ML20199L109
| ML20199L109 | |
| Person / Time | |
|---|---|
| Site: | Grand Gulf  |
| Issue date: | 04/03/1986 |
| From: | MISSISSIPPI POWER & LIGHT CO. |
| To: | |
| Shared Package | |
| ML20199L099 | List: |
| References | |
| REF-GTECI-A-44, REF-GTECI-EL, TASK-A-44, TASK-OR TAC-61196, NUDOCS 8604100294 | |
| Download: ML20199L109 (43) | |
Text
{{#Wiki_filter:__ MISSIS $IPPI POWER & LIGHT'S GRAND GULF NUCLEAR STATION STATION BLACKOUT EVALUATION REPORT hbh DO g6 P J35 STATION BLACKOUT EVAL
I EXECUTIVE
SUMMARY
As part of the resolution of TMI Action Plan (NUREG-0694) item I.G.1, entitled " Operator Training During Low Power Testing", the NRC required all BWR applicants for an operating license to commit to performing an in-plant Station Blackout (SBO) Test. The NRC Staff objectives for such testing would include evaluation of plant response and enhanced operator training under SB0 conditions. The Staff modified this re-quirement via NRC Generic Letter 83-24, dated June 29, 1983, which al-lows con:pliance through participation in the BWR Owner's Group Program for TMI Action Plan Item I.G.1, if the applicant can demonstrate that temperature and/or other S30 test conditions would adversely impact and pose a hazard to plant equipment. This report provides the results of a Grand Gulf Nuclear Station (GGNS) specific analytical evaluation of the plant response to SBO. The results conclusively demonstrate that such testing, if performed at GGNS, would only partially fulfill the hTC Staff SB0 test cbjectives and could potentially damage plant equipment. The analysis showed that the duration of a total SB0 test would be extremely time-limited in that the drywell temperature would exceed 170 degrees within 5 minutes. Exposing equipment to such temperatures would result in unnecessary costs to Mississippi Power & Light (MP&L) since the non-safety grade equipment will experience accelerated aging and thermal degradation which may require replacement or analysis to ensure that the equipment is operable prior to restart. Additionally, the safety-grade equip-ment, which will remain functional during the entire event, may experience degradation of its ability to survive future events. The results of the analysis reported herein conclusively demonstrate that a simulated Station Blackout test would unduly jeopardize the plant and pose an economic burden to MP&L. Due to the potential risks from performing an SB0 test, such full-scale tests are not recommended for GGNS. Alternate tests identified by the BWR Owners' Group have been or shall be performed during the test program to provide additional information and training about the plant response under SB0 conditions in lieu of an actual SB0 test. L J35 STATION BLACKOUT EVAL 1 l
I Table of Contents Section Page Executive Summary i List of Tables 111 List of Figures iv List of Acronyms and Abbreviations v 1.0 Introduction 1 1.1 History of the Station Blackout Issue 1 1.2 NRC Objectives for the Station Blackout Test 2 1.3 Achievement of NRC Objectives at Grand Gulf Nuclear Station 3 2.0 Evaluation of Station Blackout Testing 3 2.1 Test Deficiencies in Simulating Station Blackout Conditions 4 2.2 Risks in Station Blackout Testing 5 2.3 Alternative Startup Testing Performed at GGNS 6 3.0 GGNS Design Features for Station Blackout 8 3.1 Emergency DC Power System Design 8 3.2 Decay Heat Removal Capability 9 3.3 Instrumentation for Plant Protective Actions 10 4.0 GGNS's Limits and Procedures During Station Blackout 12 4.1 Plant Limits for Safety 12 4.2 Operational Response Strategy fc.: Station Blackout 15 5.0 Analytical Prediction of the GGNS Plant Response 17 5.1 Discussion of Assumptions 17 5.2 Evaluation of Predicted Plant Responses 19 5.3 Summary of GGNS Station Blackout Coping Capability 21 6.0 Conclusions 35 7.0 References 36 11 l l J35 STATION BLACK 0UT EVAL 1 j
f List of Tables The following tables contain the estimated times at which plant safety limits are exceeded for a Station Blackout occurring at full power with the following subsequent scenarios. Table Page
- 1. No Additional Failures-Minimal Operator Actions 22
- 2. Immediate RCIC Failure 22 111 J35 STATION BLACK 0UT EVAL
f. List of Figures Figure Page
- 1. Decay Heat Curve 23
- 2. Reactor Core Isolation Cooling Pump Room Temperature 24 Minimal Operator Actions Case
- 3. Reactor Pressure 25
- 4. Reactor Water Level 26
- 5. RCIC Injection Flow Rate 27
- 6. Suppression Pool Temperature 28
- 7. Drywell Temperature 29 Immediate RCIC Failure Case
- 8. Reactor Pressure w/ Depressurization 30
- 9. Reactor Water Level w/ Depressurization 31
- 10. Reactor Pressure v/o Depressurization 32
- 11. Reactor Water Level v/o Depressurization 33
- 12. Drywell Temperature w/o Depressurization 34 IV J35 STATION BLACK 0UT EVAL
I List of Acronyms and Abbreviations AC Alternating current ADS Automatic depressurization system ASME American Society of Mechanical Engineers BWROG Boiling Water Reactor Owners' Group CST Condensate storage tank DC Direct current FSAR Final Safety Analysis Report GGNS Grand Gulf Nuclear Station GPM Gallons per minute LOCA Loss of coolant accident LOOP Loss of offsite power L2 Low-low reactor water level (Level 2) L8 High reactor water level (Level 8) MP&L Mississippi Power and Light MSIV Main steam isolation valve NRC Nuclear Regulatory Commission PSIG Pounds per square inch gauge RCIC Reactor core isolation cooling RHR Residual heat removal RPV Reactor pressure vessel SB0 Station Blackout SP Suppression pool SRV Safety relief valve TAF Top of active fuel V J35 STATION BLACKOUT EVAL
I
1.0 INTRODUCTION
This report presents the results of an evaluation of a postulated Sta-tion Blackout (SBO) event at the Grand Gulf Nuclear Station (GGNS) and provides justification for not performing a simulated SB0 test. The SB0 test requirement was proposed by the NRC as part of TMI Action Plan Item I.G.1, " Training During Low Power Testing" (References 1 and 2). This report describes features at Grand Gulf Nuclear Station designed to mitigate the consequences of an SB0 event and demonstrates the ability of GGNS to withstand an SB0 based upon analytically predicted plant responses. The report describes the risks and deficiencies associated with performing an SB0 test, including the adverse impact that the SB0 test would have on plcnt equipment. The report shows alternate training which has been completed and future training planned at GGNS to comply with the BWR Owners' Group recommendations (BWROG-8120). Based on the findings presented in this report, a Station Blackout test at Grand Gulf is not recommended. This conclusion is in accordance with NRC Generic Letter 83-24, which allows for eliminating the Station Blackout test requirement if adverse impact from the test can be demonstrated and alternate testing in accordance with BWROG recommendations, is implemented. Section 1.0 provides a brief history of the SB0 issue leading to the commitment to a test at GGNS, a description of the NRC objectives for the SB0 test and a description of how the NRC objectives are being achieved at GGNS. Section 2.0 provides justification for not performing in plant SB0 testing. The justification is based upon deficiencies and risks iden-tified with SB0 testing. GGNS preoperational and startup tests that will accomplish the objectives of the SB0 test and provide the desired operator familiarization are also discussed. Section 3.0 describes those GGNS design features that are available for decay heat removal and plant monitoring during SB0 conditions. Section 4.0 describes the plant limits which must be observed to ensure plant safety and the GGNS SB0 procedures. Section 5.0 presents the analytically predicted GGNS response to an SB0 event. This section includes a description of the modeling assumptions used and discusses the time required to exceed certain plant safety limits. Section 6.0 presento Mississippi Power & Light's conclusions regarding the performance of a simulated Station Blackout test at Grand Gulf Nuclear Station. 1.1 HISTORY OF THE STATION BLACKOUT ISSUE Station Blackout is defined as the loss of offsite power (LOOP) to a generating unit coincident with the failure of onsite emergency diesel generators to deliver power to their respective safety-related buses. Such an event would deprive the plant of all AC power except that provided from battery inverter arrangements. It would eliminate the availability of many systems normally utilized to achieve safe shutdown conditions and to mitigate design basis events. J35 STATION BLACKOUT EVAL - 1
NRC concerns over risk to the public from an SB0 arise from uncertainty in the reliability of offsite and emergency onsite power supplies. Previous history on failures of diesel generators to start or provide power on demand and loss of offsite power events have contributed to this concern. Because of this, the NRC has identified Station Blackout as an Unresolved Safety Issue (A-44) (Reference 3). This unresolved safety issue is under review by the NRC. The requirement for performing an SB0 test arose from TMI Action Plan Item I.G.1, " Training During Low Power Testing". This Action Plan item, as presented in NUREG 0694 (Reference 4), requested that ap-plicants, "... define and commit to a special low power testing program approved by NRC to be conducted at power levels no greater than 5 per-cent for the purposes of providing meaningful technical information beyond that obtained in the normal startup test program and to provide supplemental training." In a January 27, 1981, letter from the NRC (Reference 2), Mississippi Power & Light was requested to commit to performing an SB0 test as part of TMI Item I.G.I. In References 5 & 6, MP&L committed to performing a Low-Power Test Training Program to be developed using the guidelines provided in the report "BWR Owners' Group Program for Compliance with NUREG 0737, Item I.G.1 Training During Low Power Testing" (Reference 7) and also com-mitted to performing a Station Blackout test. The Grand Gulf Operating License, NPF-29, consequently contained 11cen-sing condition 2.C.33.b which required MPSL to conduct the simulated SB0 test as described in Reference 6. In NRC Generic Letter 83-24 (Reference 8), the NRC modified their posi-tion on SB0 testing by stating "...if it can be demonstrated that tem-perature and/or other SB0 test conditions would adversely impact and pose a hazard to plant equipment, the BWR Owners' Group recommendations by themselves would constitute compliance With Item I.G.1...". Section 2.0 of this report provides justification for not performing the Sta-tion Blackout test, in accordance with this generic letter. 1.2 NRC OBJECTIVES FOR THE SB0 TEST TMI Action Plan Item I.G.1 requires applicants for a operating license to define and commit to a special low power tect program in order to (1) provide meaningful technical information beyond that ob-tained in the normal startup test program and (2) provide supplemental operator training. The training component of this requirement can be satisfied by the BWR Owners' Group generic response to Item I.G.1 (Reference 7). The general objectives and criteria for the testing re-quirement are as follows:
- 1. to provide meaningful technical information or data relative to plant response during off normal conditions, specifically information not provided by any of the tests described in Regulatory Guide 1.68, " Initial Test Programs" (Reference 9);
J35 STATION BLACK 0UT EVAL - 2 l
- 2. to be equivalent in scope to the PWR Special Low Power Tests;
- 3. to pose no undue risk to public health and safety; and
- 4. to pose no undue risk to the plant.
When the NRC indicated that a simulated loss of all AC power or Station Blackout test would be required, several additional objectives were added as follows:
- 1. to determine the limitations and capabilities of BWRs to main
- tain safe reactor and containment conditions in the event of a station blackout; and
- 2. to familiarize operators with plant response to Station Blackout.
1.3 ACHIEVEMENT OF NRC OBJECTIVES AT GRAND GULF NUCLEAR STATION The following subsections describe how the NRC objectives for the SB0 test listed in Subsection 1.2 are being met at GGNS. 1.3.1 LIMITATIONS AND CAPABILITIES MP&L has evaluated the capabilities and limitations of GGNS to maintain safe reactor and containment conditions during an SB0 event (see Sec-tion 4). The plant responses were determined analytically using these capabilities and limitations as di. cussed in Section 5. 1.3.2 OPERATOR FAMILIARIZATION AND TRAINING Because of restrictions necessary to protect the plant and public, a Station Blackout test will not be of benefit for familiarizing operators with plant response or for providing training in implementing mitigating procedures. The duration of a real test would be extremo1y short and repetitive tests are not prudent. As per the BWR Owners' Group recommendations, operator familiarization is being provided more effectively through individual component testing (as described in Section 2.3). 2.0 EVALUATION OF STATION BLACK 0UT TESTING The following subsections describe the disadvantages and risks as-sociated with performing a full Station Blackout Test at GGNS. Also provided is a discussion of the alternative testing which will be per-formed at GGNS to provide additional cperator training and familiariza-tion with different aspects associated with a Station Blackout Event. The disadvantages associated with the test fall into two categories:
- 1) Deficiencies associated with the test that prevent an accurate simulation of the Station Blackout Event, and
- 2) Risks to plant equipment associated with the test.
J35 STATION BLACKOUT EVAL - 3
I 2.1 TEST DEFICIENCIES IN SIMULATING SB0 CONDITIONS 2.1.1 RCIC SUCTION SOURCE Under SB0 conditions, RCIC suction will switch automatically from the condensate storage tank (CST) to the suppression pool (SP) when the pool level increases by two inches above the normal level of 111'7" and actuates the high level alarm. This action will conserve the cool CST water for use later in the event and to minimize the SP level rise during reactor depressurization. This would maintain RCIC operability as long as possible (as discussed in Section 4.2) by minimizing the potential for RCIC lube oil high temperature problems. In a Station Blackout test, water for the RCIC suction would only be taken from the CST. This restriction is necessary in order to avoid injecting suspended solids and impurities from the suppression pool into the reactor in a non-emergency situation. Should enough of such impurities be injected into the reactor, corrosion and fouling problems could result. Also, if activated, these impurities could produce higher plant radiation fields and thus increased man-REM exposure. The time required to clean up the reactor coolant prior to the resumption of power operation could impose a significant economic penalty in terms of lost production. Since operator action to transfer the RCIC suction source to the sup-pression pool would not be performed in the SB0 test, the test would not provide representative training in this area nor duplicate actual blackout conditions. CST water after passing through the reactor vessel accumulates in the SP as condensed steem. During a test in which only CST water would be used, the SP level will rise rapidly during RPV depressurination in contrast to the expected slow rise (due to thermal expansion) during an actual station blackout response strategy. Thus, a test would not simulate the expected suppression pool response. 2.1.2 DRYWELL TEMPERATURE RESPONSE Due to equipment qualification concerns associated with potentially elevated temperatures during a Station Blackout test, the test would be terminated very early so as to limit the peak drywell temperature. Rapid termination of the test would prevent the . acquisition of meaningful data concerning the response of the drywell environment. 2.1.3 SUPPRESSION POOL TEMPERATURE RESPONSE The suppression pool heatup rate during a test will not simulate blackout conditions since the pool water inventory will be continuously increasing due to the addition CST water. In an actual Station Blackout, RCIC suction water could be taken directly from the suppression pool and thus an essentially constant inventory would be maintained. Additionally the CST water would be cooler than the suppression pool water which would also tend to reduce the suppression pool temperature rise. J35 STATION BLACK 0UT EVAL - 4
2.1.4 BA'ITERY DEPLETION RATE Under Station Blackout conditions, the batteries assume the loads normally carried by their respective chargers as well as emergency lighting. All non-essential loads would be stripped in order to extend battery life. It will be difficult to sir.ulate battery emergency loading and non-essential load stripping unds.c test conditions. Loads cannot be stripped because the rest of the plant would be energized and on standby during this test. DC power is required for protective and control logic, for instrumentation, and for valve and pump motors throughout the plant. Battery chargers would remain in service during the test to assure the availability of DC power. As a consequence, test observations of plant battery depletion would not be representa-tive of Station Blackout conditions. 2.2 RISKS IN STATION BLACKOUT TESTING This subsection describes some of the risks associated with performing an SB0 test. 2.2.1 EXCESSIVE DRWELL TEMPERATURE Termination of drywell cooling due to the SB0 test will result in a rapid increase in drywell temperature. Assuming an initial drywell temperature of 135 degrees (the Technical Specification Limit), 170 degrees will be reached at approximately 5 minutes into the test. Temperature would continue to rise to a peak over 250 degrees. These values are for bulk (average) drywell air temperatures. Much higher local temperatures may be experienced in thermal plumes above individual heat sources and in the drywell head region. The values listed above are approximate because they are based upon the analysis of the SB0 event from Section 5 instead of an analysis of a Station Blackout test. Even with prompt restoration of drywell cooling, temperatures are not expected to return to normal for several minutes. Longer exposures to excessive drywell temperatures are possible if difficulties are experienced with the restoration of cooling. Accelerated aging and thermal degradation of both non-safety and safety related equipment are potential consequences of such excessive drywell temperatures. Additional testing and/or analysis may be required to assure that the equipment is functional prior to restart, and premature failures may be experienced during operation. Thus, plant availability may be reduced and severe economic burdens placed on the utility as a result of excessive drywell temperatures during a Station Blackout test. Safety-related equipment remains functional throughout the entire temperature excursion described above. However, the qualification of this equipment to survive future excursions (e.g. LOCAs) may be compromise.d since each challenge can affect qualified life. Reanalysis, and possibly, requalification or replacement of safety-related equipment will be required, which would be a substantial cost to the plant owners. J35 STATION BLACK 0UT EVAL - 5
P Operator options to minimize drywell heatup in the event of inability to restore cooling are limited. .The reactor could be depressurized !
-rapidly through the use of the ADS to reduce drywell heat loads, but this would impose a. severe thermal cycle on the reactor pressure vessel, reducing its design . allowable ' fatigue lifetime and exposing the plant owners to the potential costs' of reanalyzing fatigue life and reduced vessel lifetime.
In summary, any test in which drywell pooling. is turned off (an ex- , pected consequence of SBO) with the primary system at operating - tem-peratures Will result in drywell air temperatures exceeding normal i operating limits almost immediataly. Drywell. cooling must. be main-tained during any Station Blackout te.st . in order to avoid endue risk to equipment in the drywell. This restriction will prevent the deter- , mination of drywell thermal response during a station blackout. 2.2.2 f.XCESSIVE CONTROL. ROOM TEMPERATURE , Termination of control room cooling will result in a rise in the environmental teinperature which could potentially' exceed the. environ-mental qualification limits of the equipment in the area. .The " economic and safety aspects of such a temperature excursion would be' ' very similar to that discussed above for the drywell. 2.3 ALTERNATIVE STARTUP TESTING PERFORMED AT GGNS The Boiling Water Reactor Owners' Group paper BWROG-8121 (Reference 7) outlines training recommendations for compliance with NUREG-0737 requirement-I.G.1, " Training During Low Power Testing" (Reference 1), which has been used as a basis for MP&L's Station Blackout training program. The recommended training as outlined in BWROG-8121 is divided into . five areas:
- 1) Preoperational Testing, 2) Cold Functional Testing, 3) Hot Functional Testing, 4) Startup Testing, and 5) Additional Testing and Training. The first four areas were integrated into the Grand Gulf Nuclear Station Startup Test program. The GGNS Startup Test- program was not delineated as outlined ;
above, but rather, was divided into- four phases of testing which did ' encompass the BWROG recommendations. These phases were as follows: Checkout and Turnover Phase: System components were tested to ensure . proper operation and then turned over to MP&L. for system testing. Acceptance Test Phase: The ~ GGNS staff performed: complete overall system testing to prove proper system operation following the Checkout and Turnover Phase.. This phase covered BOP and non safety-related system testing addressed in the BWROG ~ Cold Functional Testing recommendations. Preoperational Test Phase: The GGNS staff performed complete system-testing on those systems which were required for initial fuel load and Nuclear- Heatup. This phase covered all safety-related system testing. sddressed in the' BWROG Preoperational Testing and. Cold Functional Testing recommendations along with -'several tests addressed in'the Hot Functional Testing recommendations. J35 STATION BLACK 0UT EVAL - 6
Startup Test Phase: The GGNS staff performed integrated system and total plant response testing to prove total plant safety, integrity, and reliability beginning with open vessel testing and capleting with 100*. core thermal power testing. This phase covered all remaining testing addressed in the BWROG Hot Functional Testing recommendations that were not covered in the Preoperational Test phase, along with all testing addressed in the BWROG Startup Testing recommendations. The BWROG training recommendations for Preoperational Testing were fulfilled by performing the Integrated ECCS Test lE71PT01 which included simulated LOCA, LOCA with LOP, and LOCA/ LOP with loss of each ESF division. Shift participation was verified by checking which Operations Shift Supervisor signed concurrence to begin the test. All five Operations shifts did participate during the Integrated ECCS Test. The BWROG Cold Functional Testing training recommendations were met by utilizing approved preoperational and acceptance test procedures and Operations personnel during testing and fuel loading activities. Various plant procedures were used during this testing phase. The Operations Shift Supervisor was required to give his concurrence to begin testing activities by signing the test procedure. Additionally, during system release to Plant Staff following completion of system testing, a checklist was completed to I ensure a complete review of the test package was performed. This checklist included a review by the Operations Superintendent of any operational considerations that were discovered during testing. After fuel load but prior to initial criticality, a Non-Nuclear Heatup ' was perfcrmed to complete testing requirements. During this time period plant systems that were in service for Non-Nuclear Heatup testing were operated per System Operating Instructions thereby providing the Operations shift personnel with additional systems operational training. In addition, i plant personnel were exposed to operating within the constraints imposed by the Plant Technical Specifications and other conditions which would be experienced during normal startup and power operational conditions. The Hot Functional Testing and Startup Testing recommendations were met during completion of the Preoperational Test phase and throughout the Startup Test phase of the Startup Testing Program. As required by the GGNS Startup Manual Section 5000, shift briefings were held by the MP&L Startup Test Engineer and the Operations shift personnel prior to test performance to ensure that all personnel were aware of the test activities and any procedural requirements or precautions that may have been required. System Operating Instructions, Integrated Operating Instructions, and Off-Normal Event Procedures were used throughout the Startup Test phase. Changes to these procedures were handled by adherence to the appropriatu administrative procedure to ensure the required changes were properly entered. Also, the required reading program routinely informed Operations personnel of changes to procedures. In some areas addressed in the BWROG Hot Functional Testing recommendations no startup test existed; however, the plant was operated in accordance with approved plant procedures when no startup tests were being performed. These areas were covered by the appropriate plant procedures. J35 STATION BLACKOUT EVAL - 7
During the Startup Test phase, each shift participated in the testing activities specified in the Startup Testing recommendations. These activities included:
- 1. See at least one reactor scram transient.
- 2. See at least one pressure regulator transient.
- 3. See at least one turbine trip or load rejection.
- 4. Operate the RCIC System.
- 5. See at least one water level setpoint transient.
The fifth area, consisting of " Additional Training and Testing" is continuing at GGNS and will be complete by the end of the first refueling outage. This area of training and testing was added to the _ overall program by the BWR Owners' Group to " provide additional technical information to aid in system and plant operational readiness evaluations" and to meet "the intent of the NUREG" (0660 TASK I.G. Preoperational and Low-power testing, and 0694 I.G.1 Training During Low-Power Testing). This area consists of five separate tests. Two of these tests, "Startup of the RCIC System After Loss of AC Power to the System", and " Integrated Reactor Pressure Vessel Level Functional Test", have been completed in accordance with the BWROG recommendations. A third test, "RCIC Operation to Prove DC Separation", was proven during component testing and during performance of the RCIC preoperational test and the integrated ECCS preoperational test. Separation of the DC system was proven by wiring checks and individual component operation rather than disconnecting all non-RCIC batteries as called for by the BWROG recommendations. Plant conditions at the time of the test made the modified test more practical, yet complied with the intent of the test. The reruaining two tests are scheduled as follows: 1) " Operation of the RCIC System with a Sustained Loss of AC Power to the System" is scheduled to be performed 8-31-86 based on the first refueling outage beginning 9-1-86, and 2) " Integrated Containment Pressure Instrument Test" will be completed during RF01. Operations shift personnel will participate in these tests. 3.0 GGNS DESIGN FEATURES FOR STATION BLACK 0lTr This section of the report de:.cribes design features the Grand Gulf Nuclear Station has available for supplying emergency direct current (DC) power, decay heat removal and for monitoring the plant's condition during a Station Blackout. The ability to remove decay heat is the primary concern associated with SB0; however, containment and vessel integrity are also important and 6hua require the monitoring of various plant parameters. 3.1 EMERGENCY DC POWER SYSTEM DESIGN The Class 1E DC power system is divided into three electrically and physically independent divisions. Each division operates at a nominal voltage of 125 volts DC and is normally supplied from a battery or battery charger. The battery and battery charger operate in a " float J35 STATION BLACKOUT EVAL - 8
! l charge" configuration in which loss of either source does not interrupt power flow to the bus under normal conditions. Since each battery system operates ungrounded, inadvertently making connection with one wire to ground will not render the system inoperable. However, during an SB0 the charger would be lost and therefore batteries would be the only source of power to the emergency DC system. The empere-hour capacity of each battery in Divisions I and II is adequate to supply expected essential loads for a period of at least four hours and perform three complete cycles of intermittent loads following the SBO. During this time the battery terminal voltage should not fall below 80% of rated voltage. Service to the equipment needed to mitigate the consequences of a Station Blackout can be maintained for longer than four hours by further reducing the loads on these DC buses. Division III is dedicated to the High Pressure Core Spray System (HPCS) and is therefore not needed during an SB0 event since HPCS will not be operable due to the lack of AC power. The DC buses supply DC loads directly through DC distribution panels. In addition, some AC loads are supplied from the DC buses via battery inverter arrangements. 3.2 DECAY HEAT REMOVAL CAPABILITY 3.2.1 VESSEL INVENTORY MAKEUP SYSTEMS Vessel inventory (i.e., water level) must be maintained in order to ensure adequate cooling of the fuel. Only those fluid systems which do not depend on normal or e.nergency AC power (except that from battery . inverters) will be available during an SBO. The primary system of this type is the reactor core isolation cooling (RCIC) system. A backup SB0 water supply can be furnished by the diesel driven fire pumps. The RCIC system consists of a turbine driven pump along with associated system piping, valves, control and instrumentation for providing high pressure makeup water to the RFV. The steam requirements for the RCIC pump turbine are supplied by steam taken from the reactor vessel. The power for essential RCIC components is supplied by the station batteries. A reactor pressure vessel low water level signal automatically initiates the RCIC system. The system can also be placed in operation manually. Water for the RCIC pump suction can be provided from the condensate storage tank or from the suppression pool. The condensate storage tank ' is the normal source. When sensors detect low water level in the tank or high water level in the suppression pool, the suction is transferred to the suppression pool. Manual transfer from either source tc the i other is possible during SB0 conditions. The RCIC system is capable of providing water flow to the reactor at a constant rate of 800 gpm at reactor pressures greater than 150 psig. RCIC flow can be maintained I at reduced rates down to reactor pressures as low as 60 psig. The RCIC l flow indicator located in the. main control room remains available after J35 STATION BLACKOUT EVAL - 9 I
a Station Blackout. The maximum suggested RCIC injection water temperature allowed is 140 degrees. This restriction is due to the maximva permissible temperature for RCIC turbine lube oil cooling. 3.2.2 SAFETY RELIEF VALVES /AUTOMCTIC DEPRESSURIZATION SYSTEM Safety relief valves (SEVs) will be available for reducing reactor pressure de, ring a Station Bleckout Event. The valves can be opened in the relief mode, the manual relief mode, the safety mode, the Automatic Depressurization System (ADS) mode or in the manual EDS n. ode. I All of the SRV modes, with the exception of the safety mode, require air pressure for valve actuation and DC power for valve actuator control. The safety mode does not require accumulator air or DC power because reactor pressure provides the motive fetco for opening of the , valves in this mode. The safety mode serves as a backup to the relief mode in providing the reactor with over-pressere piotection. The twenty SRVs utilize air frc:a idr accumulators which ensure that sufficient capacity is available to provide adequate supply pressure to the valve actuator. The ADS valves, which are selected SRVs, have two air accumulators. The accumulators are recharged by two of four large air receivers. The accumulators and receivers ensure that the valves can function following failure of the instrasent air supply. The ADS air supply i system is capable of providing two actuations for each ADS valve and then maintaining the valves open for 5 days. Alternately,- the air supply capacity is sufficient for 100 actuations, over a six hour period, of the low-low set point safety / relief valve. The ADS accumulators and receivers are normally supplied with air from air compresscrs in the instrument air system. Instrument air would become unavailatle after a Station Blackout because the instrument air compressors, which are powered from AC sources, could no longer repressurize the ADS air receivers. GGNS has the capability to connect backup air bottles for a long term air supply to the ADS accum$ators. , No motor operated valves need to be opened to make this supply available. The control function for all twenty safety relief - valves is provided electrical power from the emergency DC supply. Although direct SRV position indication is not available during an SBO, it is possible to infer if an SRV is open for an extenc'ed period of time by increased temperatures in the quadrant of the suppression pool associated with the open SRV and through the reactor pressure response. 3.3 INSTRUMENTATION FOR PLANT PROTECTIVE ACTIONS In addition to the instruments used to control or monitor the proper functioning of the equipment listed in Subsections 2.1 and 2.2, the following instrument indications are available during an SB0 and are particularly useful to the plant - operator for responding to transients where adequate core cooling or containment integrity could 'oe in jeopardy. J35 STATION BLACK 0UT EVAL - 10
3.2.2 SAFETY RELIEF VALVES /AUTOMCTIC DEPRESSURIZATION SYSTEM Safety relief valves (SRVs) will be available for reducing reactor pressure during a Station Blackout Event. The valves can be opened in the relief mode, the manual relief mode, the safety mode- the Automstic Depre:;surization System (ADS) mode or in the mhnual ADS rode. , All of the SRV modes, with the exception of the cafety mode, require air pressure for valve actuation and DC power for valve actuator control. The safety made does not require accumulator air or DC power because reactor pressure provides the motive force for opening of the valves in this mode. The safety mode serves as a backu'p to the relief mode in providing the reactor with ever-pressure protection. The tteency SRVs utilize air from air accumulaters which ensure that sufficicut crspacity is available to provide adequate supply pressure to the valve actuator. . The ADS valves, which are selecteil S'RV3 , hcve two air accumulators. The accumulators are recharged by two of four large gir receivers. The accumilators and receivers ensure that the valves can function following failure of the instrument air supply. The ADS nir supply system is: capable of providing two actuations for esch ADS volve end then maintaining the valves open for 5 days. Alternately, tha air supply capacity is sufficient for id0 .actuations, over a six hour period, of the icw-low set point safety / relief valv6. The ADS accugilators and receivers are normally -supplied with air from air compressors in the ihstru:nent air system. Instrument gir would become 'anaeailiola after a Station Blackout because the instrument air coacpres sors , which are powered from AC sources; could no longer repTessurize the ADS air receivers. GGNS has tha capability to con'aect > backup air bett.les for a long term air supply to 'the ADS cccumulators. No uotor operated valves need to be opened t6 make this supply available. The cont'rol faction for all twenty safety relief valves is provided electrical power from the emergelu;y DC supp1v. Although direct SRV position 19dic3 tion is not available during an SEO, ' it is possible to infer jf an SRV rs open for an extended period of time by incropsid temperatures in the quadrent of the suppression pool
! asso;iat.ed with the open SAV pad through the reactor pressure response.
3.3 INSTRU"ENTATION FOR PLANT PROTECTIVE ACTIONS In addition t0 the instrum'ents usad to control or monitor the proper functicning C.f the eqnipment listed in Subse tians 2.1 and 2.2, the following; instrument indications are available durira an SB0 and are ' particularly useful to the plant operater for respending to transients where adequate _ core cooling or containment integrity could be in jeopardy. i t e J35;iTATION BLACKOUT EVAL - 10
Control Rod Position Indication Direct readout of control rod position is n6t possible after Station Blackout. Additionally, the action is not covered in the GGNS procedures. However, complete cer. trol tod insertion can be verified on a rod by rod basis by attaching portable resistance meters to connections inside the . multiplex pcnels located inside containment. Since this procedure requires enter.ing the primary containment, the habitability of the containment would have to be considered. Reactor Water Level This indicatica provides evidence that adequate core cooling is ming maintained. Adequate core cooling is assured at decay heat g mer levels as long as water level remains above the top of active fuel. Additionally, this parameter can be used to confirm that the reactor is not overfilled which would threaten RCIC operation. This indication is available by direct readou t in the control room during a Station Blackout. Reactor Pressure This indication, in conjunction with suppression pool temperature, is used to determine when actions should be taken to prevent damage to containment structures from safety relief valve blowdowns. Further, the reactor pressure measurement is used to ensure that the reactor is not depressurized below the minimum threshold for RCIC operation. This indication is directly available in the control room during a Station Blackout. Containment Pressure This indication is used to determine when steps such as . reactor vessel depressurization/ flooding or containment venting could be performed without increasing the risk of losing the containment integrity. This indication is directly available in the control room during a Station Blackout. Containment Temperature This indicatien provides a measure of containment integrity. Direct readout of containment temperature is not currently available in the control room during a Station Blackout; however, a modification is scheduled for completion by the end of the first refueling outage which ' will maka the parameter directly available. Drvwell Pressure This indication can be used to detect leakage of reactor coolant into the drywell. This indication is directly available in the control room during a Station Blackout. , Drywell Temperature This indication provides a measure of drywell integrity. Direct readout of drywell temperature is not currently available in the control room during a Station Blackout; however, a modification is scheduled 'for completion by the end of the first refueling outage which will make the parameter directly available. J33 STATION BLACKOUT EVAL - 11
Suppression Pool Water Level This indication, in conjunction with reactor pressure, is used to determine if containment structutal loads are approaching design limits under abnormal conditions (e.g., containment flooding). This indication, in conjunction with suppression pool temperature, provides an indication o.f the steam quenching capability of the suppression pool. Direct readout of suppression pool water level , is available in the control room during a Station Blackout. Suppression Pool Water. Temperature This indication, in conjunction with suppression pool water level, provides a measure of the steam quenching capability of the suppression pool and, along with reactor pressure, is used to determine when actions can be performed without increasing the risk of damage to containment structures from safety relief valva blowdowns. The parameter is also used to determina when the RCIC suction must be switched from the suppression pool back to the condensate storage tank to ensure adequate RCIC turbine lube oil cooling. Direct readout of suppression pool water temperature is available in the control room during a Station Blackout. Battery Depletion Status Indication Battery terminal voltage, which is indicative of the battery deple-tion level, is provided in the main cor. trol room for all divisions of energency DC power. 4.0 GGNS's LIMITS AND PROCEDURES DURING STATION BLACKCUT , 4.1 PLANT LIMITS FOR SAFETY The following subsections describe the plant limits for safety which are important during a Station Blackout event. These parameters, when exceeded, indicate a potential reduction in the ability of the plant to , protect fuel or containment integrity. The limits determine the amount of time Grand Gulf Nuclear Station can safely withstand a Station-Blackout. It should be noted that the below described limits were set so as to yield conservative results .in terms of duration of plant operability. The use of the actual limit would serve to extend the predicted time for which equipment would remain operable. 4.1.1 REACTOR WATER LEVEL Reactor water level prcvides an indication of the state of fuel cooling. Inadequate core cooling and possible fual damage cannet occur after reactor shutdown as long as reactor water level remains above the Top of Active Fuel (TAF) which is about 200 inches below normal water level. Adequate core cooling can be maintained at lower reactor water levels for limited periods of time, but depends upon steam cooling of the fuel. Therefore, . TAF is used as the reactor low water level plant safety limit, since it assures a high level of fuel integrity and therefore .a relatively low level . of fission product release from the ' l fuel. These low release levels would not represent a significant threat to the public safety even if released to the environment. , J35 STATION BLACK 0UT EVAL - 12 i 1
1 In order to ensure that the reactor water level does not reach. the TAF, t'he RCIC system is initiated at Level 2 when the level is approximately
- 120 inches abo.e the TAF#
Entry of liquid reactor water into the main steam lines could ul-timately result in damage to the RCIC turbine, steam lines and SRVs. There fore, Level 8, which is about 18 inches above normal water level, is used as the renctor high water level plant safety limit. An in- ' dication of high water level automatically causes the RCIC turbwe to
, trip. i I
4.1.2 REACTOR PRESSURE A reactor dome pressure of 1325 psig, which corresponds to the 110?. of design peak pre 6sure .(1375 psig), is used as the reactor high pressure plant safety limit. This is the maximum pressure allowed under upset conditions by the ASME Boiler and Pressure Vessel Code. Overpressure protaction is provided by the SRVs which initially operate , in the pressure relief mode and later in the safety mode, if necessary. t If the reactor is depressurized, pressure should be maintained above
, 150 psig for full RCIC flow and above 60 psig in order to avoid sbutdown of the RCIC turbine on low steam pressure.
k Reducing reactor pressure to exactly 150 psig is not essential to maintaining the plant in a safe condition. Depressurization . will . , reduce the probability of a stuck open relief valve (because fewer I valve lifts would be required fer decay heat removal) and will slow the heatup of the drywell. This would minimize the potential for exposing the equipment to excessive drywell temperatures. With a lower risk of equipment failure due to thermal degradation, there is greater likelihood that safe conditiens will be maintained. Consequently the operator vould reduce the reactor pressure to a pressure somewhat above the 150 psig limit (e.g., 200 psig) and would .then maintain the , i pressure at the relatively low value through operation of one or more safety relief valves. 4.1.3 SUPPRESSION POOL TEMPERATURE , The limiting suppression pool temperature is governed by the tempera-ture necdad to produce adequate steam condensation at the ~ safety relief valve discharge quenchers in the suppression pool. Thus, the limiting suppression pool temperature has been. determined to be 185 degrees. The only operator action avai*1able to reduce the suppression pool temperature would be to add cooler water to the suppression pool- from sources such as the upper containment pool. The maximum amount' of inventory addition- is governed by the maximum allowable suppression " pool water level. 1 J35 STATION BLACK 0UT EVAI, _ _ - - _ _ _ _ _ _ - - _ - - _ _ _ _ - _ - _ - - _ _ _ _ - _ _ _ _ _ _ - - . _ - _ - _ _ _ _ _ _ _ _ _ _ _ _ _
4.1.4 SUPPRESSION POOL LEVEL During a blackout condition, suppression pool level will rise due to expansion from heatup and the addition of condensed steam from the reactor. Following initiation of the RCIC system, water from the condensate storage tank will be deposited into the suppression pool as steam from the SRV's and RCIC turbine exhaust. The suppression pool level will tend to be reduced by water returned to the reactor by RCIO when pumping from the pool. The suppression pool is designed -so that a - dump of the upper contain-ment pool will not cause the suppression pool to flood the drywell. The addition of the entire condensate storage tank, which is of slightly larger volume than the upper pool, will cause the suppression pool to slightly overflow into the drywell if the CST is at it's maximum level. 4.1.5 CONTAINMENT PRESSURE The design pressure for the GGNS contain2ent is 15 psig. This -value represents the containment high pressure plant safety limit, although structural failure of the containment Would not occur until a much higher pressure is reached. The plant response to an SB0 event is not expected to be limited by this parameter. 4.1.6 CONTAINMENT TEMPERATURE The environmental qualification envelope used to qualify containment equipment includes the assumption of 185 degree temperatures for a period of one day to account for Loss of Coolunt Accident conditions. This limit, if not exceeded, will provide assurance that safety related equipment will be functional after the reestablishment of AC power systems. Therefore, it is used as the high containment temperature plant safety limit. 4.1.7 DRYWELL PRESSURE The drywell design pressure is 30 psig. This value is high enough to prevent drywell structural damage after large high energy linebreaks occur in the drywell. This value is used as the high drywell pressure plant safety limit. 4.1.8 DRWELL TEMPERATURE The environmental qualification envelope used- to- qualify drywell equipment includes the assumption of 330 degree temperatures for a period of 3 hours, 310 degree temperatures between 3 and 6 hours and temperatures over 250 degrees for one day to account for loss of coolant" ' accident conditions. Thus the safety limit for purposes of the study is conservatively set at 250 degrees. This limit, if not exceeded, will provide assurance that safety related equipment will remain functional throughout the event and continue to be functional after the reestablishment of AC power systems. J35 STATION BLACK 0UT EVAL - 14
4.1.9 RCIC ROOM TEMPERATURE The environmental qualification envelope used to qualify equipment in the RCIC pump room and the RCIC instrument panel room includes the assumption of 150 degrees or higher temperatures for a peziod of 12 hours to account for high energy line break conditions. Therefore, 150 degrees is used as the RCIC room high temperature plant safety limit for this study. 4.1.10 MAIN CONTROL ROOM TEMPERATURE The environmental temperature envelope used t.o qualify equipment in the control room has a maximum temperature of 90 degrees. Another criteria imposed on the temperature is based upon control room habitability. However, the environmental qualification temperature of the equipment would represent the limiting case. The SB0 event results in loss of power to all equipment in the control roem except that supplied from DC or uninterruptible power sources and much of this would be switched off very early in the transient to conserva battery life. Thus the cooling to the control room would be lost. Control room temperature and humidity can be moderated via natural circulat. ion pathways by opening the access doors to the control room and by removing some ceiling panels. 4.1.11 PLANT BA'ITERY DEPLETION The plant safety limit used to define when emergency batteries are depleted is battery terminal voltage falling to 100 volts DC (80% of the design value of 125 volts DC). This voltage is sufficient to operate all the required components attached to the asscciated DC busses. 4.2 OPERATIONAL RESPONSE STRATEGY FOR STATION BLACKOUT The following steps describe the actions to be taken by the plant operators as described by the GGNS procedures under Station Blackout conditions.
- 1. If the plant is at power operation when the Station Blackout occurs, the operator would first confirm that the reactor had scrammed. In the event of a Station Blackout, confirmation that each control rod is fully inserted could be made by connecting a resistance meter to each individual control rod position indication wire located on the multiplex panels inside containment although this approach is not presently included in the GGNS procedures. Since this action would require entering the primary containment, environmental habitability would have to be considered.
- 2. Attempts would be initiated to reestablish offsite power and/
or start a diesel and connect it to its associated bus. J35 STATION BLACK 0UT EVAL - 15
- 3. RCIC initiates upon reactor low-low water level, Level 2.
RCIC flow would be confirmed to exist. If the RCIC system is not running, it would be manually initiated. (RCIC isolation signals, such as RCIC area high temperature isolation, may need to be overridden.)
- 4. SRVs would be operated in order to maintain the reactor pressure below the relief valve setpoint.
- 5. Backup air supply bottles to provide long term makeup for the ADS accumulators would be tied in as per the appropriate GGNS procedure.
- 6. Suction for RCIC may come from either the CST or the suppression pool. During normal (non-emergency) situations, suction temperatures should be held to less than 140 degrees to minimize heating of the turbine lube oil and seals.
However in a Station Blackout situation, the suction source will depend on the availability of suction water supply. The suction supply can be manually switched from the CST to the suppression pool and back to ensure both availability of water and due to temperature considerations.
- 7. RCIC flow will be maximized in order to maximize the amount of steam and hence energy being removed from the vessel to drive the RCIC turbine. This approach is used to aid in the cooldown process. Upon restoration of normal reactor water level, a portion of the RCIC flow is returned to the source (CST or suppression pool) so that level can be maintained and RCIC flow held at its maximum.
- 8. If AC power can not be reestablished quickly, non-essential loads on the batteries would be shed to maximize the length of time DC power will be available for essential control functions.
- 9. If additional wcter is needed in the suppression pool, the upper containment pool and spent fuel pool can be dumped to the suppression pool. Since the primary containment must be entered in order to accomplish this act3on , the habitability 4 of the containment would have to be considered.
~
The actions taken if additional failures occur may 14 different than those listed above. If the RCIC system becomes unavailable during the transient, the fire protection water (previded by the diesel driven fire pump) would be aligned to the reactor vessel. In order to accomplish this action, the primary containment must be entered which would require the consideration of containment habitability. When fire protection water is available (i.e., pumps running and alignment complete), the reactor would be depressurized via manual operation of the ADS valves to allow maximum flow from this low pressure injection source. If reactor water level falls below top of active fuel before fire protect ion water becomes available, core cooling can be maintained for a short period of time using the Core Cooling Without Injection Emergency Procedure. However, if RCIC fails early in the event, depressurization is not possible without severe core uncovery (See Section 5.2.2). J35 STATION BLACK 0lTT EVAL - 16
5.0 ANALYTICAL PREDICTION OF THE GGNS PLANT RESPONSE Plant responses have been determined analytically for Station Blackouts occurring at full power operation with an equilibrium core. The fol-lowing scenarios were analyzed.
- 1. Station Blackout with no additional failures and minimal operator actions.
- 2. Station Blackout with immediate RCIC failure.
5.1 DISCUSSION OF ASSUMPTIONS 5.1.1 INITIAL / BOUNDARY CONDITIONS The plant was assumed to be operating under normal conditions at 100% power with an equilibrium core. The initiating event was taken to be a loss of offsite power (LOOP), followed by a failure of all three divisions of the emergency diesel AC generators to supply power. The immediate plant response would be similar to a LOOP transient. The reactor would scram and the recirculation pumps would trip, the Main Steam Isolation Valves (MSIVs) would close, and all systems and equipment not powered off station batteries would be lost. The primary containment would partially isolate as a consequence of (1) isolation signals generated by the LOOP event and (2) closure of air-operated, fail closed containment isolation ralves due to loss of the instrument air compressors. The systems with motor operated valves could be isolated manually. Decay heat would be dissipated to the suppression pool through the safety relief valves (SRVs). Water injection to the reactor would be available from the steam-driven reactor core isolation cooling (RCIC) system. Using this, the analytical approach was as follows: o The initial plant response (first ten seconds) was assumed to be identical to the LOOP transient at 100% power. o The transient response after the initial 10 second period was determined using a model as described in Section 5.1.3 which simulated the plant conditions with the reactor shutdown and isolated, with an option to depressurize the reactor by holding open an SRV. This endel permitted the simulation of various operator response actions to determine the effect on the overall plant response. The model was constructed to provide a best estimate of transient response for the input parameters provided, o The decay heat curve utilized in the model was computed using the ANS 5.1 Decay Power Standard (1979) for an equilibrium core. o The fuel's decay heat and the sensible heat released or absorbed by the reactor vessel and internals were considered. o Only the full (100%) power mode of plant operation was considered since decay heat levels are greatest under this condition. J35 STATION BLACKOUT EVAL - 17
5.1.2 EQUIPMENT AVAILABILITY Only equipment which does not depend upon AC power (with the exception of those items supplied from battery inverter arrangements) can be used to maintain the plant in a safe condition during an SBO. All of the equipment discussed in Section 3.0 was assumed to be available during a Station Blackout. The following is a list of major systems / equipment that would be unavailable under SB0 conditions:
- Feedwater
- High Pressure Core Spray
- Low Pressure Core Spray
- Low Pressure Coolant Injection
- Drywell Cooling
- Suppression Pool Cooling hode of RHR
- Cooling to the RCIC Equipment Areas
- Containment Spray Mode of RHR
- Standby Service Water
- Cooling to the Control Room 5.1.3 MODEL DESCRIPTION Plant responses for the analyzed SB0 scenarios were determined using a model based on the GGNS operational response strategy described in Sec-tion 4.2 and the assumptions from Sections 5.1.1 and 5.1.2.
The model considers the heat input to the reactor vessel from the decay heat. It performs an energy balance to determine the amount of heat which is stored in the reactor vessel and internals and that which is lost to the drywell. The remaining heat is deposited into the water inside the vessel. The code performs a mass balance using the mass input from the RCIC system and the mass discharged from the safety relief valves (SRVs) and that sent to the RCIC pump's turbine. The flow through the SRVs is assumed choked at all times. It is assumed that the low-low SRV setpoint relief logic is armed during the first ten seconds of the LOOP transient. The steam discharge from the SRVs and the RCIC turbine is condensed in the suppression pool. Mass and energy balances are performed on the suppression pool to determine the suppression pool temperature. The modal has the capability of modeling RCIC suction from either the Condensate Storage Tank (CST) or the suppression pool and can model the manual or automatic switch between the two sources. The model determines the maximum pump flow possible St. a given reactor pressure. The model uses the RPV pressure and the frictional flow loss through the RCIC piping to determine the pamp power input requirements. The model determines the steam required for the pump turbine to supply the required power to the pump. Operator actions such as manual reactor depressurization, RCIC suction source switches, and RCIC flov path changes are considered when pos-sible under the SB0 conditions. J35 STATION BLACK 0UT EVAL - 18 k
The drywell response was determined taking into account heat transfer to and from the dry:rc11 structure and internal steel structures. The heat loads included the reactor pressure vessel, the uninsulated steel piping, the cooling fan motors (which are stopped and cooling off), the unidentified reactor coolant leakage, the SRV piping due to steam flow through the piping, and the heat loss from the discharge piping of the control rod drive hydraulic control units (CRD HCUs) following the scram. Following a scram, the CRD HCU piping contains water at essentially reactor saturation temperature which cools and thus transfers heat to the drywell atmosphere. 5.2 EVALUATION OF PREDICTED PLANT RESPONSES Station Blackout would result in reactor scram, reactor recirculation pump coastdown and main steam isolation valve (MSIV) closure all due to the loss of offsite power (LOOP). Reactor water level would initially rise and then drop rapidly due to void collapse after the reactor scram, recirculation pump trip and MSIV closure. Due to MSIV closure, reactor pressure would increase rapidly causing - SRVs to lift. The loss of the feedwater pumps (due to the loss of AC power) would initially prevent makeup of the inventory depletion. While the plant may be maintained in a safe condition for some period of time during an SBO, the inability to remove decay heat from the containment does not permit a stable condition of the plant to be achieved as long as SB0 conditions exist. Under the SB0 conditions, the reactor could be maintained in a safe condition provided coolant injection remained available. However, decay heat would accumulate in the containment, causing the suppression pool and drywell temperatures to rise. Temperatures would also rise in the RCIC equipment area due l
,o the passage of reactor steam through the turbine. Suppression pool level would rise due to thermal expansion and due to the accumulation of reactor injection water from the Condensate Storage Tank (CST) in the pool as condensed steam.
The first ten seconds of the transient wculd be identical to a loss of offsite power (LOOP) transient and were therefore not modeled explicitly herein. Instead the system conditions at ten seconds into the LOOP transient (as analyzed in the GGNS FSAR) were used as the initial conditions for all the following cases. Therefore, the transient times discussed herein start at ten seconds after the actual event initiator. The time histories presented herein should be considered only as representative of the general trends of the event since the exact timing of operator actions and the actual component performance charac-teristics may vary somewhat from that assumed. The decay hest input to the reactor vessel is identical for all cases and is shcun in Figure 1. The RCIC pump room air temperature response for the first case is shcwn in Figure 2. For the RCIC failure case, the RCIC cubicle air temperature is unimportant. J35 STATION BLACK 0UT EVAL - 19
5.2.1 SB0 AT FULL POWER WITH NO ADDITIONAL FAILURES AND MINIMAL OPERATOR ACTIONS The SRV low-low setpoint logic would be armed during the initial phases of the transient. Initially, eleven SRV's are open, then six, then two, then one then zero. If the operator takes no actions to depressurize the reactor, the low-low setpoint valve would then cycle open and close to control the reactor pressure between 1048 and 941 psia (Figure 3). To allow continued SRV operation, the operator may eventually have to connect the backup air supply to the ADS accumulators. The RCIC system would be actuated when reactor water level falls to Level 2 (Figures 4 and 5) . Reactor water level would continue to drop l until RCIC flow exceeds inventory losses after which the level will gradually return the normal water level. The operator would then con-trol RCIC in an attempt to maintain water level within the normal range. In this analysis, it was assumed that the operator balanced the inventory removal rate with the RCIC flow when the level returned to ! the normal level and did not readjust the RCIC flow until a high or low ) water level limit was reached again. To control the flow, the operator maintains maximum RCIC pump flow but returns a portion of the flow back to the suction source through the recirculation test line. Con-sequently, Figure 5 shows only the portion of the RCIC flow rate which is injected into the vessel. Maintaining maximum RCIC. pump flow main-tains the maximum steam removal (and hence energy) from the vessel and thus aids in the cooldown process. I ! Suppression pool temperature (Figure 6) would be rising due to SRV { discharges and the RCIC turbine exhaust steam. RCIC pump suction was assumed to be switched from the condensate storage tank to the suppression pool early in the event and back to the storage tank when suppression pool water temperature exceeded 140 degrees. If the event ( were to continue long enough, the RCIC suction would be switched back again to the suppression pool when the condensate storage tank is depleted. This was no i. , hou ver, predicted to occur within the ten hours simulated herein. The drywell air temperature will rise due to the~ loss of cooling in this area (Figure 7). As can be seen, the heat load and hence temperature rate of increase is at a maximum during the early phases of the transient since the reactor is at its hottest point, the heat due to the scram is present, and the cooling fan motors are hot. The heat load due to the SRV's is intermittent since the valves cycle open and closed. However when the valves are open the heat load is relatively constant in magnitude except for the first actuation when eleven SRV's are open. The first plant safety limit (as set in Section 4.1) exceeded during this scenario is drywell temperature at 4 hours into the event. Table 1 shows the estimated times when other plant safety limits are exceeded. l I I J35 STATION BLACK 0UT EVAL - 20
5.2.2 SB0 AT FULL POWER WITH IMMEDIATE RCIC FAILURE Loss of PCIC would leave no means of high pressure injection to the reactor. The RCIC system would not be requested to function until the water level reaches Level 2. At this time it was assumed that RCIC immediately failed to function and could not be manually actuated. Use of injection from the Fire Protection Water Supply System if the RCIC system fails immediately cannot be accomplished without uncovering the core for a significant period of time. In order to use this low pressure injection water source, prompt depressurization of the vessel is required to less than 100 psia. Given the decay heat rate and the thermai energy stored in the vessel and internals early in the transient, the vessel would have to be essentially emptied of water to accomplish this depressurization, resulting in core uncovery (Figures 8 and 9). If no depressurization is performed, however, analysis indicates that reactor water level would not reach the top of active fuel until approximately 25 minutes into the Station Blackout. The reactor pressure and water level responses are shown in Figures 10 and 11. Studies indicace that adequate core cooling can be maintained down to a vessel water level of approximately 3.5 feet above bottom of active fuel as long as steam flow through the core (such as would result from intermittent SRV lifts) occurs (Reference 10). For this case it is estimated that the water level will reath this point approximately 45 minutes into the event. Figure 12 shows the drywell response in the event of RCIC failure with no depressurization. No other plant limits would be approached during this time frame (Table 2). If the RCIC failure occurred much later in the event when the decay heat levels were less or after the operator had depressurized the reac-tor to the RCIC low pressure control range (200 to 250 psig), the com-plete depressurization approach would be appropriate. Before the water level reached the top of active fuel, the operator could depressurize enough to allow the fire protection system to be used without ex-periencing severe core uncovery. However, efforts to align the Fire Protection Water Supply System to provide water to the reactor vessel would be hampared by the possibly high drywell and containment temperatures. 5.3 SU!IMARY OF GGNS STATION BLACKOUT COPING CAPABILITY As shown in Subsection 5.2.1, in situations where SB0 occurs during full power operation and no additional failures occur, the plant can be maintained in a safe condition (where safety is defined 5, the plant safety limits described in Section 4.1) for a period of . . - least 4 hours. The predicted drywell temperature limit exceeded lu, limit at this time. If RCIC is not available for reactor coolant makeup as is discussed in Subsection 5.2.2, the first plant safety limit ~that would be exceeded is reactor water level at 25 minutes. Core cooling can be maintained for a longer period (20 additional minutes) because of steam cooling of the fuel assemblies. If makeup flow to the reactor cannot be re-established at approximately 45 minutes into the event, core damage may be expected. ' J35 STATION PLACK 0UT EVAL - 21
This evaluation was based on extremely conservative assumptions of the plant safety limits. For example, the drywell temperature was conservatively limited to 250 degrees even though all of the equipment in the dryvell is environmentally qualified to withstand much higher temperatures (310 to 330 degrecs) for periods up to six hours. Thus exceeding the 250 degree limit would accelerate the thermal aging of the safety related equipment but would not cause an immediate failure. The analysis is also based upon techniques and assumptions which yield conservatively high temperatures after the initial phase of the event. On this basis, the plant has the ability to withstand tise SB0 event and be maintained in a safe condition for at least 4 hours assuming there are no concurrent failures. The probability of fuel damage is very low on the basis of the long time period available for restoration of AC power and the low probability for the loss the RCIC system on occurrence of SBO. .i I e 6 J35 STATION BLACKOUT EVAL - 22
TABLE 1
- Estimated Times At Which Plant Safety Limits Are Exceeded For Station Blackout At Full Power With No Additional Failures Minimal Operator Actions
, Plant Safety Limit Time When Limit l Exceeded (hr) 4 Reactor Watoc Level > 10.0 Reactor Pressure > 10.0 Suppression Pool Temperature 4.7 Drywell Temperature 4.0 RCIC Room Temperature > 10.0 TABLE 2 Estimated Times At Which Plant Safety Limits Are Exceeded For Station Blackout At Full Power
, With-Immediate RCIC Failure Plant Safety Limit Time When Limit e Exceeded (min) 1 ! heactor Water Level (Top of Fuel) 25 (3.5 Foot Level) 45 Reactor Pressure > 60. t Suppression Pool Temperature > 60. ' Drywell Temperature > 60. RCIC Room Temperature > 60. 1 i l J35 STATION BLACKOUT EVAL - 22a I
e -e,y 4 e a-*u. s ac. ew -- m- e- m. e4--a m- #- zA e adie-E-am-.e w-MM e L- M J. r*-> n .smCA- .a $angd.- A4w A ee,m-d=----44=- "
+-he- am 484i4 5- e 3 +&h--
t J 9 d) e @ (' ' Page 23 I e + -O - < t T i g
*W b
4 l
- e
. <> . A i
r a N { b E
- - o y
- 2 1
% o =
4 0 n ^ 1
< ~
+
2 m M
+
1
* "7 r.-
e i O J -m e 1 ~
-u .
i 3
< 2
. v
! c 1 Z m w .,
d W l i n.
+
3 ! } , ._the l ,
*O 1,
e e r i
*N 4
a . , ) . i ) I~ 1
,/ 9 s
t S 4
! -r : . : : : : ::
s,* '
*O l A ~4 4 I
- o o. o. . 8. .
j O O O o O O t
- T O W 3* d J **4. n 4 b e ...' s e
i i i-=-.r-r,*--w-~~vwr---me-.-e,ww,. - **~+- + ,-.--ws e->--., i e-w+--c,.e-~re,vw.ca..ev.wt...,+.r*e nre w +vw , re -ee-ww , n a-+, w w ,,- m -- r-e' y - we+ w e +
- e t w + e " m yrw-
- w e' -w --we w-+-v 1
1 a l.- Figure 2 STATION BLACKOUT . RCIC CUBICLE TEMPERATURE 1 I J 0-. i
,A
^
425- ' 1 j Q~ c.. / g 1 i i ' e M
& 8 .
1 I M i , . E t 4% M
-P I
9
, A o ,s 4 R l E 410-I D
! T C 1 l r ' ' 605-f 1 i i j 100-j 0 1 2 -3 4 5 6 7 8 o 10 1 ilftf (HOURS 5 4 w -- . - - , - - , . -
Figure 3 SB0 WITIl NO ADDITIONAL FAILURES MINIMAL OPERATOR ACTIONS REACTOR PRESSURE
.400 4
4:00
< > > i i i i , ,
i > > > i i , , , i i , , , , , i > , , i > i , 400 Q r A R JO-C o m R 700- e g P 4 - r 600- M 9 Ut S U R " 0 0- ! ? 400 9 J00 to0-400-0 6 . a , 0 1 4 J 4 ' 6 7 8 4 10
!!MC (HOURS)
Figure 4 SB0 WITIl NO ADDITIONAL li'AILURES MINIMAL OPERATOR ACTIONS - REACTOR WATICR LEVEL
,, y /'/ ,
/ /,
(, /'
, /> ./
/
, V , ,
y ,,
)* /' 1
? l $>, / >
/ '
N 43 I 1 Normal Water Low Water Level gy- Level L2 g 4 e a b 33 ' kJ R @ w
- i. g,.
R L e i G-4 F L 65-T 10 O-'
. . . . . . 1 J I J ". ' u 4 4 6 8 10
- I t1F N00RS)
1 l Figure 5 SBO WITH NO ADDITIONAL FAILURES - MINIMAL OPERATOR ACTIONS RCIC INJECTION FLOW I000-900-800- , -> 4-> -> r -, o-i <-> ,-, l l 8t C 700-I C g a t COO: < $ f 94 C N T i 530-D 4 F L C00-0 W 8 C 300-' P M 200- . Ich <-> cr e, 0 3 2 3 4 5 6 7 8 4 10 iINE (HOURS)
Figure .6
~
SB0 WITH NO ADDITIONAL FAILURES MINIMAL OPERATOR ACTIONS . SUPPRESSION POOL TEMPERATURE ! v 03-U .90-i i 1 I swu DJ
?
E R .50- ' C h cw f
'O e * * . . . . ,
0 1 4 3 4 5 6 7 R 9 la TINE (HOURS)
s Figure 7 SB0 WITII NO ADDITIONAL FAILURES MINIMAL OPERATOR ACTIONS - DRYWELL TEMPEATURE . 400-J4
- V W JOO I
T L e
; = ,
F .se Y R F.
/
3 200-G V
. 50-A-
. . . . . . . . 4 - .
3 a & J 4 5 6 / 8 9 10 TIME 0100RS1
Figure 8 SB0 WITH IMMEDIATE RClC FAILURE . MANUAL DEPHESSURIZATION REACTOR PRESSURE '
.400-I, ,
i400-000l' ,! ' 400-) , F I E p 800j j 0 R 700-i 1 o R F 000-5 l o . R 530- - I . i
.400g 4
J001 t JO@ . t 00-0- _, m, , _ 0 5 to I5 20 25 Jo 35 40 45 50 55 60 7iNE (NINUTES)
- Figure 9 SB0 WITH IMMEDIATE RCIC FAILURE ,
l MANUAL DEPRESSURIZATION REACTOR WATER LEVEL ' t.0-i. 2 ss. _ 5 s a.' f .i . 4N > , L t 9 .
' E -
4 4 >- c .T e T o M R J s-- s e y , e . - 1 4
- Jo-{
r 9
~
l L , r 5j i 0 . i' f .
, L 20 ; . r ;
i I 15-4 i ? ic , o
~
0-) ,. -- 0 5 to 15 20 25 J0 35 40 45 50 %S 60
'lME (MINUTES) i I
i Figure 10 SB0 WITIf IMMEDIATE RCIC FAILURE ' NO DEPRICSSURlZATION i j REACTOR PRESSURE - 5 1200-I b i .400-i l i 4
.000 5' / \ / /
i 400-i* g, e 7 - g 800-i t
- h. T
!o t
'ow, j
P * , R
- F COO a W ;
- S M . S ; , u 4 R .500-1
.+ g
! ? 400-,
i s 4 1 A l' i J00-l [ aa; j
. t i ; ION .
! } I O 5 to 65 20 25 'Ju 35 40 45 SJ '55 60 FINE (MINUTES) j !
, - . .i -r - -. -,% .,%. . . - , - - ;-,.-,-.c -. . . . . . . , . , . - . - - .....-e. . . - . - - ,.
Figure 11 SB0 WITH IMMEDIATE RCIC FAILURE ' NO DEPRESSURIZATION REACTOR WATER LEVEL - Sk: o 45 i 5 4J ' 9 J%
\m '.
4 1
,30- g J h W 4 W
\_
e 8 1 X -\ - h 20 ~ \
- . N.
=
-l _
L 6 % a 5-1 3 4 IO' 5-
~
6 - . -T"~ . . ' . . . . . a 0 5 to 15 20 25 JD 35 40 45 50 55 60 4 fine (dlNUTES) e
Figure 12 SBO WITH IMMEDIATE RCIC FAILURE . NO DEPRESSURIZATION - l DRYWELL TEMPERATURE ,
* *1 i
e l D [ R - W $00-r t A. L 3 (de E E 45Y
- a
! A I T U R E
]a c - _. _
F IO - .- .- .- .- . ,- ... ... .,. , . _ ,. ,, 3 5 10 15 23 25 30 35 40 45 50 'iS 60 f tNE (NINUTES) ,
- ._ , _ _ _ _ n' -J
i
6.0 CONCLUSION
S The plant response to Station Blackout has been evaluated to determine the extent to which that response can be simulated in testing. ; Restrictions en testing necessary to protect public health and plant equipment prohibit a plant-wide Station Blackout test and severely limit the degree to which expected Station Blackout conditions can be simulated in the reactor vessel and drywell. Station Blackout testing , is essentially limited to performance and response testing of a limited number of specific systems and components where blackout conditions can be safely simulated. As a consequence, the value of -Station Blackout testing towards determining GGNS capabilities or providing operator familiarization is minimal. This analysis has conservatively demonstrated that GGNS can tolerate SB0 conditions for a period of time, even if further equipment failures following SB0 are postulated. # Grand Gulf Nuclear Station has the capability to safely withstand a Station Blackout event for at least 4 hours if RCIC remains available. [ If RCIC is not available, core cocling can be maintained for at least 45 minutes through boil-off of the core inventory. In order to address the recommendations of the BW Owners' Group, preoperational and startup tests on individual systems are being , performed to provide information relative to the ability of equipment 3 to function under Station Blac.kout conditions. This- information will also contribute to operator familiarization with operations which are - expected to occur during SB0 conditions. t A Station Blackout Test is not recommended at Grand Gulf for the i following reasons: ,
- 1) A test to simulate an actual Station Blackout response cannot be safely performed.
- 2) Even limited scope testing could pose a significant 7 challenge to plant safety systems as demonstrated by analysis.
- 3) The operability of non-safety related components exposed to the test environment could potentially be jeopardized.
- 4) The benefit to operator familiarization is minimal at best I due to the extremely short duration of a test. f
- 5) Alternate testing on a component basis can be performed to '
provide much of the same information which would be derived from a full test. i t J35 STATION BLACKOUT EVAL - 35
a
- 6) GGNS has been analytically shown to be ' capable of withstanding an SB0 for a period of time. This capability coupled with the reliability of the grid reduces the averall risk associated with a Station Blackout.
! These conclusions support Missia,sippi Power and Light's position, in accordance with Generic Letter 83-24, that Station Blackout testing I would be of minimal benefit with regards to operator training, would l indeed be detrimer.tal to safe operation of the plant, and should not be '
,- performed at Grand Gulf. l' l i I i 4 4 1 J j 1 1 i I P l P Q b ~!
' i 4
4 1 1 I J35 STAT 10N BLACK 0tTr EVAL - 36 l 1 1 6
7.0 EFERENCES
- 1. NUREG-0737 Clarification of TMI Action Plan Requirements, Novemb r, 1980.
- 2. Tedesco, R. L., Assistant Director for Licensing, NRC, "TMI Task Action Item I.G.1, Special Low Power Test Progrom fo:-
BWRs", letter to McGaughy, J. P., Assistant Vice President-Nuclear Production, MP6L, 1/27/81.
- 3. NUREG-0606, Unresolved Safety Isnues Suamary, February 13, 1981.
- 4. NUREG-0694, TMI Related Requirements for New Operating Licenses, June, 1980.
- 5. Dale, L. F., Nuclear Project Manager, NP&L, "TMI Task Ac-tion Item 1.G.1, Training During Low Power Testing", letter to Tedesco, R, L., Assistant Director of Licensing, NRC, April 7, 1981.
- 6. Dale, L. F., Manager of Nuclear Services, MP&L, "TMI Tash Action Item 1.G.1, Training During Low Power Testing", let-ter to Tedesco, R. L., Assistant Director of Licensing, hRC, August 18, 1981.
- 7. Waters, D. B., Chairman BWR Owners Group, "BWR Owners' Group Evaluation of NUREG-0737 Requirement I.G.), Training During Low Power Testing", letter BWROG-8120 to Eisenhut, D. G., Director Division of Licensing, NRC, February 4, 1981.
- 8. Eisenhut, D. G., Director of Licensing, NRC, "TMI Task Action Plan Item I.G.1, "Special Low Power Testing and Training, Recommendations for BWRs (Generic Letter 83-24)",
June 29, 1983.
- 9. Regulatory Guide 1.68, Initial Test Programs for Water-Cooled Nuclear Power Plants, Rev. 2 August 1978.
- 10. S. Levy Incorporated, " Inadequate Core Cooling Detection In Boiling Vater Reactors", Report for Boiling Water Reac-tor 04ners Group, SLI-8218, November, 1982.
J35 STATION BLACKOUT E'.'AL - 37}}