performance of the jet pumps at varying pressure and -drive flow is included. The external recirculation loop flow is represented so that flow into the vessel as a function of time is accurately simulated. Core Phenomena The important phenomena in the core region are the reactivity effects that contribute to changes in the neutron flux and fuel surface heat flux. During the initial phase of the transient, the primary phenomena are the effects of the increase in. inlet subcooling on the moderator temperature and void reactivity. The change in moderator temperature and -the reduction .in steam voids. due to the colder water entering the core is .responsible for the, initial positive reactivity insertion. This causes an increase in power level and I

fuel temperature which increases the Doppler reactivity and 1 generates additional steam voids to mitigate the effects of the decrease in core inlet temperature. The.net effect is a slow rise in", core power and a shift in the power distribution toward the bottom of the core.

                               ,,5.3 '-5

During the second phase of the transient, following the turbine trip, the steam void reactivity, due to steam void collapse as the pressure wave from the turbine inlet reaches the coxe, provides the additional positive reactivity insertion. The reactivity increase causes a rapid increase in core power, which then increases fuel temperature, core voids, and system pressure. However, with steam flow restricted, system pxessure 'nd core power continue, to increase until a rapid scram of the control rods and trip of the recirculation 'pump is initiated by -the turbine stop valve closuxe (valve position switch).'During this portion of the event, the time and'spatial 'dependent scram reactivity, effects are simulated. 5.3.7.2.2 Systems Considerations For the feedwater controller failure transient, the initiating ~ event is' failure which'results in theImaximum demand signal to the feedwater system. All other systems normally operating are assumed to function as designed. Safety systems that are designed to actuate are assumed to actuate at their pre-established setpoints. The 'steam bypass is assumed to operate as designed., It It ~ The important systems to be considered are: (1) the reactor protection system including the turbine stop valve position scram; I , I (2) the control "rod drive {scram) system; {3) the steam system including I stop valves, bypass= valves, and relief valves; (4) the recirculation . system, including the prompt'PT; (5) the .steam separation system inside the vessel; (6) the fuel and core system, including the nuclear/thermal-hydraulic coupling; and (7) feedwater control system. Other systems called upon for long-term operation are not required to be part. of this analysis because their. action occurs much later in the transient following the time of challenge or nearest approach to the event acceptance limits. 5.3.7.2.3 Component Performance Characteristics I I feedwater controller - failure transient analysis requires The detailed modeling of the NSSS in order to ensure that all systems

                                       '5 ~ 3- 7'-6
                                                                                     ~ I

that influence reactor system pressure, steam flow, core flow, and core inlet enthalpy are properly considered. The selection of licensing basis component performance characteristics is based on a buildup of conservative assumptions established by past practices and licensing requirements. Feedwater S stem The characteristics of the feedwater system are important for the feedwater= controller failure transient. The largest increase (pump runout) in feedwater flow from the operating state produces the most severe event consequences. The maximum feedwater flow rate has been compared to plant startup test results and current system performance. Turbine Sto Valve Closure Characteristics The turbine stop valve closure characteristics are important in the period following the high reactor vessel level trip of the main turbine. The turbine stop valve characteristics are specified by the turbine manufacturer and confirmed during plant startup testing. The technical specifications establish the value for closure time to the trip setpoints for the reactor protection system. From that. position to full closure, a linear ramp change in valve position is assumed. Steam B ass Valve 0 enin Characteristics The steam bypass valve opening characteristics are important in determining the steam system pressure and flow. The steam bypass valve opens on signals from the pressure regulator system upon receipt of the turbine trip signal. The opening time is specified in -the design process and confirmed during plant startup testing., A conservative time delay for bypass valve opening, is ,applied to the licensing basis analysis. Relief Valve Characteristics The relief valves are used to protect the reactor coolant pressure boundary, against overpressure events. The technical or design specifications establish limiting conditions for the relief valve setpoints. The maximum values are [ I 5 ' 7-7

( used in the licensing basis analysis in order .to ensure ( conservative evaluation of the system pressure response. Recirculation Pum Coastdown Characteristics The recirculation jumps receive a trip signal from the turbine stop valve closure which trips a breaker to the recir'culation pump power supply. The slowest pump coastdown 'consistent with'esign specifications is used in the'icensing basis analysis.-

                                                           ~ J Reactor Protection                     S  stem Si    nal'ela       s   .The reactor protection system includes the                      collection   'of a number of analog and digital 4

signals, conditioning of these . signals, comparison. to pre-established setpoint limits and acti.vation of nuclear system trips. The signal processing and trip initiation involves delay times which impact transient response.' The

plant technical specifications identify the allowable 'eactor protection system .

response

            ~               ~

times.'ontrol Rod Drive Insertion Time The control rod drive system provides the primary mechanism, for negative reactivity insertion for terminating the transient. The control rod drives are inserted in the scram mode by'the scram hydraulic control system. The scram time for the control rods is consistent with the technical specification surveillances. - - - *" Hi h Reactor Water Level LS Tri -The high reactor water level trip initiates the closure of the turbine stop valves and the feedwater system trip. The maximum setpoint identified in, the technical specification is used to maximize the event dynamics. 5.3.7.3 Methodology/Integration. of Codes and Analysis

l The primary analysis model in the simulation of the feedwater controller failure-- maximum demand-is the system thermal hydraulic model, RETRAN-02. RETRAN-02 is ised to -calculate the. changes in system and core average nuclear" and thermal hydraulic parameters throughout the course of the event; The RETRAN-02 analysis results 5 ' ' 8

~ i

are used in the assessment of fuel thermal margin, the increase in nodal power, and the peak reactor vessel,.pressure. The analysis of the feedwater controller failure maximum demand is performed using the following codes in the sequence shown on Figure 2-1: (1) ESCORE; (2) MICBURN-E; (3) CASMO-2E; (4) NORGE-B; (5) SIMULATE E (6) SIMTRAN E( (7) STRODE'8) RETRAN 02 / (9) FICE/ (10) VXPRE-01; and (11) STARS (when limiting). ESCORE is used to provide the fuel rod temperature distribution used in CASMO-2E. Gap conductances calculated by approved vendor methods are used in RETRAN-02 and VIPRE-01. MICBURN-E provides the gadolinia cross sections used in CASMO-2E. CASMO-2E is used to perform the lattice physics analysis to generate the cross sections for SIMULATE-E and the inverse neutron velocity and total effective delayed neutron yield for SIMTRAN-E. NORGE-B is used to transfer the CASMO-2E data to SXMULATE-E and SIMTRAN-E. SIMULATE-E develops the three-dimensional macroscopic cross section data to be processed by SIMTRAN-E. SIMTRAN-E collapses the three-dimensional cross section data to one dimension and transfers the other nuclear parameters to RETRAN-02. STRODE is used to adjust the moderator density feedback behavior and delayed neutron fraction data for input to RETRAN-02. RETRAN-02 is used to perform the transient analysis. VIPRE-01 is used to determine the hCPR during the transient based on the local peaking function provided by FICE. STARS, if required, is used to perform the statistical assessment to demonstrate compliance with the fuel cladding integrity or PAFF limits. 5.3.7.4 Licensing Analysis Process In the analysis of the feedwater controller failure maximum demand, the following conditions are applied: (a) The rod insertion times are based on plant surveillance data and technical specification requirements. (b) Scram is initiated by the position" switches on the turbine stop valves. Should a high neutron flux or high thermal power trip due to the power increase during the initial phase of the event be predicted to occur, it is conservatively ignored. Scram time delay is the maximum technical specification value. 5' ' 9

(c) RPT time delay is the maximum technical specification value. An analysis is also performed without RPT to establish the appropriate operating limit for plant operation with RPT out of service. (d) Relief valve opening setpoints are maximum values consistent with technical specifications. (e) The analysis is performed at end of cycle conditions, with all control rods fully withdrawn. (f) The analysis is performed at the most limiting point on the power/flow operating map, consistent with the licensing basis assumption on maximum power level. An analysis is also performed at 474 power and 106% flow. (g) Feedwater temperature is determined by the RETRAN code consistent with the system heat balance at the licensing power level. (h) The turbine stop valves have a full stroke closure time, from I fully open to fully closed, of 0.10 seconds. ('i) A bypass valve opening time delay is applied to provide conservatism in the licensing basis analysis. The plant is operating in the manual flow control mode. (k) The feedwater flow is increased to 1464 maximum flow at initiation of the transient. Events caused by low reactor water. level trip setpoints, including main steam line isolation valve closure and ECCS initiation, are not included .,in the simulation.. These events, should they occur, will be later than the time of challenge or nearest approach to the event acceptance limits. ( 5.3.7.5 Sensitivity Studies/Justification of Process

 'RETRAN-02 and- VIPRE-01 analyses, were performed       to determine the
  -sensitivity of the calculated results to changes in input assumptions. The parameters considered in the sensitivity analysis were:
                            \

(a) Initial core power (b) High level (L8) setpoint for turbine and feedwater trip

                                    '5 ~ 3 7'-10

(c) Scram speed (d) Prompt RPT The parameter values used in the sensitivity studies and the calculated bCPR are shown in Table 5.3.7-3. The results of these studies are consistent. RPT mitigates the event consequences because of the reduced core flow and higher core average void fraction. Use of normal scram time also mitigates the, event consequences because of earlier control blade negative reactivity insertion. Earlier turbine trip time mitigates the event consequences because the core power at the time of turbine trip is lower than in the base 'case. 5-3.7.6 Typical Results This section shows the results of.a WNP-2 Cycle 8 analysis of the feedwater controller failure maximum demand event using the Supply System licensing analysis process. The base case analyzed is 474 power/1064 core flow with technical specification scram time and with RPT operable. Plots of core power, core average heat flux, core inlet flow, reactor vessel steam dome pressure, vessel steam flow, reactor vessel water level, and feedwater flow are provided on Figures 5.3.7-1 through .5.3.7-7, respectively. II Results of a high power case (104~o power/106< core flow with technical specification scram time and with RPT operable) are also provided. Plots of core power, core average heat flux, core inlet flow, reactor vessel steam dome pressure, vessel steam flow, reactor vessel water level, and feedwater flow are shown on Figures 5.3.7-8 through 5.3.7-14, respectively. A comparison of the Supply System and fuel supplier (SPC) calculated results for WNP-2 Cycle 8 is provided in Tables 5.3.7-4 and 5.3.7-5. For the 47<, initial core power base case with 5~3 ~ 7-11

technical specification scram time and RPT, the Supply System calculates hCPR of 0.292 for the Sx8 fuel and 0.329 for the 9x9 fuel compared to 0.32 calculated by SPC for the SxS fuel and 0.34 for the 9x9 fuel. Results are shown in Table 5.3.7-4. The Supply [ System calculates a slightly lower dCPR than the fuel vendor for this event.'owever, the difference is small and the agreement is considered to be good, especially, for the limiting 9x9 fuel type. For the 104> initial core power case with RPT, the Supply System calculates dCPR of 0.16 for.the Sx8 fueland 0.169 for the 9x9 fuel compared with 0.16 calculated by SPC for'both fuel types. Results are shown in Table 5.3.7-5. As in the low power case, the results are in. good agreement. r H 0

Table 5.3.7-1 Feedwater Controller Failure - Maximum Demand Sequence of Events for 47% Power/106< Flow Time Sec Events 0.0 Feedwater pumps runout.to maximum flow 10.92 High vessel water level (LS) setpoint trips feedwater pumps 10.98 High vessel water level (LS);,setpoint .trips main turbine 10.98 Turbine bypass operation is initiated 10.99 Reactor scram trip and RPl 'are actuated 'by main turbine stop valve position switches 13.. 08 Main turbine stop valves are fully closed

11. 18 Recirculation pump motor circuit breakers open causing a decrease in core coolant flow Low level (L2) reactor vessel water level is reached Main steam line isolation valves close and high pressure coolant inventory makeup systems are initiated

- These events are beyond the RETRAN simulation time 5~3 ~ 7-13

Table 5.3.7-2 Feedwater Controller Failure - Maximum Demand Sequence of Events for 104% Power/3.06< Flow Time Sec Events 0.0 Feedwater pumps runout to maximum flow

21. 64 High vessel water level (L8) setpoint. trips feedwater pumps 21.70 High vessel water level (L8) setpoint trips main turbine

                            'I 21.70                 Turbine bypass operation is initiated 21.71                 Reactor scram trip and RPT are actuated by main turbine stop valve position switches-21.80                 Main    turbine stop valves are fully closed

21. 90 Recirculation pump motor circuit breakers open t

causing a decrease in core coolant flow 23.16 - 23.77 Groups 1 through 5 relief valves open to mitigate pressure increase 24.58 27.37 Groups 1 through 5 relief valves close (Group 5 closes first,'-Group 1 closes last) Low level (L2) reactor vessel water level is reached Main steam line isolation valves close and high pressure coolant inventory makeup systems are initiated

- These events are beyond the RETRAN simulation time

                                 -5 '.7-14

Table 5.3.7-3 Sensitivity Studies for Feedwater Controller Failure, - Maximum Demand b,CPR 8x8 9x9 Full Power Cases With RPT 0.160 0.169 No RPT 0.224 0.237 With RPT, normal scram time* . ~ 0.135 0.142'74 Power Cases With RPT 0.292 0.329 No RPT 0 '17 0.356 With RPT, normal scram time*- 0.274 0.308 Normal scram times are rod insertion times based on WNP-2 measured values (See Appendix A, Section A.2) and are approximately 2 standard deviations above the mean measured scram times. The normal scram times are listed in the Core Operating Limits Report (COLR). All other cases were run with the technical specification scram'peed (listed in the plant technical specifications) which provides a very conservative upper -bound. F

~ '

5 ~ 3 ~ 7-15

Table 5.3. 7-4 Comparison of Supply System Results to SPC Results for Feedwater Controller Failure - Maximum Demand Low Power Case ->> Technical S ecification Scram Time with RPT 47~ ower 106< flow Supply System Fuel Vendor Result Result Maximum -.Neutron Flux (4 Rat:ed) 91 , 107 Maximum Core Average Heat Flux (4 Rated) 63 61 hCPR ( 8xS ) 0. 292 0.32 bCPR (9x9) 0.329 0.34 No al Scram Time with RPT 47% ower 1064 flow Supply System Fuel Vendor Result Result; Maximum Neutron Flux (4 Rated) . 87 107 Maximum Core Average Heat Flux (4 Rated) 63 61 hCPR (Sx8) 0.274 0. 31 ACPR {9x9) .. ,0 '08 0.33 5' '-16

Table 5.3.7-5 Comparison of Supply System Results to SPC Results for Feedwater Controller Failure - Maximum Demand High Power Case echnical S ecification Scram Time RPT 1044 ower 1064 flow Supply System Fuel Vendor Result Result Maximum Neutron Flux (0 Rated) 231 211 Maximum Core Average Heat Flux (~ Rated) 128 116 b,CPR (8x8) 0. 160 0.16 BCPR (9x9) 0.169 0.16 Normal Scram Time no RPT 104% ower 106~ flow Supply System Fuel Vendor Result Result. Maximum Neutron Flux (< Rated) 289 280 Maximum Core Average Heat Flux (< Rated) 132 121 bCPR (8x8) 0.189 0. 18 ~ DCPR (9x9) 0.198 0.19 5+3.7 17

VfNP-2 EOCS FNCF 150 ~ 100 Q3 ~O L 0 Q 0 Q 50 0 0 36 20 Time (sec) Figure 6.3.7-1 FWCF Results for 47% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOC8 FNCF J 300 80 K 60 Z ~O X LL 40 r, 20 0 0 12 20 Time (sec) Figure 5.3.7-2 FNCF Results for 47% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOCS FWCF 120 t'

                         ~
                                                   ~ ~

100 tT K Z Woo 80 0 LL 60 Core Inlet Flow 40 0 i2 20 Time (sec) Figure 6.3.7-3 FNCF Results for 47% Power and t06% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 FWCF 4 1,150 Steam Dome Pressure'- 1,100 ~ 1,050 CL C 0) U) V) 1,000 44 4 950 900

           '0..              , 4                8                 12     16 20 Time (set:) .

Figure 6.3.7-4 FNCF Results for 47% Power and 4 ~ 106% Flow, RPT Operable, Tech. Spec. Scram Time

NNP-.2 EOC8 FWCF 80 ~ ~

Vessel Steam Flow-' ~ ~ t>> 60 lY CO Z WOO W 40 lL E (8

 '0 0,

0 12 20 Time (sec) Figure 6.3.7-5 FNCF Resuts for 47% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOCS FWCF 70 60 C 0) 0) 'D 50 0) U) M 6) 40 30 0 16 20 Time (sec) Figure 5.3.7-6 FNCF Results for 47% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 FNCF 360 ~ ~

320 K 03 Z ~O 0 80 I 6) 6$ I ~ l3 0) 0) 40 0 0 12 16 20 Time (sec) Figure 6.3.7-7 FVfCF Results for 47% Power and 106% Flow, RPT Operable, Tech.

                        ,Spec. Scram Time

WNP-2 EOC8 FVICF 300 l ~ ~ 250 Tt 200 Z gO

  ~ 150 0

L 0 O 100 50 0 0 8 12 16 . 20 24 28 Time 5.3.7-8 FNCF Results for 104/o Power and (sec)'ig'ure 106% Flow, RPT Operable, Tech. Spec. Scram Time

NNP-2 EOCS FVfCF 140

              ~
                '

I 120; Yc +~ 100 X LL 80 z 60 40 0 4 8 12 16 20 24 28 Time (sec) Figure 6.3.7-9 FNCF Results for 104% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 FWCF 120 Core'Inlet Flow 100 CC m Z <0'0 I LL 60 40 0 8 12 16 20 24 28 Time (sec) Figure 5.3.7-10 FWCF Results for 104% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

=~

WNP-2 EOC8 FNCF 1,250 4 Steam Dome Pressure 1,200 ~

 ~ 1,150 0

tD 1,100 1,050 1,000 0 : 8 12 16 20 24 28 Time (sec) Figure 5.3.7-11 FNCF Results for 104% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time-

WNP-2 EOC8 FWCF 160 120 K CO Z0

   ~p  80 Vl 4J E

I tO (8 40 Vessel Steam Flow 0 0 8. 12 16 20 24 28 Time (sec) Figure 5.3.7-12 FWCF Results for 104% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 FNCF 70 ' 60 C 0) g 50 CD -tO U) 6) 40 I 30 0 8 12 36 20 24 28 Time (sec) Figure 6.3.7-13 FNCF Results for 104% Power and l06% Flow, RPT Operable, Tech. Spec. Scram Time

WNP-2 EOC8 FWCF 160 120-CC CO Z gO 80. L 0) cd U 0) EL 40 0

        .0         8          12          16        20     24 28 Time (sec)

Figure 5.3.7-14 FWCF Results for 104% Power and 106% Flow, RPT Operable, Tech. Spec. Scram Speed

U, 4

5-3.8

 ~ ~    Recirculation Flow Controller Failure 
            ~       ~

Increasing Flow 5.3.8.1 Event Description Failure of the master controller or the neutron flux controller can result in opening of the flow control valves in both recirculation loops. The valve opening speed is limited by system electronics. Also, failure within an individual loop's flow controller can open the flow control valves for that loop. In this case, the valve opening speed is limited by the system hydraulic characteristics. In either of these cases, the increase in recirculation flow causes an increase in core flow, which in turn, results in an increase in core power and shifts the power distribution toward the top of the core. The rate and magnitude of the power increase is dependent on the rate and magnitude of the recirculation flow increase. There are two possible analysis objectives: (1) demonstrate that the most severe recirculation flow increase does not exceed transient limits; and (2) identify reduced flow operating limits. Based on the plant safety analysis, the first case has been shown to be non-limiting with respect to the reload fuel analysis process. Thexefore, it is not discussed further with respect to the event analyses required as a part of the reload fuel event analysis process. It is the second case that is evaluated as a part of the reload analysis process. In this case, the initial conditions and assumptions are chosen to maximize the change in CPR. This is accomplished by the assumption of a gradual flow incxease such that the protective actions will not occux prior to the time of operator actions to mitigate the event consequences. This is the case described herein. The results of this analysis can establish the MCPR operating limits at lower flow conditions. l Table 5.3.8-1 shows the expected sequence of events for the recirculation flow controller failure increasing flow transient. 5~3 ~ 8-1

5.3.8.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and.assumptions form the principal bases for the analysis of the recirculation flow controller failure-'- increasing flow event:

                                 'I (a)     The plant is operating on low power and       flow operating limits on the power/flow operating map.

(b) The NSSS'operating parameters;.are consistent with a plant heat balance for the initial power and flow conditions. (c) A failure in the recirculation flow controller system causes the xecirculation flow to slowly increase. (d) The system trips and initiation signals are consistent with

          ,.technical specifications.

('e) 'll. of the plant control, systems function normally. 5.3.8.1.2 Operator Actions Operator actions are aimed toward reducing power and controlling recirculation flow. These actions include: (a) 'egain control of" the xecirculation syst: em flow control valves. (b) Take'he 'necessary'ctions to return to a normal operating state. (c) Identify cause of the failure and take action to initiate repairs., 5.3.8.1.3 Event Acceptance Limits f,

-  The     acceptance   limit for this        event  is that the 'MCPR > fuel

).'cladding integrity limit...,Compliance to the fuel cladding (-" integrity limit is demonstrated by ensuring that the operat'ing

   'limit MCPR is greater than or equal to the fuel cladding integrity limit'MCPR (which ensures that greater than 99.9% of the fuel xods in the core are.not expected to experience boiling transition)*plus

]: the change in. CPR during the event. A

                                       '5 '   8-2

5.3.8.2

      ~  ~    Analysis Considerations This section describes the key analysis considerations applicable to the recirculation flow controller failure  increasing flow event. It  includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences;       (2) a -discussion       of, the system performance
                                                               .

characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the imporCant components as they relate'o the event consequences.

5. 3.8.2. 1 Key Phenomena

Described below are the key phenomena related to .the recirculation flow controller failure -increasing flow; event., These phenomena are considered in the simulation of this event in order to accurately model the plant response., The recirculation flow controller failure - increasing flow event is relatively simple to model because of the slow nature of Che event. P Recirculation Phenomena Simulation of the recirculation phenomena is important for the analysis of this event. The-event. begins with a postulated failure that slowly increases recirculation flow, which results'n an increased core; power and core flow. For analysis purposes, the power and flow increases are i.assumed to

'continue until Che maximum. recirculation flow, as limited by the system design, and maximum neutron flux that will not initiate a scram, are reached.

Core Phenomena Simulation of the core flow and power increase is important in the analysis of this event." The-phenomena."important in the core region are the reactivity effects that contribute to .,changes in the neutron 'flux and heat" transfer'o the coolant. During the recirculation flow controller failure increasing flow transient, the reduction of steam voids due to the increased core flow is responsible for the initial positive reactivity insertion. This causes an increase in power which increases fuel temperature. 5~3 ~ 8-3

Pressure Vessel Phenomena As the recirculation water enters the vessel, it is used to drive the jet pumps which take suction flow from the downcomer region between the core shroud and the vessel wall and discharge to the lower plenum. The flow out of the jet pumps represents the total core flow (except for some minor contribution from the control rod drive cooling flow). The increase in recirculation flow increases the core flow. The water and steam mixture exits from the core to the upper plenum and then through the steam separators and steam dryers: Steam Line Phenomena As the powerlevel increases, the steam flow will increase and the pressure regulator, system will open the turbine control valves, and if necessary the'turbine bypass valves, to control turbine inlet pressure. Feedwater Phenomena The feedwater system is not substantially affected by this transient. Small changes in feedwater temperature are neglected. 5.3.8.2.2 Systems Considerations The recirculation flow controller failure increasing flow transient is initiated by an assumed failure in the recirculation flow control system." All'other systems are assumed to operate as designed and continue to function throughout the event. No other system or component failures are assumed to occur. For the limiting event, the important systems to be considered are: (1) the core and fuel system, including the nuclear/thermal-hydraulic coupling; (2) the recirculation system, which limits the maximum flow increaseI (3) the steam system, including control valves and stop valvesI (4) the feedwater system; and (5) the reactor protection systems average power range monitor (APRN) neutron flux and flow referenced thermal power scram setpoint. For the limiting event, the maximum power level is based on the scram setpoint, which effectively limits the power increase. 5~3~8 4

5.3.8.2.3

 ~ ~    ~ ~    Component Performance       Characteristics Analysis       of  the   slow   flow -increase          associated      with the recirculation flow"'controller failure - increasing flow event requires modeling of the core and fuel only., The performance of the other components is associated with the selection of the initial and final operating states.

5.3.8.3 Methodology/Integration of Codes and Analysis The primary analysis model in. the simulation of .the recirculation flow controller increasing flow -,event is the core thermal hydraulic model, VIPRE-01. .VIPRE-01 is used: to calculate the I changes in core thermal hydraulic parameters, based on the assumed changes in core flow and core power during the event. The VIPRE-01 analysis results are used to determine the hCPR from the operating statepoints evaluated. The analysis of the recirculation flow controller failure increasing flow is performed using the following codes in the sequence shown on Figure 2-1: (1) ESCORE; (2) MXCBURN-E; (3) CASMO-2E; (4) FICE; and (5) VIPRE-01. ESCORE is used to provide the 'uel rod temperature 'distribution used in CASMO-2E. Gap conductance calculated by the vendor's approved methods is used in VIPRE-01. MICBURN-E provides the gadolinia cross sections used in CASMO-2E. CASMO-2E is used to perform the lattice physics analysis to generate the local peaking factors used by FICE. VIPRE-01 is used to determine the ACPR during the transient based on the local peaking function provided by FICE. l "I N 5.3.8.'4 Licensing Analysis Process a analysis of the'ecirculation flow controller failure C I'he increasing flow event follows a six step process: I (1) Determine the discrete power and flow-points to be analyzed. The calculations assume that the event is initiated from the 104% rod line at minimum flow and terminates at 1204 power and 5~ 3" 8-5

1034 flow ('low control. valve wide open). The power and flow discrete points along this line are then calculated. (2) *Determine core pressure as a function of core power. (3) Perform a heat balance calculation to determine steam flow, feedwater flow, and feedwater enthalpy for the range of power and flow conditions. Include the recirculation pump power. (4) Perform heat balance calculations to determine core inlet

       ,enthalpy for the range of power and flow conditions.

(5) -'alculate"core bypass'flow.. Determine active core flow from total, core flow and bypass flow. (6) Choose' radial power distribution .that puts .the high, power fuel, assembly on the safety limit MCPR at 1204 power and 1034 flow. Calculate the MCPR along the power/flow line determined in Step 1. 'his calculation's performed by a steady-.,state

.; . VIPRE-01 analysis.. The VIPRE-01 boundary conditions of pressure, inlet enthalpy, and inlet flow are determined 'in "Steps (2), (4), 'and,(5); respectively.

                                *
                                                                't.

5.3.8.,5, Sensitivity Studies/Justification of Process The recirculation flow controller increasing flow event is based on,a conservative determination of the bCPR between various reduced power,and flow,operating states and the maximum core flow and power level that can be attained as a result of a slow increase in recirculation flow. The analysis assumes that the event is initiated from the control rod line on the power flow map associated with 1054 steam flow (104.2< power). The event is assumed to be terminated at 1204 power and 1034 core flow. The core flow at the 1204 power level is based on the maximum that can be attained with the recirculation flow system design. The power flow relationship is bounding for a slow increase in core flow assuming no increase in xenon concentration in the fuel during the event (constant xenon assumption). The constant xenon assumption is more limiting than the assumption of xenon buildup during the event. To determine the conservatism in the operating states evaluated for the event, the analysis of changes in operating state assuming constant xenon between the initial operation state and the maximum (with flow control valve wide open)

                                  "5'3 '=6

core flow was made using the SIMUIATE-E code. For this case, the final power level obtained was 112.54. This analysis demonstrates the conservatism in the selection of the operating states used in the analysis of this event. 5.3.8.6 Typical Results The licensing analysis process for evaluating the recirculation flow controller failure increasing flow event is described in Section 5.3.8.4. This process has been used to analyze the recirculation flow controller failure increasing flow event for Cycle 8. The analysis results are provided in Table 5.3.8-2. The results of the fuel supplier (SPC) are also shown in Table 5.3.8-2. The operating limits determined by the Supply System agree well with SPC's results. (Except at the two lowest flow points, e.g., 204 and 304 rated flow, where the discrepancies are greater due to differences in the predicted flow distributions at low flow conditions. There, SPC calculated higher hot channel flows and thus higher MCPRs). Therefore, it is concluded that the Supply System licensing analysis process is reasonable based on the analysis conservatisms and the comparison to the SPC results. 5 '.8 7

Table 5;3.8-1

                    'equence of Events for Recirculation Flow Controller Failure - Xncreasing Flow Recirculation flow controller fails.       and recirculation flow .begins to increase.

Turbine control valves, and control reactor pressure. if necessary bypass valves, open to k New steady state power level is reached at maximum recirculation flow.

                           " '5.:.3   8-8

Table 5.3.8-2 Reduced Flow Operating Limit Based on Recirculation Flow Controller - Increasing Plow Supply System Fuel Supplier. Core Flow Reduced Flow MCPR Reduced Flow MCPR 0 Rated 0 eratin Limit 0 eratin Limit 103 1. 071 1.070 90 1.166 1.163 80 1.245 1.242

"'

70 1.329 1.322

1. 412 1 '05 50 1.498 1.492 40 1.582 1.587 30 1.665 1.724 20 1.836 1.926 5.3 '-9

~ ~

.A ~

~ t

~ ~

5.3.9

 ~ ~      Control   Rod Drop  Accident 5.3.9.1       Event Description There are many ways of inserting reactivity into a BWR; however, most result in a relatively slow rate of reactivity insertion and do not pose a significant challenge to the fission product barriers.       It  is possible that the rapid removal of a high worth control rod could result in a potentially significant power excursion.         The  accident that has been selected to bound the consequences of the most rapid reactivity insertion events is the control rod drop accident.

The control rod drop accident is the postulated separation of the control rod blade from the control rod drive, with the blade sticking in the fully inserted position while the drive is withdrawn until a high worth control rod pattern is achieved, followed by the dropping of the blade to the control rod drive position. The dropping of a high worth control rod results in a high local reactivity in a small region of the core and, for large, loosely coupled BWR cores, significant shifts in spatial power generation. The initial rapid power increase is limited by Doppler, void, and moderator reactivity, and final shutdown is achieved by a high neutron flux initiated scram. For the limiting case assumed in the safety analysis process, fuel failures are predicted to occur as a consequence of this accident. Table 5.3.9-1 shows the expected sequence of events for the control rod drop accident. 5.3.9.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and assumptions form the principal bases for the analysis of the control rod drop accident: (a) The reactor is critical and the power level is less than 204. 5~3 ~ 9-1

(b) A control rod blade is separated from its drive and stuck in the fully inserted position. (c) Control rods are withdrawn to establish a high worth control rod pattern consistent. with the constraints of the rod sequence control system (RSCS). (d) The drive separated from its blade is at a position consistent with the other control rods assigned to its group. (e) The control rod blade becomes unstuck and drops at its maximum velocity to the position of the drive. (f) Scram is initiated on high neutron flux. 5.3.9. 1.2 Operator Actions IP The termination of the excursion is accomplished by the inherent design of the fuel and core and the automatic initiation of a scram. Following the scram, the operator would be expected to confirm that the reactor is shut down and take the necessary actions to regain control of the plant. Assuming the plant is isolated, the operator should take the appropriate actions identified in the plant emergency procedures, which include monitoring reactor water level and pressure and suppression pool temperature. 5.3.9.1.3 Event Acceptance Limits The acceptance limit for this event is a peak fuel enthalpy deposition of 280 cal/gm. Compliance with the peak fuel enthalpy limit is demonstrated by ensuring that the key inputs to the generic analysis will result in a peak radially averaged fuel enthalpy deposition of less than 280 cal/gm. 5.3.9.2 Analysis Considerations This section describes the key analysis considerations applicable to the control rod drop accident. It includes: (1) a description of the phenomena occurring during the event that have a significant 5~3 ~ 9-2

impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.9.2.1 Key Phenomena Described below are the key phenomena .related to the control rod drop accident. Consideration of these phenomena is necessary in the simulation of this event to accurately model the plant response. The major complexity in analyzing this event is in the simulation of the core phenomena, including the changes in the core power and power distribution during the initial power excursion. From a systems standpoint, the control rod drop accident is relatively simple to model because the majority of the system actions occur after the challenge to the accident acceptance limits is terminated. The primary systems considerations are in the simulation of the normal operating systems as they limit control rod worth and the performance of the control rod drive system as it inserts scram reactivity. These phenomena are considered as part of the core phenomena. Other system phenomena are associated with evaluating the radiological consequences of calculated fuel failures. Core Phenomena The event begins with the dropping of a fully inserted high worth control rod that had been previously separated from its drive. The control rod blade is then assumed to drop at its maximum velocity to the position of its drive. The maximum control rod worth is constrained by the normal operating systems as they limit the allowable control rod patterns. The maximum velocity of the falling control rod is limited by the design of the control rod blade. 5~3 9-3.

The postulated dropping of a control rod results in a high local reactivity addition in a small region of the core, a substantial local power increase, and a shift in power distribution during the course of the event. The phenomena important in the core region are the reactivity effects that contribute to the changes" in the local neutron flux and the energy deposition in the fuel rods. The primary effects are the reactivity changes due to the dropped control rod, the feedback effects of Doppler,- void and moderator temperature, and control rod (scram)." The reactivity insertion due to the dropped control'"rod is dependent on control 'rod wort?i, drop velocity, and distance dropped. The rapid change in local power causes a rapid increas'e in fuel temperature and, depending on the initial 'eactor conditions, generates additional steam voids or i'ncreases moderator temperature. The local power increase is initially limited by the Doppler and void/moderator reactivity feedback and is terminated by reactor scram. The selection of initial conditions is important in 'he determination of the reactivity characteristics to be used during the accident. Because the presence of voids'tends to mitigate-t: he consequences of the event, zero power startup conditions are limiting. Control rod patteins are selected consistent 'with these conditions to establish the appropriate accident reactivity 1 Ir characteristics'o be used during the postulated accident. The important accident reactivity characteristics are the total control rod worth, accident reactivity shape function,'ontrol rod drop velocity, interassembly local power peaking fa'ctor, 'and delayed neutron fraction. The total control rod worth establishes the maximum amount of reactivity that can be inserted as a result of a dropped control rod. The accident reactivity shape function establishes the reactivity inserted as a function of the distance the rod has dropped. The control rod dr'op velo'city establishes the reactivity insertion as a function I

                                                 'of time. The maximum interassembly local peaking factor is used to'lloca'te 'the energy 0

V l deposition in the fuel assemblies surrounding the control rod. The

                                       ~ t   I 5 3.9      4

delayed neutron fraction is an important parameter in establishing the magnitude of the power increase. The important reactivity feedback parameters are the Doppler, void, and moderator temperature reactivity. The increase in fuel temperature that results from power increase due to the dropped control rod causes the Doppler reactivity to become more negative, which tends to mitigate. the event consequences. In addition, the heat transfer to the moderator from the fuel rods and the direct energy deposition into the coolant cause the moderator temperature to increase or generate additional voids, which also provi'des negative feedback. The scram reactivity insertion is the .mechanism for making the reactor subcritical. The scram reactivity consists of the scram reactivity function and the scram insertion time. The scram reactivity function is the control rod reactivity as a function of the distance that the control rods are inserted. The scram reactivity insertion time is used to establish the scram reactivity as a function of time. S stems Phenomena Because the evaluation of this accident is performed with a core dynamics code, the external system phenomena are treated through the use of code inputs. The primary systems inputs are those which impact core reactivity. These include the normal system operating constraints on control rod patterns and the control rod, drive (scram) system and are discussed above. The remaining system inputs are treated as steady state because the event is extremely rapid and the system controls do not respond in a manner to significantly affect the course of the event.

                                ~  n 5.3.9.2.2    Systems Considerations The   control,rod drop accident is the postulated separation of a control rod from its drive, the sticking of the blade in the fully inserted position, the withdrawal of control rods to establish a high worth pattern, and the subsequent dropping of the blade to the 5+3.9-5

position of the drive. 'The important'systems to be considered in the accident analysis are: (1) the core and fuel system; (2) the RSCS; and (3) the reactor protection and control rod drive (scram) systems, including the high neutron flux initiated scram and the rapid insertion of the control rods. Other systems that may be initiated as a result of an isolation or the decision to change the operating state as part of the'ccident recovery process are not required because their action occurs after the challenge to the event acceptance limits has occurred. With the exception of the RSCS, which places constraints on "the allowable control rod p'attern, the system components as discussed in Section 5.3.9.2.3 limit the system performance characteristics.

For'NP-2', the RSCS coupled with the banked position withdrawal sequence constrains the control rod pattern during plant startup and low power operation. The RSCS is a system that constrains control rod movements to predetermined patterns and consequences by initiating control rod blocks to ensure that allowable control rod withdrawal and insertion sequences are followed. The banked position withdrawal sequence limits control rod movements to pre-assigned control rod groups and banked positions, such that the maximum control rod worth is reasonably minimized. The RSCS operates until-the power level reaches the setpoint that has been established -such that constraints on 'rod patterns are:.no .longex required'for protection against the consequences of the control rod drop accident. 5.3.9.2.3 Component Performance Characteristics The control rod drop accident requires modeling of the core and fuel systems, of the systems that. place constraints on control rod h patterns, and- of the react'or protection and control. rod drive (scram) systems. These systems are modeled by treating them as ll inpu'ts to the core analysis. The key- parameters with respect to the 'core and fuel systems are discussed,.with respect to the core phenomena and the con'straints on control rod patterns are discussed with'respect to the overall 'systems consideration. This section 5'. 3 ~ 9-'6

~,

describes the analysis inputs that are based on the performance of the key system components.e,, Co trol d Dro Ve oc't Each control rod is equipped with a velocity'imiter that limits the free fall velocity of the control rod blade that is separated from its drive. The maximum drop velocity determined from experimental test data- is used in the analysis. Neutron Flux Tri level The average power range monitors (APRM). system high neutron flux level provides the signal that .initiates reactor scram to achieve reactor .shutdown. . The technical specification setpoint for high neutron flux in the power range is used in'he 'analysis, even though other flux .trips would occur earlier. "

P Reactor'rotection S stem Dela s= -The reactor protection system includes the devices to generate signals, conditioning, of these signals, and comparison to trip setpoints, and initiates reactor scram". The technical specification response time for the reactor protection system is used in the analysis.

Control Rod Insertion Time 'he control rod drive system provides the necessary negative reactivity insertion to achieve reactor shutdown. The technical specification for the average control rod insertion time for all control rods at reduced pressure is used in 4 the analysis. 5.3.9.3 Methodology/Integration of Codes and Analysis P The control rod drop, accident analysis, is performed by integrating the WNP-2 reactor analysis methodology, with the fuel supplier CRDA analysis 'methods. ,In this approach, the cycle-specific .CRDA analysis input parameters for the reload are used in conjunction with the fuel supplier,'s generic CRDA analyses. Minor details of the analysis could change in the future in response to a change in fuel supplier or a.change. in the,supplier's approved methodology. 5.3.9-7

The Supply System will continue to provide whatever:neutronics ( parameters are needed to interface with the vendor's approved CRDA analysis. These are expected to remain the dropped rod worth, the four-assembly local peaking factor, .the Doppler coefficient, and the effective delayed neutron fraction. For each operating cycle, the Supply System evaluates the maximum rod worths, four-assembly local power peaking factors, Doppler coefficient, and delayed neutron fraction. These values are used, along with- the results of the vendor's generic control rod drop accident analysis, to obtain a conservative bound for the fuel rod enthalpy deposition. The following codes are used in the sequence shown on Figure 2-1 to determine the input parameters for the generic parametric. analysis: (1) MICBURN-E; (2) CASMO-2E; (3) NORGE B I ( 4 ) SIMULATE E I and ( 5 ) S IMTRAN-E ~ MICBURN-E provides, the gadolinia cross sections used in CASMO-2E. CASMO-2E is used to perform the lattice physics-.analysis to generate the cross sections for SIMULATE-E, the total effective delayed neutron yield for SIMTRAN-E, the- Doppler coefficient, and in conjunction with SIMULATE-E, the four-assembly local power peaking factor. NORGE-B is'used to transfer the CASMO-2E data to SIMULATE-E and SIMTRAN-E. SIMULATE-E is used to determine the control rod worth and,. in conjunction with CASMO-2E, the four-assembly local power peaking factor: SIMTRAN-E is used- to develop a conservative value for the delayed neutron fraction.= I 4 5' ' ' Licensing Analysis Process In the ana'lysis of the control--'rod drop, accident, the following analysis assumptions- are made:.'i if (a) The plant is at hot zero power conditions: Moderator and fuel temperatures h (b) are equal. {c)'he'oolant void fraction=is'0<;-.. 1

       .{d) The core is in a xenon free state.
                                        "5 3'     8

(e) The control rod patterns are consistent with the banked position withdrawal sequence and the RSCS is operable. Eight control rods may be inoperable and are assumed to be fully inserted, with the inoperable control rods separated by at least two operable control rods in all directions. (g) No more than three inoperable control rods exist in any one RSCS rod group. The evaluation of each of the four parameters needed for use in the vendor's generic parametric analysis is discussed in more detail below. The 'maximum worth control rods are identified by core analysis calculations. Candidate high worth rods are identified consistent with the rod withdrawal sequence for the operating cycle being evaluated. 'The inoperable control .rods all are assumed to lie in one half of the core and rods in the other half are investigated as high worth candidates. This assumption conservatively increases the predicted worth of candidate rods. For each candidate rod, the rod worth is determined by a pair of core calculations, one with the candidate rod fully,inserted, the other with the rod fully withdrawn. In this way, the top few highest worth. rods are identified and, after the remaining three parameters are evaluated, the enthalpy deposition in the adjacent bundles is calculated, as described below. This is done to ensure that the highest enthalpy deposition, not just the highest rod worth, is obtained. The four-assembly local peaking factors are calculated for each of the highest worth rods. The four-assembly local power peaking factor is evaluated by combining the core predictions of assembly power with the lattice physics analysis values of assembly local peaking factors. The Doppler coefficient is. evaluated as a function of void history and exposure for each fuel type from pairs of lattice physics calculations at different fuel temperatures. The Doppler

coefficient for any particular 'ode is then- obtained by interpolation with respect to exposure and void history. The delayed neutron fraction is evaluated by condensation of three-dimensional core data to a core average value. The delayed neutron fraction is based on the lattice physics data. For each of the high control rod worth rods identified above, the values of rod worth; four-assembly local power peaking factor, ( Doppler 'coefficient, and 'delayed neutron fraction are used along with the vendor's generic CRDA parametric results to evaluate the associated maximum fuel rod enthalpy deposition; The results, for each high worth rod are then examined to identify the largest value and to verify that it does not exceed 280 cal/gm. It is assumed that fuel clad failures may occur in all fuel rods in which the CRDA radially averaged enthalpy deposition exceeds 170 cal/gm at any axial location. In all WNP-2 cycles to date the predicted CRDA peak enthalpy deposition has been considerably less than 170 cal/gm. To prepare for the eventuality that future changes in cycle length or fuel design might lead to predicted peak CRDA enthalpy depositions exceeding 170 cal/gm, the Supply System has developed a methodology to analyze, that situation. The nodal power shape predi'cted by the core .simulation code during the rod worth calculation is combined with the pin local peaking factors from the lattice physics code and the maximum enthalpy 'deposition from the vendor's generic analysis to estimate the number of fuel rods whose maximum enthalpy deposition exceeds 170 cal/gm. The radiological consequences, of the failure of all such fuel rods are compared to the radiological consequences of the scenario analyzed in the WNP-2 FSAR (releases from the failure of 770 GE 8x8 fuel rods) to show. that the FSAR scenario is bounding. If the FSAR scenario were not bounding, then new radiological releases would be determined and evaluat'ed. 5 ' '-10 0

5.3.9.5

 ~ ~  ~   CRDA  Results for Cycle     8 The   current fuel vendor, SPC, has performed generic parametric evaluations of the consequences of the CRDA to determine the maximum fuel rod enthalpy deposition for a range of values of the control rod worth of the dropped control rod, four-assembly local power peaking    factors,. Doppler coefficient,      and delayed    neutron fraction [Reference. 21]. For conservatism, the SPC parametric studies neglect the contributions of void reactivity, so the void coefficient does not appear in their analysis. In addition, the SPC generic parametric analysis utilizes a conservatively low scram reactivity insertion rate and a conservatively high reactivity insertion rate for the dropped control rod.

The Supply System and SPC results for the Cycle 8 CRDA analysis are compared below. l Supply System SPC Rod Withdrawal B2 B2 Sequence Dropped Rod 8.4 mk 7.0 mk Worth Doppler -10.5 x 10~ -10.0 x 10 Coefficient (dk/kdT F') P-effective 0.0055 0.0050 Four-Bundle Local Peaking 1.26 1 '7 Factor Maximum .. 130 120 Enthalpy Deposition cal/gm In determining the CRDA maximum enthalpy deposition for Cycle 8, both the Supply System and SPC used an extremely conservative approach to bound the worths of the highest worth rods: Rather than considering only the normal A2 control rod pull sequence used 5 ~ 3.9-11

during WNP-2 startup other sequences were considered also. Zn it ( ( addition, was assumed that any rod in a rod withdrawal group could be the first withdrawn rod in that group. The resulting rod worths are highly conservative for CRDA analysis. I As required, the maximum enthalpy deposition is less than 280 cal/gm. (And less than 170 cal/gm, so no analysis of radioactive releases is required). I / 'W 5.3.9.6 Sensitivity Studies/Justification'of Process The control rod drop accident analysis's based on the use of approved fuel supplier methodology. 1 The Supply System inputs to the generic parametric analysis are conservatively determined. No further sensitivity studies are required. I 0

                              " 5". 3 9-12

Table 5.3.9-1 Secpxence of Events for Control Rod Drop Accident Control rod blade becomes separated from its drive and sticks in the fully-inserted position. Operator withdraws control rods until the reactor becomes critical with fully-inserted control rod having its maximum worth. '

The control rod becomes unstuck and drops. at its maximum

                                                              ~P velocity.

Reactor becomes I prompt critical and initial power increase I E

                                                                           's limited  by the Doppler and void/moderator temperature feedback.

I' Scram occurs on high neutron flux. Sufficient control rods are inserted to terminate the accident.

                              ;,5 3 ~ 9 13

5.3.10

~  ~    Loss   of Coolant Accident 5.3.10.1     Event Description The LOCA   is the postulated loss of coolant   from the reactor coolant pressure    boundary at a rate in excess of the capability of the reactor coolant makeup systems, from pipe breaks up to and including a break equivalent to the double ended rupture of the largest pipe in the reactor coolant system.                The analysis requirements for the LOCA are established in 10CFR50.46 and 10CFR50 Appendix K. For BWRs, a LOCA may be postulated for a wide spectrum of break locations and break sizes. Responses to the postulated break may vary significantly over the break spectrum. The largest break is the postulated double ended rupture of a recirculation pipe; however, the largest break is not necessarily the most severe challenge to the performance of the ECCS.           This leads to the requirements to evaluate the entire break spectrum and a number of possible single failures.

Regardless of the initiating break characteristics, the response of the plant to a LOCA can be separated into three phases: (1) the blowdown phase; (2) the refill phase; and (3) the reflood phase. During the blowdown phase, there is a net loss of coolant inventory, an increase in fuel cladding temperature, and uncovery of the core. In the refill phase, the ECCS is functioning and

there is a net increase in coolant inventory, and the heat transfer to the coolant is less than the decay heat rate of the fuel, resulting in a continued increase in the fuel cladding temperature. In the reflood phase, the coolant inventory has increased to the point where the core recovers, and the fuel cladding temperature decreases. The relative duration of each phase is dependent on the break size, location, and available ECCS components. The LOCA scenarios vary considerably over the spectrum of break sizes, locations, and equipment failure combinations. For analysis purposes, the limiting LOCA has been demonstrated in the safety analysis to be a large break in the recirculation system suction

line with the assumed failure of the diesel generator that powers the .low pressure core spray. This is the event described below. Following the postulated break, reactor vessel pressure and core flow begin to decrease. The initial pressure response is dependent on the closure characteristics 'of the main steam line isolation valves and the relative values of the energy added to the system by the decay heat and the energy removed fr'om thesystem by the initial blowdown of the fluid from the downcomer 'region of the reactor pressure vessel. The'initi'al core flow decrease is rapid because the recirculation pump in the broken loop loses suction almost immediately, and the pump in the intact loop begins to coast down. The pump coastdown controls the core flow for the .next several seconds. When sufficient fluid is released from the vessel and the jet pumps uncover, the core flow decrease to near zero. Following recirculation pump suction uncovery, the energy release from the break increases significantly, and the pressure begins to decay more rapidly. During the rapid pressure reduction, the initially subcooled liquid in the lower plenum flashes, increasing core flow for the next several seconds. Water level in the core region remains high during the early stages of blowdown because 'of the initial fluid inventory and the flashing of the water in the core. After a short time, the level in the core decreases, and the core becomes uncovered. Several seconds later,- the ECCS is actuated and"the reactor vessel, water level begins to increase. The core is rapidly .recovered following, filling of the lower 1 plenum. I

~ ~

'Heat transfer rates k on the. fuel cladding during the early stages of the blowdown are governed primarily by the core flow response. Nucleate boiling continues in the high powered regions of the core until uncovery of the jet pumps.'oiling tiansition follows, and film boiling heat. transfer rates are applied. Heat transfer rates increase during the'eriod of lower plenum flashing; 'lowly

                       ~     ~ ~

decreasing as the flashing progresses until the high power region uncovers. Following uncovery, convective heat transfer is assumed to cease, leaving only radiation heat transfer between the fuel 5 ~ 3 ~XO 2

~ I

rods and to the channel. Heat transfer following ECCS initiation is based initially on the heat transfer to the core spray, followed by a rapid increase in heat transfer due to core recovery. The cladding temperature in the high powered region of the core decreases initially because nucleate boiling is maintained and the heat input and fluid temperature decrease. The reactor initially becomes subcritical due to the large increase in core voids, followed by reactor shutdown due, to a scram of the control rods. A rapid, short duration cladding heatup follows the time of boiling transition, when film boiling occurs and the cladding temperature approaches the fuel temperature. The subsequent heatup is slower, controlled by the decay heat and core spray heat transfer. Heatup is terminated by core recovery due to the accumulation of ECCS water. Table 5.3.10-1 shows the expected sequence of events for the LOCA. 5.3.10.1.1 Initial Conditions and Operational Assumptions The following plant operating conditions and assumptions form the principal basis for the analysis of the LOCA. o The plant is operating at its maximum power level and at a core flow consistent with the power level. A pipe break occurs at any location in the reactor coolant pressure boundary, of a size greater than the capability of the normal makeup system up to and including the double ended break of a recirculation system pipe. 0 The combination of ECCS components that are operable is the most limiting considering a single failure and a concurrent loss of power, consistent with the definitions in 10CFR50 Appendix A. 0 Only safety related components are available to mitigate the consequences of the LOCA. The ECCS is initiated by high"drywell pressure or low reactor water level, whichever occurs first. 5 3 '0-3

o The containment isolation valves are closed by the first isolation setpoint reached. o The secondary containment is isolated and the standby gas treatment system is initiated by the first setpoint reached. 0 No cxedit is taken for the operation of the reactor core isolation cooling system (RCIC). The RCIC is considered the normal makeup system'or the purposes of establishing the minimum break. size.

5. 3. 10. 1. 2 Operator Actions Short term actions (scram,,ECCS initiation, primary and secondary containment isolation, standby gas treatment system initiation) take place automatically. The operator should take the appropriate actions identified in the plant emergency procedures, which include monitoring reactor water level and pressure and suppression pool I

temperature. The operator would be expected to confirm reactor shutdown and appropriate system actuations and attempt to initiate operation of any failed components. Upon successful completion of the initial core cooling phase, the operatox would be expected to initiate the long,term core and containment cooling and begin the

  'a'ccident'ecovery process.                                      t 5.3. 10.3..3    Event Acceptance Limits The'vent       acceptance limits for this accident are contained in 10CFR50.46.. They are:         (1) a peak cladding temperature 5 2200'F;
                                                                      ~ g'I (2) maximum cladding.,oxidation 517~.; (3) core wide metal water
 -reaction S 1%; (4). the. maintenance of a eoolable geometry; and (5) assurance of:long.term, cooling. - For the reload analysis process,
 "-compliance with the. peak cladding temperature and maximum cladding oxidation limits are demonstrated by-the ECCS performance,.analysis for= the. LOCA, consistent  with the 10CFR50 Appendix K model  4

( requirements for the fuel operating at its,MAPLHGR. The ECCS performance analysis also demonstrates compliance with the core wide metal water reaction analysis. As described in Section 5~3 ~ 10-4

5.1.4.2 for the reload fuel analysis, compliance with the first three criteria provides assurance that the remaining criteria are satisfied. 5.3.10.2 Analysis Considerations This section describes the key analysis considerations applicable to the LOCA. lt includes: (1) a description of the phenomena occurring during the event that have a significant, impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course,of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences.

 , I 5.3.10.2.1    Key Phenomena Described   below are the key phenomena      related .to   LOCA for the limiting break size, consistent with the requirement of 10CFR50.46 and Appendix E. Consideration of these phenomena is necessary in the simulation of this event to accurately model the plant response. The LOCA is a very complex event to model. The primary phenomena    to   be   considered    include:-   ..(1),,blowdown;,  (2) recirculation;   (3) steamline; (4) feedwater; -(5) pressure    vessel; (6) ECCS;  (7) core; and (8) fuel.

Blowdown Phenomena The event is initiated by the assumed instantaneous break in -a pipe in th'e reactor coolant .pressure boundary. The fluid at the-break entrance is initially subcooled, and flashes to a two ph'ase mixture as 'it passes through, the break. Because of the initial pressure reduction,'ulk flashing, will occur in the downcomer region'nd'two phase flow. continues until the decrease in'ater level in'ithe downcomer region of, the pressure vessel leads to recirculation suction line uncovery. .Following uncovery of the suction line', the blowdown -flow is primarily steam with entrained liquid. E 5 3. 10-5

Recirculation Phenomena The recirculation flow during the blowdown phase is important because of its effect on core flow. The unbroken recirculation loop will experience a coastdown due to the loss of power to the recirculation system pumps. The broken loop will experience reverse flow through the pump during coastdown. The core flow is dependent on the recirculation pump and jet pump characteristics, including consideration of the fluid characteristics during blowdown. Steamline Phenomena'he main. steam lines -will be isolated as a result of the inventory loss during blowdown. Closure of the main steam line isolation valves (MSIVs) will reduce , the depressurization rate. Feedwater Phenomena Feedwater flow is assumed to coastdown rapidly during the event. Pressure Vessel Phenomena The most important pressure vessel phenomena are those that influence the coolant inventory and its distribution, including the effect on water level. Water level in the downcomer region is important because it determines the time of jet pump and recirculation- suction uncovery during the blowdown phase. Jet pump uncovery significantly affects the core flow, and recirculation system suction uncovery significantly affects the reactor vessel depressurization rate. Because the structural stored energy is significant, heat transfer from the internals to the coolant is included 'in the analysis. ECCS Phenomena The ECCS are assumed to initiate at the appropriate setpoints. The limiting single failure is the low pressure core spray'diesel generator. The HPCS.is initiated consistent with the system startup- time." The low pressure coolant -injection begins. as soon as the reactor vessel pressure reaches the pressure permissive setpoint and the injection valves .open. Core Phenomena The important core phenomena during the LOCA include the core inlet flow, "flow.between. the core bypass and the 5 ~ 3 ~ 10 6

fuel 'assemblies, and counter current flow limitations at the top and bottom of the core., I Initially, the core flow rapidly coasts down consistent with the characteristics of the unbroken loop and essentially stops at the time of jet pump uncovery. When the system pressure falls below the saturation pressure of the lower plenum, lower plenum flashing occurs and significant core flow rate is:,reestablished. Following lower plenum flashing, the core flow stops until startup of the HPCS syst: em'egins spraying water'nto -the .core region. The core is reflooded by the combined -action..of. the core spray system and low pressure coolant injection pumps;= C r One of the most impo'rtant phenomena during the refill phase of the LOCA's" counter current flow limitations. Counter current flow limitations occur when the vapor flow through a restricted area,.is sufficiently high to impede the liquid drainage. Counter current flow limitations can delay the reflooding of the core and termination of the core heatup process. There are three areas of interest with respect to counter current flow limitations during a 'BWR LOCA: (1) at the upper tie plate of the fuel assembly; (2), at the top of the core bypass"due to the top fuel guide; and (3)., at the fuel assembly inlet'orifice; During the refill phase, the. bypass region will refill faster than the fuel assemblies. Flow. through the bypass. flow paths aids in reflooding the vessel and'fuel assemblies. Also the water in the bypass region ensures that the channel remains a primary heat sink for the fuel rods.- Fuel Phenomena -The primary fuel phenomena"-,of interest- during a LOCA include the internal heat generation, conduction heat:,transfer within the fuel pel'lets,'uel rod pressure, and cladding swelling and rupture, chemical reaction, between the;cladding and -coolant, and radiant heat transfer between the fuel rods and to the channel wall. Internal heat generation, along with,-the stored energy in the fuel, -is the primary'ource. of, energy .for increasing fuel

                                " 5~3 ~ 10-7

cladding temperature'during the LOCA. internal heat generation is due to delayed neutron induced fissions, decay of the actinides,, and decay of the fission products. Conduction heat transfer both within the fuel pellet and in the fuel pellet to cladding gap limits the rate at which the stored energy and the decay heat is transferred to the fuel cladding. During the core heatup phase, the fuel cladding may swell and rupture as a result of the increasing fuel rod internal pressure. At .elevated temperature, a significant exothermic "hydrogen "producing reaction between the cladding and the coolant (metal water reaction) occurs that can signifi'cantly increase the predicted cladding temperature. Radiant heat transfer between the fuel rods and to the fuel assembly channel is important in limiting the peak cladding temperature of the fuel assembly. 5.3.10.2.2, Systems'onsiderati.ons The LOCA is initiated by the postulated break of a pipe in the reactor coolant pressure boundary. The primary systems associated with the LOCA are the ECCS, which include the HPCS,:the low pressure core 'spray', the low pressure coolant injection,- and .the automatic depressurization systems. The limiting case is evaluated p 'I assuming only the availability of" onsite power supplies. .-ln addition, it was determined that the limiting, single failure is the ( failure of the low pressure core spray diesel generator, and, it, is (

 'assumed to have failed for ana'lysis -purposes..             Other systems associated with the LOCA analysis are the main steam,- reactor protection, and control rod drive (scram) systems.              The system performance 'characteristics are limited by the key components in the system as described in Section 5.3;10.2.3.

t

5.3.10.2.3 Characteristics II Component Performance For the LOCA, detailed modeling of the reactor vessel, core, and fuel is required. The ECCS is required to provide core cooling; the reactor protection system and control rod drive (scram) system 5'"3 .'1 0'-'8

are required to achieve reactor shutdown;and the main steam system impacts the vessel blowdown. The key components within these systems limit their performance. The selection of the licensing basis component performance characteristics is based on a buildup of conservative assumptions established by past practices and

licensing requirements. ECCS Initiation Dela s The. systems initiating the ECCS are comprised of a number of analog and digital, components. Time delays are based on the maximum values contained in the technical specifications.

                                                       =I E

ECCS Flow Rates The minimum pump flow characteristics based on the technical specification flow rates are used. ECCS In'ection Valve 0 enin Times The slowest,ECCS injection valve opening times identified in the technical specifications are used. MSIV Closure Time The slow rate of MSIV closure identified in the technical specification-is used to maximize the inventory loss. [ 4 Reactor Protection S stem Si nal Dela The reactor protection system includes the devices to generate signals, to condition the signals., to compare them to trip setpoints,. and to initiate reactor, 4

scram. The technical specification response time for the reactor protection system is used in the analysis.

Control-Rod Insertion, Time,,The control rod drive system provides the necessary negative reactivity, insertion. to .achieve reactor 1 4 shutdown. The technical specification for the average control rod insertion time for.all.control rods..at reducedpressure is used in the analysis.

I~ >> 0 ~ h

                                <<.,5 ~ 3 ~ 10 9

5.3.10.3 Methodology/Integration of Codes and Analysis The LOCA analysis is performed by integrating the WNP-2 reactor analysis methodology with'he fuel supplier LOCA analysis methods. In this approach,'certain cycle-specific input parameters developed by the Supply System are compared by the Supply System to conservative values used in the vendor's LOCA analysis to ensure that the vendor's analysis is bounding. Any cycle-specific data requested by the fuel vendor are transmitted to the vendor for their use to verify that their LOCA analysis is bounding or, if necessary, to rerun their LOCA analysis.

,I The cycle-specific parameters evaluated by the Supply System are the Doppler reactivity, the void reactivity, the tim'e-dependent scram reactivity, the assembly local peaking factors, and- data describing the fuel rod stored energies. The details of exactly how the reactivities are'expressed, and exactly what data is needed to describe the fuel rod stored energies, may vary between fuel vendors (and in response to changes in a particular vendor's LOCA analysis methods). However, the parameters listed above -'are expected to be the relevant ones for use in the-LOCA analysis" no matter which fuel vendor is involved. I The following codes are used in the sequence shown on Figure 2-1"to determine the input parameters'or the LOCA analysis:- '(1) MICBURN-E; (2) CASMO-2E; (3) NORGE-B; '(4) SIMULATE-E; (5) SIMTRAN-E; and (6) RETRAN-02. MICBURN-E provides the gadolinia cross section's r used in CASMO-2E. CASMO-2E is used to perform the lattice'physics analysis to generate the cross sections'for SIMULATE-E, the 'total effective delayed neutron yield for E SIMTRAN-E, the Doppler A coefficient, and the'ocal peaking 'factors. NORGE-B is used 'to transfer the CASMO-2E data to SIMULATE-'E and'SIMTRAN-E. SIMULATE-E is used to determine the void reactivity and to provide the three-dimensional core data to SIMTRAN-E. SIMTRAN-E is used to develop the delayed neutron fraction and provide input to RETRAN-02 for the determination of the scram 'reactivity. Separate RETRAN-02 cases are run to determine the scram reactivity. 5~3 i 10-10

5.3.10.4

 ~ ~    ~ Licensing. Analysis Process
            ~     ~          ~

The evaluation of each of the five cycle-specific neutronics quantities needed in the current LOCA analysis is discussed below. Future changes in the vendor's,approved LOCA analysis methods, or changes in fuel vendor, could require minor modifications. The Supply System will continue to provide whatever neutronics information is required to interface with the vendor's approved analysis methods. The local peaking factors are calculated as a function of exposure and moderator void fraction using the lattice physics methods. The fuel rod power history data are calculated using the core simulation code. The first step in determining the rod power histories is to do a cycle step through, based on the cross section libraries generated by the lattice physics codes. Following these calculations, the fuel rod power histories are, determined by extracting two-dimensional nodal power and LHGR distributions, and core average and specific assembly axial power shapes, from the core simulation results at each exposure point of the stepthrough. In evaluating the void reactivity the all rods out, end of cycle, conditions are analyzed because the combination of scram, void, and Doppler reactivities is most limiting under those conditions. The " void reactivity is determined as a function of moderator density by running a series of core simulation calculations in which the core pressure and inlet subcooling are changed in combinations that preserve the inlet enthalpy. The resulting reactivities as a function of moderator density. are examined to verify that the Supply System void reactivities are, more negative than those used in the fuel vendor's.LOCA analysis. Results for Cycle 8 are given in the following section. l The Doppler reactivity is obtained as a function of exposure and fuel temperature from the results of pairs of lattice physics calculations at different .fuel temperatures. The results are 5~3 ~ 10-11

examined to verify that the Supply System Doppler reactivity is less negative than that'used in the fuel vendor's LOCA analysis. Results for Cycle 8 are given in the following section. The scram reactivity is calculated by. first condensing the three-dimensional core data for the end of cycle.to one-dimensional data by use of the core neutronic linkage code. The resulting one-dimensional data -is 'used as input:to the transient analysis code. In the transient analysis calculation, the void and Doppler reactivities are set-to zero and a control rod scramis modeled in order to determine the time dependent scram reactivity. The resulting scram rod worths are compared,to the .values used in the fuel vendor's LOCA analysis to verify that..the Supply System worths are greater. Results for Cycle 8 are given in the following section. 'I N 5.3.10.5 LOCA Neutronics Results for Cycle 8 I The current fuel vendor, SPC, in their LOCA analysis (Reference ( 22), does not use best estimate values of Doppler reactivity, void ( reactivity, and.scram -reactivity.: Rather, input values of these ('eactivities are selected to increase the severity of the LOCA and thereby provide bounding results. for its'consequences. Thus, when t'these three cycle-specific'reactivities are evaluated by the Supply System, they are compared by the Supply System to those used by SPC to'ensure that SPC's analysis remains bounding. The Supply System and SPC void reactivities for Cycle 8 are compared on Figure 5.3.10-1. For consistency with SPC, the void reactivities are shown as a function of axial average moderator density with the zero point corresponding to an axial average void ( fraction of 404. The Supply System EOC8 curve is seen to be steeper than the curves for the SPC 8x8 and 9x9 assemblies. Figure 5.3.10-1 shows that the Supply System k-effective decreases with decreasing density (increasing void fraction) more 'rapidly than SPC's. Thus, SPC's analysis remains bounding with respect to void reactivity. 5". 3'. 10-12

The Supply System and SPC Doppler, reactivities for Cycle 8 are compared on Figure 5.3.10-2. For consistency with SPC, k,<< is shown ( as a function of the square root of the fuel temperature (in degrees Rankine), with'the zero point at 1467 R. The Supply System curve is seen to be less steep than SPC's. Thus-, the. Supply System k,<< increases less rapidly with decreasing fuel temperature than that assumed in SPC's bounding LOCA analysis. Thus, SPC's analysis remains bounding with respect to.Doppler, reactivity. I The Supply System'nd SPC scram reactivities for Cycle, 8 are compared on Figure 5.3.10-3. The Supply System rod, worth, is seen ( to be more negative than that used in SPC's bounding LOCA analysis. Thus, SPC's analysis. remains, bounding with respect to scram reactivity. I I 5.3.10.6 Sensitivity Studies/Justification of Process

The LOCA analysis is based on the use of approved fuel supplier methodology, which satisfies the requirements of 10CFR50.46 and 10CFR50 Appendix K. The required conservatism in the LOCA analysis process is based on the .use of. the .10CFR50.46 event acceptance limits and the 10CFR50 Appendix K.model requirements. The. Supply System inputs to the LOCA, analysis are determined consistent, with the approved methodology. No. further sensitivity studies are required.

                                            '
                                                   ) *
                                                           '

V

Page deliberately left blank r I ~ 5 ~ .3'. 1'0-14

Table 5.3.10-1 Sequence of Events for the Loss of Coolant Accident A large break in a recirculation pump suction line assumed to occurs Offsite power is lost. High drywell pressure and reactor low water level reached. Scram initiated. All diesel generators signaled to start. Low pressure core spray diesel generator assumed to fail to start. ECCS signaled to start. Reactor low-low water level reached. MSIVs signaled to close Reactor low-low-low water level reached. MSIVs closed. Diesel generators ready to load and load sequencing begins. HPCS injection valve open and system reaches design flow. ECCS low pressure permissive satisfied. LPCI injection valves open and system reaches design flow.

                                <<5 ~ 3 ~ 10-.15

EOCS LOCA YOID REACTIYITY CQ

0) 3 J3 2

Vl 0 I 6$

0) I, EOC8 SPC 9x9 SPC 8x8

      -3 0.35 0.4           0.45      0.5        0.55    0.6 0.65 Moderator Density (gr/cm3)

Figure 5.3.10-1 Cy LOCA Void Reactivi

EOCS LOCA DOPPLER REACTIVITY IS Ql 1 K 0 h I

   -2 EOC8    SPC 9x9 SPC 8x8
                                          ~ ---"*+------.
   -3 25 30             35           40              45    50. 55 SQRT( Fuel Temp (R)              )

Figure 5.3.10-2 Cycle 8 LOCA Doppler Reactivity

EOCS LOCA SCRAhJI REACTIYlTY 0

-5

~ -10 a$ ~0) -20 ~ -25

)  -30
>  -35 6$

(D CC -40 EOC8 SPC

   -50 0              4            6           8 Distance Inserted (ft)

Figure 5.3.10-3 Cycle 8 LOCA Scram Reactivity

5.3.11

 ~   ~        Shutdown Margin 5.3. 11. 1 Event Description A   shutdown margin         calculation is performed to demonstrate that the core is capable of being made subcritical at all moderator temperatures with adequate margin throughout the operating cycle to account for uncertainties and the effects of a stuck-.control rod.

Shutdown margin is a measure of'the degree to which the core is subcritical under the analyzed conditions. The shutdown margin in the cold condition is analyzed for the reference loading pattern and recalculated for the final loading pattern. These analyses provide assurance that,.the,. shutdown margin demonstration test required by the plant technical specifications will be acceptable. There is no initiating event associated with the shutdown margin analysis. 5.3.11.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and assumptions form the principal bases for the shutdown margin demonstration analysis: c~ (a) The highest worth control rod is. fully withdrawn and all i other contxol rods are fully inserted.

        '(b)      The core is in a xenon free condition.

The moderator temperature is at its most. reactive state 4'1 (c) associated with attaining cold shutdown conditions.

5. 3. 11. 1. 2 Operator Actions There are no operator actions associated with this event because it is an evaluation of plant capability and a demonstration that the plant can attain a safe cold shutdown condition.

5 ~ 3. 11-1

5.3.11.1.3 Event Acceptance Limits The shutdown margin requirement is contained in the plant technical specifications. The criteria used in the analysis process is to ensure that there is sufficient margin incorporated to account for analytical uncertainties and ensure that the shutdown margin demonstration test will be satisfied. In the core design for the reload fuel analysis to satisfy this criteria, the shutdown margin bk is required to be greater than 0.01 k~ (1% of the calculated best estimate cold critical eigenvalue). 5.3.11.2 Analysis Considerations This section describes the key analysis considerations applicable to the shutdown margin demonstration analysis. It includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate to the event consequences. 5.3.11.2.1 Rey Phenomena 7 Core Phenomena Only the core phenomena are, required in the

shutdown margin analysis. The systems effects are treated .as boundary conditions to the core. The important core phenomena are those that affect the core reactivity in the cold shutdown condition. The reactivity components important in the shutdown margin analysis are: (1) the core reactivity, including exposure effects and reflector representation; (2) the control rod reactivity; and (3) moderator temperature. 5 "3 ~ 11-2

5.3.XX,.2.2

 ~ ~     ~ ~   Systems Considerations,,

The shutdown margin analysis is based on the assumption that the plant is in the cold shutdown condition. All systems are assumed to operate as designed for the cold shutdown mode, with the exception that the highest worth rod is ,stuck in the fully withdrawn condition. 5.3.11.2.3 Component Performance Characteristics The shutdown margin analysis, requires modeling of the core and fuel system, including control rods, to ensure that the reactivity effects are properly accounted for. The remainder of the NSSS provides boundary conditions to the core. It tt a F I 5.3.11.3 Methodology/Integration of Codes and Analysis The shutdown margin analysis utilizes the SIMULATE-E three-

dimensional BWR simulator code as the primary analysis code. SIMULATE-E is used to directly calculate the shutdown margin. ,The lattice physics input to SIMULATE-E is provided by CASMO-2E through NORGE-B. The MICBURN-E code is used to determine the gadolina cross sections used in CASMO-2E. The- RODDK-E code, based on SIMULATE-E input, is used for preliminary identification of candidate high worth control rods. ,(See Section 2and Figure 2-1 for an 'overview of the overall WNP-2 reactor, analysis methodology computer code sequence;) '

5.3.11.4 Licensing Analysis Process Calculation of 'the ',shutdown margin -(LR). requires .the .use of SIMULATE-E and RODDK-E and associated cold cross section libraries developed using the lattice physics codes. The use of SIMULATE-E and RODDK in the shutdown margin analysis is described below. Calculation of the shutdown margin requires comparisons of calculated and measured cold critical data to provide estimates of

                               '5  3'11-3

the computational bias and .uncertainty present.. in .,the, core simulation model. Based on the results of these comparisons, two cold critical correlations have been determined. One of these gives k~ a best estimate value of the cold critical eigenvalue (k,<<) as a function of exposure. The other gives a conservative value of. the cold critical k,<< (k ); such that for calculated values of k,<<below k, there is 95% conf idence that the reactor is subcritical. During the 'development of a fuel loading pattern- for- the core, shutdown margin is generally calculated first, for a number of preliminary designs and then for the final design. Most details of the shutdown margin calculation- are 'the same for-preliminary and final designs. The main steps, in the shutdown margin calculation are described below. Figures 5.3.11-1 and 5.3.11-2 are provided as an aid in -understanding the shutdown margin 'calculation. t STEP 1: To begin, a SIMULATE-E hot restart file is-generated for each exposure point in the cycle. This is the only step where the details differ for preliminary and final designs: For' preliminary design, a SIMULATE-E. Haling depletion is first run to the end'f full power life (EOFPL) with the end of cycle (EOC) exposure sele'cted by. the code so the final value of k,<< matches a target eigenvalue.- The local peaking factors and thermal limits 'predicted by the'-code are then checked, and; if they are acceptable, a SIMULATE-E 'everse Haling'epletion is - run to generate a hot restart file at each cycle:exposure point .that is a multiple of 1.0 GWd/MTU from EOC to zero exposure. r For the'inal design', a"set of SIMULATE-E rodded depletions is run starting at the beginning of 'cycle (BOC) and ~ progressing in exposure steps of 0.5 GWd/MTU. At each exposure step--the rod patterns are adjusted u'ntil'he eigenvalue-(k,<<) matches a target eigenvalue and the flux shape and thermal limits are acceptable. When these criteria are satisfied the SIMULATE-E hot restart file 5' 11-4

is saved and the depletion proceeds to the next exposure, point. The process continues until the .EOC is reached. By either of the above methods a set of- SIMULATE-E hot restart files is generated,. for each exposu're point considered.

I'ne The 'remaining steps in the shutdown calculation are performed for each of these exposure points in turn. 2: At each exposure point, two SIMULATE-E full core, cold F'TEP calculations are run, one with'the.control rods in the all rods out (ARO) .position and one with the- rods',in the all rods in,(ARI), position. These calculations use the cold cross section, library, assume a temperature of 68 'F,-and set the xenon, concentration to zero. "

         'In addition', and -for added conservatism, the samarium concentrations are set to "their hot equilibrium values, i.e. no reactivity credit is taken for ',"additional samarium, produced by promethium decay    after shutdown. The two SIMULATE-E runs generate the cold restart 'files for the'RO and ARI cases.

STEP 3: An initial estimate of rod worths is made to identify likely candidates for highest worth rod (HWR). Because the execution of separate SIMULATE-E runs for every rod in the core would require a large amount of effort .and would produce an unwieldy- amount of data, this preliminary,rod worth evaluation is done with the RODDK-E code. RODDK-E reads the SIMULATE;E cold ARO and ARI restart files, calculates an estimate of the reactivity worth of each control rod, and provides 'a list of rods (and corresponding eigenvalues).in .order of decreasing rod worth. STEP 4: The RODDK-E results are examined and one or more candidate HWR's are selected for more accurate. analysis with the, SIMULATE-E code. '.If- RODDK-E identifies;,a 'single., high worth .rod with a 't corresponding k,~ significantly greater than that of the next highest worth rods then, it. may.be appropriate to select only that

rod as the HWR. -'In most cases though, RODDK-E will identify several high worth rods having very similar values of k,ff. Then, all such rods are-selected for further .study. ~ST P 5: A SIMULATE-E full core cold calculation is run for each of the candidate rods selected in the previous step. In each of these calcula'tions,'ll of the. control rods are set to the ARI position except for. the"associated candidate,rod which is fully withdrawn. r STEP 6:..The values of k,ff obtained by SIMULATE-E in the are examined.. The highest eigenvalue- is selected and the previous'tep corresponding withdrawn rod is identified as the true HWR. Because the location "of - the HWR often changes with exposure this

identification of the HWR generally is applicable only to the c'urrent exposure point.

               ~
                 ~

STEP 7: In'his final step, the>>value of the shutdown margin (M) is determined. This quantity'is defined as the difference between the eigenvalue given by kband the SIMULATE-E k,~ value (k ) corresponding to the HWR found in the previous step, i.e.:

            'LUc = kb,  k This 'completes the calculation of- shutdown margin for a,particular exposure point. Steps 2 through 7 are repeated for any remaining points.

Shutdown Mar in Re uirements in Su l S stem Core Desi ns For conservatism, the Supply System requires that the shutdown margin exceed an appropriate minimum value in all situations. The minimum is defined by the simultaneous requirements that: (a) N > (technical specification margin)

k~ and (b)

The first inequality is a requirement contained in the plant technical specifications. The second inequality is a statement 5.'3 ~ 11-6

that shutdown margin would remain greater than zero even if it were defined as k k instead of as kb k . (This alternative definition would provide a 954 confidence, rather than a best estimate, that the reactor is subcritical). In the event that inequality (b) is more demanding than (a), k~ is simply redefined to have an appropriate lower (more conservative) value such that (a) again holds. Thus, shutdown margin is required to exceed the technical specification requirement times kb in all cases. En core design work, it is current Supply System practice to seek loading patterns having an e'ven more conservative 1% shutdown margin, and in those cases LR is required to exceed 0.01 times kb 5.3.11.5 Sensitivity Studies/Justification of Process The Supply System requirement that the shutdown margin satisfy (b) above, has built in conservatism because it is equivalent to defining shutdown margin in terms of k (954 confidence) rather

than kt (best estimate). The use of this more conservative cold critical correlation is believed to bound other uncertainties in the shutdown margin analysis. The correlations k~, and k, are based on comparisons of measured and calculated cold criticals from several cycles at MNP-2. The Supply System will continue to update these correlations as additional cold critical data becomes available.

                                '5'o 3 ~ 1"1-7

Step Cycle Exposure GWD/MT

.'.:'.:.::O'.:::::::. 0.5 1.0::.'.::::Ei:.'.:..::..:

SIMULAT;E:: :.:S.IM V.L'ATE.'.:

'::HOT:::::::::: ::::::::::HOT:':::::::::

Hot Restart

SlMVL'ATE.::.:: :.:SlMQLA'TE:.:::

                             ',COl.':P:.:::. AR'0:                          COVU::.:::A'Rf:.

Cold ARO Cold ARI Restart Restart

3. .::::ROD.D.K:::::::.:

Candidate HW Rods ELEC ONE OR MORE Rod 1 Rod 2 Rod N

                                      . Figure 5;3.11-1 5.3.11-8

Step

.:SIMUNATE:..::..: :.:SIMULATE::.:.:, ::S1MULA',fg:.'..:

5. :::: COED ::::: :::::COLD::::: .:::::: COLD;:::: ':

ARI'-:Rod::1::: ::::: ARI'-.Rod::2:: ::.::: O'Rl'.-'Rod::N::.

DENTIFY k-max and HWR loc. k-max

7. CALC SDM SDM SDM 0

0 0 0 0 Q o 0 'O 0 0.6 1.0 Ei EOC Exposure GWD/MT Figure 5.3.11-2 5.3.11"9

5.3.12

 ~ ~       Standby Liquid Control System Capability

5. 3. 12. 1 Event Description The standby liquid control system capability analysis is performed to demonstrate the ability of the system to perform its design function. The standby liquid control system is designed to insert sufficient negative reactivity to enable the reactor to reach a xenon free shutdown condition from full power operation without movement of the control rods. In the standby liquid control system capability analysis, it is assumed that the control rods remain withdrawn in their full power pattern, and the standby liquid contxol system is manually initiated to provide the negative reactivity, by injection of sodium pentaborate into the core, necessary to enable the cold shutdown condition to be attained.

Following the manual initiation of the standby liquid control system with the plant initially at full power, the power level will begin to decrease as the sodium pentaborate enters the core. The operator is assumed to follow procedures and control the remaining NSSS parameters such that no automatic system trips or system initiations occur. The event is terminated when the cold shutdown condition is reached. For the purposes of this analysis, shutdown is considered to be accomplished when the reactor is subcritical at the most reactive temperature with no xenon present. 5.3.12.1.1 Initial Conditions and Operational Assumptions The following plant operational conditions and assumptions form the principal bases for the shutdown margin demonstration analysis: (a) The plant is at its rated power level and minimum core flow at the most reactive point in the operating cycle. (b) The control rods remain in a pattern consistent with the operating condition. (c) The core is in an equilibrium xenon condition. 5 ~ 3. 12-1

(d) The standby liquid control system is-manually initiated and functions as designed. (e) The reactor shutdown and subsequent cooldown is controlled by operator actions consistent with plant procedures. 5.3.12.1.2 Operator Actions Once the operator determines that shutdown is to be accomplished by the standby liquid control system, the system is. initiated from the main control room. Following system initiation, system opexation

>>

and isolation of the xeactor cleanup system are confirmed. During

                                                                             ~ >>

the shutdown process, the operator monitors power level and the NSSS operating parameters and follows the procedures for 'attaining a cold shutdown condition. l 5.3.12.1.3 Event Acceptance Limits (

     .The  criteria    used   in the standby liquid control system capability analysis process is to ensure that the reactor can attain a cold shutdown, condition without, movement of the control rods.         In the core design for the reload fuel analysis to satisfy this'riteria,
                                         >>

the shutdown margin is required to be greater than 0.01 cR at the most reactive temperature with a boron concentration of 660 ppm in the core.

          '2 '
             >> ~   h
    .5 '          Analysis Considerations
                                                                 >>    >>
                       ~   >>>>

This section describes the key analysis considerations applicable It

                     >>
 ,,to the shutdown margin demonstration analysis.              includes: '(1) a description of the phenomena occurring during the "event'hat have a significant impact on the event consequences;      (2) a discussion of the system.. performance characteristics that can significantly
 ,,   affect the course  >>>>

of the event:; and (3) a discussion of the performance characteristics of the important components's they relate to the event consequences. 5>>3 12'

S.3. 12.2.

  ~ ~    ~ ~ 1  Key Phenomena The standby     liquid control   system         capability is a relatively simple event to analyze because the only conditions of importance are the full power operating condition and the shutdown condition at the temperature of maximum reactivity. The major complexity is in the simulation of the core phenomena and the standby liquid .control system phenomena as       it. impacts      the core phenomena.

Core Phenomena The core phenomena I are" the only ='phenomena that require simulation for the standby liquid control system capability analysis. The phenomena that are of importance in the core region are those that affect the change in reactivity from the full power operating state to the shutdown condition, using sodium pentaborate mixed with, the moderator instead of control'ods as the mechanism for attaining shutdown. The negative reactivity insertion by the standby liquid control system must compensate for the reactivity gains in the transition from the full power to the shutdown condition. The positive reactivity effects to be considered include the elimination-'of steam voids, the reduction in the Doppler reactivity, the reduced neutron leakage from hot to cold, the decrease in control rod worth b as the moderator cools, and the decay of the xenon inventory. The selection of the operating states is important in the analysis. In selecting the full power operating stat'e, the core exposure, control. rod pattern, and core flow are selected to maximize the void reactivity and minimize the control rod inventoiy. In addition, the control rod inventory is'established with the maximum xenon inventory {equilibrium xenon). The shutdown condit'ion 'is established at the most reactive temperature in the range of possible operating conditions between hot'shutdown and the minimum temperature within the capability of the shutdown .cooling system. The sodium pentaborate solution is simulated's uniforml'y mixed with a concentration of 660 ppm.

                                   ,5 ~ 3   ~ 12-3

S stem Phenomena The system effects are treated as, steady state inputs to the specific operating state being evaluated. The mixed sodium pentaborate concentration is used to simulate the operation of the standby liquid control. system. 5.3.12.2.2 Systems Considerations The standby liquid control system capability analysis is based on the assumption that the control. rods. remain in position until the cold shutdown condition is reached. All other systems are assumed to operate as designed. 4 ~ * \ ~'

y
5.3.12.2.3 Component Performance Characteristics

      > 'I ~ , ~

The standby liquid control -system capability analysis requires modeling of the core and fuel system to ensure that the reactivity effects are properly taken into account. The remainder of the NSSS including the standby liquid control system is modeled as steady state inputs. The mixed sodium pentaborate concentration is based on an assumed allowance for imperfect mixing, leakage, and the volume 'of the"recirculation system and shutdown cooling system.

 '                         l 5.3.12.3     Methodology/Integration of             Codes and Analysis.
                                      '

C 'The standby liquid-control system capability analysis utilizes the SIMULATE-E three-dimensional BWR "simulator code- as the primary analysis code. SIMULATE-E is used to. establish the control rod pattern associated with the limiting full power operating condition. This control rod pattern is used at the limiting temperature with the mixed boron concentration to determine the shutdown margin in the xenon free condition. The lattice physics input to SIMULATE-E is provided by CASMO-2E through NORGE-B. The MICBURN-E code is used to determine the gadolinia cross sections used in CASMO-2E and ESCORE provides the fuel temperature distribution in the hot condition. (See Section 2 and Figure 2-1 for an overview of the overall NNP-2 reactor analysis methodology computer code sequence).

                                     ".5: 3 ~ 12-4

5.3.12.4

 ~ ~    ~    Licensing Analysis Process
               ~     ~

Calculation of the,, shutdown margin 'M) requires the use of SXMULATE-E associated hot and cold cross section libraries developed using the lattice physics codes, including the boron libraries for the shutdown analysis. Zn the analysis, a uniform mixture of 660 ppm of boron is assumed in the reactor coolant. Analyses are performed for both the full power at the most reactive exposure point and shutdown condition- at the most reactive. temperature. 5.3.12.5 Sensitivity Studies/Justification of Process I

                                                                ~"
                                                                     )

The use of 660 ppm of boron in the core provides the required conservatism in the. analysis. - The mixing allowance..and the allowance for. dilution provide adequate assurance that the standby liquid control system satisfies its design objective. Table 5.3.12-1 shows various sensitivity studies performed throughout Cycle 4 and the corresponding margin to criticality for 660 ppm boron in terms of N,~.~. The most reactive exposure is at the beginning of Cycle 4. The hot operating rod patterns are the control rod patterns at hot full power critical conditions. The rod patterns on the 1044 rod line are the control rod patterns developed for the lowest recirculation pump speed allowed at full power which was the 1044 rod line. As can be seen the minimum dk,~.; occurs at 560'K at the most reactive exposure in Cycle-4.. f r 5'3. 12-5

( 5.3.12.6 Cycle 8 Results I ( Table 5.3.2.2-2 shows analysis results for Cycle 8. There is no ( direct comparison to vendor results since the vendor does this analysis at 68'F, with all control rods out and a requirement of 34 margin to criticality. However in the Cycle 4 sensitivity ( studies it was found with the Supply System methodology and criteria that the minimum shutdown margin was 1.64 which is only 0.64 above the requirement of 14 LQc margin to criticality. In the same sensitivity studies it was determined that if the vendor criteria was used with the Supply System methods that there was a shutdown margin of 6.14 which is 3.14 above the requirement of 34 ddt margin to criticality. Thus the Supply System methodology and criteria is more stringent than if the Supply System used 68'F and all contro'l rods out-with a -34 margin to criticality. 5 ~ 3..12 6

Table 5.3.12-1 Sensitivity Studies Case Case Cycle Description Exposure (GND/MT) Hot Operating Rod Panem at 293'K 0.2 0.065 Hot Operating Rod Pattern at 42S'K " 0.2 0 '38

'3   Hot Operating Rod Panem at 560'K            0.2  0 ~ 017 Rod Pattern (101% Rod Linc) at 293'K'od 0.2  0.064 Pattern (101% Rod Linc) at 4253C          0.2  0 '37 Rod Pancrn (101% Rod Lme) at 56(pK            0.'2 0.016 All Coatrol  Rods Out at 29%C              0.2  0.061 Hot Operating Rod Panern at 560K             1'   0 '16 Rod Panem (101% Rod Line) at 293'K            1.3  0.067 10  Rod Pattern (101% Rod Linc) at 42$ 'K         1.3  0. 038 Rod Pattern (101% Rod Linc) at 560K           1.3  0.016 12      All Coatrol Rods out at 293'K             1.3  0.065 13   Hot Operating Rod Panem at 293'K            2.8   0.073 14   Hot Operating Rod Pancrn at 425'K           2.8   0 '42 Hot Opcratmg Rod Pattern at 560K            2.8   0.018 AU Coatrol Rods out at 293'K              2.8   0. 069 17     All Coatrol  Rods out at 293'K            6.0   0.086 18     All Coatrol  Rods out at 560K             6.0   0. 027
                           "    5 ~ 3. 12-7

Table -5.3.12-2. Cycle 8 Results Depl. (GWD/MT) 0.0 0.020 1.0 0. 018 5.1 0.023 5 ' '2-8

5.3.13

 ~ ~      ASME Code  Overpressure,Protection    Analysis 5.3.13.1     Event Description The    pressure     relief   system   is designed    to   prevent over-pressurization of the primary reactor coolant pressure boundary.

The Code overpressure protection analysis is performed to demonstrate compliance with .the ASME Code [Reference 18]. Pressure relief is accomplished by the opening of ASME Code qualified safety/relief valves. The vessel overpressure protection system for.WNP-2 is designed to satisfy the requirement of Section III, "Nuclear Vessels," of the ASME Code. The ASME Code, Section III, permits the reactor pressure vessel and reactor coolant pressure boundary to exceed their design pressures in a pressurization event based on the frequency of occurrence. The code requires that the lowest qualified safety/relief valve setpoint be at or below the vessel design pressure. Section III also allows credit to be taken for the reactor protection system and reactor scram as a pressure protection device when determining the required safety valve capacities for nuclear vessels. The following pressure limits are applied consistent with the ASME Code requirements: (a) Under upset conditions, the reactor pressure is not to exceed 1104 of design pressure. (b) Under emergency conditions, the reactor pressure is not to exceed 1204 of design pressure. (c) Under faulted conditions, the reactor pressure is not to exceed 1504 of design pressure. Based upon the ASME Code requirements, NRC regulations, and WNP-2 licensing commitments, a conservative approach to the overpressure protection analysis has been adopted. In this approach, the most severe pressurization event is analyzed and the results are compared to the ASME Code upset limits. The event definition includes the failure of any direct scram signal associated with the event initiator. Based on the current safety analysis, the most

severe pressurization event-is. the closure=of all main steam line isolation valves (MSIV) with a high neutron flux scram (i.e., MSIV position switch scram disabled). This, consexvative approach is used for the WNP-2 analysis. Event occurrence probabilities suggest that it would be moxe'ppropriate to compare the ASME emergency or faulted limits to the pressurization consequences of a closure of all MSIVs with a failure of the direct MSIV position switch scram. I ~ Closure of all MSIVs causes a rapid reduction in steam flow which results in a system pxessure increase. Neutron flux increases S rapidly because of the core moderator void reduction caused by the pressure incr'ease. The pressure increase is limited by opening of the safety/relief valves and the reactor scram that is initiated by the average power range monitor (APRM) high neutron- flux signal. Table 5.3.13-1 shows the expected sequence of events for-the .Code overpressure protection analysis transient .initiated by MSIV closure. 5.3.13.1.1 Initial Conditions and Operational Assumptions' The following plant opexational conditions and assumptions form the principal bases for the Code ovexpressure protection analysis: 4 5* (a), The plant is operating at the safety analysis power 'level and 1064 rated core flow.'

(b) The remaining NSSS operating parameters are consistent with normal plant operation.

(c) All- MSIVs close at the fastest, rate identified in the technical specifications.

(d) A reactor scram is initiated only by high neutron"flux. No credit is taken for the scram 'signal. generated by MSIV position switches. (e) Safety relief valves are available -to limit the pressure increase. However, the six safety/relief valves with the lowest safety setpoints are assumed to be out of service; I 0 ~

                                 " S.3 13-2

only the safety mode is~ available for opening of the remaining valves. (f) All of the remaining plant control systems function normally. (g) The system trips and initiation signals are consistent with the technical specifications. 5.3. 13. 1. 2 Operator Actions I This event is analyzed to demonstrate compliance to the overpressure protection requirements of the ASME Code. The peak pressure conditions are limited only by systems that initiate automatically. Operator. actions are not considered. 5.3.13.1.3 Event Acceptance Limits The acceptance limits for this event are based on the ASME Pressure Vessel Code, Section III. As discussed above in Section 5.3.13-1, the Supply Syst: em a pplies the more conservative upset condition limit (110'f desig n pressure, or 1375 psig) to the peak reactor vessel pressure. l 5.3.- 13.2 Analysis Considerations This section describes the key analysis considerations applicable to the Code overprotection analysis event. Xt includes: (1) a description of the phenomena occurring during the event that have a significant impact on the event consequences; (2) a discussion of the system performance characteristics that can significantly affect the course of the event; and (3) a discussion of the performance characteristics of the important components as they relate.to the event consequences. I h

~ +

5. 3. 13. 2. 1 Key Phenomena Described below are the key phenomena related to the ASME Code overpressure protection analysis event. ~ Consideration of these

                                '5" 3 ~ 13-3

phenomena is =.necessary., in. the simulation.. of this event to accurately model the plant response. The Code overpressure protection event involves the reactor core, the -entire reactor coolant pressure boundary, and the associated valves and discharge piping. The event is characterized by rapidly changing conditions with- complex interactions. Because scram is delayed, this is one of the most dynamic events considered in the safety analysis. Steam Line Phenomena" The event begins .with the rapid closure of all MSIUs which causes a pressure increase in the steam syst: em that is*rapidly transmitted to the reactor,. pressure vessel .by pressure wave phenomena in the steam lines. The relief valves open at pre-established setpoints allowing.a steam release path for pressure relief. Nodalization of the steam lines, up to and including the MSlVs, is sufficient to .ensure simulation of the system pressure The .nodalization of the downstream piping and the response. , turbine control valves is adequate to simulate the control valve and MSXV interactions; Extensive nodalization studies, for the steam'lines are performed and=shown in. the attachment to.Reference e Pressure Vessel Phenomena The propagation of the pressure wave from the steam lines to the core is an -important phenomenon.. The attenuation of the pressure wave by the steam separators is a 'particularly important .phenomenon" in modeling the timing of the core moderator void changes. r Recirculation Phenomena During the initial phase of the event,. the recirculation .phenomena are,-dominated :by the rapidly, changing conditions in the core and reactor pressure vessel. .Zn,.the .manual flow control mode, the recirculation valve position is held constant. '.The'increase.,in vessel. pressure during the, event.may,be suffici'ent to .initiate a high pressure trip of the recirculation pumps (RPT); Following the RPT, the recirculation pumps will coast down reducing the recirculation flow and core inlet flow. i,5 ~ 3 13-4

~ i

Modeling of the recirculation flow phenomena is important to ensure that the changing recirculation flow is correctly calculated. The recirculation system modeling includes consideration of the downcomer phenomena, including the annular flow region above and through the jet pumps. The changing performance of the jet pumps at varying pressure and drive flow is included. The external recirculation loop flow is represented so that flow into the vessel as a 'function of time is accurately simulated., Core Phenomena The phenomena important in the core region are the reactivity effects that contribute to changes in neutron flux level and hence energy generation and power input tothe coolant. The primary reactivity feedback effects are steam void reactivity, fuel temperature Doppler reactivity, and control rod reactivity. The steam void reactivity contributes to the initial positive reactivity as a result of steam void collapse as the pressure increase from the steam system reaches the core. The collapsing moderator voids cause an increase in power level which in turn increases fuel temperature and moderator voids to the point that power would reach a new level. With steam flow restricted (unless scram is initiated) pressure and core power level would continue to rise. A rapid scram of control rods limits the magnitude of the transient pressure and power levels. 5.3.13.2.2 Systems Considerations For the ASME Code Overpressure Protection analysis, the initiating event is the action that causes full closure of all MSIVs. MSIV position scram is not assumed to occur and ASME Code qualified setpoints are used for the safety/relief valves. All other safety systems that respond are assumed'o function as, designed and to actuate at their pre-established setpoints. The important systems to be considered are:.- (1) the reactor protection system including the APRM high neutron flux scram; (2) the control rod drive (scram) system; (3) the steam system

including MSIVs, control valves and safety/relief valves; (4) the recirculation system, including the RPT; (5) the steam separation system inside the vessel; (6) the feedwater system; and (7) the fuel and core system, including the nuclear/thermal hydraulic coupling; Because this analysis is directed toward establishing peak vessel pressure, no other systems .are assumed to operate. 5.3.13.2.3 Component Performance Characteristics The, Code overpressure protection analysis requires detailed modeling of the NSSS in order to ensure that all systems that influence reactor system pressure, steam flow, core flow, and core inlet enthalpy are properly considered. The selection of licensing basis component performance characteristics is based on a buildup of conservative assumptions, established by ,past practices and -licensing requirements. MSIV Closure Characteristics The main steam isolation valve closing characteristics are fundamental to the analysis because the MSIVs initiate the event by rapidly stopping steam flow from the vessel. The MSIVs are designed to have an adjustable closure time within specified limits and the allowable range is controlled by the. technical specifications. Because. this event is a pressurization event, the fastest closure time in the technical specifications is used in the analysis to ensure a conservative I result.

~
  'a et Relief Valve Set pints The safety/relief valves are used to protect the reactor coolant pressure boundary against overpressure events.. The technical specifications for the ASME Code qualified mode establish-,limiting conditions for the .safety/relief valve setpoints. The maximum values, are used in the analysis in order to ensure conservative evaluation of the system pressure response.

Only the self-actuated (spring) function. of the safety/relief valves is provided for in the analysis. The pressure drop on both the inlet and discharge sides of the valves is accounted for. 5 ~ 3 ~ 13-,6

Further conservatism is obtained by assuming. the six SRVs with lowest setpoints are out of service.

f Recirculation Pum Coastdown Characteristics - The RPT on high reactor pressure is simulated. The slowest pump coastdown consistent with design specifications is used in the analysis. In addition, the maximum instrumentation and signal processing delay time's are used in the analysis. Feedwater Controls The nominal feedwater control response time:is used in the analysis; WNP-2'as ste'am turbine driven; feedwater pumps and closure of the MSIVs isolates'heir steam. supply..

                                                                             'The coastdown of the'feedwater system is simulated-following isolation.

Neutron Flux

                !'PRM Tri       It is  assumed     that the  APRM  high neutron flux trip provides the signal to the reactor protection system which, in turn, initiates a reactor scram.                    This setpoint is controlled by the plant technical specifications                and  the  maximum allowable value is used in the analysis.

Reactor Protection S stem Si nal Dela s The reactor protection system includes the'collection of a number of analog and digital signals, conditioning of'hese signals, -comparison '.to pre-established setpoint limits and activation of nuclear system trips: The 'signal processing and -trip initiation involves delay times which impact transient response. The plant technical specifications identify the allowable reactor protection system response times.

          'h              !.

1 Control Rod Drive Insertion Time -The control -rod drive system provides the primary mechanism for negative reactivity insertion for terminating the transient.-'he control rod dri'ves are inserted

  ~                     *!."'.'

in the scram mode by the scram hydraulic control system. .The scram time for the control rods is based: on'he'scram time specified'in the technical specifications,!"(e.g., te'chnical specification scram time)-. 5 3 ~

13-7

5.3.13.3 Methodology/Integration of Codes and Analysis The primary model used in the simulation of the event is RETRAN-02. RETRAN-02 is used to calculate the changes in system and core average nuclear and thermal hydraulic parameters throughout the event. The RETRAN-02 analysis results are used in the assessment of peak reactor vessel pressure. The analysis of the Code overpressure protection analysis is performed using the following.codes in the sequence shown on Figure 2-1: {1). ESCORE; (2) MICBURN-E( (3) CASMO-2E( (4) NORGE-B( (5) SIMULATE-E; (6) SIMTRAN-E; {7) STRODE; and (8) RETRAN-02. ESCORE is used to provide the -fuel rod temperature distribution used in CASMO-2E . MICBURN-E pr'ovides the gadolinia cross sections used in CASMO-2E. CASMO-2E is used to perform the lattice physics analysis to generate the cross sections for SIMULATE-E and the inverse neutron velocity and total effective delayed neutron yield for SIMTRAN-E. NORGE-B is used to transfer the CASMO-2E data to SIMULATE-E and SIMTRAN-E. SIMULATE-E develops the three-dimensional macroscopic cross section data to be processed by SIMTRAN-E. SIMTRAN-E collapses the three-dimensional cross section data to one dimension and transfers the other nuclear parameters to RETRAN-02. STRODE is used to adjust the moderator density feedback behavior and delayed neutron fraction data for input to RETRAN-02. RETRAN-02 is used to perform the transient analysis. 5.3.13.4 Licensing Analysis Process In the Code overpressure protection analysis, the following conditions are applied. (a) The analysis is performed at the most limiting point. on the power/flow operating map, consistent with the

>>

licensing basis assumption on maximum power level (i.e., safety analysis power level, 1064 core flow). (b) The Technical Specification scram times are'used. (c) Scram time delay is the maximum technical specification value.

                              '5 ~ 3 13 8

(d) RFT time delay value.

                           's   the maximum,-technical specification (e) The  six safety/relief valves -with the lowest opening setpoints are assumed to be inoperable. Safety/relief valve opening'etpoints are consistent with the self-actuated (spring) operation mode.

The analysis is performed at end of cycle conditions

'f)

(g) The fastest MSZV closing time identified in the technical specifications is used in the analysis. Events caused by low reactor water level trip'etpoints,including ECCS initiation, are not included in the simulation. These events, should they occur, will be later than the time of 'challenge'or the time of nearest approach 'to the'vent acceptance limits. 5.3.13.5 Sensitivity Studies/Justification of Process The event definition, which assumes that the first scram initiation signal encountered is inoperable, provides a substantial amount of conservatism in the analysis process. Further, the ASME 'Code incorporates additional margin in establishing the limits used in the analysis process. Even further conservatism is incorporated by the use of upset events limits, -rather than the more appropriate emergency or faulted limits, for'n event of .the probability

analyzed. No further sensitivity studies are. required..

5. 3. 13. 6 Typical Results From the method described in Section 5.3.13.4, an analysis of the main steam isolation valve closure (MSXVC) transient was performed for Cycle 8 for Technical Specification scram "speed. with>> RFT-.

Plots 'of 'core power; core average, heat flux, core inlet flow, reactor vessel steam dome pressure',. vessel'team flow, reactor

                                        ~ II vessel water level, and. feedwater flow are provided on Figures 5.3.13-1 through 5.3.13-7. For this event, the figure of merit for the analysis is peak reactor vessel pressure. The peak calculated pressure is 1313 psig, which is below the limit of 1375 psig.
                             '.3,. 13-9

A comparison of the Supply- System and fuel supplier (SPC)

overpressure protection . analysis results is provided in Table 5.3.13-2. The Supply 'System .result is more conservative with respect to the event limit. 0 5 '.3. ~ 1.3-10

Table 5.3 '3-1 Sequence of Events for the Code Overpressure Protection Analysis Time Secs Events 0.0 Closure of all NSIVs Begin. 1.84 Scram Initiated on High Neutron Flux. 2.71 Group 3 safety/relief valves actuated. 2.83 Group 4 safety/relief valves actuated. 2.89 Group 5 safety/relief valves actuated. 3.00 All MSIVs.are fully closed. 3.30 Recirculation pumps trip on high reactor vessel pressure. 4.30 Peak reactor vessel pressure is reached.

5. 3. 13-11

Table 5.3 13-2

Results of Code Overpressure Protection Analysis Supply Syst: em Fuel Supplier Results Results Peak Neutron Flux (% rated) 426 295 Peak Heat Flux (4 rated) 138 129 t Peak Reactor Vessel Pressure (psia) 1328 1303 5 3 ~ 13-12

WNP-2 EOC8 MSlVC 500 400 K a 300 ~O PL e 200 0 U 100 0 0 2 3 4 Time (sec) Figure 5.3.13-1 MSlV Closure Results, RPT, TSSS

WNP-2 EOC8 MSlVC ., 150 ioo CC 03 ~O X U cU z6) 50 0 0 2 3 Time (sec) Figure 5.3.13-2 MSIV Closure Results, RPT, TSSS

WNP-2 EOCS MSlVC 120 100 K Vl z CQ GJ o> 80 I Vl 0 LL 60 Core Inlet Flow 40 0 2 3 4 Time (sec) Figure 5.3.13-3 MSIV Closure Results, RPT, TSSS

                                  .*   -  WNP-2 EOC8  Mslvc 1,400 Lower Plenum Pressure 1,350 Steam Dome Pressure 1,300 1,250 O.

1,200 1,150 1, I 00 1,050 1,000 0 2 3 4 Time (sec) Figure 5.3.13-4 MSlV Closure Results, RPT, TSSS

III WNP-2 EOC8 MSlVC 125 Vessel Steam Flow Relief Valve Flow 100 CC Q3 z 75 gO U E so (0 k 25 0 0 2 3 4 Time (sec) -. Figure 5.3.13-5 MSIV Closure Results, RPT, TSSS

V/NP-2 EOC8 MSlVC- -- 50 40 C ) 30 6) g 20 6) 10 0 0 2 3 Time (sec) Figure 5.3.13-6 MSlV Closure Results, RPT, TSSS

WNP-2 EOC8 MSlVC 125 100 CC lQ o 75 0 U 0) 50 U 0) U 25 0 0 2 3 4 Time (sec) Figure 5.3.13-7 MSIV Closure Results, RPT, TSSS

( 5 ~ 3. 14

     ~      Stability
                 ~ ~

5.3. 14. 1 Event Description Three general types of stability are considered in the design and analysis of BWR systems: I o Stability of the entire reactor system in response to changes in system pressure, flow, and water level as determined by the coupled response of the overall plant dynamics and the turbine and reactor contxol systems (total plant stability). r o Stability of the reactor core in response to changes in core flow, subcooling or pressure, including nuclear feedback effects from changes in core voids and fuel temperature (core stability). Thermo-hydrodynamic stability of individual fuel channels at various power and flow conditions due to perturbations in flow or channel boundary conditions, independent of reactor system controls or nuclear feedback (channel hydrodynamic stability). Of these three types of stability, only the core and channel stability evaluations are of importance in the reload fuel analysis process. The total plant stability was demonstrated during the plant startup test program, and the introduction of reload fuel does not significantly change the overall plant dynamics and control system performance. The potential for encountering instabilities in a BWR varies with the plant operating condition. Acceptable plant performance with respect to plant stability is to be demonstrated over the allowable operational regions of the power/flow map. Stability margin decreases in the low flow and high power regions of the power/flow map. This is the operating region of the power/flow map that is the subject of stability evaluations in the reload fuel analysis 5~3 14-1

process. Because stability - is associated with perturbations (noise) encountered during normal plant operation, no particular initiating event is associated with the stability evaluations. 5.3.14.1.1 Xnitial Conditions and Operational Assumptions The following operational conditions and assumptions form the principal'ases for core'- and channel hydrodynamic stability evaluations. (a) The reactor is operating at a high power level and low core flow 'rate within the all'owable power/flow operating map. (b) A" perturbation in the operating state occurs. 5.3.14.1.2 Operator Actions There are no operator actions associated with the evaluation of this event because it

is a demonstration of the acceptability of the allowable regions in the power/flow map. Should the plant 0 encounter an 'instability,. the 'operator would be expected to take the actions identified in -the p'lant technical specifications .and operating procedures.

                      ~,
                                                    'I 1F  ~

5.3.14.1.3 Event Acceptance Limits The -acceptance limit for this

=-

evaluation is that, within the allowable region of the power/flow map identified in the plant technical specifications, no power oscillations that could result )in SAFDLs being exceeded are predicted to occur, or that any such oscillations could be detected readily and suppressed. 5.3.14.2 Evaluation Considerations II

 'This section describes the key evaluation considerations applicable to the stability. Xt includes: (1) a description of the phenomena occurring during the event that have a significant impact on the 5 ~ 3.-14-2

event consequences; (2) 'a discussion of the system performance characteristics that can significantly affect, the course of the event; and (3) a discussion of the performance characteristics of the important, components as they relate to the event consequences. 5.3.14.2.1 Key Phenomena Only the core and channel. hydrodynamic phenomena are. important in the evaluation of the stability phenomena. This=section describes these phenomena as they relate to stability evaluations. Co e Phenomena The important core phenomena associated with stability are the fuel time constant, the rate at which voids are removed from the core; (void sweep, time), reactor kinetics parameters, core inlet subcooling, radial and axial power profiles and peaking factors. The closed loop neutron flux frequency response exhibits a resonance whose frequency is related to the void-sweep-time/fuel-time-constant relationship and the 'void reactivity. The core thermal power exhibits a resonance. at, the same frequency, but the magnitude is much less due to the attenuation from the fuel time constant. For a given.,fuel design,

 'the most significant effects, on the core stability.are due to the change in void sweep time with the state of the core and .a, more negative void reactivity with fuel exposure. Fuel design changes that increase the gap conductance and heat transfer. area can also have a significant effect on core stability. These changes cause a decrease in phase and gain margins,,and .consequently,                tend to destabilize the system.

4 I . Channel H drod namic Phenomena; . The predominant . type of. hydrodynamic 'instability. that, can, occur. in a,BWR channel is one which arises from a dependency of the vapor volume production rate upon the flow rate as a result of momentum, "mass,- and energy conservation. Void volume depends on mass flow rate because of energy and mass conservation; . however, mass flow rate simultaneously depends on void volume because of momentum , n

5 ~ '3.o 14 3

conservation. Channel stability is sensitive to the axial power V distribution and channel pressure drop characteristics. 5.3.14.2.2 Systems Considerations The plant system performance characteristics are not included in the core and channel stability evaluation for each reload. These parameters do not change from cycle-to cycle. 5.3.14.2.3 -Component Performance Characteristics The only component performance characteristic of importance in the stability evaluation is the fuel design and its relationship to the core design and rod patterns. Changes in .the fuel design as they impact the key phenomena can have a significant effect on the core stability evaluation. 5.3.14.3 Methodology/Integration of Codes and Analysis The plant technical specifications contain requirements that restrict plant operation to certain regions within the power/flow map. The restrictions, are consistent with the General Electric Company recommendations contained in Service Information Letter ( (SIL) 380, with the NRC recommendations contained in NRC Bulletin 88-07 and Bulletin 88-07, Supplement 1, and with current recommendations of the BWR Owner's Group. ( The fuel vendor's NRC-approved analysis methods are used to evaluate decay ratios at selected operational points on the power/flow map. Recommendations of the BWR Owners Group Committees on Stability and Reactivity Control, and subsequent NRC guidelines, will be followed in updating the exclusion regions within the power-flow map. 5, ~ 3, ~ 14-4

5.3.14.4

 ~ ~  ~   Licensing Evaluation Procedure
            ~    ~

For each new reload design, decay ratios are evaluated by the fuel vendor's approved analysis methods at selected operational poin ts on the power/flow map. The requirement that the calculated dec ay ratios be suffi:ciently 'ow is intended to ensure that he t boundaries of the allowable operating region,'are .defined so th at. core wide or regional oscillations either cannot .occur, duri ng operation in the allowable part of the power/flow map, or that a ny such oscillations can be dete'cted-readily and suppressed. I 5.3.14.5 Sensitivity Studies/Justification of Procedure Each cycle, sensitivity studies will be performed to ensure that I the allowable operating region of the power-.flow map. has been I conservatively defined. I 5.3.14.6

 ~ ~  ~   Typical Results
              ~

Analysis results and 'ensitivity'tudies results, for each new reload will be documented to demonstrate" compliance with, the technical specifications. I V I' ~ 5 '.14-5

C 'C N Nf N II ' IN N II I'I

SECTION 6 ' DOCUMENTATION REQUIREMENTS The Supply Syst: em must appropriately document operating limits and other technical specifications that may change during the lifetime of the reactor. This section describes that documentation. 6~1 RELOAD

SUMMARY

REPORT The. reload summary report documents the results of the analyses of the potentially limiting events. These events are summarized in Table 5.2-1. Table 6-1 p'rovides an outline for reload summary reports. This outline may be updated as required to reflect changes in NRC requirements. 6e'2 CORE OPERATING LIMITS REPORT The NRC has granted the Supply System approval to use a core operating limits report (COLR) to specify most cycle-specific fuel and core operating limits for plant operation. (See NRC Generic Letter 88-16, "Removal of Cycle-Specific Parameter Limits from Technical Specifications.") The NRC has established three requirements: I 0 the addit ion of a named report, t he COLR, that lists the values of the cycle-specific parameter limits that, have been established using an NRC-approved methodology; these values must be consistent with all applicable safety analysis limits the addition of an administrative reporting requirement to submit the COLR to the NRC the modification of individual technical specifications to note that cycle-specific parameters are to be maintained within the limits specified in the COLR, and that the COLR must identify approved reports that describe the development of the cycle-specif ic limits. 6-1

( The Supply System COLR specifies operating limits for the MAPLHGR, MCPR, and LHGR. 6 ' TECHNICAL SPECIFICATIQNS The safety limit minimum critical power ratio (SLMCPR) and many instrument setpoints remain in-t:he technical specifications,. The SLMCPR may change from one operating cycle to the next. Setpoints in the technical specifications could also change.

The "reload summary report will identify any changes made to the SLMCPR or to instrument setpoints; it'ill also document the analyses that provide the bases for these changes. The Supply System will then seek any necessary amendments to technical specifications.

s ~

                                  '6 2

                             'able   6-1 Outline of the Reload    8ummary Report 1.0 Xntroduction Describes the cycle this reload analysis is for, the types of fuel assembly designs in this core loading, and any distinguishing characteristics of the cycle.

2.0 Fuel Mechanical Design'nalyst;s l References applicable fuel vendor design reports for fuels resident in the core in this cycle. Compares expected power histories for the fuel designs .with power histories in the vendor fuel mechanical design. analyses.a 3.0 Thermal-Hydrauli'c Analysis 3.1 Fuel Centerline Temperature Lists all fuel vendor references for the LHGR associated with the fuel centerline melting point. Provides evidence of the margin to centerline melting. 3.2 Bypass Flow Provides the bypass flow for the maximum rod line at maximum flow. 3.3 NCPR Fuel Cladding integrity Safety Limit Lists the core power, core inlet enthalpy, steam dome pressure, feedwater temperature, and design basis radial and local power di'stributions.

Table 6-1 (Continued) Outline of the Reload Summary Report 4.0 Nuclear Design Analysis 4.1 Fuel Assembly Nuclear Design Lists the average enrichment, radial and axial enrichment distributions, burnable absorber rods, non-fueled rods, and neutronic design parameters for each new assembly design in the cycle. 4 ' Coxe Nuclear. -Design,. Describes the core loading, pattern. Lists the core exposure at the end of the previous cycle, the core exposure *at the beginning of this cycle, and the core exposure at the end of this cycle. Also lists the following core reactivity characteristics: o beginning-of-cycle cold target k,, o beginning-of-cycle cold k,~~, with all control rods

out o beginning-of-cycle cold k,~ , with the strongest control rod out 0 reactivity defect (R-value) in terms of LUc 0 dJc for the standby liquid control system at 660 ppm boron o decay ratio (to define regions of decreased stability). 5.0 Anticipated Operational Occurrence Analyses 5.1 Anticipated Operational Occurrences at Increased Core Plow Conditions Lists the limiting transients at increased core flow conditions and indicates where on the power flow map the transients are initiated. Evaluates transients at increased flow conditions relative to design conditions. Discusses assumptions made fox specific transients (i.e. RPT in service or out of service, scram speed, exposure conditions, and final feedwater temperatuxe reduction ). Tabulates events, power and flow conditions, maximum heat flux, maximum power, maximum pressure, and bCPR for the various fuel types.

                                '= 6-4

Table 6-1 (Continued) Outline of the Reload Summary Report 5.2 Reduced Flow Operation Lists the limiting transients at reduced flow conditions and indicates where on the power flow map the tra'nsients are initiated unless transients, listed under 5.1 are bounding. Tabulates the results for these transients as

   'in 5;1.' Provides 'the reduced. flow, MCPR operating limit.

r 5.3 Power and Single Loop Operation I'educed Lists and tabulates any transients that are more severe at reduced power than at full power. Provides a reduced power MCPR operating limit. Lists and tabulates transients for single;- loop operation and gives the corresponding MCPR operating limits.and MAPLHGR limits. 4 j 4 5.4 ASME Overpressurization Evaluation Discusses the limiting event, the worst single failure, F maximum vessel pressure, and steam dome pressure. 5.5 Control Rod Withdrawal Error Illustrates the initial control rod pattern for the control rod,withdrawal error analysis. Tabulates the RBM setting, the distance the rod is withdrawn, and the corresponding limiting dCPR. 5.6 Determination of Thermal Margins f 4 4 Presents a summary of MCPR operating limits. for each fuel h type over various exposure ranges of the cycle. 65

Table 6-1. (Continued) Outline of the Reload Summary Report 6.0 Postulated Accidents 6.1 Loss-of-Coolant Accident

        'Presents the results of vendor analyses of peak clad temperature and peak local metal-water reaction for each fuel type given the Supply System local peaking factors, fuel rod power- histories, void coefficient, Doppler coefficient,  and time-dependent   scram reactivity.

6.2 Control:Rod Drop Accident 1 presents the." results of ;vendor analyses of maximum deposited fuel- rod enthalpy given Supply System results for maximum control rod worths, four-assembly local peaking factors, Doppler coefficient, and delayed neutron fraction.. 6.3 Fuel Loading Error Lists the bCPR for the worst errors in locating and/or rotating fuel assemblies. 6.4 Fuel Handling Accident Lists the radiological consequences of a fuel handling accident (FHA) in terms of whole body dose and thyroid dose for every fuel design in the core. This data will come from fuel design analyses performed by the fuel vendor.

                              ,, 6-6

Table 6-1 (Continued) Outline of the Reload Summary Report 7.0 Technical Specifications 7.1 Limits Presents the SLMCPR and the-steam dome pressure safety limit. 7 ' Limiting Conditions for Operation J the following limiting conditions for operation:

                                'ists o    APLHGR limits versus exposure'for each fuel type o    MCPR limits for. each fuel type for given exposure ranges and off-normal 'conditions o    LHGR'imits versus exposure for" each fuel type o     Surveillance requirements,'f- required, for scram insertion time 'and *stability.

8.0 References Lists all items referenced in the. summary report. 6-7

~ '

I v 4 ~ a, v ~ III i 4 II

SECTION 7 ' LOADING PATTERNS The reload analysis must be completed long enough before fuel reloading begins to allow time for manufacturing fuel and meeting safety analysis requirements. The analysis schedule requires making some assumptions about what the core characteristics will be at the end of the current cycle so that work can begin on a reference loading pattern for the new cycle. The .core characteristics at the end of the cycle may differ, however, from the characteristics postulated during the reload analysis. If the difference is large enough, some parameters in the safety analysis will need to be rechecked. If the differences require deviation from the reference loading pattern, additional parameters will also need to be checked. 7.1 CHANGES IN REFERENCE LOADING PATTERN The following parameters must be checked if the core characteristics at the end of cycle differ significantly from the postulated characteristics and/or if the actual loading pattern deviates from the reference loading pattern. 7.1.1 End-of-Cycle Exposure and Axial Exposure Distribution The reference loading pattern assumes a certain core average exposure and axial exposure distribution at the end of the current operating cycle. Either of the following requires evaluation to determine the impact on the event, analyses: any deviation beyond specified maximum and minimum core average exposure values assumed for the reference loading pattern any significant deviation from the assumed axial exposure distributions used in these evaluations. 7 1

7.1.2 Number and Location of .Reload Fuel Assemblies The reference loading pattern specifies the number and location of ) fresh fuel, assemblies in each reload. Any change in number or ) change in location requires re-examination of the reload analyses. If the number of fresh assemblies is decreased, the reductions may be made only in peripheral, control-rod-centered, four-fuel-assembly cells. Furthermore, the number of fresh fuel assemblies eliminated may not exceed 104 of the reload batch or 2> of the total core, whichever is smaller. Failing to meet this criterion requires a re-examination of the reload analyses. 7.1.3 Type, Number, and Location of Exposed Fuel Assemblies The reference loading pattern specifies the type, number, and location of exposed assemblies in the reload. Fuel assemblies of a different type may be substituted as long as they are less reactive. Any changes in the placement of fuel assemblies should be in the regions of least importance, and replacements should match as closely as possible the exposure and exposure history of the assemblies they are replacing. 7' RE EXAMZNATZON OF A RELOAD ANALYSZS Re-examination of a reload analysis requires re-evaluating the following: 0 scram reactivity 0 void reactivity shutdown margin 0 generic parameters for a rod drop accident 0 misloaded fuel assembly hCPR 0 RBM response for a control rod withdrawal error 0 limiting parameters for core-wide transients These parameters are of primary importance in establishing a core operating limit or in determining the consequences of an analyzed 7 2

event. Other parameters affected by the core loading pattern are less significant and are covered by conservatism in the analysis process. 7-3

SECTION 8 ' CONCLUSIONS This applications topical xeport describes the Supply System xeload analysis methodology. This methodology, when integrated with the reload fuel supplier methodology, can perform all tasks and evaluations required for the reload analysis. The reload summary report submitted at the end of each reload analysis will ensure that all requirements have been met. This report specifically documents the following:-

1. The Supply System xeload analysis methodology uses conservative methods that ensure successful reload fuel designs and'ore configurations.

2. The spectrum of events considered in the reload analysis will be consistent with current regulatory requirements and with current industry practice.

3. The event limits used in the reload analysis will be conservative.

4. Each of the codes used in the reload analysis can pex'form the required function; the integrated set of codes can perfoxm the event analyses and provide the data required by the fuel supplier.

5. The Supply System methodology will ensure thermal-hydraulic and nuclear compatibility between the resident fuel and reload fuel assemblies.

6. The Supply System input to the fuel vendor critical heat flux methodology will establish a conservative MCPR that ensures fuel cladding integrity 'in the event of an anticipated opexational occurrence or a fuel loading error.

8-1

7. The Supply System evaluation of PAFF limits provided by the fuel supplier will ensure fuel integrity.

8. The reload analyses will identify any necessary changes in core operating limits .and technical specifications.

9. Startup physics testing will confirm the suitability of the fuel loading pattern.

10..The reload summary -reports will satisfy all documentation requirements,specifiedin 10CFR50.59. This report documents that the Supply 'System reload analysis methodology will provide conservative reload fuel designs and core configurations that. ensure the safety of. the facility and the surrounding community. c N 1

                                  ~8 2 4

REFERENCES'

 ~   J.M. Sorensen      et al., The Reactor Anal sis Su ort Packa e RASP    Volume 1: Introduction and Overview, EPRX., NP.-4498 Volume 1, Electric Power Research Institute, April 1986.

2 ~ D.B. Jones, ARMP-02 Documentation. Part II Cha ter" 7 MICBURN-E Com uter Code Manual, NP-4547-CCM,. Volumes 1 to 3, Electric Power Research Institute, December 1986: 3 ~ M W.R. Cobb et al., ARMP-02 Documentation Part II Cha ter 8 SIMULATE-E Mod.3 Com uter Code Manual, NP-4574-CCM, Part II, Chapter 8, Electxic Power Research Xnstitute, September .1987. 4 ~ J.D. Teachman and B.M. Moore, NORGE-B A Nodal Re resentation Generator for Boilin Water Reactors Com uter Code -User's Manual for the .Washin ton Public Power Su l S stem Version of NORGE-B, WPPSS-FTS-106, Washington ' Public Power "Supply System, November 1986. . "

                                                                         . =  -
                                                                                 '

n

5. B.M. Moore, A.G. Gibbs, J.D. Imel, J.D. Teachman,';H.

Thomsen, and W.C. Wolkenhauer, uglification of Core Ph sics Methods for BWR Desi n and Anal sis, WPPSS-FTS-127, Washington Public Power Supply System, March 1990.

6. J.A. McClure et al., S1MTRAN-E - A SIMULATE-E to RETRAN-02 Datalink, EPRX NP-5509-CCM, Electric Power Research Institute, December 1987.

7. J.H. McFadden et al., RETRAN-02 A Pro ram for Transient Thermal-H draulic Anal sis of Com lex Fluid Flow S stems, EPRI NP-1850-CCM-A, Revision 4, Volumes I-XII, Electric Power Research Institute, November 1988.

8. C.W. Stewart et al., VIPRE-01 A Thermal-H draulic Code for Reactox Cores, EPRI NP-254-CCM-A, Revision 3, Volumes 1-4, Electric Power Research Institute, August 1989.

9. Y.Y. Yung, S.H. Bian, and D.E. Bush, BWR Transient Anal sis Model, WPPSS-FTS-129, Rev. 01, Washington Public Power Supply System, September 1990.

10. I.B. Fiero, ESCORE The EPRI Stead State Core Reload Evaluator Code) EPRI NP 4492 CCMg Volumes 1 to 3, Electric Power Research Institute, August 1986.

     "RODDK-E:     A  Program for       Rapid   Estimation of Control                Rod Worths,"     Appendix C,      -  in   W.R.      Cobb    et      al.,       ARMP-02 Documentation       Part    II NP-4574-CCM, Cha ter 8          SIMULATE-E           Mod.3 Com uter     Code Manual, Electric Powex Research        Institute, Part September II, 1987.

Chapter 8,

                                      'R 1

12 '.J.Res onse Doran et al., STARS: Surface Pro ramp. EPRI NP 7558 Statistical Transient Anal sis b CCML Electric Power Research Institute, January, 1992. 13 ~ J. Pappas, RBLOCK: A Rod Block Monitor Simulator User's Manual, Yankee Atomic Electric Company, March 1987. 14., J.M. Betancourt et al., T e ea tor nal s's Su ort Packa e RASP Vo ume 8: LWR Set-Point Anal sis Guidelines, EPRI NP-4498, Volume 8, Electric Power Research Institute, May 1986.

15. W.S. Dunnivant, Generic Mechanical Des' fo Advanced Nuc ear Fuels 9X9-IX and 9X9-9X BWR Reload Fue , ANF-89<<014(P),

Advanced Nuclear Fuels Corporation,'ay 1989: 0 ~ E 16; A. Rapacz et al, Generic Mechanical Desi n for Exxon Nuclear Jet Pum MWR Reload Fuel, XN-NF-85-67(P)(A) Revision 1, Exxon Nucl'ear Company, September,1986. a S.E. State, Advanced uc ear uels Cor oration Critical Power P 17. Methodolo for Boilin Water Reactors,. ANF-524 (P)(A) Revision 2, Advanced Nuclear Fuels Corporation, April 1989, and Supplement r 1, Revision 2, November 1989.

18. American Society of Mechanical Engineers, Pressure Vessels and Pi in : Desi n and Anal sis, New'York: American Society of Mechanical Engineers, 1976.

19. K.W. Zerressen 'and R.B. Macduff, ANFB Critical Power Correlation, ANF-1125(P)(A) .Supplement 1, Advanced. Nuclear Fuels Corporation, April 1989. 'I 20; R.E. Engel, A lication of -the Reactor Anal sis Su ort Packa e LWR Set-Point Anal sis Guidelines, EPRI NP-6432, Electric Power Research Institute, July 1989.

21. EXXON Nuclear Methodolo for Boilin Water Reactors Neutronic Methods for Desi n and Anal sis XN NF 80 19 (P) (A) g

      .Volume     '1  and Volume       "1   Supplements         1   and 2,      EXXON   Nuclear
      .Company, March 1983.

'22. 'XXON Nucl'ear'Methodolo for Boilin Water Reactors Neutronic Methods for Desi n and Anal sis, XN-NF-80-19(P)(A) Volumes 2, 2A, 2B, 2C, Rev. 1, EXXON Nuclear Company,

                                                -
                                                              -                       .
     - September -.1982:.',            ~,

23. M. Edenius, A. Ahlin, and H. Haggblom, CASMO-2 A Fuel Assembl Burnu Pro ram =User's Manual,. STUDSVIK/NR-81/3, Studsyik Energiteknik AB, March, 1981.

t. I~

R-2

APPENDXZ A STATISTICAL COMBINATION OF UNCERTAXNTXES METHODOLOGY APPLXCATXON In the plant safety'""'a'na'lysis process, it is necessary to account for uncertainties in the model and model inputs, operating state, and instrumentation systems. These uncertainties in the safety analysis process are typically treated through a conservative or deterministic approach. The deterministic approach to the treatment of uncertainties'nvolves. taking the principal

>>

uncertainty components at an arbitrarily defined adverse bound, and no attempt is made to estimate the overall uncertainty distribution. This'pproach essentially assumes that all significant'uncertainties are'simultaneously at their most adverse values within the possible range of. conditions, which results in very conservative predictions. of event consequences. In most cases, the plant has sufficient margin to accommodate this approach and no further analyses are required. However, the use of the detexministic approach can lead to core operating limits or technical specification setpoints that result in undesirable plant zestrictions. For those'ases, 'the WNP-,2 reactor - analysis methodology incorporates the use oftatistical combination of uncertainties (SCU) methodology 'to"."define a set of moxe operationally acceptable "setpoints while retaining. an appropriate level of conservatism.

~ ~

t The statistical simulation of an event requires a large number of cases to be run to obtain the desired accuracy. Response suxface methodology provides an efficient way of -reducing the number of system. and coze thermal hydraulic analyses;required to make an accurate statistical statement about the event analysis results. A response surface is an algorithm that approximates the event analysis codes. There are five basic st'eps associated with the response surface methodology: (1) the determination of the model uncertainty; (2) the quantification and selection of the paxametexs to be used in the response surface; (3) the development of the A>> 1

response surface; (4) the simulation of the event using the response surface; and (5) the convolution of the response surface for the event with the model uncertainty. Each of these steps is described below. A 1 DETERMINATZON OP MODEL UNCERTAINTY To determine the model .uncertainty, studies are performed to establish 'he effect of "key modeling and model input . parameter

uncertainties on the event analysis results. Xn these studies, the analysis model. is.run with perturbed inputs to quantify the effect of changes in the model and model inputs. The results of the model uncertainty'tudies are statistically combined to determine the overall -model uncertainty.- The model .uncertainty established through this process is -then combined with .the results of the response 'surface analysis to provide the overall probabilistic statement for'he event analysis. *, The Supply Syst: em model uncertainty procedure has been applied to the generator load rejection without bypass event (See Section 5.3.3) which is the limiting transient with respect to minimum critical power -'-ratio (MCPR). The - base case in the model

uncertain:nty evaluation uses technical specification scram. time and recirculation pump trip.(RPT). at licensing- basis power level and 1004 core'low. The parameters considered in the model uncertainty evaluation- analysis; fall into five groups: . (a) Nuclear Model Parameters; (b) -Core Thermal-Hydraulics Parameters; (c) Recirculation System Parameters; (d) Steam Line Model Parameters; and (e) Vessel and Loop Geometry Parameters. The effect of the .uncertainties in,each of, these parameters on the calculated consequences, of the generator load rejection .without bypass event is shown in Table A-l.= RCPR,.defined. as dCPR/(initial CPR); 'is used as the figure of merit for the. uncertainty evaluation. The change in RCPR in each uncertainty evaluation is used 'to quantify the modeluncertainty effect on the transient thermal margin. .'he overall .model uncertainty is determined by A-.2

taking the square root of the sum of the squares of the MCPR

due to the individual model and input parameter uncertainties.

A.i.l Nuclear Model Parameter Uncertainties Nuclear model uncertainties affect the coupling of the core power generation to the moderator conditions and include: moderator void reactivity feedback; fuel temperature feedback (Doppler); scram reactivity; and fraction of prompt energy deposited directly in the coolant. The magnitude of the parameter uncertainties and their effects on the calculated dECPR is shown in Table A-l. Increasing the moderator void reactivity feedback increases the severity of the event because the power generation will increase, relative to the base case, for an equivalent core void fraction reduction. The sensitivity evaluation case uses a void reactivity, feedback 134 more negative than the base case. This conservatively bounds the uncertainty in void reactivity (Reference Al). As seen from Tables A-1 and A-2, this is the largest single source of overall model uncertainty. Decreasing the Doppler fuel temperature reactivity feedback increases the severity of the event because it reduces the mitigation of power generation due to increased fuel temperature. The sensitivity evaluation case reduced the Doppler reactivity feedback by 104, consistent with the NRC staff recommendation

(Reference A2, Page II-32). The contribution to overall model uncertainty is small. The prompt moderator heating fraction is the portion of the total fission energy that is deposited directly into the core coolant by gamma heating. Reducing 'the prompt moderator heating fraction increases the severity of the event because it increases the rod heat flux for the same fission power. From Reference A2, for typical BWR fuel the 954 confidence lower limit is about 204 lower than the nominal value. For additional conservatism, a 254 reduction was used in the Supply System analysis. As seen from A-3

Tables A-1 and A-2, this,. is a significant .contribution to the overall model uncertainty. Decreasing the control rod scram reactivity feedback increases the severity of the event because it reduces the mitigation of power generation* due to control rod insertion. -The sensitivity evaluation case reduces the scram reactivity feedback by 104, consistent with the NRC staff recommendation (Reference A2, Page XZ-32). The contribution to overall model uncertainty is small. 0 4 r A.1.2 Core Thermal-Hydraulic Parameter Uncertainties Core thermal-hydraulic model uncertainties include: drift flux model correlation parameters; core pressure drop loss coefficients; bypass .flow fraction; fuel pin conduction heat transfer; and core power. These parameters directly, affect the. core moderator conditions during the transient. The magnitude of the parameter uncertainties and their effects on the calculated rSCPR is shown in Tables A-1 and A-2. The drift flux model parameters of interest are the concentration parameter, C and the drift velocity, V . For uncertainty evaluation, the NRC staff recommends using a limiting value of 1.0 fo'r C and a 30<-variation in V. These cases were analyzed in the RETRAN-02 sensitivity studies by variation of the parameters KAPPA1 and CGL, respectively. The contribution of drift flux parameter uncertainty to overall model uncertainty is small. I The Dittus<<Boetler heat transfer correlation is used in the,profige fit model to calculate the subcooled voids for the neutronic feedback. To study'--the impact .of uncertainty on the. calculated dZCPR, the leading coefficient in the correlation, CDB, is increased by 204 as recommended in, Reference A3. The contribution of correlation uncertainty .'to overall model- uncertainty-is very ( small.

                                      ~,
                                 '

F f I

                                                                         'P
                                                                                -

A,'

The Hancox-Nicoll heat transfer correlation is also used in the profile fit model to calculate the subcooled voids for the neutronic feedback. To study the impact of uncertainty on the calculated dZCPR, the leading coefficient in the correlation, CHN, is increased by 20% as. recommended in Reference A3. The contribution of correlation uncertainty to overall model uncertainty is very small. The core dynamic pressure drop loss coefficients were reduced by 204 as recommended by the NRC staff (Reference A2, Page XZ-32). The contribution to overall model uncertainty is small. From Reference A4, the uncertainty in initial core bypass flow fraction is less than 204. The initial bypass flow fraction in this study was reduced 204 from the base case. The contribution to overall model uncertainty is small. Uncertainties in the overall fuel rod thermal time constant contribute to the overall model uncertainty. To investigate the sensitivity, the fuel pellet and cladding radial noding was increased by a factor of two. The contribution to overall model uncertainty is small. General Electric has made extensive studies . of the core .power uncertainties (Reference A2) based on analysis of the uncertainties of components in the plant energy balance. They concluded that, the one standard deviation uncertainty is 2% The Supply Syst: em has used an uncertainty of 4% in the model uncertainty evaluation. The contribution to overall model uncertainty is negligible. I A.1.3 Recirculation System Parameter Uncertainties Recirculation system model uncertainties affect the timing and attenuation of the pressure wave from the vessel steam dome,to the, reactor core and the rate of change of core flow following recirculation pump trip (RPT). The parameters of interest include: recirculation loop inertia; recirculation loop head; jet pump

inertia; steam separator inertia; and the jet pump loss coefficients. The magnitude of the parametex uncertainties and their effects on the calculated &CPR is shown in Tables A-1 and The recirculation pump dynamic characteristics affect the core flow following RPT. Based on the analyses performed by General Electric and accepted by the NRC staff (Reference A5) the recirculation loop inertia is increased 1004 in the model 'uncertainty evaluation. As 4 seen in" Tables A-1 and A-2, recirculation loop inertia uncertainty has a moderate contribution to overall model uncertainty. The recirculati'on pump head is 'reduced by 104 in the model uncertainty 'evaluation. The pump head contxibution to overall model uncertainty is small. Jet pump fluid inertia affects the core flow following RPT as well as the timing and attenuation of the pressure wave from the steam lines to the reactor core via 0he lower plenum region. From Reference A4, there is a significant uncertainty in jet pump fluid inertia. In the model uncertainty evaluation, the inertia was increased by 1004. The contribution to overall model uncertainty is small. Steam separator inertia affects the timing of the pressure wave from the steam lines to the core via the'pper plenum .region. Sensitivity evaluations were performed for the separator liquid outlet (carryunder) junction inertia and for the separator inlet junction inertia."'n accordance with Reference A4, the liquid outlet inertia was increased by 1004. In accordance with Reference A2 (Page Q15-'2), 'the 'inlet inertia =was reduced by 30%., The contribution to overall model uncerta'inty is small. The jet pump pressure drop loss coefficients were reduced by 20% as xecommended by the NRC staff (Refexence A2, Page .II-32). The contribution to overall model uncertainty is small. A-6

A.1.4 Steam Line Model parameter Uncertainties Steam line model uncertainties affect the timing and attenuation of the pressure wave fr'om the turbine control valve to the vessel steam dome and include steam line inertia and steam line pressure drop. Increasing. the magnitude of the core pressurization causes greater void collapse and greater positive reactivity insertion due

                                                              'I to void reactivity feedback. Reducing the steam line pressure wave transit time reduces the consequences of, the event., The magnitude of the parameter uncertainties and their effects on the calculated dBCPR is shown in Tabl'e A-1.

Based on a study performed by TVA and, documented. in Reference A4, an" uncertainty of .74 was - used for the main.steam line fluid inertia. The impact is a moderate increase. in dZCPR. The pressure loss coefficients in the main steam lines directly affect the attenuation of the pressure wave. The main steam line pressure drop loss coefficients were reduced by 204 as recommended by the NRC staff (Reference A2, Page II-32). The. contribution to uncertainty is moderate. ,

                                                                    ~
                                                                      'verall'model t

A.1.5 Vessel and Loop Geometry Parameter Uncertainties Vessel'nd 'loop geometry -uncertainties affect the timing and attenuation of the pressure wave to the reactor- core and include the reactor vessel steam 'dome and the steam .line volumes. The magnitude of the parameter uncertainties and their effects on the calculated dZCPR is shown in Tables A-l,and A-2. I Il r a Decreasi.'ng the reactor vessel. steam dome, volume will increase the severity of a pressurization event because the pressure wave will-reach the reactor core sooner. Based on a study performed by TVA and documented in Reference 'A4, an,.uncertainty of 54 was used for the steam dome volume., Steam dome volume uncertainty is a moderate contribution to overall .model uncertainty.

                                  . A-7

Decreasing the main steam line volume will also affect the severity of a pressurization event because the pressure wave will reach the reactox core soonex. Based on Reference A4, an uncertainty of 54 was used for the main steam line:volume. Main steam line volume uncertainty is a small contribution to overall model uncertainty. Reducing the steam line volume slightly decreases the calculated LSCPR because, although the pressure wave reaches the core sooner, it has a reduced magnitude because of .its more rapid transit time through the steam lines. e A.2 QUANTIFICATION AND SELECTION OF RESPONSE SURFACE PARAMETERS A screening process aids in the selection of the parameters to be used in the development of the response surface. In this screening process, the uncertainties in the key analysis input parameters are characterized and sensitivity studies are perfoxmed to determine their relative impact on the analysis results. Generally, the parameter(s) that can provide the greatest relative improvement in figure of merit for the event being analyzed are included in the response surface. For the generator load rejection without bypass event, the parameter with the greatest potential improvement in calculated thermal margin is control rod scram speed. Control rod insertion timing is affected-by timing of the xeactor protection syst: em trip signal (e.g.', turbine contr'ol valve closure), reactox protection 'sy'tem logic response time, the solenoid de-energizing time, and the control rod .drive scram insertion time. t Current. safety analysis is performed using scram insertion times contained" in the plant technical specifications. The .technical specification scram times are quite conservative compared to scram times based on plant data. All actual plant control rod scram times measured since October 1985 are retained in a data base. The data base includes all unplanned full core scrams as well as the scrams that are performed to satisfy plant surveillance test requirements. The plant scram time data base is sufficient to A-8

justify the

~   ~

use of more realistic scram times in WNP-2 plant safety analysis.

       ~
          ~

A computer program was written to perform a statistical evaluation of the scram times contained in the data base. The program reads the measured times for insertion from fully withdrawn to each of four control rod notch positions (0.75 ft, 2.25 ft, 5.75 ft, and 10.75 ft). The scram insertion time mean and standard deviation is then calculated for each notch position. A range of dates is specified for each calculation so that statistical information may be obtained for a subset of the entire data base. The data for full scrams is considered to be, more relevant to system transient analysis than single rod data. All of the full scram =data, from the earliest times in the data base to the present, were used to develop a realistic scram time table. This included 4858 scram time measurements for each of the four notch positions. Table A-3 shows the scram times used in the Supply System analysis of the generator load rejection without bypass. A.3 RESPONSE SURFACE DEVELOPMENT The statistical simulation of an event requires a large number of cases to be run to obtain the desired accuracy. Response surface methodology 'provides an efficient way of reducing the number of system and core thermal hydraulic analyses. required to make an accurate statistical statement about the event analysis results. A response surface is developed based on experimental design considerations. The experimental design defines the specific system and core thermal hydraulic cases that must, be run to develop the response surface algorithm. The response. surface is a polynomial fit to the experimental-design cases, that approximates the system and core thermal hydraulic analysis methodology for a specific analysis output parameter over the limited range of interest. To define the response surface, a least squares fitting technique is used to determine the polynomial fitting coefficients. As a part of this process, the fitting error, which represents the A-,9

                               'f uncertainty introduced in the analysis process'"by .the use "of the response surface, is determined.

} The Supply System response surface is of the general form (Ref. ( A6):

       ..Y=B+ZB;g;+ZB(g;-c)+ i%7                                  ZB,,   ~.,    ~,.         (A-1) 4 Where:

B';, B-, and B;; are, the, response surface coefficients; g; are the independent variables C is a known normalization coefficient Y is the response surface dependent variable For the generator-load rejection=without bypass event, only the control rod"scram time is used as an independent variable and the response surface assumes the simple form: RCPR = Bo + Bi T + Bn T (A-2) 1w *~ As shown in Tables A-4 and A-5, five different scram times were analyzed for each fuel type for the construction of the generator load rejection-without bypass response surface. The results of the RCPR evaluations for these cases were input to .the STARS code (See Section 2.1.4.7). STARS then calculated the fitting coefficients B,-, B and Bn " The coefficients for, the RCPR in Tables A-4 and A-5 for the two fuel types are: l I s

                          ~  -    -

h

                                       .. 8x8

0. 1383

                                                     .
                                                  .",," ...

9x9-9X, F

                                                                ,0. 148,0
                                                                              .
                                                                                                ~- a Bo Bl                   0.0110                 0.0104 B 11              -0.0005714             '-0.001000 The response surface piovides an excellent                           fit      to the calculated RCPR's with an RMS fitting'error.of 0.0023.for the 8x8 hot channel and 0.0004 for the 9x9-hot channel..=--

A.4 EVENT SIMULATION,USING THE RESPONSE SURFACE Once the response surface has been defined, the event can be simulated using Monte'arlo techniques. In this process, STARS randomly samples the independent parameters and the response surface fitting error, based on their statistical characteristics, and then calculates the dependent variable (RCPR). Each set of random samples forms one "history" for the statistical evaluation of the response surface. 100,000 histories were run to accurately quantify the probability of a given analysis result for the response surface, considering the fitting, error. The model uncertainty has not been considered in this evaluat:ion. A 5 CONVOLUTION OF THE RESPONSE SURFACE AND, THE, MODEL UNCERTAINTY The final task is to convolve the response surface analytically. with the model uncertainty to establish 'the overall probability of the event analysis results. This probability distribution is then

used to demonstrate compliance with the event acceptance limits.

This analysis considers the response surface fitting error as well as the model uncertainty discussed in Section A-1. The calculated RCPR at a 95% confidence level- is s hown below: -. I 8x8 ,9x9-9X I RCPR at 95% confidence level. 0.166. 0.176 I

I I ~

> ~

the analysis, the response surface:development the event

                                                                      'n STARS simulation using the response surface, .and the convolution of the          (

response surface with the overall model uncert;ainty are performed in a single computer run. The steps have been described separately to clarify the statistical analysis,.process., l II A.6 APPLICATION 'OF THE SCU METHODOLOGY TO OPERATING LIMIT MCPR The WNP-2 plant measured scram speed must be consistent:.with the scram speed used in -the statistical approach. The WNP-2 technical specifications contain surveillance requirements that: all,control .

rods must, be scram tested after each refueling outage and t,hat 104 of the control rods must be tested at 120-day intervals. The surveillance testing data is utilized to compute t,, the average scram time to control rod notch position 39 {the position closest to 204 insertion, which is the portion of the scram that affects a limiting -pressurization transient the most). The average scram time to notch 39, r,, is updated after each surveillance test. The average scram time, r,, is then tested against the analysis mean using T,5 'Tg. (A-3 ) where fg ~ p.+ A d (A-4) A ~ '1. 65 (N/n)" The parameters p and d are the mean and standard deviation of the distribution for the scram insertion time to contxol rod notch 39 used in the WNP-2 SCU analysis. As shown in Table A-3, I'osition p = 0.6000 and d = 0.0259. Parameter A provides the 54 significance coefficient {i.e., 954 probability) that the measured aver'age scram time will not exceed v'~. The parameter N is the number of contr'ol 'rods tested at the-beginning of the cycle and parameter n is the total number of control rods tested to date for the current cycle. If the cycle average scram time satisfies the Equation A-3 'riteria, continued plant operation using the 'perating 'limit established with the SCU methodology.j.s permitted. If not, the. operating limit for.the generator load rejection event must be re-established based on a linear interpolation between the SCU ap'proach 'and the deterministic; approach as, follows: 4I OLMCPR,~ = OLMCPRscg + TF BOLMCPR..., ., (A-5) where TF (~av g) / (~p. 0

The present technical specification limit on scram time to control rod notch position 39 (0.868 seconds as shown in Table .A-2) bOLMCPR is the difference between the operating limit MCPRs using the deterministic and the SCU approaches This approach is consistent with'he NRC requirements described in Reference A2. A 7 REFERENCES A1. Letter from J.M. Sorensen (SLI) to G. SRikantiah (EPRI),

   "Evaluation of Void Coefficient Uncertainty for WNP-2," August 13, 1991.

A2. NRC Safety Evaluation for the General Electric Topical Report, "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors, Volume 1", NED0-24154-A, August 1986. A3. M.A. Alammar, "The NRC Review of Oyster Creek Reload Licensing Model>>, Proceedin s: Sixth International RETRAN Conference EPRI NP 6949 g August 1990 ~ A4. S.L. Forkner, et al.,'BWR Transient Analysis Model Utilizing the RETRAN Program"-, TVA-TR81-01, Tennessee Valley Authority, 1981. A5. Letter from R.L. Tedesco (NRC) to G.G. Sherwood (GE),

   "Acceptance for Referencing General Electric Licensing Topical Report NEDO-24154/NEDE 24154P", February 4, 1981.

A6. K.J. Doran, et al., "STARS Statistical Transient, Analysis by Response Surface Program Theory and Users Manual", I NP-7558-CCML, Electric Power Research Institute, October 1991.

Table A-1 Generator Load Rejection 'Without Bypass Model Uncertainty, Evaluation for Sz8 Fuel Case* MCPR Nuclear Model Uncertainties Void Coefficient (134) 109/110 +0.018 Doppler (-104) 101/104 +0.004-Prompt Moderator Heating (-254) 001/105 +0 '10 Scram Reactivity {-10%) 001/108 +0.003 Core Thermal Hydzaulics Parameters -, Code Correlation .,(kappal+0.20) .001/202 Code Correlation (CGL+30o) .

                                                   ~-    001/204    +0.007+0.000 Code    Correlation -{CDB+204)                      001/206 ., +0.000-Code    Correlation (CHN+20%)                       001/208    +0.000 Core Pressure Loss Coefficients (-204)              001/212    -0.004 Initial Core     Bypass Flow (-204)                 001/213    +0.005 Fuel Pin Radial Nodes (+504)                        001/214    +0.002 Coze Power (+44),                                   001/216    +0.000 Recirculation System Parameters Recirculation Loop Inertia (+1004)                  001/301    +0.006 Recirculation Pump Head (-104),                     001/302    +0.'003 Jet Pump Inertia (+100%)                            001/303.   +0.003 Separator Liquid Outlet Inertia (+1004)             001/304    +0.002 Jet Pump Loss Coefficient (-204)                    001/305    +0.003 Separator    Inlet Inertia    (-304)                001/307    -0.003 Steam Line Model Parameters Steam Line'.-Inertia (+7<)                          001/401'0.005 Pressure Loss Coefficient {-204)                 -  001/402    +0.006 Vessel and Loop Geometry Parameters Vessel Dome Volume (-54)                   .       001/501    +0.004 1

Steam'ine Volume (-54) 001/502 "

                                                                    -0;004 Overall Model, Uncertainty (dBCPR) = 0.0267

k'" 'Supply.'ystem analysis *traceability case numbers.

dZCPR 'is the difference in RCPR for the two cases identified.

Table A-2 Generator Load Rejection Without'Bypass Model Uncertainty Evaluation for 9x9-9Z Puel Case* ZZCPR Nuclear Model Uncertainties I Void Coefficient {134) 109/110 +0.019 Doppler (-104) 101/104 +0.005. Prompt Moderator Heating (-254) 001/105 '+0.012 Scram Reactivity {-10%) 001/108 +0.003 Core Thermal. Hydraulics Parameters Code Correlation {kappa1+0.20) 001/202 "+0. 008 Code Correlation (CGL+304) 001/,204 +0 '03 Code Correlation (CDB+204) 001/206 +0.000 Code Correlation {CHN+204) 001/208. .+0,.000 Core Pressure Loss Coefficients (-20~) 001/212 -0.001 Initial Core Bypass Flow (-204) 001/213 ~ +0.006 Fuel Pin Radial Nodes (+50%) 001/214 ; +0. 003

, .Core Power (+44)                                                 001/216          +0.000, Recirculation System Parameters Recirculation Loop Inertia (+1004)                               001/301,+0.006=

Recirculation Pump Head (-10~) 001/302 +0.004 Jet Pump Inertia (+1004) 001/303, +0. 002 Separator Liquid Outlet Inertia 001/304 +0.001 Pump Loss Coefficient (-204) (+1004)'et 001/305 +0.004 Separator Inlet Inertia (-304) 001/307 . -0. 004 Steam, Line Model Parameters Steam Line Inertia (+74) .001/401 . +0.005 Pressure Loss Coefficient (-204) '01/402,'.. +0. 007 Vessel and Loop Geometry Dome Volume {-5~) '01/50.1,"" +0. 005 Parameters'essel Steam Line Volume (-5%) 001/502 .-0.001 Overall Model Uncertainty (MCPR) = 0.0291

                         'I Supply System analysis traceability.case numbers.

dZCPR is the difference in RCPR for. the-two cases identified.

Table A-3 Scram Times Used in the WNP-2 Safety Analysis Control Tech Spec Normal Mean Standard Mean Rod Scram Scram Scram Dev. (cr) Scram Position Time Time Time Time+2 cr (ft) (sec) (sec) (sec) * (sec) * (sec)

0.0 0.00 0.00 0.00 0.00 0.0 0.20** 0.20<<<< 0.20** 0.20**

0.75 0.43 0. 404 0.3048 0.0161 0.3370 2.25 0.868 0. 660 0.6000 0.0259 0 '518 5.75 1. 936 1 '04 1.3040 0.0633 1.4306 10.75 3.497 2.624 2.3912 0.1354 2.6620 12 F 00 3.889 2.904 2,6630*** 2 '698***

Obtained from WNP-2 scram time surveillance data

     **    Accounts   for 0.20 sec time from de-energization of scram solenoid to the beginning of control rod insertion
     *** Extrapolated from scram time surveillance data.

Surveillance data is for control rod positions 45 9 0.75 ft, 39 9 2.25 ft, 25 9 5.75 ft, and 05 9 10.75 ft. A-.16

Table A-4 Generator Load Rejection Without Bypass RCPR As a Function of Scram Time for Sz8 Fuel (Used in Construction of Response Surface) d,CPR RCPR Mean Scram Time 0. 160 0. 138 Mean Scram Time Plus One Standard Deviation 0.173 0. 147 Mean Scram Time Minus One Standard Deviation 0.148 0. 129 Mean Scram Time Plus Two Standard Deviations 0.188 0. 157 Mean Scram Time Minus Two Standard Deviations 0.127 0. 113 Table A-5 Generator Load Rejection Without Bypass RCPR As a Function of Scram Time for 9z9-9X Fuel {Used in Construction of Response Surface) ACPR RCPR Mean Scram Time 0. 174 0. 148 Mean Scram Time Plus One Standard Deviation 0. 186 0. 157 Mean Scram Time Minus One Standard Deviation 0.159 0 ~ 137 Mean Scram Time Plus Two Standard Deviations 0.197 0.165 Mean Scram Time Minus Two Standard Deviations 0.140 0.123 A-17

N E 1 J A t

APPENDIX B HOT CHANNEL METHODOLOGY The change in Critical Power Ratio (bCPR) during the limiting transient is to be determined in order to establish the minimum CPR operating limit for each reload cycle. The Hot Channel Methodology used by the Supply Syst: em for evaluation of bCPR is described in Section B.1. This methodology is based on a NRC reviewed core thermal hydraulic code VXPRE-01 MOD02 '"VIPRE-01"). Benchmark studies performed to verify the capability of UNPRE-01 vith the ANFB critical power correlation~ for dCPR calculations are presented in Sections B.2 through B.4. B~1 VIPRE-01 METHODOLOGY FOR EVALUATION OP dLCPR The following discussions describe how VIPRE-01 is used to evaluate the limiting bundle ACPR for BWR transients that are analyzed with the RETRAN-02 code. The RETRAN-02 code is used to determine core-wide system response for the limiting transients. The WNP-2 transient analysis model developed with RETRAN-02 is described and qualified in the topical report WPPSS-FTS-129~. Zn the WNP-2 RETRAN-02 model, the core is modeled vith tvo hydraulic channels: the core average active channel and the bypass channel. These are parallel flow path channels that share common lover plenum and upper plenum boundary . conditions on pressure and enthalpy. Modeling of individual fuel bundles is not needed for the purpose of determining core-wide system response. However, because of power level and fuel design differences, a hot channel model is necessary for an accurate evaluation of limiting bundle thermal hydraulic response during a transient. In the hot channel model, the limiting bundle is modeled as a single channel as shown in Figure B-1. This hot channel model developed with UIPRE-01 is used to evaluate hCPR.

The Hot Channel Methodology involves four major steps: After the core-vide transient analysis, the boundary conditions for VIPRE-01, namely, the time histories of core power, inlet enthalpy, upper plenum pressure, core pressure drop and the axial power distribution, are saved on a computer

file by a RETRAN-02 REEDIT run. This file, after reformatting is read by VIPRE-01.- r I 2) Because the bypass flow is not modeled in VIPRE-01, the inlet I loss coefficient's adjusted .to. give active flow and core t pressure drop results identical to RETRAN., A full core VIPRE-l" 01 model with five,channels'in the active,.core region is used l in this process. The five channel full core nodalization is I shown in Figure B-2."" The axial nodalization remains unchanged I from the hot channel model (See Figure B-1) . 1 VIPRE-01 (hot channel model) is run with a successively higher 3) bundle radial peaking factor until the flux ratio transient. (MCHFR) equals 1. 0 at minimum some critical time during the heat 0 4)' The bundle power that caused MCHFR = 1.0 is then used to evaluate the initial .'critical power ratio (ICPR) for the transient. 'he" e ~ is lt hCPR equal to (ICPR 1.0) . Input data for VZPRE-01 are obtained not only from RETRAN-02, but )iso from SIMULATE-E~ and CASM0-2E~. SIMULATE-E is a three dimensional steady-state nodal analysis code which yields the power distributions. CASMO-2E through FICE yields the local peaking function "FEFF". FEFF is needed in the ANFB critical power correlation to account. for planar local effects.

                                         'B 2 0

B 2 CODE BENCHMARKING The ANFB critical power correlation developed by Advanced Nuclear Fuels Corporation (ANF, nov SPC) is implemented in, the VIPRE-01 code for the thermal margin evaluation. Calculations are, performed to benchmark the VIPRE-01 code with-- steady-state and transient critical heat flux (CHF) test data. Specifically, these calculations provide i) a comparison between critical power results computed with the VIPRE-01 code and steady state critical power test data, ii) VIPRE-01 predictions of transient boiling transition performance versus transient data. This benchmarking therefore provides an 'verall .assessment of how the combination of thermal/hydraulic modeling and:CHF. modeling in VIPRE-01 performs relative to data for BWR fuel bundle CHF performance. It also verifies the. proper implementation of the.ANFB correlation.

                                                    ~ 1 If II B.3     BENCHHARKZNG DATA The CHF test data         to vhich   VIPRE-01   is benchmarked     are summarized as follows:

I 1) I Steady-state cases: 96 cases vere selected from the ANFB correlat'ion data base~'. They are selected from 11 test sections which differ from one another either in terms of geometry (4X4, 5X5 and 9X9 rod configurations) or power distribution (cosine, upskew and uniform axial power distributions)

   ~ g     f                         'I
                                                               * ~

2) Transient cases: 14 transient tests (7 power ramp tests and 7 flow decay tests~) on a 4x4 rod configuration. I "II a "B 3

BE 4 RESULTS B.4.1 Steady-state CHF Analysis A summary of the steady-state CHF analysis, results is given in Table B.4-1. Examination of the results shows that VIPRE-01 predicted ECPRs are the same as those reported for the ANFB correlation, with the exception of, some small variations between test sections. The overall average difference in ECPR between the VIPRE-01 and ANF's results is 0.0001. It is therefore concluded that the overall mean and standard deviation for the VIPRE-01 predicted ECPR distribution remain essentially unchanged from those reported for the ANFB correlation~ (mean = 1.003, standard deviation = 0.025). B.4.2 Transient CHF Analysis A summary of the transient CHF analysis results is given in Table B.4-2. For each test case, the initial power was iterated until-the predicted time to boiling transition (BT) equaled the measured time to BT. Since the power forcing function (transient bundle power normalized to the initial value versus time) remained unchanged during the iterations, ECPR can be determined as the ratio of predicted initial power to measured initial power (i.e., ECPR = predicted critical power / measured critical power predicted initial power / measured initial gower). The values of ECPR show that the differences between the predicted and measured critical powers are within the uncertainty of ANFB correlation. The uncertainty is incorporated into plant safety limit methodology. These results therefore indicate that the application of the steady-state ANFB correlation in a transient analysis yields CHF results bounding the data (within the uncertainty of ANFB correlation) during the transient. This is consistent with NRC staff's conclusion in the Safety Evaluation Report for VIPRE-01~. The NRC found "... except for very rapid depressurization, the use of CHF correlations developed with steady state CHF data can 0

correctly or conservatively predict the transient CHF when the instantaneous local fluid conditions are used." On the basis of the steady-state and transient benchmarks presented here, it is concluded that VIPRE-01 predictions of BWR fuel bundle CHF behavior using ANFB correlation are acceptable for BWR licensing analysis.

TABLE B ~ 4.-1 Summary of Steady-state CHP Analysis Test Section Run ECPR (2) JP1 33 1.006 1. 008 46 1.000 1. 002 Sl 1.007 1.008 57 1.013 1.014 62 1.009 1.010 66 0.996 0.998 79 1.050 1.051 91 1.011 1 '13 105 0.942 0.943 114 0.967 0.969 116 0 '90 0 '92 COS 7 1. 031 1.029 15 1.003 1.003 25 1.020 1.017 47 0.991 0.989 52 1.009 1.008 58 1.034 1.033 62 1.011 1.011 81 0.968 0.969 97 1.000 0.999 UP SKEW 6 1. 049 1. 048 33 0.963 0.961 36 1.000 0.998 43 0.991 0.989 57 1. 026 1.025 58 1. 028 1.025 73 0.927 0.926 84 1.014 1.015 JP7 21 1. 017 1. 020 24 1. 030 1. 033 33 0. 996 0.999 34 1. 040 1.043 42 1. 032 1.034 44 1. 022 1.024 66 1. 020 1.023 79 0.988 0.991 80 0.983 0.985 85 0.979 0.981 103 0.942 0.945 JP10 8 1. 045 1.047 18 1.025 1.025 28 1.003 1.005 B-6

TABLE BE 4-1 (CONT.) Summary of Steady-state CHF Analysis Test ~Sectio 'Run ECPR (1) (2) JP10 38 1.029 1. 029 48 1.016 1. 017, 54 0.994 0.994 64 1.027 1.029 74 1.032 1.032

             '104                         0. 976"     0.977 114                         0.989       0.990 120                         1.034       1.033 ANPV,           14                         1. 020      1. 021 15                         l. 016      1. 016 55                         1.022       1. 020 56                         1.010       1.007 81                         0.954       0.953 82                         0.984       0.983 107                         0.936       0.936 108                         0.951       0.949 ATA62A                                     1.002       1.002 18                         0.984       0.984 28                         0.987       0.986 38                         0.979       0.979 48                         1.029       1.029 58                         1.004       1.004 KWU1A            7                         1. 039      1. 039 12                         1. 037      l. 038 17                         0. 969      0.970 23                         0.966       0.966 25                         0.961       0.961 26                         0.951       0.951 KWU2A
      '

48 1.001 1. 000 58 0.991 0.993 68 0.986 0.987 203 0.993 0.994 213 1.031 1.031 223 1.056 1.057 ATA714A 10 0.987 0.987 11 0.984 0.983 20 1.020 1.020 21 1.016 1.016 30 1.010 1.010 31 1.013 1.013 40 0.997 0.997 B-7

TABLE B. 4-1 (CONT. ) Summary of Steady-state CHP. Analysis Test Section ~Ru ECPR (1) (2) ATA714A 41 0.995 0.995 48 0.992 0 '91 49 0.990 0 '90 ATA714F 807 0.998 0.997 808 0.994 0.993 817 1.025 1 026 818 1.023 1. 023 827 1.012 1 '13 828 1.022 1 '21 837 0.997 0.997 846 1.017 1 016 912 0.963 0.960 927 0.975 0.975

                 '1 I

NOTE: (1) Predicted by ANF (Ref. 2) (2) Predicted by VEPRE-01 (3) ECPR = Experimental Critical Power Ratio

   = Predicted Critical Power / Measured Critical Power C       *t
                ~ ~ ~

l'

TABLE B. 4-2 Summary of Transient CHF Analysis 4X4 Bundle Power Ramp Test Run Initial Power KN Measured~ Predicted'CPRi PR001 2010.0 2021.0 1.004 PR002 2008.0 1991.0 0.992 PR003 1888.0 1855.0 0.983 PR004 1891.0 1931.3 1.021 PR005 1659.0 1669.0 1.006 PR006 1658.0 1653.0 0.997 PR007 2011.0 2011.0 1.000 4X4 Bundle Flow Decay Tests FD001A 1449.0 1406.0 0.970 FD001B 1452.0 1527.0 1.052 FD002 1449.0 1439.0 0.993 FD003 1455.0 1350.0 0.928 FD004 1476.0 1430.0 0.969 FD005 1730.0 1700.0 0.983 FD006 1735.0 1765.0 1. 017 Mean 0.993 Standard deviation 0.026 NOTE: (1) ECPR = Experimental Critical Power ratio

         =   Predicted Critical Power / Measured Critical  Power (2) Measured Value (Ref. 6)

(3) Predicted by VIPRE-01

BE 5 REFERENCES B1 C.W. Stewart et al.,"VIPRE-01 A Thermal-Hydraulic Code for Reactor Cores," EPRI NP-254-CCM-A, Revision 3, Volumes I-V, Electric Power Research Institute, August 1989. B2 R.B. Macduff, "ANFB Critical Power Correlation," ANF-1125(P)(A), ANF-1125(P)(A) Sup. 1 & Sup. 2( April 1990

                                                    '3 Y.Y. Yung, S.H. Bian,- and D.E. Bush, "BWR Transient Analysis Model,"WPPSS-FTS-129, Revision 1, Washington Public Power Supply System,  September   1990.

B4 D.M. Ver Planck, W.R. Cobb, R.S. Borland, B.L. Darnell and P.L. Versteegen, "SIMULATE-E (Mod. 3) Computer Code Manual," EPRI NP-4574-CCM, September Part 1987. II,. Ch. 8, Electric Power Research Institute, J B5 M. Edenius, A,. Ahlin, and H. Haggblom, "CASM0-2, A Fuel Assembly Burnup Program, User's Manual," STUDSVIK/NR-81/3, Studsvik Energiteknik AB, March 1981. B6 "Results and Analysis of-Transient Rod Bundle Boiling Transient Rod Bundle Boiling Transient Tests," XN-NF-487, Exxon Nuclear Company, October 1982. B7 "Safety Evaluation Report on EPRI NP-2511-CCM VIPRE-01," NRC, May 1986.

node 31 UTP 30 29 TAF 28

                                           ... ........   . ....27.......... SPA¹7 26 UTP - Upper Tie Plate 25 TAF - Top of Active Fuel SPA - Spacer                                              ......24.;..         SPAN 6 BAF - Bottom of Active Fuel                                       23 LTP - Lower. Tie Plate                                            22 ORIF - Orifice                                                    21 ILC - Inlet Loss Coef. (for adjustment)                                        SPA¹5 19
                                                    ............17.           SPA¹4 15
                                                                             ,SPA ¹3 12 SPA N'2 SPA ¹1 BAF                                    LTP + ORIF 3

ILC Figure B-1. WNP-2 VIPRE Hot Channel Model

Channel 1 models the hottest central 9x9 bundle Channel 2 models 187 central 9x9 bundles 'hannel'3 models the hotest central Gx8 bundle Channel 4 models 483 central 8x8 bundles Channel 5 models 92 peripheral 8x8 bundles Rod 1 models 72 fuel rods

    ,Rod 2 models.1 87 x 72 = 13464 fuel rods Rod 3 models 62 fuel rods Rod 4 models 483 x 62 = 29946 fuel rods Rod 5 models 92 x 62 = 5704 fuel rods Figure B-2. Five Channel Full Core Nodalization 8-12

APPENDIX C GENERATION OF KINETICS DATA The one-dimensional kinetics data for RETRAN-02 described herein uses nuclear cross-sections information prepared by the core analysis methodology described in Reference C1. Files containing kinetics data for the various fuel types present in the reactor core are produced by CASMO-2E and the three-dimensional nodal characteristics of the core are determined by SIMULATE-E. SIMTRAN-E collapses corewide cross-sections from the three-dimensional form to one-dimensional form as required by RETRAN-02. SIMULATE-E and RETRAN-02 calculate the moderator density differently. Because of 'this, the'IMTRAN-E cross-sections are adjusted to account. for the difference. To do this adjustment, there are additional steps required in the SIMTRAN-E. to RETRAN-02 one-dimensional kinetics file transfer. These steps, which involve completion of additional SIMULATE-E and RETRAN-02 cases and the execution of the STRODE code., are required to adjust the moderator density coefficients. STRODE also performs an adjustment of the delayed neutron fraction. CD 1 GENERAL DESCRIPTION OF THE GENERATION OF ONE-DIMENSIONAL DATA The generation of the initial one-dimensional data file for RETRAN-02 uses the EPRI codes SIMULATE-E and SIMTRAN-E. SIMULATE-E predicts core power and burnup .distributions during detailed depletion analyses of the reactor core.. Qualification of the Supply System's SIMULATE-E methodology is provided in Reference C1. SIMTRAN-E was developed under EPRI " sponsorship for linking SIMULATE-E and RETRAN-02. SIMTRAN-E reads restart files written by SIMULATE-E, extracts the appropriate information" for determining the kinetics parameters, and generates the direct RETRAN-02 input for transient analysis. C 1

SIMTRAN-E produces a one-dimensional kinetics data file in the form of polynomials which describe the effects of relative changes in water density and fuel temperature on calculated two-group cross-sections, diffusion coefficients, .inverse velocities, radial bucklings, and delayed neutron fractions. This data file could be used directly by RETRAN-02. However, without the adjustments described below and the use of the STRODE code, this approach would lead 'o very conservative .-RETRAN-02 predictions -for severe pressurization-events. S S STRODE, uses the, results of a -set of several SIMULATE-E= and RETRAN-02,.cases to quantify the effects of .the difference in axial moderator density distributions between the two codes for identical variations in core pressure. The differences between the axial arrays produced by SIMULATE-E and RETRAN-02 are used by, STRODE to adjust the moderator density coefficients from SZMTRAN-E to obtain consistent'oderator density reactivity feedback between SIMULATE-E and 'RETRAN-02. The STRODE output data is in the same form"as that produced by SZMTRAN-E and is directly used as RETRAN-02 input. STRODE is also used to correct the delayed neutron fractions in the cross-section= libraries used by CASMO-2E ..and processed .through NORGE-B. :;The CASMO-2E cross-section library (ENDF/B-IZI); delayed neutron .fractions. are lower. than, that provided in the more recent cross-section library (ENDF/B-V). STRODE is used to adjust .the delayed neutron-,fraction input to RETRAN-02 to be consistent with the more recent data;.

          '                                                       tf C 2   CALCULATION OF THE         INITIAL ONE-DIMENSIONAL DATA E                                   \             ~  g ~

To generate the, initial one-dimensional data; a base SIMULATE-E case [shown as '(1) in Figure C-1] .is run,at,a core configuration

consistent with the initial conditions for- the given. transient. This base SIMULATE-E case. uses power and void feedback to determine the three-dimensional core power and flux distributions and the C-2

critical eigenvalue. The base SIMULATE-E case uses cross-sections which have not been adjusted to match k-infinities of the lattice physics code (i.e. unadjusted Z), but it is run from a SIMULATE-E restart file generated with cross-sections which were adjusted to match k-infinities of the lattice physics code (i.e. adjusted Z). For transients in which it is necessary to model the effects of control rod insertion resulting, from, a scram, an additional SIMULATE-E case is required [shown as (2) in Figure C-1]. This case is based on the nominal case and is run with power feedback disabled. The only difference between this case and the nominal case is the control rod position array, which has all rods fully inserted. As noted above, SIMTRAN-E [shown as (3) in Figure C-1] reads the restart files generated by the SIMULATE-E cases. It then collapses the three-dimensional SIMULATE-E data to one-dimensional data for RETRAN-02 and determines the dependence of the kinetics parameters on relative water density, square root of fuel temperature, and control state. SIMTRAN-E generates all .kinetics parameters except ~Z and ~Z~ by radial collapse with adjoint flux weighting. ~Z and rcZ~ are radially collapsed with volume weighting. The dependence of the , kinetics parameters on water density and fuel, temperature is determined by making perturbations in these quantities.'ll relative water density and square root of average fuel temperature perturbations are done in three dimensions and are then radially collapsed. The one-dimensional nominal and perturbed kinetics variables are then analyzed to produce polynomials that are functions of the relative change in water. density and the change in the square root-of the average fuel temperature at each axial node. This calculation is performed for both .the nominal case and for the controlled case.

I C-3

C.3 ADJUSTMENT OF KINETICS DATA To begin the second step in the generation of the one-dimensional data, the SIMTRAN-E output from Step (3) of Figure C-1 (called the Unmodified 1-D File) is used and parallel SIMULATE-E and RETRAN-02 cases are run to quantify the difference in axial moderator density distributions between the two models for identical variations in core pressure. These runs are shown as Steps (4), (5) and (6) in Figure C-1. The extra SIMULATE-E delta pressure cases in Step (6) are used as moderator density perturbation sets for each axial node of the one-dimensional core model 'for the final SIMTRAN-E run shown in Step (8) of Figure C-l. An extra calculation is performed at 104 higher power than the base case [shown in Step (7) of Figure C-1],. From this a calculation is performed to determine the one-dimensional temperature distribution for, this increased power, case. The differences in temperature between -the Step (3) case and -the Step (7) case are used as a fuel temperature perturbation set for each axial node of the one-dimensional core model in the final SIMTRAN-E run [Step (8)]. A final SIMTRAN-E run is then performed with these density and fuel temperature perturbation sets to generate a one-dimensional data file for STRODE. The coefficients in the kinetics parameter polynomials that are associated with the changes, in relative moderator density are then modified by STRODE [Step (9) of Figure C-1] so the change in each kinetics variable in RETRAN-02 for a given pressure change is the same as that pressure change would give in the one-dimensional SIMTRAN-E model. Thus reactivity changes at each axial node generated by a pressure change are preserved between SIMTRAN-E and RETRAN-02. The constant term in each kinetics parameter polynomial determines the initial steady state eigenvalue in the RETRAN-02 unperturbed state. The constant terms are not modified when new C-4

polynomial fits are developed; consequently,

         ~      ~

the SIMULATE-E eigenvalue is preserved in the RETRAN-02 unperturbed state.

The cross-section libraries used in, the core physics analysis are on ENDF/B-III. ENDF/B-III includes delayed neutron fractions

                      ~V')*<,~'ased which are artificially low. Preliminary ENDF/B-V data shows an increase in delayed neutron fraction ranging upwards from 5.44 in all fissile isotopes. To bring the delayed neutron fractions closer to those specified in ENDF/B-V, a +54 adjustment is applied in the STRODE code to all delayed neutron fractions before final data is put into the RETRAN-02 input file.                ~

C 4 VERIFICATION OF. THE. SUPPLY SYSTEMiS METHODOLOGY Jl Verification of the Supply System methodology is documented in Reference C2. There, a'omparison in made between the axial power distributions produced by SIMTRAN-E and the initial, states of the three Peach Bottom turbine trip tests. Also in Reference C2 is a comparison of results calculated using the Supply System's methodology to the measured results of the Peach Bottom turbine trip tests. In these results the calculated response of the Supply System's.model closely matches the measured results. I

C+5 REFERENCES C1. B.M. Moore, A.G. Gibbs, .J.D., Imel;... J.D. Teachman, D.H.

Thomsen, and W.C. Wolkenhauer, "Qualification of Core Physics Methods for BWR Design and Analysis," WPPSS-FTS-127,

                                      .         ,
    . Washington Public Power Supply System, March 1990.

C2. Y.-Y." Yung, S.H. Bian, and D.E. Bush, ".BWR Transient Analysis Model," WPPSS-FTS-129, Rev. 01,- Washington Public Power Supply System, September 1990. C-5

.::.SIMULATE:.::.::.:::.:

.::.SIMV.LATE:.::.:::.::.':.:::.::.::.::.:.:::Has'e':::.::.:::.::.::.::.:

.::.::.:::::;:Delta:.:::.:.::.::::.:::.:.:

'.::.::.::.Pl.'essiii:es:.:'.::.::.::.:: :Case:::.:::.:'.::,:'.::.::

6::::::::::::::::::::

+::.'I'.D~Po.'F..'ciwbi'::.::.::

.:::Tymp';: OIs't::::::::::

                                            .:::.:::.$ IMTRIIIIN::.::::.::.:                               :,:,:::.Ease:             Temp,::::.::::                                     .::.::.'..::Qel@':'.:.::::::.:.'.:

.:::,:Base.';:::.::.::.:::.::::. :::: Gisfributioi::::;::::: :::T~mpei atuIe:::.:

.'.:.:.:;:.:,:.:,.:'..::.Cas'e.:::.:.:.:.:..'.:::.."

.::::.::.:.:::.:.: 3 ".:.':.':.'.:::.'.::.:.':.

.:::: 8[M'TR'AN:::::::.::::

                                            ':.::.::.Vnmodifie'd.::::::                                     :  '::.::::::F.foal
                                            '.:::::.::::.:O'-:O';File:.::.::.:::.::.::.:.:
                                                                                                            '.:.::.::.::.:::.:.:.:.:Huh:.:':.::.::::,::.:

0

                                             ETR'A'N:.':::::';

8aseI:::::::::::::::::

Csss::::::::::':::

RETFIA't4: ...:::.

                                             .:.:::.'.'.:.'.:..':.'.Gelt'".:'..::,'..:'::.'.
                                             .::::.:Pressures::.:::.::::.::::

,::::5:::::::::::::::::::

.:.:::SERO QE'.:.:.:::.::.:.::.:

QeisItII'.::4:Bet'a ':

CqA'.eotlo0:.:::::.::.::

.::.::.::.::.::.:.:-':(9>.:::.:.:::.::.::.::.:.:::::::.

Figure C-1. Generation of Kinetics Data C-6 Rev. 1}}

ML17289B153: Difference between revisions

Revision as of 13:52, 29 October 2019

Contents

Text

1.0 INTRODUCTION

5.1 INTRODUCTION

SUMMARY

SUMMARY

Navigation menu

ML17289B153: Difference between revisions

Revision as of 13:52, 29 October 2019

Text

1.0 INTRODUCTION

5.1 INTRODUCTION

SUMMARY

SUMMARY

Navigation menu

Search