ML18024A350

From kanterella
Revision as of 02:06, 26 April 2019 by StriderTol (talk | contribs) (Created page by program invented by StriderTol)
Jump to navigation Jump to search
Updated Final Safety Analysis Report (Ufsar), Amendment 27, 14.10 Analyses of Abnormal Operational
ML18024A350
Person / Time
Site: Browns Ferry  Tennessee Valley Authority icon.png
Issue date: 10/05/2017
From:
Tennessee Valley Authority
To:
Office of Nuclear Reactor Regulation
Shared Package
ML18018A778 List: ... further results
References
Download: ML18024A350 (18)


Text

BFN-18 14.10-1 14.10 ANALYSES OF ABNORMA L OPERATIONAL TRANSIENTS PRE-UPRATED This section contains general descripti ons of abnormal operational transients analyzed for the initial operating cycle of Br owns Ferry Units l, 2, and 3. The bounding transients are reanalyzed for each fuel reload and subsequent operating cycle to determine which is most limiting.

The results of these specific analyses may change with subsequent core reloads. These results can be found in the

appropriate reload licensing document. Ev ents for which a newer fuel reload specific analysis have been performed will be noted; however, the original analysis descriptions will be retained in this chapter.

This section does not reflect the effect s from power uprate.

For power uprated conditions, the results of the re-analyse s at 3458 MWt using the latest transients methodologies for the non-limiting events not included in the cycle-specific reload analyses are provided in Section 14.5.

14.10.1 Events Resulting in a Nucl ear System Pressure Increase Events that result directly in significant nuclear system pressure increases are those that result in a sudden reduction of steam flow while the reactor is operating at power. A survey of the plant systems has been made to identify events within each system that could result in the rapid reduction of steam flow. The following events were identified:

a. Generator Trip
b. Loss of Condenser Vacuum
c. Turbine Trip d. Bypass Valve Malfunction e. Closure of Main Steam Isolation Valve
f. Pressure Regulator Malfunction 14.10.1.1 Generator Trip (Turbine Control Valve (TCV) Fast Closure)

A loss of generator electrical load from high power conditions pr oduces the following transient sequence:

a. Turbine-generator acceleration protection devices trip to initiate turbine control valve fast (about 0.20 second) closure, b. Turbine control valve fast closure is sensed by the reactor protection system, which initiates a scram and simultaneous re circulation pump trip (for initial power levels above 30 percent rated),

BFN-18 14.10-2 c. The turbine bypass valves are opened simultaneously with turbine control valve closure, d. Reactor vessel pressure rises to the ma in steam relief valve setpoints, causing them to open for a short period. The steam passed by the main steam relief valves is discharged into the pressure suppression pool, and

e. The turbine bypass system controls nuclear system pressure after the main steam relief valves close.

Below about 25 percent of rated power, the bypass system will transfer steam around the turbine and thereby avoid reac tor scram. Between about 25 percent to 30 percent power, high-pressure scram will result unless operator action can reduce power to within the bypass capacity.

14.10.1.1.1 Generator Trip (TCV Fast Closure)

With Bypass Valve Failure The most severe transient for a full-power generator trip occurs if the turbine bypass valves fail to operate. Althoug h the TCV fast closure time is slightly longer than that of the turbine stop valves, the control valves are considered to be partially closed initially. This results in the generator trip steam supply shutoff being faster than the turbine stop valve steam shutoff.

A generator trip from high power conditions produces a transient sequence similar to the sequence described in Section 14.10.1.

1 except the turbine bypass valves are assumed to remain closed.

This abnormal operating transient is evaluat ed for each reload core to determine if this event could potentially alter the previous cycle MCPR operating limit. The analyses of this event for the most recent reload cycle is contained in the Reload Licensing Report. A typical generator load rejection bypass is shown in Figure 14.10-20. Assuming the init ial reactor power level is 105 percent nuclear boiler rated steam flow, the neutr on flux peaks at 281 percent nuclear boiler rated, the average heat flux peaks at 111 percent of it s initial value and MC PR remains greater than the safety limit MCPR. The peak pr essure at the bottom of the vessel is approximately 1245 psig which is well below the established transie nt limit of 1375 psig. (Reference - "Basis For Installati on of Recirculation Pump Trip System", NEDO-24119A, April 1978).

14.10.1.2 Loss of Condenser Vacuum This case is a severe abnormal operational transient resulting directly in a nuclear system pressure increase.

It represents the events that would follow an assumed instantaneous loss of vacuum and closure of the turbine stop valves and bypass BFN-18 14.10-3 valves with a turbine trip scram. It is assu med that the plant is initially operating at design power (105 percent rated).

Figure 14.10-1 shows a typical transient with relief capacity equal to 61 percent of rated steam flow. Peak neutron flux reaches 198 percent of the rated power; however, the fuel surface heat flux does no t exceed 107 percent of its initial value and peak fuel center temper ature increases less than 150

°F. No damage to the fuel results from the transient.

The main steam relief valves open fully to limit the pressure rise, then sequentially reclose as the stored energy is dissipated. The peak nuclear system pressure at the botto m of the vessel is also well below the nuclear process barrier transient pressure limit of 1375 psig.

14.10.1.3 Turbine Trip

This case represents the events that would follow an assumed tr ip of the turbine stop valve producing the fastest possible steam flow shutoff and severe nuclear system pressure increase. It is assumed that the plant is initially operating at design power. The sequence of events for a turbine trip is very similar to t hat for a generator load rejection. However, the valve closure is faster, occurring over a period of about 0.1 second. Position switches on the stop valves provide the means of sensing the trip and initiating immediate reactor scram, recirculation pump trip, and bypass valve opening. Figure 14.10-2 shows a typical transient expected from design power conditions with 61 percent relief capacity.

The main steam relief valves open for a short time to help relieve the pressure transient, and then the bypass valves control the reactor pressure for post-trip conditions. The fuel thermal transient is mild.

Peak pressure in the bottom of the vessel and at the steam lines is below the ASME Code limits for the nuclear process barrier.

Turbine trips from lower initial power levels decrease in severity to the point where scram may even be avoided within the bypass capacity if auxiliary power is available from an external source.

14.10.1.4 Bypass Valves Failure Fo llowing Turbine Trip, High Power This event is included to illustrate that single failure could prevent the turbine bypass valves from opening in conjunction with a turbine trip.

14.10.1.5 Bypass Valves Failure Following Turbine Trip, Low Power This abnormal operational transient is of in terest because turbine stop valve closure and turbine control valve fast closure scr ams are automatically bypassed when the reactor power level is low. Turbine first-st age pressure is used to initiate this bypass at 154 psig. The highest power level for which these scrams remain bypassed is

about 30 percent of rated pow er. Figure 14.10-3 graphically shows the transient BFN-18 14.10-4 starting with the recirculation pumps at about 20 percent speed producing 40 percent core flow at 31 percent rated power. Reactor scram is initiated at about 3.0 seconds by high vessel pressure. No bypa ss flow is assumed; however, the main steam relief valves partially open to relie ve the pressure transient. The peak pressure at the main steam relief valves is well below the ASME Code limits. Since pressure remains below 1375 psig at the bottom of the vessel, no damage occurs to the nuclear process system barrier. No fuel damage occurs since peak heat flux is significantly lower than rated conditions.

14.10.1.6 Main Steam Isolation Valve Closure

Automatic circuitry or operator action can init iate closure of the main steam isolation valves. Position switches on the valves provide reactor scram if valve(s) in three or more main steam lines are less than 90 percent open and reactor pressure is greater than 1,055 psig or the mode switch is in the Run position. However, Protection System logic does permit the te st closure of one valve without initiating scram from the position switches. Inadverte nt closure of one or all of the isolation valves from reactor scrammed conditions (such as Operating States C or E) will produce no significant transient. Closures during plant heatup (O perating State D) will be less severe than the maximum power cases (maximum stored and decay heat) which follow.

14.10.1.6.1 Closure of All Main Steam Isolation Valves Figure 14.10-4 shows typical changes in im portant nuclear system variables for the simultaneous isolation of all main steam li nes while the reactor is operating at design power. Reactor scram is initiated by the isolation valve position switches before the valves have traveled more than 10 percent from the open position.

A three-second nonlinear valve closure was simulated, which is the fastest closure attainable.

Scram is initiated very early into the event; therefore, no fuel c enter temperature, or fuel surface heat flux peaks occur. A small neutron flux peak occurs near 2 seconds. The nuclear system main steam relief valves begin to open when pressure reaches the lowest setpoint at about 2.5 seconds afte r the start of the isolation. They close sequentially as t he stored heat is dissipated and will continue to intermittently discharge the decay heat.

The peak pressure in the main steam line near the spring setpoint main steam relief valv es is well below t heir setpoint. Peak pressure at the bottom of the vessel is also below the pressure limits of the nuclear system process barrier.

14.10.1.6.2 Closure of One Main Steam Isolation Valve Closure of only one isolation valve without scr am is permitted for testing purposes. Normal procedures for such a test will normally require an initial power reduction to about 80-90 percent of design conditions in or der to avoid high flux or pressure scram. Figure 14.10-5 graphically shows typical changes of important nuclear BFN-18 14.10-5 system variables during the simulated th ree-second closure of one main steam isolation valve from design power conditions. The steam flow disturbance raises vessel pressure and reactor power caus ing a high neutron flux scram. Peak pressures remain below the setting of the lowest main steam relief valves and peak fuel parameters are well below the point at whic h damage might occur.

14.10.1.7 Pressure Regulator Failure Pressure regulator malfunctions that result in the turbine steam flow shutoff and a nuclear system pressure increase are simila r to but of milder consequence than the generator trip described previously.

14.10.2 Events Resulting in a Reacto r Vessel Water Temperature Decrease Events that result directly in a reactor vessel water temperature decrease are those that either increase the flow of cold wate r to the vessel or reduc e the temperature of water being delivered to the vessel. The events that result in the most severe transients in this category are the following:

a. Loss of a feedwater heater,
b. Shutdown cooling (RHRS) malfunction-decreasing temperature, and c. Inadvertent pump start.

14.10.2.1 Loss of a Feedwater Heater A feedwater heater can be lost if the steam extraction line to the heater is shut, the heat supply to the heater is removed, produc ing a gradual cooling of the feedwater.

The reactor vessel receives cooler feedwater which produces an increase in core inlet subcooling. Due to the negative void reactivity coefficient, an increase in core power results. An assumed loss of f eedwater heating event is analyzed for each reload cycle using the methodology in NEDE-24011-P-A and the results are contained in the Reload Licensing Report.

Figure 14.10-6 shows a typical response of the plant to the loss of 100

°F of the feedwater heating capability of the plant. This repres ents the maximum expected single heater (or group of heaters) which can be tripped or bypassed by a single event. The reactor is assumed to be at design power conditions on automatic recirculation flow control when the heater is lost. For this analyzed case, the feedwater flow delay time of approxim ately 25 seconds between the heaters and the feedwater sparger is neglected. The plant would continue at steady-state conditions during this delay period. The recirculation flow control system responds to the power increase by reducing core flow so t hat steam flow from the reactor vessel to the turbine remains essentially constant throughout the transi ent. Neutron flux BFN-18 14.10-6 increases above the initial value to pr oduce turbine design steam flow with the higher inlet subcooling. Normally the reac tor would be on manual flow control, and this neutron flux increase would have reach ed within 1 percent of the scram setting.

In the case with automatic control, reactor power settles out sli ghtly below the scram setting, but with core flow reduced to about 90 percent. The average power range monitors provide an alarm to the operator at about 20 seconds after the cooler feedwater reaches the reactor vessel.

Because nuclear system pressure remains essentially constant during this transient, the nuclear system proc ess barrier is not threatened by high internal pressure. All fuel parameters remain below the limiting values at which fuel damage could occur.

This transient is less severe from lower power levels for two main reasons: (1) lower initial power levels will have initial fuel par ameter values less limit ing than the values assumed here, and (2) the m agnitude of the power rise decreases with the initial power condition. Therefore, transients from other reacto r operating states or lower power levels within operating state F will be less severe.

14.10.2.2 Shutdown Cooling (RHRS)

Malfunction-Decreas ing Temperature A shutdown cooling malfunction leading to a moderator temperat ure decrease could result from misoperation of the cooling water controls for the RHRS heat exchangers. The resulting te mperature decrease causes a slow insertion of positive reactivity into the core. If the reactor were critical or near critical (operating states B or D), a very slow reactor power increase could result. If no operator action were taken to control the power level, a high neutron flux reactor scram would terminate the transient without fuel damage and without any measurable nuclear system pressure increase.

14.10.2.3 Inadvertent Pump Start

Several systems are available for providing high-pressure supplies of cold water to the vessel for normal or emergency functions. The control rod drive system and the makeup water system, normally in operati on, can be postulated to fail in the high-flow direction introducing the possibility of increased power due to higher core inlet subcooling. The same type of transient would be produced by inadvertent startup of either the RCIC S ystem or the HPCI System.

In all of these cases, the normal feedwater flow would be correspondingly reduced by the water level controls.

The net result is simply a r eplacement of a portion of the 370

°F feedwater flow (at design power operation) by approximately 100

°F flow. The severity of the resulti ng transient is highest for the largest of these abnormal events: the inadvertent startup of the large, 5000 gpm HPCI System.

BFN-18 14.10-7 Since the startup of the steam-turbine driven pump takes approximately 25 seconds, the transient that occurs is very similar to the loss of feedwat er heater transient given above. As in that case, the most threatening transient would occur where minimum initial fuel thermal margins ex ist (maximum power within reactor operating state F). The HPCI startup transient is cl early less severe than the loss of feedwater heater case because its effect on mixed feedwater temperature will produce a change of only 46

°F compared to the 100

°F change previously analyzed. For this reason, no fuel clad barrier damage will result for the malfunction or inadvertent startup of any of these auxiliary cold water supply systems.

14.10.3 Events Resulting in a Po sitive Reactivity Insertion Events that result directly in positive reac tivity insertions are the results of rod withdrawal errors and errors during refueling operations. The fo llowing events result in a positive reactivity insertion:

a. Continuous rod withdrawal during power range operation, b. Continuous rod withdrawal during reactor startup, c. Control rod removal error during refueling, and
d. Fuel assembly inserti on error during refueling.

14.10.3.1 Continuous Rod Withdraw al During Power Range Operation Control rod withdrawal errors are considered over the entire power range from any normally expected rod pattern. The cont inuous withdrawal, from any normal rod pattern, of the maximum wo rth rod (approximately 0.01 k) results in a very mild core transient. The system will stabilize at a higher power level with neither fuel damage nor nuclear system process barrier damage.

The limiting control rod withdrawal error during power range operation is examined for each reload cycle using the methodology in NEDE-24011-P-A and the results presented in the Reload Licensing Report.

Figure 14.10-7 shows typical results of an analysis of the continuous withdrawal, at design power, of the rod wit h the maximum possible worth. For this analysis, the central rod was left fully inserted in the core and all other rods withdrawn such that the worth of the central rod was maximized.

This rod configuration could only be achieved by deliberate operator action or by numerous operator errors during rod pattern manipulation prior to the selecti on and complete withdraw al of the rod.

Abnormal indications and APRM alarms woul d warn the operator as he approaches this abnormal rod pattern. The rod block monitors (RBM) stop the rod withdrawal.

The increase in nuclear system pressure is less than 50 psi. Thus, neither nuclear system process barrier damage nor fuel damage occur.

BFN-18 14.10-8 14.10.3.2 Continuous Rod Withdr awal During Reactor Startup Control rod withdrawal errors are considered when the r eactor is at power levels below the power range. The most severe case occurs when the reactor is just critical at room temperature and an out-of-sequence rod is continuously withdrawn.

The rod worth minimizer would normally prevent withdrawal of such a rod. It is assumed that the Intermediate Range Neutr on Monitoring (IRM) channels are in the worst conditions of allowed bypass. The scaling arrangement of the IRMs is such that for unbypassed IRM channels a scram si gnal is generated before the detected neutron flux has increased by more than a fa ctor of ten. In addition a high neutron flux scram is generated by the APRMs at 15 percent and at 120 percent of rated power. The analysis was performed for a 2.5 percent k control rod withdrawal at the rod drive speed of 3 in./sec starting from an average mode rator temperature of 82

°F. The results of these analyses indicate a maximum fuel temperature well below the melting point of UO 2 and a maximum fuel clad temper ature which is less than the normal operating temperature of the clad. The possible failure of the fuel clad due to strain was analyzed using the following conservative assumptions:

1. The total volume expansion of UO 2 is in the radial direction, 2. There is no thermal expansio n of the fuel cladding, and 3. The fuel is assumed to be incompressible.

The results of these analyses indicate a maxi mum radial strain analogous to a radial expansion of 0.6 mils, whic h is much less than the postu lated cladding damage limit of approximately 1 percent plastic strain, which corresponds to approximately 3.3 mils radial expansion.

Thus, no fuel damage will occur due to a c ontinuous rod withdrawal during reactor startup.

14.10.3.3 Control Rod Removal Error During Refueling The nuclear characteristics of the core assure that the reactor is subcritical even in its most reactive condition with the most reactive control rod fully withdrawn during refueling.

When the mode switch is in Refuel, onl y one control rod can be withdrawn.

Selection of a second rod initiates a rod block thereby preventing the withdrawal of more than one rod at a time.

BFN-18 14.10-9 Therefore, the Refueling Interlocks will prevent any condition which could lead to inadvertent criticality due to a control rod withdrawal error during refueling when the mode switch is in the Refuel position.

In addition, the design of the control rod, incorporating t he velocity limiter, does not physically permit the upward re moval of the control rod wit hout the simultaneous or prior removal of the four adjacent fuel a ssemblies, thus elimin ating any hazardous condition.

14.10.3.4 Fuel Assembly Insertion Error During Refueling

The core is designed such that it can be made subcritical under the most reactive conditions with the strongest control rod fully withdrawn. Therefore, any single fuel assembly can be positioned in any availabl e location without violating the shutdown criteria, providing all the control rods are fully inserted. The refueling interlocks require that all control rods must be fully inserted before a fuel bundle may be inserted into the core.

14.10.4 Events Resulting in a Reacto r Vessel Coolant Inventory Decrease Events that result directly in a decrease of reactor vessel coolant inventory are those that either restrict the norma l flow of fluid into the vesse l or increase the removal of fluid from the vessel. Four events are identified as causing the most severe transients in this category:

a. Pressure regulator failure,
b. Inadvertent opening of a main steam relief valve,
c. Loss of feedwater flow, and d. Loss of auxiliary power.

14.10.4.1 Pressure Regulator Failure If either the controlling pressu re regulator or the backup pressure regulator fails in an open direction, the turbine admission va lves can be fully opened, and the turbine bypass valves can be partially or fully opene

d. This action initially results in decreasing coolant inventory in the reactor vessel as the mass flow of steam leaving the vessel exceeds the mass flow of water ent ering the vessel. The total steam flow rate resulting from a pressure regulator ma lfunction is limited by the turbine controls to about 125 percent of design flow.

Figure 14.10-8 graphically shows a typical transient, starting at design power, resulting from a pressure regulator malfunction in which a steam flow demand capable of fully opening the turbine control and bypass valves is assumed as a most severe case. The depressurization results in the formation of voids in the reactor coolant causing a rapid rise in reactor vessel water level up to the high level trips BFN-18 14.10-10 (level 8). The reactor scrams after about 2 seconds due to the trip of the main turbine. A typical turbine trip response occu rs, but it is milder than the limiting cases since power had begun to drop due to the depressurization. The peak neutron flux and fuel surface heat flux do not exceed the initial power. There is no reduction in fuel thermal margins. The bypass system is also already open (due to the failed regulator), therefore the pressure increase is mild, opening only part of the main steam relief valves. They quickly reclose and the depressurization trend is reestablished. The main steam isolation valves automatically close when pressure at the turbine decreases below 840 psia (and t he reactor mode switch is in RUN) near 50 seconds. (See Subsection 7.3, "Primary Containment and Reactor Vessel Isolation Control System"). The reactor vessel isolation limit s the duration and severity of the final depressurization so that no significant thermal stresses are imposed on the nuclear system process barrier. After the rapid portion of the transient is complete and isolation is effective, the nuclear system main steam relief valves may again operate intermittently to re lieve the pressure rise resulting from decay heat generation. Because the initia l portion of the transient results in depressurization of the nuclear system and power reduction, only a portion of the main steam relief valves need to operate to relieve the pressure increase due to the nuclear system process barrier.

14.10.4.2 Inadvertent Opening of a Main Steam Relief Valve The opening of a main steam relief valve allows steam to be discharged into the primary containment: The s udden increase in the rate of steam flow leaving the reactor vessel causes the reactor vessel c oolant (mass) inventory to decrease. The result is a mild depressurization transient.

Figure 14.10-9 shows a typical transient resulting from the opening of a main steam relief valve with the capacity to pass 6.5 percent of rated nuclear system steam flow. An initial power level corresponding to design power conditions is assumed.

The pressure regulator senses the nuclear system pressure decrease and closes the turbine control valves far enough to main tain constant reactor vessel pressure.

Reactor power settles out at nearly the init ial power level. Automatic recirculation flow control (assumed to be active) increases recirculation flow to the maximum.

Because the recirculation flow cannot satisfy the additional load demand, the pressure regulator setpoint is automatica lly reduced to its lower limit, and nuclear system pressure decreases. No fuel damag e results from the transient. Because pressure decreases throughout the transien t, the nuclear system process barrier is not threatened by high internal pressure. The small amounts of radioactivity discharged with the steam are contained inside the pr imary containment; the situation is not significantly different, fr om a radiological vi ewpoint, from that normally encountered in cooling the plant using the main steam relief valves to remove decay heat.

BFN-18 14.10-11 14.10.4.3 Loss of Feedwater Flow A loss of feedwater flow results in a sit uation where the mass of steam leaving the reactor vessel exceeds the mass of water entering the vessel, resulting in a net decrease in the coolant inventor y available to cool the core.

Feedwater control system failures or feedwater pump trips can lead to partial or complete loss of feedwater flow. Figure 14.10-10 graphically shows a typical transient resulting from the trip of all feed pumps from design power. Feedwater system inertia results in a 5 second f eedwater flow decrease before flow is completely stopped. The decrease in feedwat er flow produces a slight pressure drop and a decrease in core inlet subcooling which both increase core void fraction, and reduce reactor power initially and helps moderate the decrease in actual reactor vessel water level for the first few seconds of the transient. However, sensed reactor vessel water level decreases quickly, causing a reactor low water level scram at about 6 seconds. The maximum rate of actual level decrease is about 7 inches/second. Startup of the RCICS, HPCI, isolation of the main steam lines and recirculation pump trip occurs near 16 seconds when wide range level reaches about 50 inches below the separator skirt

(-51.5 inches in Fi gure 14.10-10). The ability of the RCICS alone to maintain adequate core coverage is described under "Loss of Auxiliary Power" below.

Pressure in the reactor vessel decreases gradually with the power reduction so that no threat is posed for the nuclear system process barrier. After the main steam isolation valves close, decay heat slowly raises nuclear system pressure to the lowest main steam relief valve setting, but no excessive overpressure occurs.

This transient is most severe from high power (operating state F) conditions, since the rate of level decrease is greatest and the amount of stored and decay heat to be dissipated is highest.

After lowering the Main Steam Isolation Valve (MSIV) reactor water level set point (Reference NEDE-30012 Decemb er 1982), the transient for loss of feedwater flow was re-evaluated. This evaluation was performed by General Electric using the Appendix K evaluation models with the following conservative assumptions:

a. Conservative decay heat values (1973 ANS + 20%)

are used to maximize heat addition to the vessel, main steam relie f valve challenges, and inventory loss.

b. The initial reactor power is assum ed at 102% of licensed power which also maximizes the above parameters.
c. The initial water level in the reactor ve ssel is assumed to be at the scram level (Level 3) and the reactor is scrammed at time zero. This is consistent with Appendix K LOCA analysis.

BFN-18 14.10-12 d. The feedwater pumps are assumed to c oast down in 1 second. This is also consistent with the Appendix K LOCA analysis.

e. Only RCIC will initiate at Level 2. Since the HPCI injection rate is about 10 times that of RCIC, this assumption prov ides the most severe challenge to the reactor core cooling.

The major change in the transient is that th e main steam lines are not isolated with the startup of HPCI and RCIC when the reactor water level reaches the reactor water level 2 setpoint. As shown in Figure 14.10-10a, RCIC alone is still capable of maintaining adequate core coverage with the MSIV's open. RCIC also maintains

reactor water level above the MSIV water level isolation setpoi nt; therefore, the MSIV's remain open and the main condenser re mains as a heat sink. As shown in Figure 14.10-10b, reactor pressure is ma intained at approximately 950 psig by the turbine bypass valves. Pressure suppression pool heatup which could occur as a result of main steam relief valve actuation is totally eliminated from this event with the new MSIV reactor water level setpoint.

14.10.4.4 Loss of Auxiliary Power The reactor is subjected to a complex s equence of events when the plant loses all auxiliary power. This can occur if all external grid connect ions are lost or if faults occur in the auxiliary power system itself. Estimates of the responses of the various reactor systems to loss of auxiliary power provided the following simulation sequence:

a. All pumps are tripped at time = 0.

Normal coastdown time s were used for the recirculation and feedwater pumps.

b. At time = 5 seconds, the reactor prot ection system MG sets are assumed to coast down to the point that RPS instrum entation power is lost. This initiates closure of the MSIV's which also pr oduces a scram signal after the valves have moved 10 percent of their total movement.
c. The condenser vacuum was assumed to continue dropping and reaches the turbine trip setting by 6 seconds. T he turbine bypass valves open for a short period (about 2 seconds), t hen they close due to the lo ss of pressure in the main steam lines downstream of the MS IV's once the MSIV's complete their closure at time = 8 seconds.

Figure 14.10-11 graphically shows for lo ss of auxiliary power the simulated transients from design power. Th e initial portion of the transient is very similar to the loss of all feedwater described above exce pt for the recirculation pump trip.

Initiation of scram, isolation valve closure, and turbine trip all occur between 5 to 6 BFN-18 14.10-13 seconds and the transient c hanges to that of an isolatio

n. The main steam relief valves open for a short time then sequentially reclose as the remainder of the stored heat is dissipated. Peak pressures reached only 100 psi above nominal operating pressures; therefore, no safety valve lifting was initiated nor were the vessel pressure limits approached. Note how the lowest main steam relief valve group in the model was reopened and reclosed as the generated heat drops down into the decay heat characteristic. This pressure and relief cycle will be continued with slower frequency and shorter relief discharges as the decay heat drops off up to the time the RHRS, in the shutdown cooling mode, can dissipate the heat. Sensed level

dropped to the RCIC, HPCI and isolation initiation setpoint (about -51.5 inches in Figure 14.10-11) 25 seconds after the loss of auxiliary power.

A different transient results if complete connection with the external grids is lost at time = 0. The same sequence as above would be followed except that the reactor would also experience a generator load rejection and its associated trip scram at the beginning of the transient. Figure 14.10-12 shows this simulated loss of auxiliary power event from design power. No increase in neutron flux occurs due to the trip scram and the recirculation pump trips. No increase in fuel surface heat flux occurs, and the thermal behavior is again much like a si mple recirculation pump trip. Peak pressures are virtually identical to the pr evious case; however, they occur sooner during the transient. Wide range (WR) sensed level dropped to the RCIC, HPCI and isolation initiation point by 30 seconds.

No fuel damage occurs in either case, since the only critical fuel transient is almost exactly the same as that experienced during the trip of both recirculation motor generator (MG) set drive motors. By about 20 seconds after the simulated losses of power, both transients look essentially identical. Pressure is cycling about the lowest main steam relief valve setpoints and water level is dropping gradually, waiting for RCIC (or HPCI) operation to rest ore water level control. Figure 14.10-13 shows the calculated long-term water level transient conservatively considering RCIC operation only beginning at 90 seconds and reaching full RCIC flow (600 gpm) at 120 seconds. The minimum calculated water level is 100 inches above the top of the active fuel, providing ample margin.

14.10.5 Events Resulting in a Core Coolant Flow Decrease Events that result directly in a core coolant flow decrease are t hose that affect the reactor recirculation system. Transients beginning from operating state F are the most severe since only in this state do pow er levels approach fuel thermal limits.

The following events result in the most si gnificant transients in this category:

a. Recirculation Flow Control Failure-Decreasing Flow, b. Trip of One Recirculation Pump, c. Trip of Two Recirculation Pump MG Set Drive Motors, and d. Recirculation Pump Seizure.

BFN-18 14.10-14 14.10.5.1 Recirculation Flow Control Failure-Decreasing Flow Several varieties of recirculation flow c ontrol malfunctions can cause a decrease in core coolant flow. The master controller could malfunction in such a way that a zero speed signal is generated for both recircul ation pumps. The recirculation flow control system is provided with a speed demand limiter which is set so that this situation cannot be more severe t han the simultaneous tr ipping of both recirculation pump MG set drive motors.

A simultaneous trip of both recirculation pump MG set drive motors is ev aluated in paragraph 14.10.5.3.

The remaining recirculation flow contro ller malfunction is one in which the speed controller for one recirculation pump set fails in such a way that the speed controller output signal changes in the direction of zero speed. This transient is similar but less severe than the trip of one recirculation pump. A trip of o ne recirculation pump is evaluated in paragraph 14.10.5.2.

14.10.5.2 Trip of One Recirculation Pump Normal trip of one recirculation pump is accomplished through the drive motor breaker. However, a worse coastdown tr ansient occurs if the generator field excitation breaker is opened, separating the pump and its motor from the inertia of the MG set. This condition was assum ed for this calculation. Figure 14.10-14 shows a typical transient from design power conditions. Diffuser flows on the tripped side reverse at about 3 seconds; however, M-ra tio in the active jet pumps increases greatly, producing about 150 percent of normal diffuser flow. No fuel damage results from this transient.

14.10.5.3 Trip of Two Recirculation Pump MG Set Drive Motors This two-loop trip provides the evaluation of the fuel thermal margins maintained by the rotating inertia of the recirculation drive equipment. No single operator act or plant protection action can produce simultaneous trip of the generator field breakers in both loops. Plant protection action can, however, simultaneously trip the power supplying the MG set drive motors. Also, the recirculation pump trip (RPT) system can trip both pumps.

Figure 14.10-15 graphically shows the transient resulting from the trip of both MG set drive motors with the minimum design rotating inertia from design power. Fuel thermal margin reached its worst condi tion near 2.0 seconds; however, no damage to the fuel barrier occurs.

No scram is initiated directly by the simultaneous MG set motor trip and the power will se ttle out at part-load, natural circulation conditions. An inadvertent RPT has also been analyzed and shown to have similar results.

BFN-18 14.10-15 14.10.5.4 Recirculation Pump Seizure*

This case represents the instantaneous stoppage of the pump motor shaft of one recirculation pump. It produc ed the most rapid decrease of core flow. The reactor is assumed to be operating at design power. Figure 14.10-16 shows a typical transient. The fast decrease in recirculat ion flow in the seized loop is due to the large hydraulic resistance introduced by the stopped rotor. Core coolant flow reaches its minimum value at about 1.5 seconds. Nucleate boiling is maintained throughout the transient and no damage occurs to the fuel barrier. No scram occurs. The initial pressure regulator ma intains pressure control as the reactor settles out at the final, lower power condi tion. Because nuclear system pressure decreases throughout the transient, the nuc lear system process barrier is not threatened by overpressure.

  • This event has been reclassified as an accident (see NEDE-24011-P-A-US)

14.10.6 Events Resulting in a Core Coolant Flow Increase

Events that result directly in a core coolant flow increase are t hose that affect the reactor recirculation system. The following events result in the most significant transients in this category:

a. Recirculation Flow Control Failure-Increasing Flow, and b. Startup of Idle Recirculation Pump.

14.10.6.1 Recirculation Flow Controller Failur e - Increasing Flow Several possibilities exist for an unplanned increase in core coolant flow resulting from a recirculation flow control system malf unction. Failure of the master controller can result in a speed increase for both recirculation pumps. On Unit 1, the maximum output signal of the master controller is provided with rate limits which are adjusted in such a way that a master controller failure is less severe than a failure of one of the MG set speed contro llers. The most severe case of increasing coolant flow results when the MG set fluid coupler for one recirculation pump attempts to achieve full speed at maximum acceleration. The maximum acceleration for this failure is 25 percent of full speed per sec ond. The most severe transient results when reactor power is initially at 68 percent of rated, which is at the lower end of the automatic flow control range. These condi tions correspond to the lowest power and flow conditions on the automatic flow contro l characteristic curve for the reactor.

Figure 14.10-17 shows typical results of the transient. The changes in nuclear system pressure are not significant with regard to overpressure. The pressure decreases over most of the transient. T he rapid increase in core coolant flow causes an increase in neutron flux, which in itiates a reactor scram. The transient BFN-18 14.10-16 fuel surface heat flux reaches 83 percent of rated heat flux, but it barely exceeds the steady state power-flow control curve. No fuel damage occurs.

14.10.6.2 Startup of Idle Recirculation Pump The transient response to the starting of an idle recirculation loop without warming the drive loop water is shown in Figure 14.

10-18. The assumed initial conditions are as follows:

a. One recirculation loop is id le and filled with cold water (100

°F). (Normal procedure requires warming this loop.), b. The active recirculation pump is operating at a speed that produces about 125 percent of normal rated jet pump diffuser flow in the active jet pumps, c. The core is receiving 48 percent of its normal rated flow; the remainder of the coolant flows in the reverse directi on up through the inactive jet pumps, d. Reactor power is 68 percent of design power. This is the highest initial power for which a high neutron flux scram is not initiated. (Normal procedures require startup of an idle loop at a much lower power.) If transient is initiated from higher power scram will occur and the results will be less severe, e. The idle recirculation pump suct ion and bypass valves are open: the pump discharge valve is closed, and

f. The idle pump fluid coupler is at a setting which approximates 50 percent of generator speed demand.

BFN-18 14.10-17 The loop startup transient sequence is:

a. The recirculation pump MG se t breaker is closed at t = 0,
b. The motor reaches near synchronous speed quickly, while the generator approaches full speed in appr oximately 5 seconds, c. Next, the generator field breaker is closed, loading the g enerator and applying starting torque to the pump motor and generator speed decreases as the generator tries to start the stopped rotor of the pump. Pump breakaway is modeled to occur at 8 seconds. Speed demand is sequentially programmed back to 20 percent of rated speed, and
d. The pump discharge valve is started open as soon as its interlock with the drive motor breaker is cleared. (Normal procedure would delay valve opening to separate the two portions of the flow transient and make sure the idle loop water is properly mixed with the hot wa ter in the reactor vessel.) A nonlinear 30-second valve opening char acteristic is used.

Shortly after the pump begins to move, a surge in flow fr om the started up jet pump diffusers gives the core inlet flow a sharp rise. A short-duration neutron flux peak of almost 105 percent (no scram occurs) is produced; however, surface heat flux follows the slower response of the fuel. No damage occurs to the fuel barrier and no significant changes in nuclear system pressure result from the transient.

Throughout the transient, diffuser flow in the startup loop jet pumps is either reversed or less than about 10 percent of rated.

For this reason, the cold loop water does not significantly affect the transient.

14.10.7 Event Resulting in E xcess of Coolant Inventory An event which can cause directly, an excess of coolant inventory is one in which makeup water flow is increased without changing other core parameters. The Feedwater Control System Failure - Maxi mum Demand is the limiting event of the excess coolant inventory type. The analysi s results for the feedwater controller failure to maximum demand for the curr ent cycle are presented in the Reload Licensing Report. The methodology and anal ysis assumptions for the current reload cycle analysis described in NEDE-24011-P-A differ from the older analysis described below. The typical response of the plant to a fa ilure of the feedwat er controller which demanded maximum flow is shown in Figure 14.10-19. The transi ent was initiated from the low end of the analyt ical automatic flow cont rol range (68 percent rated power) producing a more severe steam/feed flow mismatch and level transient than BFN-18 14.10-18 would be produced at higher power. The feedwater pumps were assumed to accelerate to their maximum capability.

Sensed and actual water level increase durin g the initial part of the transient at about 4.0 inches/sec. The high water level main turbine trip and feedwater turbine

trip was initiated at 5 seconds when s ensed level had increased about 19-21 inches preventing excessive carryover from damaging the turbines. Scram occurs simultaneously with the turbine trip, limiti ng the neutron flux peak and fuel thermal transient so that no fuel damage occurs.

The turbine bypass system opens to limit t he pressure rise. The lower set main steam relief valves open only momentarily and no excessive overpressure of the nuclear system process barrier occurs.

The bypass valves close at about 24 seconds, bringing the pressure in the ve ssel under control during reactor shutdown.

Although lower initial power conditions would result in more rapid increases in level, high power cases represent the maximum threat to fuel clad and nuclear system process barriers. Obviously, no power transient will occur if the r eactor is shut down (operating States C and E).

14.10.8 Loss of Habitabilit y of the Control Room Loss of habitability of t he control room is arbitrarily postulated as a special event to demonstrate the ability to safely shut dow n the reactor from outside the control room. (For additional information see Section 7.18 - Backup-Control System)