ML113140613

Enclosure 3 - Regulatory Enforcement Conference - Resubmittal of Supplement

ML113140613
Person / Time
Site:	Oconee
Issue date:	11/01/2011
From:	Byers G, Carroll B, Henshaw E, Thomas S, Kanipe L Duke Energy Carolinas
To:	NRC/RGN-II
References
Download: ML113140613 (36)

Text

Enclosure 3 Thermal- Hydraulic Response PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters (R2)

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Notice: This document pertains only to a PRA risk discussion concerning the potential loss of SSF pressurizer heaters and the expected thermal hydraulic response of the plant and the response of operators to these abnormal conditions. This information represents the best available information on this subject.

The statements or opinions provided herein do not represent licensing or regulatory positions with respect to the Oconee SSF. Therefore, the use of this document should be limited to the development of PRA risk models or the assessment of the risk signficance of issues associated with the SSF heaters.

Authors Lee Kanipe, Senior Engineer Greg Byers, Principal Engineer Eric Henshaw, Principal Engineer Bryan Carroll, PRA Manager Scott Thomas, Safety Analysis Manager Duke Energy Revision 2 November 1, 2011

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Executive Summary Duke Energy has performed detailed thermal hydraulic analyses to evaluate the plant response for Oconee SSF scenarios involving the loss of the SSF pressurizer heaters.

This evaluation stems from the discovery of a design deficiency where the heater breakers were not qualified for the harsh environment expected in containment following an event requiring the use of the SSF. The goal of the evaluation was to identify the scenarios that are important to the PRA evaluation and describe the plant thermal hydraulic response for these scenarios.

The loss of pressurizer heaters in an SSF event creates off-normal conditions that require operators to perform a different set of actions to control RCS pressure and maintain core cooling. Based on the SSF procedural guidance in place at the time of discovery, there are three procedure paths that operators may take to attempt to control the plant as the pressurizer steam bubble decreases. Regardless of which approach operators use to control pressure, analysis shows that the system evolves into a sub-cooled water-solid natural circulation condition. SSF operators see a slow moving transition to a solid pressurizer condition that is easy to monitor and control, and presents no significant challenge to human performance. Hand calculations and other means of predicting the plant response support this conclusion. There are no significant risk concerns with either a loss of subcooling or lifting primary code safety valves during or after the transition to water-solid conditions.

Therefore, the risk impact of a loss of SSF pressurizer heaters is limited to accident sequences involving a stuck-open primary safety valve induced by either an operator error or failure of the letdown isolation valve to open when required to control RCS pressure. The operator action in these cases is considered very reliable because of the slow-moving nature of the pressure changes and because written procedure guidance, validated in operator training, is used.

The overall conclusion of this evaluation is that Duke Energy has high confidence in the successful mitigation of accidents involving the loss of SSF pressurizer heaters when operators follow procedural guidance. A review also found precedent for the use of water-solid operation in Appendix R Rulemaking as described in Generic Letter 86-10.

Appendix A was added in Revision 1 of this document to provide information supporting the thermal hydraulic codes used in the Significance Determination Process (SDP) evaluations.

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters

1. Introduction This paper provides perspectives on the PRA risk evaluation associated with design deficiencies identified with the Oconee SSF pressurizer heater breakers. The loss of pressurizer heaters in an SSF event creates off-normal conditions that require operators to perform a different set of actions to control RCS pressure and maintain core cooling. The goal of this paper is to identify the scenarios that are important to the PRA evaluation and describe the plant thermal hydraulic (T/H) response for these scenarios.

The specific design deficiency of concern for this paper is that the breakers that power the SSF pressurizer heaters were not qualified for the harsh environment expected in containment following an event requiring the use of the SSF.

2.0 Background The normal mitigation strategy in AP/0/A/1 700/025 (SSF Emergency Operating Procedure) is to return the RCS to normal post trip conditions after activating the SSF systems by performing a slow cool down based on RCS pressure indication. A hot standby condition is eventually achieved in the RCS with decay heat being removed by SSF ASW flow by natural circulation in the primary system, RCS temperature controlled by the lowest lifting main steam relief valves (MSRVs), SG levels controlled to natural circulation levels, pressurizer level controlled with the SSF letdown line, and RCS pressure controlled by using the SSF powered pressurizer heater elements with a steam bubble present in the pressurizer.

The SSF letdown line is normally isolated and remains isolated prior to reaching normal post-trip conditions (Tave 555 °F). During this initial cooldown, RCS pressure and pressurizer level are held steady by adjusting the cboldown rate so that RCS shrinkage is matched by the makeup rate from the SSF Reactor Coolant Make Up Pump (RCMUP).

The SSF RCMUP is a positive displacement pump with a capacity of 29 gpm. At typical RCS leakage rates, the net makeup capacity (excluding letdown) is approximately 28 gpm. When normal post-trip conditions are reached, SSF ASW flow is throttled to control steam generators at the natural circulation setpoint and the SSF letdown line is opened to balance makeup flow to maintain pressurizer level. At typical RCS leakage rates, the mass flow rate through the letdown line slightly exceeds makeup flow. Thus, operators may be required to periodically close the letdown isolation valve to increase net makeup flow to maintain pressurizer level in the desired range.

In 2002, AP/0/A/1 700/025 was modified to include guidance for water-solid operation.

The intent of this guidance was to handle situations in which there was a net loss of energy from the pressurizer due to excessive pressurizer ambient losses, pressurizer steam leaks, or inadequate SSF pressurizer heater capacity (up to a loss of all heaters).

The fundamental assumption with this guidance was that this condition existed at the beginning of the event and continued for its duration. The mitigation strategy added at that time allowed for a gradual heat up and expansion of the RCS to compensate for a collapsing steam bubble until a water-solid condition was achieved. This allowed operators to maintain subcooling until the water-solid condition was achieved, after 2

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters which a gradual cooldown to nominal post-trip conditions is performed (Tcold -555 °F).

Operators then would cycle the SSF letdown line for the duration of the event to control RCS pressure between 1600-2200 psig.

3 Loss of SSF Pressurizer Heaters Overview -

The discovery of the potential failure of the SSF heater breakers due to adverse containment conditions resulted in the possibility of losing the heaters some time into an SSF event. For any time prior to reaching the normal post-trip conditions (Tcold 555

°F) the SSF procedural guidance as written in 2002 would have successfully brought the RCS to a water-solid condition as designed.

For any time after normal post-trip conditions had been achieved from the SSF, procedural guidance would result in three different paths operators may take to attempt to control the plant as the pressurizer steam bubble decreases. Each of these paths is briefly discussed below and in more detail in Section 5 of this document.

3.1 Procedural Flow Path 1 This flowpath assumes that operators strictly adhere to the procedure steps that call for reducing ASW flow to increase RCS pressure after the pressurizer heaters become unavailable. The procedure has them open and leave open the SSF letdown line in an effort to control pressurizer level as it increases due to the collapsing steam bubble. As RCS pressure decreases, the pressurizer heaters are turned on to control pressure. Since these are not functional at this time, RCS pressure continues decreasing below the procedural band of 1950-2250 psig. After decreasing below 1950 psig, the procedural guidance has operators revert back to throttling SSF ASW flow to the SGs which results in heating up and expanding the RCS. This flow path is successful when a water-solid condition is achieved in which the SSF letdown line mass flow rate decreases (due to the heat up) to balance out with the net RC Makeup being added to the RCS. Analyses have been performed that show a successful subcooled water-solid condition is achieved for this procedural flow path.

3.2 Procedural Flow Path 2 In this procedure path, operators use the SSF letdown line to control RCS pressure after the pressurizer heaters become unavailable. Operators are aware from their training that cycling the letdown line in conjunction with functioning pressurizer heaters can help control RCS pressure. For this strategy, operators cycle the SSF letdown line as needed to maintain RCS pressure between 1950 and 2250 psig until the pressurizer level reaches 310 inches. Then after pressurizer level reaches 310 inches (indicating pressurizer is approaching a solid condition), the SSF letdown flow is cycled to maintain RCS pressure between 1600 and 2200 psig. Analyses have been performed that show a successful subcooled water-solid condition is achieved for this procedural flow path.

3.3 Procedural Flow Path 3 This flowpath begins similar to path 1, but as RCS temperature increases operators (in consultation with the TSC) diagnose that the pressurizer heaters are no longer available 3

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters and are directed by the Technical Support Center (TSC)/Operations Shift Manager (OSM) to close the SSF letdown line. Per the procedural guidance, they would have already reverted back to throttling SSF ASW flow to the SGs and heating up the RCS to control pressure. By closing the SSF letdown line, operators effectively control the plant by the 2002 guidance (RCS pressure maintained between 2200 and 1600 psig) which is considered a success path for this event.

Summary: Regardless of which approach operators use to control pressure, the system will evolve into a sub-cooled water solid natural circulation condition.

4. Detailed Thermal Hydraulic Response 4.1 Normal SSF Operation The following discussion provides a detailed description of the plant thermal hydraulic response for a typical SSF event and how SSF operator actions are used to maintain core cooling and prevent core damage.

The initial condition presumed for this evaluation is steady state, full power operation which is followed by an initiating event that causes a loss of main feedwater flow. The mismatch between the heat produced in the core and the heat transferred in the steam generators causes a reactor trip on high RCS pressure. Alternately, the loss of main feedwater may cause a turbine trip and a subsequent anticipatory reactor trip. In either case, a reactor trip is expected early in the event.

The initial RCS response to a decrease in core heat generation is a drop in RCS pressure.

Without an available feedwater source, secondary liquid inventory is rapidly depleted.

Core decay heat begins to be stored in the primary coolant leading to an increase in RCS temperatures. The operator response to a loss of all main and emergency feedwater is to turn off the reactor coolant pumps, and activate the SSF. As the RCPs coastdown, the RCS transitions from forced to natural circulation cooling.

The Oconee RCS has three distinct circulation loops while in natural circulation flow, with two within the reactor vessel (RV) and one through the steam generators. The first loop starts at core exit, and flows downward through the core bypass region to the inlet of the core. The second loop is from the core exit, up to the RV head, through the RV vent valves to the top of the RV downcomer, and downward through the downcomer to the core inlet. The third loop follows the normal forced flow path through the steam generators, returning to the core inlet via the idle RCPs, cold legs and the RV downcomer.

The RCS heats up using all three natural circulation cooling loops until steam generator cooling is restored. Pressurizer level increases to accommodate the volume expansion, increasing RCS pressure. RCS pressure is limited through cycling of the pressurizer power operated relief valve (PORV) or the pressurizer safety valves (PSVs). These cycles end when steam generator cooling is restored.

4

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters A stable configuration is established with natural circulation in the RCS, SSF ASW providing flow to the steam generators, pressurizer level on-scale, pressurizer heaters operating, and RCS pressure high enough to ensure subcooling. Secondary system temperatures are controlled by the lift and reseat pressures of the lowest lifting main steam relief valves. Operation of the RC makeup pump ensures RCP seal integrity, and provides a small mass addition to the RCS. The initial procedural guidance controls RCS pressure using the SSF-ASW feed flow.

The action of the RC makeup pump compresses the bubble in the pressurizer and tends to increase RCS pressure. To compensate for this effect, SSF ASW feed flow over time exceeds that required to remove core decay heat, resulting in a slow RCS cooldown.

During this cooldown, RC makeup flow increases RCS mass while RCS pressure and pressurizer level remains roughly constant. A SG water level cannot be established while the RCS cold leg temperatures are higher than the saturation temperature associated with the lowest lifting MSRV setpoint. This slow cooldown continues until the RCS cold leg temperature reaches the saturation temperature in the SG secondary. At this point a SG water level develops and the dynamics of the event change slightly. Due to the constraint on RCS cold leg temperatures, additional SSF ASW feed flow is required to maintain RCS pressure constant. SG level builds slowly, and upon reaching the natural circulation SG water level setpoint, the procedural guidance for controlling the plant changes. SG water level is controlled to natural circulation levels, pressurizer level controlled with the SSF letdown line, and RCS pressure controlled by utilizing the SSF powered pressurizer heater elements with a steam bubble present in the pressurizer. The plant reaches a hot standby condition with natural circulation using the SSF equipment.

4.2 Evaluation of Potential Core Cooling Challenges From the hot standby condition described above, the potential PRA scenarios of interest are those that lead to a core cooling challenge. The Significance Determination Process (SDP) discussions center on the loss of pressurizer heaters as the initiating event for these scenarios, and the associated transient evolutions. The loss of the pressurizer heaters will in time result in water-solid operation.

The two main avenues that lead to a core cooling challenge are a loss of subcooling that interrupts natural circulation leading to core uncovery and the potential of water relief through a PSV resulting in a failure of the valve to close. These scenarios are discussed below in the following sections.

4.2.1 Loss of Pressurizer Heaters Leading to Loss of Subcooling The first scenario postulated above is examined to determine whether it is credible. The primary question to be answered for this scenario is how the RCS mass can be depleted using the available procedural guidance and the following equipment.

• RC makeup pump operating at 28.7 gpm (27.6 gpm net makeup)

• SSF letdown line

• SSF-ASW pump providing liquid for SG heat transfer 5

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters With SSF ASW flow removing decay heat, the RCS inventory does not deplete while the RC makeup pump is operating, unless the SSF letdown line is left open. For this postulated configuration, RCS pressure is expected to decrease due to the SSF letdown line exceeding the RC makeup pump flow. For the SDP evaluations, the net RCS makeup flow from the RC makeup pump is 27.6 gpm which corresponds to a mass flow of 3.69 ibm/sec using a source temperature of 220°F (boiling spent fuel pool). The SSF letdown iine performance characteristics are dependent upon RCS pressure. As RCS pressure decreases, a decrease in the SSF letdown line flow also occurs. At an RCS temperature of 555°F, roughly the conditions defined by the main steam relief valves, a mass balance would be achieved between the SSF letdown line and RC makeup pump at an RCS pressure of 1362.5 psig. The associated saturation temperature is approximately 5 83.6°F. In natural circulation flow with the temperature difference across the core being typically 10-20°F depending on time after reactor trip, it is reasonable that hot leg temperatures would be at most 575°F at this point in the event. Therefore, the RCS would remain subcooled if the letdown line were left open. Note that as the RCS temperature assumed for the mass balance increases, so will the RCS pressure where the balance is achieved.

Therefore, it can be concluded that the concerns surrounding loss of subcooling scenarios leading to core damage are unlikely. Additional information and analyses supporting this conclusion is provided in Appendix A.

422 Loss of Pressurizer Heaters Leading to PSV Failure The second scenario postulated above is examined to evaluate the lengths of time available for operators to open/close the SSF letdown line when controlling the RCS in a water-solid condition. The available time for the operator to take action to control RCS pressure is assessed.

To perform this assessment, the RCS is assumed to be full. This assumption maximizes the pressurization rate, minimizing the available operator action time. The RCS mass at 555°F and pressures of 1600, 2200, and 2500 psig is determined for a minimum RCS volume of 11,813 ft. The amount of time required to transition from one condition to the 3

other is determined by water properties obtained from the Steam Tables and the net RCS makeup flow. No credit is taken for the decrease in SSF letdown line flow as RCS pressure decreases.

The following RC makeup pump and SSF letdown line capabilities are considered:

Nominal RC Makeup flow 29.0 gpm net makeup @ 70°F (4.0527 lbm/sec)

SDP RC Makeup flow 27.6 gpm net makeup @ 220°F (3.6905 lbm/sec)

SSF letdown line flow = 5.0463 lbm/sec @ 2200 psig, 555°F (Unit 1) 6

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Available Time Nominal RC SDP RC Makeup flow Makeup flow Increase pressure 1600-2200 psig 21.6mm 23.8mm Increase pressure 2200-2500 psig 10.2mm 11.2mm Decrease pressure 2200-1600 psig 88.3 mm 64.7 mm The above table shows there is adequate time for the operators to open!close the SSF letdown line to stay within the RCS pressure band specified in the procedure. It also shows there is >10 minutes available for operators to act and prevent an overpressurization and potential lift of the PSVs when the RCS is water-solid.

This evaluation assumes the RCS is isothermal, which conservatively reduces the available times calculated. Early during an event, the decrease in core decay heat results in a decreasing hot leg temperature. The shrinkage associated with the temperature change lengthens the available times for increasing RCS pressure.

The length of time required to decrease pressure using the SSF letdown line shown above does not credit the decrease in SSF letdown line flow as RCS pressure decreases. To examine the conservatism in this assumption, the depressurization is broken down into 200 psi segments, and an average letdown line flow is used for each segment. The following data is considered for this evaluation. The results demonstrate that the above approach contains significant conservatism.

SSF letdown line flow = 5.0463 Ibm/sec @ 2200 psig, 555°F (Unit 1)

SSF letdown line flow 4.7829 ibm/sec @ 2000 psig, 5 55°F (Unit 1)

SSF letdown line flow = 4.5073 ibm/sec @ 1800 psig, 555°F (Unit 1)

SSF letdown line flow = 4.2 173 lbm/sec @ 1600 psig, 5 55°F (Unit 1)

Available time Nominal RC SDP RC Makeup flow Makeup flow Decrease pressure 2200-2000 psig 33.0 mm 23.2mm Decrease pressure 2000-1800 psig 49.3 mm 30.6 mm Decrease pressure 1800-1600 psig 97.0 mm 44.7 mm Total time 179.4 mm 98.6 mm 4.3 Procedural Flow Path Considerations Procedural Flow Path I Following the loss of pressurizer heaters, ambient heat loss would begin to cool the pressurizer reducing RCS pressure. The procedural guidance for this flow path throttles SSF-ASW flow to maintain RCS pressure within the target pressure band. The SSF letdown line is open in an attempt to reduce pressurizer level.

7

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters If no action is taken to throttle SSF-ASW flow, the minimum RCS pressure would be the same as that determined above in the Loss of Subcooling discussion presented above.

Operator action to throttle SSF-ASW flow allows the water levels in the SG secondary to decrease, and RCS temperatures to increase as the boiling length decreased. The boiling length required for decay heat levels is less than 50, so this approach would not be immediately successful in raising RCS pressure. This delay could prompt the operator to transition to Procedural Flow Path #3. As RCS temperatures increase, the mass flow through the SSF letdown line decreases, resulting in a higher RCS pressure to balance the RCS mass addition from the RC makeup pump. The SSF letdown line and RC Makeup pump flow have been shown to balance for an RCS pressure of 2100 psi at a cold leg temperature of 617°F.

Procedural Flow Path 2 Following the loss of pressurizer heaters, ambient heat loss results in steam condensation that reduces RCS pressure. The procedural guidance for this flow path throttles SSF ASW flow to maintain SG level, and the SSF letdown line is cycled to maintain RCS pressure.

The minimum RCS pressure would be the same as that determined in the Loss of Subcooling discussion presented above, if the SSF letdown line is left open. By closing the SSF letdown line, RCS pressure would remain higher than this minimum value. The conclusion that subcooling would be maintained for this flow path remains valid.

Procedural Flow Path 3 This procedural flow path is similar to flow path #1 described above, with the exception that the SSF letdown line is closed. This flow path is a hybrid of the previous two flow paths, and results in the highest RCS pressure as a function of time. Subcooling is maintained for this flow path.

5 PRA Perspective 5.1 PRA Acceptance Criteria Licensing analyses are used to demonstrate that the plant design meets an acceptable level of safety and employ conservative assumptions to ensure adequate design margin.

In contrast, PRA risk analysis attempts to estimate the desired risk metrics using best estimate assumptions to predict most likely outcomes. For the PRA, the key success measure is the prevention of core damage which occurs following a reduced core mixture level that uncovers the top of the core, resulting in fuel pin heat-up, followed by significant melting of the fuel.

In the case of the ONS SSF, one of the design requirements is to provide secondary side heat removal via natural circulation. A failure to maintain subcooling could eventually lead to a loss of single phase natural circulation but this does not automatically equate to core damage. Instead, a transition to two-phase natural circulation is expected to occur 8

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters provided that steam generator cooling is maintained. Therefore, it is expected that any potential loss of subcooling that could be postulated as a result of heater failure would not automatically lead to core damage. Thus, the PRA success criteria may still be met.

To illustrate how an event could evolve into two-phase natural circulation conditions, it is postulated that RC makeup pump flow is lost while the SSF letdown line remains open. 1 This scenario will unfold similar to a very small SBLOCA. The following discussion is based on SBLOCA phenomena. RCS pressure would decrease until subcooling is lost.

Due to the upper vessel configuration, the initial voids would be expected to form in the RV head, followed by void formation in the core. These voids would not impair natural circulation flow. As the void volume increases, voids would continue to coalesce in the RV head. The RCS will transition to two phase natural circulation as voids began to form in the hot leg. Two phase natural circulation will continue until enough RCS inventory has been lost and enough voids have formed in the high points to temporarily interrupt natural circulation. The natural circulation loops within the RV would continue to cool the core allowing for a coolant heatup and expansion until the liquid in the hot leg spilled over the top of the candy canes. RCS pressure increases due to the boiling in the core. The steam produced in the core rises into the upper reactor vessel region, enlarging the void. The water displaced from the reactor vessel head flows into the hot legs and the pressurizer. The water entering the hot legs from the expanding vessel head void will push some water up and over the hot leg candy cane.

After the initial interruption of natural circulation there may be a period of time where there will be intermittent flow of liquid over the hot leg. The restoration of liquid flow over the hot leg, even if intermittent, will result in a period of primary-to-secondary heat transfer and a decrease in RCS pressure. Should no liquid be transported over the hot leg, then the RCS will continue to pressurize. A sustained pressurization can result in reaching the 2500 psig pressurizer safety valve lift pressure. With an extended mass depletion, the liquid levels in the RCS will decrease to the point where initially high-elevation boiler condenser, then later pool boiler condenser heat transfer occurs. These are very efficient methods of transferring heat from the core to the SG secondary.

To estimate the time required to evolve into these conditions, the length of time required to deplete the volume of the RV head using the SSF letdown line is selected. This provides an indication of the amount of time required, and additional volume would need to be depleted before periodic two-phase natural circulation would cease. Using the Unit I SSF letdown line flow at the safety valve lift pressure, it would take about 77 minutes to deplete the volume of the RV head. Note it is not possible to lift the pressurizer safety valves without an extended loss of RC makeup pump flow or SSF ASW flow. If the operator takes action to close the SSF letdown line within this time frame, the RCS inventory depletion will terminate precluding the possibility of lifting the pressurizer safety valves. The RCS could remain in a periodic two-phase natural circulation Note that a loss of the RC makeup pump is not part of the SSF pressurizer heater SDP, and therefore would not contribute to the differential risk.

9

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters condition for an extended time frame, and ensure core cooling, assuming that RCP seal integrity is maintained.

Prior to a loss of natural circulation, subcooling can be regained by increasing RCS pressure. For a water-solid SSF event, pressure is controlled with letdown and RCP seal injection. If pressure drops to a point where subcooling is lost, closing the letdown line allows the RCS to pressurize due to RCS seal injection into a solid system. Duke analysis shows that subcooling is not lost using the setpoints in the SSF procedure.

Additionally, current analysis shows that as pressure decreases, nominal seal injection and letdown will equalize prior to a loss of subcooling. Once the seal injection equals letdown, the pressure decrease stops. However, if the analysis does not correctly predict the RCS response and a loss of subcooling occurs, the loss is temporary and RCS pressure recovers once letdown is isolated.

Duke analysis shows that subcooling is not lost during the transition to water-solid conditions. Should the analysis underpredict subcooling margin, a loss of subcooling during the transition is temporary. Closing the letdown line allows the RCS to pressurize from RCP seal injection.

With the letdown line isolated and the RCMUP injecting into a solid system, RCS pressure increases. Procedure guidance instructs the operators to maintain RCS pressure in a range to prevent opening a relief valve. However, if left unchecked, pressure can increase to the safety relief valve set point. The valve lifts and relieves either steam or liquid (depending on the condition of the RCS at the time). Pressure decreases and the valve reseats. A relief valve LOCA could occur if a safety relief valve were to fail to reseat. This condition could lead to core damage since the RCMUP is not able to keep up with the inventory lost through the relief valve.

In summary, the PRA success criteria is the prevention of core damage. Failure to meet all the licensing requirements will not necessarily lead to core damage.

52 Important PRA Scenarios There are three procedural flow paths that the operators may take in the event the SSF pressurizer heaters are lost. All 3 paths are deemed to fully comply with the governing SSF procedure (AP/0/A/1 700/025 Standby Shutdown Facility Emergency Operating Procedure) in effect at the time the inadequate pressurizer heater breakers were discovered. Each path is modeled in the Duke SDP PRA to assess the core damage probability associated with inadequate pressurizer heater breakers.

The initial conditions for all three paths are such that the SSF pressurizer heater failure due to breakers tripping open occurs after natural circulation steam generator levels have been established and RCS temperature is being maintained at 555°F. RCS pressure is maintained at about 2150 psig via cycling of the pressurizer heaters.

10

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters 5.3 Procedural Flow Path 1 The failure of the SSF pressurizer heaters results in a gradual decrease in RCS pressure and a gradual increase in pressurizer level as the pressurizer steam bubble collapses due to steam condensation. Per the procedural guidance, operators would attempt to control RCS pressure by turning on the heaters and cycle the SSF letdown line to maintain pressurizer level stable. If RCS pressure decreases below 1950 psig due to the loss of pressurizer heaters while the operator is trying to maintain a stable level, the procedural guidance has the operators revert back to throttling SSF ASW flow to maintain RCS pressure within the target pressure band. In this path the operator makes a quick determination that pressurizer level cannot be maintained at a stable level. SSF ASW flow is throttled such that it no longer matches decay heat which results in increasing RCS temperatures. This results in an expansion of RCS liquid volume to keep RCS pressure in the target band. No guidance was provided in AP/01A117001025 to close the SSF letdown line for these conditions. If the operators fail to close the SSF letdown line to get back into the pressure band of 1950-2250 psig of procedure AP/0/A/1700/025, then as RCS temperature increases by throttling back on ASW flow, the decrease in density results in a corresponding decrease in the SSF letdown flow rate. A stable steady-state condition is reached in the RCS before a saturated condition is reached.

5.4 Procedural Flow Path 2 The failure of the SSF pressurizer heaters results in a gradual decrease in RCS pressure and a gradual increase in pressurizer level as the pressurizer steam bubble collapses due to steam condensation. Per the procedural guidance prior to June, 2011, operators attempt to control RCS pressure by turning on the heaters and cycling the SSF letdown line to maintain pressurizer level stable. During this time, RCS pressure is being affected by cycling MSRVs, SSF ASW flow to maintain SG level, cycling pressurizer heaters and changing pressurizer level. The operators will cycle SSF letdown to control pressurizer level in an acceptable band and this action also has the effect of also controlling pressure. Because the time for the bubble to collapse is so long (hours), there is some chance the operators would continue to use the SSF letdown line to control level and also RCS pressure in the target band of 1950-2250 psig. The cold leg temperatures continue to be maintained at 555°F by maintaining SG natural circulation levels with SSF ASW flow. The pressurizer level would slowly increase over time until it reaches 310 inches or the operator would pursue path 1 above. If the operators continue to let the level increase to above 310 inches they will utilize an If At Any Time statement to begin cycling HP-426 to control RCS pressure in the 1600-2200 psig band.

5.5 Procedural Flow Path 3 This path is the same as 1 above, except that operators are directed by the TSC/OSM to isolate the SSF letdown line after swapping to RCS pressure control by SSF ASW. If this occurs, RCS pressure continues to be controlled by SSF ASW, but the increase in mass supplied by RCMUP allows the plant to again cool down the plant to 555°F. This would be similar to a loss of pressurizer heaters at t=0. Once level in the pressurizer reaches 11

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters 310 and Tc 555°F or levels exist in the SGs, operators are directed by an If At Any Time statement to cycle the SSF letdown line to control RCS pressure in the 1600-2200 psig band.

5.6 PRA Core Damage Scenarios Regardless of which approach operators use to control pressure, the system evolves into a sub-cooled water-solid natural circulation condition unless operators fail to perform the procedural actions or other equipment fails. In the case of path 1, a failure to throttle feedwater would result in an RCS pressure decrease where the letdown flowrate gradually decreases to a point where RCS pressure would stabilize well above the saturation temperature. Thus, there is no core damage risk increase associated with path In the case of paths 2 & 3, a failure to open the letdown line valve before reaching the safety relief setpoint would challenge the relief valves to reseat. If a relief valve sticks open, the loss of coolant exceeds the SSF makeup capacity and core damage is assumed to eventually occur. The two failure mechanisms considered for this are operator error and failure of the motor-operated valve to open on demand. The operator action in these cases is considered very reliable because of the slow-moving nature of the pressure changes and because written procedure guidance is used. Thus, the primary difference between path 2 & 3 from a risk perspective is that path 2 requires a higher number of valve strokes during the SSF mission time. The core damage risk impact of paths 2 & 3 are evaluated in Reference 5.

6. Other Considerations Duke is not aware of any plants that have thermal hydraulic analyses supporting water-solid operation, and no precedent for specific NRC approval of thermal hydraulic analysis.

However, there are two instances in which the NRC has documented their support of the ability to use water-solid operations. Both instances are described below.

6.1 Appendix R Rule Making The NRC provided their approved guidance for the implementation of fire protection requirements in Reference 1. The following is an excerpt from the Reference 1 letter.

In the Spring of 1984, the Commission held a series of Regional Workshops on the implementation of NRC fire protection requirements at nuclear power plants. At those workshops, a package of recently developed NRC guidance was distributed to each attendee which included NRC staff 12

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters responses to industry questions and a document titled Interpretations of Appendix R. The cover memo for the package explained that it was a draft package which would be issued in final form via Generic Letter following the workshops.

The guidance approved by the Coission is appended to this letter, and is in the same format as the draft package, i.e., Interpretations of Appendix R and responses have been modified from the draft package, and a number of industry questions raised at or subsequent to the workshops have been added and answered. This package represents recent staff assessment of these questions and provides guidance as to acceptable methods of satisfying Commission regulatory requirements. Other methods proposed by licensees for complying with Commission regulations may also be satisfactory and will be considered on their own merits. To the extent that this guidance may be inconsistent with prior guidance (including Generic Letter 83-33), it is intended that the current letter takes precedence.

The NRC guidance for water-solid operation is contained in Enclosure 2, Appendix R Questions and Answers, of Reference 1.

5.3.5 Pressurizer Heaters QUESTION Most PWR5 do not require pressurizer heaters to maintain stable conditions. In fact, the Commission does not consider heaters to be important to safety and they are not required to meet Class IE requirements. Are they required for hot shutdown under Appendix R? If yes, then how does a plant meet the separation requirements of Section III.G.2.d,e. or f without major structural alterations to the pressurizer?

RESPONSE

One train of systems necessary to achieve and maintain hot shutdown conditions must be free of fire damage. PWR licensees have demonstrated the capability to achieve and maintain stable hot shutdown conditions without the use of pressurizer heaters by utilizing the charging pump and a water solid pressurizer for reactor coolant pressure control.

The NRC approved guidance for water-solid operation is used at other plants, such as McGuire, as a basis for operability of the pressurizer heaters in SSF events. The McGuire DBD references Generic Letter 86-10, Section 5.3.5 as justification.

Ii

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters The pressurizer heaters are not required to maintain hot shutdown stable conditions during an SSS event. The reactor system can be maintained by utilizing the standby makeup pump for charging, head vents, and the pressurizer water solidfor coolant pressure control.

6.2 2002 NRC Inspection for Water-solid Operation The NRC performed a special inspection at Oconee in 2002 focused on the ability to safel, operate the Standby Shutdown Facility (SSF) with the pressurizer in a water-solid condition during events where the SSF is used to achieve safe shutdown. The inspection report (Reference 2) documents the inspection findings. The NRC concluded that water-solid operation was a successful mitigation strategy.

The inspectors concluded there was reasonable assurance the SSF would perform its design basis function with the temporary compensatory measures implemented at your facilities.

One of the focus items of the 2002 NRC inspection was the RETRAN thermal hydraulic analysis which validated the procedural strategy for operating the pressurizer in a water-solid condition. An excerpt of the 2002 NRC Inspection report is provided.

RETRAN Modeling The NRC staffhas extensive experience with the RETRAN computer code. The code is widely used, and it is capable ofpredicting system response under water-solid conditions. Consequently, the inspectors limited their assessment to the licensee s application, the predictions, and evaluation of the results. The licensee uses a proprietary RETRAN nodalization that is basically a single dimension model with a modest number ofnodes in the reactor vessel and the hot and cold legs. The steam generators are finely nodalized in the vertical dimension. The absence oflarge temperature variations at the core exit, as exhibited in the 1974 natural circulation test discussed above, just fIes the absence ofcircumferential modeling in the reactor vessel as long as the steam generators behave similarly. The hot and cold leg nodalization is adequate for representing single phase natural circulation and the choice ofhigh point hot leg nodes allows steam to collect at the high points fprimary side steam generation is predicted. The fine nodalization in the steam generators is adequate to represent primary side cooling that drives natural circulation with ASW injection into the steam generators. A detailed pressurizer model is not used, but the inspectors concluded the model was sufficientfor predicting the approach to solid operation. The inspectors noted that pressurizer modeling is not important during solid operation.

The licensee provided calculations based upon conservative decay heat generation rate assumptions with SSF operation initiated 14 minutes after event 14

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters occurrence. They also discussed the results obtained by assuming a realistic decay heat generation rate with SSF operation initiated 12 minutes after event occurrence. The conservative decay heat generation rate was predicted with the American Nuclear Society (ANS)-5.1, 1979 plus two sigma model. As illustrated in Information Notice 96-39, options contained in the ANS-5. 1, 1979 standard can affect predictions by 10 percent or more. The licensee modeled irradiation history assumingfull power operation between refueling outages with what it described as a conservative number ofdays for outages. To assess the effect ofthis and the other licensee assumptions, the inspectors compared licensee predicted decay heat generation rates to several other calculations. The inspectors found the licensee s predictions were comparable with the ANS 5.1,-

1979 standard assumingfull power operation for three years, and were greater than 10 percent above typical ANS-5. 1, 1979 standard values with no uncertainty allowance.

The inspectors judged that the conservative-based calculations were conservative when predicting the initial heatup and they were conservative for predicting the water solid pressurizer operation thatfollows, assuming SSF operation proceeds as anticipated. The realistic-based calculations were judged to provide a good prediction ofRCS heatupfor the assumed event. The inspectors concluded that the RETRAN model was acceptable for predicting SSF-associated behavior for the initial transient and the following pressurizer water solid operation.

Based on the 2002 Oconee NRC Inspection, there is a clear precedence supporting water-solid operation and the associated RETRAN analysis.

7. Conclusions Duke Energy has performed detailed thermal hydraulic analyses that support the successful mitigation of accidents involving the loss of SSF pressurizer heaters when operators follow procedural guidance. SSF operators see a slow moving transition to a solid pressurizer condition that is easy to monitor and control, and presents no significant challenge to human performance. Hand calculations and other means of predicting the plant response support this conclusion. There are no significant risk concerns with either a loss of subcooling or lifting code safety valves during or after the transition to water solid conditions. The risk impact of a loss of SSF pressurizer heaters is limited to accident sequences involving a stuck-open safety relief valve induced by either an operator error or failure of the letdown isolation valve to open when required to control RCS pressure.

15

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters

7. References

1. Implementation of Fire Protection Requirements (Generic Letter 86-10), letter from the NRC to all Power Reactor Licensees and Applicants for Power Licenses, April 24, 1986.

(http://www.nrc.gov/reading-rm!doc-collections/gen-comm/gen letters/i 986/g1860 1 0.html)

2. OCONEE NUCLEAR STATION NRC SPECIAL INSPECTION REPORT, 50-269/02-08, 50-270/02-08, AND 50-287/02-08, April 22, 2002. Letter from NRC to W.R.

McCollum, Vice President, Oconee Nuclear Station.

3. Design Basis Specification for the Standby Shutdown Systems MCS-1223.SS-00-0001, Rev. 27

4. Duke Calculation OSC-10427, ONS Loss of All Pressurizer heaters

5. Duke Calculation OSC-10320, Oconee SSF Pressurizer Heater SDP Analysis

6. AP/0/A/1 700/025 Standby Shutdown Facility Emergency Operating Procedure, Revision 49.

7. EPRI Report NP-5357, PWR Pressurizer Transient Response, August 1987.

8. OSC-3 144, Pressurizer Heat Losses, Rev. 15.

9. OSC-9918, RELAP Model To Determine Acceptance Criteria For SSF Letdown Line, Rev. 5.

10. OSC-7818, 510 and 680 EFPD Decay Heat Calculation, Rev. 4.

11. Oconee Nuclear Station- NRC Inspection Report 050000269/2011018,05000270/2011018, and 0500287/2011018; Preliminary Greater Than Green Findings, October 4, 2011, letter from NRC to T.P. Gillespie, Vice President, Oconee Nuclear Station.

12. Safety Evaluation Regarding The Thermal Hydraulic Transient Analysis Methodology DPC-NE-3000 for Oconee Nuclear Station Units 1, 2 and 3 (TAC Nos. M871 12, M87 113, and M87 114), letter from NRC to M.S. Tuckman, Duke Senior Vice President.

13. Review of Updated Final Safety Analysis Report, Chapter 15, Transient Analysis Methodology Submittal Oconee Nuclear Station, Units 1, 2, an 3., letter from NRC to W.R. McCullum, Vice President Oconee site. (SER for DPC-NE-3005, Oconee Nuclear Station UFSAR Chapter 15 Transient Analysis Methodology).

14. Letter from NRC (C.A. Castro) to Duke Energy (W.R. McCollum) dated April 22, 2002, Oconee Nuclear Station NRC Special Inspection Report 50-269/02-08, 50-270/02-08, and 50-287/02-08 16

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters

15. Letter from CSA (Craig Peterson) to Duke (Greg Byers) dated July 11, 2011, REF: CSA 031-11.

16. Letter from NRC (C. 0. Thomas) to UGRA (T.W. Schnatz) dated September 4, 1984, Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5, RETRAN A Program for One Dimensional Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems and EPRI NP-i 850-CCM, RETRAN-02 A Program for Transient Thermal-Hydraulic Analysis for Complex Fluid Flow Systems

17. Letter from NRC (A.C. Thadani) to GPU (R. Furia) dated October 19,1988, Acceptance for Referencing Topical Report EPRI-NP-1850 CCM-A, Revisions 2 and 3 Regarding RETRANO2/MODOO3 and MODOO4

18. Letter from NRC (A.C. Thadani) to Texas Utilities (James Boatwrite) dated November 1, 1991, Acceptance for Reference of RETRANO2/MODOO5.0

19. Letter from M.J. Virgilio (NRC) to C. R. Lehman (PPL), dated April 12, 1994, Acceptance for Referencing of the RETRANO2 MODOO5. I Code

20. Letter from G. B. Swindlehurst (Duke) to J.E. Lyons (NRC), RETRANO2 MODOO5.2 Code Version Request for Extension of RETRAN-02 MODOO5.0 SER, March 27, 1997.

21. M. P. Paulsen, et al., RETRAN-3D A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems, Volume 4: Assessment Manual, NP-7450 (A)

Revision 8, May, 2011.

22. Letter from S.A. Richards (NRC) to G. L. Vine (EPRI), Safety Evaluation Report on EPRI Topical Report NP-7450(P) Revision 4, RETRAN-3D A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems (TAC No.

MA431 1), January 25, 2001.

17

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Appendix A A1.O Introduction This appendix contains information requested by the NRC in Reference 11. The NRC request is shown below:

In addition, analyses that support the use of the thermo hydraulic codes used in your engineering calculations and in your simulator, relative to the performance deficiency, is requested.

This appendix includes information that was not included in the original document transmitted on October 3,2011.

Information is presented in this appendix that support the use of the RETRAN code and plant simulator used to evaluate the identified performance deficiency. The following information is provided:

1. Calculations demonstrating that subcooling is maintained in each of the three procedural flow paths.

2. Description of RETRAN benchmark analyses reviewed by the NRC

3. Evaluation of the SSF training simulator performance The information supports Duke Energys position that RCS subcooling would have been maintained at all times for the Oconee SSF scenarios involving the loss of the SSF pressurizer heaters, and specifically during the time in which the RCS transitions to a water-solid condition in the pressurizer.

A2.O Calculations Supporting RETRAN Analyses This section provides conservative hand calculations for each procedural flow path. These calculations support the RETRAN analyses conclusions that RCS subcooling will be maintained throughout the event.

A2.1 Calculations Supporting Procedural Flow Path 1 For procedural path 1, it is assumed that operators will revert back to throttling SSF ASW flow to control RCS pressure after the pressurizer heaters are lost and when pressure drops below the low end of the controlling band (1950 psig). This allows for the RCS to heat up and expand to compensate for the collapsing pressurizer steam bubble. A calculation is performed to determine what decay heat level is required to accomplish this.

18

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters It is assumed in this calculation that all the pressurizer ambient heat loss occurs in the region of the steam bubble. This is very conservative given the fact that even at the lowest pressurizer level allowed per the guidance in Reference 6, at least 1/4 of the pressurizer interior surface area is in the liquid region of the pressurizer. In addition, as the pressurizer bubble collapses the total interior surface area exposed to the steam region decreases which would result in a decreasing portion of the overall ambient loss from the steam region.

Interfacial heat transfer between the pressurizer steam and liquid regions is expected to be negligible during this event and is assumed to be zero in this calculation. With no pressurizer spray (RCP5 are off) causing turbulence in the liquid surface and very slow level changes following the initial plant response to the loss of all feedwater event, it is believed the inter-region heat transfer coefficient is small. This judgment is further supported below.

EPRI Report NP-5357 (Reference 7) documents an assessment of PWR pressurizer modeling to examine important phenomenon, including inter-phase heat and mass transfer at the liquid-vapor interface. Analytical models were compared against full-scale PWR transients, including TMI Unit 2, for transients that empty and then refill the pressurizer. The report concluded that pressurizer spray flow, which disturbs the interface significantly, enhances heat transfer between the vapor and liquid regions. In the absence of pressurizer spray flow, interfacial heat transfer is considered to be negligible. The Oconee SSF transients do not include pressurizer spray due to the loss of RCPs. Therefore, the assumption of a small value for pressurizer inter-region heat transfer coefficient is consistent with independent modeling and is validated by actual B&W plant data.

Procedural path I assumes that operators open and leave open the SSF letdown line.

Since the letdown line flow capacity is greater than the net RC Makeup flow capacity in the pressure band they are controlling to, there will be a net reduction of RCS mass until the RCS heats up and these flow paths balance out. Until this occurs, additional heatup of the RCS is required to offset this imbalance. This flow imbalance is therefore factored into this calculation.

An RCS pressure of2lOO psig is assumed. This is the middle of the 1950-2250 psig band specified in the procedure (Reference 6).

Pressurizer Bubble Collapse Rate The pressurizer bubble collapse rate is calculated below. The following values are taken from the ASME steam tables:

RCS pressure 2115 psia v(pzr steam region) 0.173064 /lbm 3

ft h (Vsat steam) 1127.496 Btu/Ibm h(Lsat liquid) 685.1887 Btu/lbm 19

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters This calculation first determines the amount of energy that must be removed from a given saturated steam volume to reduce it to a saturated liquid condition. To evaluate a rate, a unit volume of 1 ft is assumed.

Energy removal! ft 3 of steam = *( h (Vsat) h(Lsat liquid))

v(pzr steam regiony 4 -

(0.173064 /

3 ftlbm)*(l 127.496 685.1887 Btu/lbm) 2555.74 Btu/ft 3 of steam Using the maximum pressurizer ambient loss (212.6 KW or 725425 Btu/hr, Reference 8) of the three ONS units over the time frame of consideration, the following collapse rate is calculated:

Collapse rate = (725425 Btu/hr) /(2555.74 Btu/ft

)

3

= 283.8 ft

/hr 3

It should be noted that if credit were taken for the pressurizer being a least 1/4 full of liquid, the resultant reduction in ambient loss (0.75 x 2 12.6KW) from the pressurizer steam region would reduce the bubble collapse rate to 213 ft3!hr. As the bubble continues to collapse, there would be an associated decrease in the ambient loss from the steam region resulting in a reduction in the collapse rate.

It should also be noted that no reduction in the pressurizer ambient heat loss is credited due to the Reactor Building heating up over the course of this event. This is what causes the loss of the SSF pressurizer heaters.

SSF Letdown!RC Makeup Flow Imbalance The net reduction in RCS volume due to the flow imbalance between the SSF letdown line and the RC Makeup pump is determined next. A flow capacity of 5.4263 Ibm/sec is assumed for the SSF letdown line. This is very conservative in the fact that the corresponding RCS pressure for this flowrate is 2420 psig (Reference 9) which is well above the 1950-2250 controlling band the plant would be at and clearly bounds the maximum SSF letdown line flow that could occur over this pressure range. The minimum RC Makeup pump flow rate of 27.6 gpm is used. A maximum SFP temperature of 220°F is assumed to minimize the mass addition of the RC Makeup flow.

No credit is taken for the heat up of the RCS decreasing the SSF letdown line flow in this calculation.

SSF letdown line flowrate (555°F, 2420 psig) 5.4263 lbm/sec RC makeup mass flowrate (27.6 gpm) 3.6905 Ibm/sec The net RCS mass loss is therefore RCS mass loss SSF letdown line flowrate RC mass flowrate

= 5.4263 3.6905 lbm/sec

= 1.7358 Ibm/sec At an RCS condition of 2114.7 psia and 555°F, the specific volume of the RCS is 20

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters v(555°F, 2114.7 psia) = 0.021541 ft

/lbm 3

The RCS volumetric reduction due to this flow imbalance is then Flow imbalance z RCS mass loss (lbm/sec)

• v(555°F, 2114.7 psia)

= (1.7358 lbm/sec)*(0.02 1541 ft/lbm)*(3600 seclhr) 3

= 134.6 ft

/hr 3

RCS Expansion Rate The expansion rate of the RCS is calculated to determine if it can offset the collapse rate of the pressurizer steam bubble. RCS ambient losses and heat removal provided by the SSF letdown line are subtracted from the decay heat in calculating this. A decay heat value is iterated on to determine how much decay heat is required to match the bubble collapse. For any time after which decay heat drops below this minimum value, RCS pressure may not be maintained resulting in operators closing the SSF letdown line. This results in Procedural Path 3 which is successful.

The following decay heat value is assumed:

Qdecay heat 3.549E7 Btu/hr The highest RCS ambient heat loss is QRCS ambient loss = 6.63E6 BtiJhr Next, the RCS energy removal by the SSF letdown line is calculated. This is defined as s I Q net letdown mletdown)) letdown) mnakeup)) t. makeup Where mletdown SSF letdown line flow mjneup RC makeup flow hletdown SSF letdown line enthalpy hmakeup RC makeup enthalpy A high SSF letdown line flow of 5.4263 ibm/sec is assumed at a temperature of 640F and RCS pressure of 2350 psig. This bounds the highest Tcold seen in the RETRAN runs performed for Path I in Reference 4. This is conservative in that this flowrate reflects a higher RCS pressure (2420 psig) and a lower RCS temperature (555°F). A minimum RC makeup flowrate of 3.6905 lbm/sec previously identified as 27.6 gpm at 220°F is assumed. A low spent fuel pool temperature of 80F is assumed as the suction source for the RC makeup pump. The SFP rapidly heats up during this event so this is bounding.

mletdown 5.4263 ibm/sec mmakeup = 3.6905 ibm/sec hletdown 674.6 Btu/lbm hmakeup = 48.1 Btu/lbm t letdown Qne (5.4262 lbm/sec)*(674.6 Btu/ibm) (3.6905 ibm/sec)*(48.1 Btu/lbm)

= (3483.0 Btu/sec)(3600 sec/hr) 1.254E7 Btu/hr 21

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Therefore, the net energy addition to the RCS is Qnet RCS = Qdecay heat QRCS ambient loss Qnet letdown

= 3.549E7 Btu/hr 6.63E6 Btu/hr l.254E7 Btulhr

= 1 .632E7 Btu/hr Next, the RCS expansion rate is calculated using the above QnetRCS.. The following values are obtained from the ASME steam tables:

Vjntiaj(550°F, 2114.7 psia) 0.02139 3 /ft lbm hinitiai(550°F, 2114.7 psia) 547.309 Btu/lbm The total volume of the RCS is 11,813 ft . The volume of the pressurizer, surge line, and 3

spray line is subtracted from this. These are V(pressurizer) = 1532.24 ft 3 V(surge line) 21.18 ft 3 V(spray line ) = 1.51 ft 3 1532.24ft Vrcsll,813ft 3 21.18ft 1.51ft Vrcs 10258.] ft 3 The total mass of the RCS is therefore Mrcs (ibm) = Vrcs * (Vinitial) 1

= (10258.1 ft3)*(1/0 02139 ft3/Ibm) 479575 Ibm The heatup rate of the RCS due to QDetRCS is then Heatup rate (Btu/lbm/hr) = 11t RCS (Btu/hr))/(Mrcs (ibm)

Q 1 .632E7 Btu/hr I 479575 Ibm

= 34.0 Btu/lbm/hr After one hour with all QnetRCS added to the RCS, the RCS enthaipy would increase to h(RCS) h(initial) + (heatup rate)(1 hr) h(RCS) (547.309 + 34.0) Btullbm

= 581.3 Btu/lbm From the ASME steam tables, this equates to the following temperature and specific volume at an RCS pressure of2l 14.7 psia Trcs 576.5 °F Vfinal(576.5°F, 2114.7 psia) 0.022265 ft/lbm 3

This is the RCS temperature and average specific volume after one hour of decay heat addition to the RCS.

The volumetric expansion rate of the RCS per hour is therefore:

22

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters RCS volumetric expansion = (Vfinal Vjnjtjal)* Mrcs RCS volumetric expansion = (Vfinal(576.5°F, 2114.7 psia>

1 14.7psia))*Mrcs (0.022265 ft /lbm 0.02 139 ft 3

/lbm)*479575 ibm 3

= 419.6 ft/hr Based on this calculation, A decay heat rate of3.549E7 Btulhr is large enough to compensate for both the collapsing pressurizer steam bubble and the maximum net mass imbalance between makeup and letdown (419.6 ft /hr vs. 283.8+134.6 418.4 ft 3 /hr).

3 At BOC conditions, this decay heat rate exists during the first 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />. Beyond 22 hours2.546296e-4 days <br />0.00611 hours <br />3.637566e-5 weeks <br />8.371e-6 months <br />, a gradual delta between the expansion rate and the bubble collapse rate would result in a very slow depressurization rate, where for some period of time the RCS would still remain subcooled for the duration of the bubble collapse. It should be noted that the bubble collapse rate was calculated with extremely conservative assumptions and with no credit for a decreasing rate as the condensation surface area it is exposed to decreases with increasing pressurizer level.

For MOC and EOC conditions, decay heat is greater than this for the full 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> of the event. It is expected that for the majority of the time during a given operating cycle, adequate decay heat would be available to compensate for the pressurizer bubble collapse. For any time that it is not, RCS pressure would slowly decrease resulting in operators closing the SSF letdown line. This results in the operators transitioning to Procedural Path 3 which is successful.

Procedural path 1 assumes that operators revert back to using SSF ASW flow to control RCS pressure within the prescribed procedural pressure band. Inherent in this is that SG levels must boil back down from their natural circulation condition such that the RCS can begin heating up to offset the pressurizer bubble collapse. If the bubble collapse rate is high enough and operators see RCS pressure continuing to decrease even after throttling back on SSF ASW flow, they (in conjunction with the TSC/OSM) would close the SSF letdown line to minimize outflow from the RCS. A hand calculation is also performed in this Attachment (see below) for procedural path 2 that shows the net RC Makeup flow that was available is large enough to match the maximum bubble collapse rate calculated in this section. This path would therefore be considered successful in that RCS subcooling would have been maintained.

A2.2 Calculations Supporting Procedural Flow Path 2 This section provides hand calculations for procedural flow path 2 that demonstrate RCS subcooling margin will be maintained.

It is assumed in Procedural Flow Path 2 that operators cycle the SSF letdown line to maintain RCS pressure within the designated pressure band after the pressurizer heaters become unavailable. A calculation is performed to determine if the net RC Makeup capacity that was available was large enough to offset and maintain RCS pressure during the time frame where the pressurizer steam bubble collapses after the pressurizer heaters 23

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters become unavailable. The steam bubble will collapse as energy is lost from the steam region due to ambient losses.

Bubble Collapse Rate Vs. Net RC Makeup Capacity The pressurizer bubble collapse rate previously calculated is used for this evaluation.

This was determined to be 283.8 ft /hr.

3 The net RC Makeup flow capacity is evaluated to determine if it can match the collapse rate of the pressurizer steam bubble. This assumes that the SSF letdown line is closed. A net makeup flowrate of 27.6 gpm is assumed. A maximum SFP temperature of 220°F is assumed for the suction source of this pump to minimize the mass addition and to minimize the volumetric addition. A correction is made to the RC makeup flow to account for the fact that it will heat up to 550°F in the RCS. From the EXCEL ASME steam tables:

(v 121 15 psia, 220F) 0.0 16654 /ft 3lbm vf(2ll5psia,550F) 0.02139 /lbm 3

ft Q(makeup) 27.6 gpm Net RC Makeup volumetric rate = 1 (v vf)*Q(makeup)

(0.02139/0.01 6654)*(27.6 gpm)

(35.45 gpm)*(60 minlhr)*(ft

/7.4805 gal) 3 284.3 ft

/hr 3

Based on this calculation, the net RC Makeup is high enough to compensate for the collapsing pressurizer steam bubble (284.3 ft /hr vs. 283.8 ft 3 /hr). This is a very 3

conservative calculation in that all of the pressurizer ambient loss is assumed to occur in the steam region without crediting the fact that as the bubble collapses, the pressurizer interior surface area exposed to the steam region decreases. This calculation shows that RCS pressure could be maintained within the procedural target band which ensures subcooling would be maintained for the duration of this event and that cycling of the SSF letdown line could be expected.

Pressurizer Cooldown & RCS Fill The following calculation is performed to show that the RCS will become water solid before a loss of hot leg subcooling can become an issue during procedural path 2. NRC expressed concern that the time available for operators to establish water solid conditions might not be achievable prior to a loss of subcooling, depending upon the starting level in the pressurizer. The starting pressurizer level is varied for this calculation. Note this is an actual level, and not an indication determined by a differential pressure transmitter.

Details of this calculation are not included in this document, but are presented in Appendix D of Reference 4.

The evaluation of loss of subcooling is performed through the use of an energy balance, and a mass balance on the RCS. The assumed initial RCS conditions reflect a stable hot 24

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters standby condition with the SSF operating. This initial condition includes stable RCS temperatures, target SG water levels, with RCS pressure and pressurizer level within procedural limits. From this initial condition, the SSF pressurizer heaters are assumed to fail due to equipment issues relating to the reactor building ambient temperature. This enables a depressurization due to ambient heat losses from the pressurizer. This calculation presumes that RCS pressure decreases monotonically from an initial pressure of 1950 psig to a final pressure of 121 1 psig, corresponding to the saturation pressure for the assumed hot leg temperature (570°F). The SSF letdown line is not considered in this evaluation as procedural guidance would close this line when RCS pressure is less than 1950 psig. Note, if RCS pressure does not decrease after the heaters are lost, then subcooling is assured.

A mass balance is performed on the RCS to determine the length of time required to fill the RCS using the RC makeup pump. The energy balance determines the length of time required to cool the pressurizer from the initial condition to the assumed hot leg temperature. As pressure decreases, voiding will occur at the hottest parts of the RCS, the RV head and the hot legs. Voiding in the hot leg requires the pressurizer to be cooled to hot leg conditions. The hot leg temperature assumed is representative of natural circulation conditions, a couple of hours following reactor trip with end of cycle core decay heat.

The results of these calculations to evaluate the time to cool the pressurizer, and the time to fill the RCS are shown below. The results shown assume the liquid in the pressurizer is initially saturated at 1950 psig. The final temperature is the assumed hot leg temperature of 5 70°F.

Actual Initial Time to cool Pzr Time to Fill RCS Pzr Level (Saturated liquid) (Saturated liquid)

[inches] [mini [mini 0 372 227 100 391 178 200 409 129 300 427 79 400 446 30 The results of these calculations demonstrate that the time required to fill the RCS is less than that required to cool the pressurizer. Thus, it can safely be concluded that the RCS will become water solid before a loss of hot leg subcooling can become an issue.

A couple of sensitivity studies are performed on the results shown above. The first sensitivity examines the potential impact of subcooled liquid within the pressurizer. For this sensitivity, the initial pressurizer liquid temperature is reduced to 600°F. The second sensitivity examines the potential impact of not requiring the pressurizer to cool to hot leg conditions. A final pressurizer temperature of 575°F is selected for this sensitivity. The results of these sensitivity cases do not alter the conclusion that the RCS will become water solid before a loss of hot leg subcooling can occur.

25

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters A2.3 Calculation Supporting Procedual Flow Path 3 This path is similar to Procedural Flow Path 1, except that operators are directed by the TSC/OSM to isolate the SSF letdown line after swapping to RCS pressure control by SSF ASW. Once the SSF letdown line is closed, the calculations performed above for Procedural Flow Path 2 apply. The net RC Makeup flow capacity that was available is sufficient to compensate for the collapsing steam bubble. Thus, RCS subcooling would be maintained for the duration of this event.

26

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters A3.O RETRAN Capabilities to Model Phenomena Important to SSF Events The RETRAN analyses performed for the SDP evaluation use models that were reviewed and approved by the NRC in DPC-NE-3 000-PA (Reference 12) for application to Catawba, McGuire and Oconee. The analyses utilize RETRAN-02 which was generically approved by the NRC in References 16-20.

RETRAN is well established in the PWR industry, and is currently utilized extensively by Duke Energy, Dominion, and Westinghouse for transient analyses. Duke uses RETRAN to perform all of the Oconee UFSAR Chapter 15 non-LOCA analyses using the NRC approved methodology in Reference 13.

As described below, RETRAN is fully capable of modeling natural circulation flows during slow moving transients, such as the SDP evaluation related to water-solid operations at Oconee. No limitations or conditions relating to natural circulation flowrate regimes were placed on usage of the RETRAN code by the NRC during their review and approval of its use.

A31 Capability of RETRAN to model pressurizer transition from 2-phase to water solid, including the impact of modeling valve relief instead of a dead-ended water-solid volume RETRAN-02 balance equations solve for the volume energy and mass and junction flow and phase velocities each time step. All volumes are treated the same in this solution (including the pressurizer). With new volume energy and masses, the equation of state (EOS) is solved to obtain thermodynamic properties.

After the balance equations are solved, the nonequilibrium volume model then explicitly determines how much mass and energy is in the vapor and liquid regions by simulating the processes that occur such as spray, wall heat transfer, etc. The total mass and energy from the balance equation solution is conserved.

Normal RETRAN volumes use an EQS solution that assumes thermal equilibrium between the vapor and liquid. A nonequilibrium volume uses an EQS solution that allows unequal vapor and liquid temperatures when vapor and liquid phases are present. If the nonequilibrium volume fills or empties (vapor or liquid disappears) the normal volume EQS is used to obtain thermodynamic properties.

RETRAN assumes all volumes are right circular cylinders. The volume elevation, height, hydraulic diameter, and relative roughness allow RETRAN to compute the appropriate elevation heads and wall friction. RETRAN does not know the difference between 27

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters plenums, pipes or pressurizer volumes, they are all treated the same in the balance equation solution. Codes like RELAP5 do have components such a pipe, annulus, and plenum, however, these designations are used only to select appropriate flow regime maps, and ultimately all RELAP5 volumes are treated in the same manner as RETRAN (i.e., field equations are solved for one-dimensional flow).

A water-solid nonequilibrium volume without flow from the safety valves or PORV does not present a problem for the RETRAN balance equation solution. Since there is no vapor present when the pressurizer fills, the normal volume EOS is used so it is actually a normal volume.

A typical RETRAN model has several volumes that have flow at only one junction from/to the volume either initially or during the transient. For instance, in the Oconee model there are the core flood tanks, feedwater line, the spray line when the valve is closed, and a steam line volume when the turbine inlet valve is closed. In RETRAN models of other plants, volumes with one inlet or outlet are common. Closed ended volumes behave well and are not subject to any conservation equation or EOS solution problems.

A good demonstration of a closed ended volume is in the analysis of Standard Problem One (Edwards Pipe) in the RETRAN Assessment Manual [21). The Standard Problem One experiment consisted of a pipe containing single-phase liquid (400 to 500 degrees F) pressurized to 2500 psia. One end of the pipe was ruptured while the other end remained intact.

A3.1.1 NRC Review of RETRAN Benchmark transients that fill and empty pressurizer The RETRAN pressurizer model was evaluated by the NRC during the review of the RETRAN-3D code. The following information describes the chronology of the NRC interactions, including the consideration of comparisons of RETRAN predictions to three measured plant transients that either filled or emptied the pressurizer.

A smooth pressure transition when the pressurizer filled was demonstrated during the RETRAN-3D review as shown below in the excerpt from page 10 the RETRAN-3D SER (Reference 22) which indicates validation cases were submitted. The validation cases submitted to the NRC, which were performed with RETRAN-02, demonstrated there was no discontinuous pressurizer pressure behavior when the pressurizer filled or drained.

During review of the RETRAN-3D code, the NRC issued RAIs dated April 27, 1999, of which the following was noted, followed by the response.

General Comments and Questions 28

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters G. 1 In general the RETRAN-3D assessment does not display the level ofrigor and completeness expected ofa code planned to be an industry standard.

Previous versions of the RETRAN code shared this problem. The staffplaced numerous requirements on the code user to supply proper assessment of the code for the application being subm ittedfor staffapproval. At this time there is no indication that these requirements will not be imposed on the RETRAN-3D user as well.

Response

There are two issues associated with the limitations from the SER for R.ETRAN

02. Some of the limitations are associated with the application of specific models, while others involve system analyses for certain transients. These are discussed in the following.

The Technical Evaluation Report (TER) [Reference 16] for RETRAN-02 identified certain models that were determined to be deficient or had specific weaknesses and some other models for which the reviewed assessment was determined to be incomplete relative to the application of the models. Some examples include the subcooled void model, the bubble rise model, reverse flow through jet pumps, the pressurizer model (when completely full or empty of water), and the temperature transport model.

A major objective of the RETRAN-3D development and assessment program was to eliminate many of these limitations. Section 111.4.4 of the RETRAN-3D Assessment Manual addresses each of the issues related to findings from the RETRAN-02 review. {text cut for brevity}

Proceeding to Section 111.4.4 of the RETRAN-3D Assessment Manual, the following NRC SER restriction and corresponding response are found:

(o) The nonequilibrium pressurizer model has no fluid boundary heat losses, cannot treat thermal stratification in the liquid region and assumes instantaneous spray effectiveness and a constant rainout velocity. A constant L/A is used and flow detail within the component cannot be simulated. There will be a numerical drfl in energy due to the inconsistency between the two-region and the mixture energy equations but it should be small. No comparisons were presented involving afull or empty pressurizer. Specic application ofthis model should justify the lack offluid boundary heat transfer on a conservative basis.

Response

Wall heat transfer can be included in the RETRAN-3D pressurizer model.

Thermal stratification can be resolved by adding normal nodes below the pressurizer volume. The mixture and two-region energy equations are consistent.

In the case of the implicit solution method for the pressurizer, the mixture energy equation is used with the vapor-region energy equation. This approach ensures consistency.

29

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters When a pressurizer fills or drains, only a single region exists and the normal pressure equation of state is used to obtain the pressure for the pressurizer. The fact that this can occur without numerical discontinuities indicates the model is function properly. Another way of stating the above, is that the pressurizer (two regions nonequilibrium) pressure equation of the state degenerates to the two limiting single-phase (single-regions) pressure solutions as the pressurizer fills or drains.

The pressurizer fills or empties in the following analyses V1.3.1 ANO-2 Turbine Trip and VI.3.4 Trojan Loss of Feedwater ATWS VI.3.13 TMI-1 Loss of Feedwater Accident (this accident added by Duke for this discussion and was not part ofthe response)

Based on review of those transients, the NRC agreed with the above response and issued the following in the generic RETRAN-3D SER, page 10.

The staffnotes that when a pressurizerfills or drains, a single region exists for which the normal pressure equation ofstate is used. Lack ofnumerical discontinuities in validation analyses offilling and draining pressurizers indicates that the model isfunctioningproperly. It is the responsibility of the code user to justfy any numerical discontinuity in the pressurizer during afilling or draining event.

The NRC staff position above was formalized as generic limitation No. 18 in the Safety Evaluation approving RETRAN-3D for generic use. The non-equilibrium pressurizer thermal-hydraulic model was not changed from RETRAN-02 to RETRAN-3D, per a review of the changes identified on pages 3-5 of the RETRAN-3D SER. Further, the RETRAN-02 and RETRAN-3D HEM and non-equilibrium EOSs are the same as demonstrated by validation work showing RETRAN-02 analyses results can be reproduced when using RETRAN-3D in the RETRAN-02 mode.

A3.2 Capability of RETRAN to calculate natural circulation with RCS pressure and mass changes Natural circulation flows are driven by density differences and the relative distance between the thermal centers for heat addition and heat removal in the primary system.

RETRANs solution of the energy and momentum equations remain applicable even under unsteady RCS conditions, as evidenced by NRCs approval of the code for typical UFSAR Chapter 15 transient analyses [Ref 16-20]. A thorough review of the NRC approvals for usage of the RETRAN-02 code documented in References 16-20 confirms that there are no NRC restrictions on usage of the code in natural circulation conditions.

The thermal centers for natural circulation flow are located in the reactor vessel and OTSG tube region. The variation in RCS mass as the PZR fills does not play any 30

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters significant role in the RETRAN prediction of natural circulation flows. This point was affirmed by the NRC during the 2002 special inspection (Reference 2) at Oconee for this very set of conditions. The following text is taken from page 5 of the Report Details section of Reference 14.

The inspectors noted that the pressurizer modeling is not important during solid operation.

In the NRCs acceptance of DPC-NE-3000-PA for application to Oconee [documented within Reference 12], the NRC did not identiii any limitation or restriction for modeling events that result in either steady-state natural circulation, or unsteady natural circulation RCS flow rates.

DPC-NE-3000-PA, Section 4.3.1 provides an Oconee RETRAN model benchmark comparison to an actual Loss of Forced Flow event at Arkansas Nuclear Unit 1. The benchmark is considered directly applicable, since Oconee and ANO-1 are sister plants.

Natural circulation parameters predicted by RETRAN were in good agreement with actual plant data, for the limited nature of the benchmark, which was only presented for the first 5 minutes after the event. During this transient, RCS pressures spanned a range of approximately 460 psi, which is comparable to the range of RCS pressure changes shown in OSC-2310, Rev. 22, Appendix I. (See DPC-NE-3000-PA, pages 4-71 thru 4-83)

DPC-NE-3 000-PA, Section 5.3.4 provides a RETRAN model benchmark to a McGuire plant trip with subsequent RCP coastdown, and entry into natural circulation conditions.

Even though this is a McGuire benchmark, it does demonstrate that RETRAN is capable of modeling a transition to the natural circulation flow regime. (See DPC-NE-3000-PA, pages 5-105 thru 5-119)

In the RETRAN results documented in OSC-23 10, Rev. 22, Appendix I, MSSVs cycle at a frequency of approximately 500 seconds for case rev2l.3ogpm.max.rst. When the MSSVs open, the extended startup range SG level decreases rapidly by about 20 inches.

This cyclical reduction in the OTSG tube-side thermal center, and the corresponding changes in cold leg temperatures by about 2 degrees F, result in cyclical perturbation in RCS pressure and the natural circulation flow rates. However, the much-longer duration swings in RCS pressure from 2200 to 1600 psig caused by the cycling of the SSF letdown valve (period of 7,000 seconds), do not introduce any obvious effects on the natural circulation flow rates. These results show that RETRAN is appropriately predicting the expected system response, even though the system is not in a stable, steady-state condition.

31

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters A3.3 Basis for pressurizer Inter-Region Heat Transfer coefficient RETRAN models the pressurizer heat transfer between the vapor and liquid space using a user input value for the Inter-region heat transfer coefficient (IRHT). During the SSF events evaluated in the SDP, the pressurizer will experience maximum compression and superheating of the pressurizer steam bubble. This type of behavior is seen during the initial phase of the transient due to the operator delay in starting the SSF ASW pump to feed the SGs and terminate the overheating aspect of the transient. The operator delay results in an initial overheating and expansion of the RCS.

The SSF scenarios have very slow changes in pressurizer level due to the small net RC makeup pump injection flow. Thermally stratified conditions will exist in the pressurizer, and a layer of near saturated water is expected to be present at the liquid-steam interface.

Very little heat transfer is expected to be occurring across this interface. Therefore, a small non-zero value for the Inter-region heat transfer coefficient (IHTC) is appropriate such that heat transfer is allowed to occur across this interface.

EPRI Report NP-5357 [EPRI Report NP-5357, PWR Pressurizer Transient Response, Project 443-3, Final Report, August 1987] documents an assessment of PWR pressurizer modeling to examine important phenomenon, including inter-phase heat and mass transfer at the liquid-vapor interface. Analytical models were compared against full-scale PWR transients, including TMI Unit 2, for transients that empty and then refill the pressurizer. The report concluded that pressurizer spray flow, which disturbs the interface significantly, enhances heat transfer between the vapor and liquid regions. In the absence of pressurizer spray flow, interfacial heat transfer is considered to be negligible. The Oconee SSF transients do not include pressurizer spray due to the loss of RCPs. Therefore, the assumption of a small value for pressurizer inter-region heat transfer coefficient is consistent with independent modeling and is validated by actual B&W plant data.

A3.4 Predicted natural circulation flow uncertainties on predicted Sub-cooling margin No specific code uncertainty has been quantified for RETRAN transient analyses. The overall conservatism of RETRAN output results is assured by selection of bounding initial conditions, input parameters, and boundary conditions.

The NRC reviewed RETRAN predictions of natural circulation flow during their review of DPC-NE-3000 (Reference 12). DPC-NE-3000-PA, Section 4.3.3 provides an Oconee RETRAN model benchmark comparison to natural circulation flow rates from various tests and events at B&W plants similar to Oconee (see DPC-NE-3000-PA, pages 4-10 1 thru 4-103). The RETRAN predictions appear to be biased high by 0.5% of full flow, as compared to the B&W plant data. For the data points considered to be reliable, the plant data shows natural circulation flow equal to about 3% of full flow, while the RETRAN predictions show about 3.5% of full flow. This difference is well within the measured flow uncertainty for Oconee, which is approximately 2% of Design Flow with 4 RCPs operating.

32

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters Duke has conservatively accounted for the small over prediction of natural circulation flow rates on predicted subcooling as follows. The decay heat removal is proportional to the product of RCS mass flow rate

• vessel AT. For the transients analyzed for the SDP evaluation, vessel AT values range from 15 °F to 10 °F in the time frame of interest. If a conservative factor of 1.2 is applied to the maximum AT value, then the adjusted AT value is 18°F, or an increase of 3 °F. If this 3 °F increase is added to the hot leg temperature, it effectively reduces the subcooling margin by the same 3 °F. With this conservative adjustment, there is ample subcooling margin to account for the over-prediction in natural circulation flow rates calculated by RETRAN.

A3.5 SSF Simulator Evaluation SSF scenarios were run on the ONS simulator in which the SSF pressurizer heater breakers were assumed to fail after nominal post-trip conditions had been achieved in the RCS. Transient data was recorded at different times during these simulations. A discussion of this is provided below.

Procedural flowpath 1 (as discussed in this document) was simulated first. This entailed leaving the letdown line open and throttling back SSF ASW flow to control RCS pressure. This results in the SG levels boiling back down and a subsequent heat up of the RCS to maintain RCS pressure in the procedural RCS pressure band. The simulator data shows that the SSF letdown line flow balances out with the RC makeup flow when RCS cold leg temperatures reach 585°F. This is a somewhat lower temperature then the RETRAN case predictions, but was expected since a higher net RC makeup flowrate was modeled on the simulator (29 gpm vs. 27.6 gpm in RETRAN). The RCS will not have to heat up as much since the SSF letdown line flow requires less of a reduction to balance out with the net makeup flow rate.

After a steady-state condition was achieved in procedural flowpath 1, the operator closed the SSF letdown line to simulate procedural flowpath 3. With the SSF letdown line closed and RC makeup flow adding mass to the RCS, it became necessary for the operator to shrink the RCS to maintain RCS pressure constant. With a steam bubble still present in the pressurizer at this time, it is apparent that the bubble collapse rate predicted by the simulator is less then the net RC makeup flow capacity modeled on the simulator.

The simulator data showed that the operator gradually cools and shrinks the RCS back to a nominal 555°F condition where he then began reestablishing natural circulation levels in the SGs.

The simulator data and the operator confirmed that there was little difficulty in controlling the plant during these evolutions. The general trends of important plant parameters on the simulator agree with those predicted by RETRAN given the slight differences in some of the boundary conditions modeled on the simulator vs. that in the RETRAN runs.

Thermal-Hydraulic Response for PRA Accident Sequences Involving the Loss of SSF Pressurizer Heaters The pressurizer bubble collapse rate is hard to determine from the available simulator data, though it appears to be slower than those predicted in the RETRAN cases. It was discovered after this simulator run was done that the simulator pressurizer ambient heat loss did not match the RETRAN maximum pressurizer heat loss and that a fraction of the pressurizer heaters were still powered. This is not a significant concern since one of the primary objectives of the simulator runs was to evaluate the ability of the operator to manipulate the plant in a successful and timely manner during these scenarios. This is inherently assumed in the RETRAN analyses and can only be verified by operators performing these actions in real time on the simulator.

An additional simulator run was later performed in which operators cycled the SSF letdown line to control RCS pressure between 1600-2200 psig. Maximum pressurizer ambient heat losses and a complete loss of SSF pressurizer heaters were modeled.

Transient data was recorded for a nine hour time period starting at 1 0 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> into the event. The purpose of this run was to see what SSF letdown line cycling frequency occurred on the simulator. An average closed-to-open time of21 minutes was seen, while the average open-to-closed time frame was 42 minutes. Overall, the cycling frequency is in reasonable agreement with hand calculations and computer code predictions.

Even if an extremely rapid pressurizer bubble collapse on the order of a few hours were modeled on the simulator, this would not change an operators ability to throttle flow to the SGs for SG level or RCS pressure control, or to cycle the SSF letdown line in controlling pressurizer level or RCS pressure. These actions take on the order of seconds, and would not be impacted by the pressurizer bubble collapsing.

Based on the data reviewed for these simulations, the simulator does a satisfactory job of predicting the expected trends during an SSF event. This justifies that the simulation runs performed for these SSF events results in an acceptable demonstration of operator interaction with the plant.

34