ML21133A134
Text
LGS UFSAR CHAPTER 15 - ACCIDENT ANALYSIS 15.0 GENERAL This chapter describes the transient and accident analyses for LGS Units 1 and 2. The original analyses have been updated as part of the Power Rerate Project which increased the licensed rated thermal power to 3458 MWt (Reference 15.0-7). In addition, the original analyses have been supplemented to reflect changes to the licensed reactor operating domain (References 15.0-7, 15.0-10 and 15.0-11). As a result of improvements in plant feedwater flow measurement accuracy, a reduced reactor thermal power uncertainty can be applied. Due to the reduced uncertainty a MUR power uprate has been implemented that increases the licensed rated thermal power to 3515 MWt (1.65%) (See Section 1.1). Transient analyses to support MUR power uprate were performed for the first reload for MUR operation. Results are given in Cycle 14 reload documents.
Radiological consequences evaluated for the Power Rerate Project are bounding for MUR because they were performed at a power level of 3527 MWt. The LGS operating domain is described in Appendix 15B.
The results of the analyses presented in the following sections provide the user with information regarding the general sequence of events, features, system behaviors, and trends and characteristics of each event. The information provided allows for an evaluation of the potential impact of changes to plant systems on the results of a particular analysis. The specific results presented (i.e. peak neutron flux and pressure, CPR, etc.) are explicitly applicable to the LGS Unit 1 Cycle 5 core only, which was the basis of the analyses (unless specified otherwise). The results are, however, representative of the expected plant response for both units.
The limiting transients in each category of event are discussed in detail and have been revised to reflect power rerate conditions. In general, the non-limiting events have not been reanalyzed for power rerate. The results presented in Chapter 15 for the non-limiting events reflect the original plant operating conditions. However, these results continue to provide a reasonable representation of the trends and characteristics of the event.
For each core reload, a cycle specific safety analysis is performed utilizing the methods described in References 15.0-2 to 15.0-5, 15.0-13, 15.0-15, and 15.0-16. The limiting transient events are re-evaluated for each reload. The results of these analyses are documented in the cycle specific Supplemental Reload Licensing Report (SRLR). Information from the SRLR is used in the development of the cycle specific Core Operating Limit Report (COLR).
The scope of the situations analyzed includes anticipated (expected) operational occurrences (e.g.,
loss of electrical load); off design, abnormal (unexpected) transients that induce system operation disturbances; postulated accidents of low probability (e.g., the sudden loss of integrity of a major component); and hypothetical events of extremely low probability (e.g., an ATWS).
15.0.1 ANALYTICAL OBJECTIVE The spectrum of postulated initiating events is divided into categories based upon the type of disturbance and the expected frequency of the initiating occurrence; the limiting events in each combination of category and frequency are quantitatively analyzed. The plant safety analysis evaluates the ability of the plant to operate within regulatory guidelines, without undue risk to the public health and safety.
15.0.2 ANALYTICAL CATEGORIES CHAPTER 15 15.0-1 REV. 20, SEPTEMBER 2020
LGS UFSAR Transient and accident events contained in this report are discussed in individual categories as required by Reference 15.0-1. The results of the events are summarized in Table 15.0-1, for the initial core, and in Table 15.0-1A for rerated conditions. Each event evaluated is assigned to one of the following applicable categories:
- a. Decrease in Core Coolant Temperature - Reactor vessel water (moderator) temperature reduction results in an increase incore reactivity. This could lead to fuel cladding damage.
- b. Increase in Reactor Pressure - Nuclear system pressure increases threaten to rupture the RCPB. Increasing pressure also collapses the voids in the core moderator, thereby increasing core reactivity and power level which threaten fuel cladding due to overheating.
- c. Decrease in Reactor Core Coolant Flow Rate - A reduction in the core coolant flow rate threatens to overheat the cladding as the coolant becomes unable to adequately remove the heat generated by the fuel.
- d. Reactivity and Power Distribution Anomalies - Transient events included in this category are those that cause rapid increases in power and are due to increased core flow disturbance events. Increased core flow reduces the void content of the moderator, increasing core reactivity and power level.
- e. Increase in Reactor Coolant Inventory - Increasing coolant inventory could result in excessive moisture carryover to the main turbine, feedwater turbines, etc.
- f. Decrease in Reactor Coolant Inventory - Reductions in coolant inventory could threaten the fuel as the coolant becomes less able to remove the heat generated in the core.
- g. Radioactive Release from Subsystems and Components - Loss of integrity of a radioactive containment component is postulated.
- h. Anticipated Transients Without Scram - In order to determine the capability of plant design to accommodate an extremely low probability event, a multisystem maloperation situation is postulated.
15.0.3 TRANSIENT OR ACCIDENT EVALUATION 15.0.3.1 Identification of Causes and Frequency Classification Situations and causes that lead to the initiating event analyzed are described within the categories designated above. The frequency of occurrence of each transient or accident is summarized based upon currently available operating plant history for the transient, or accident. Transients, or accidents, for which inconclusive data exist are discussed separately within each section.
Each initiating event within the major groups is assigned to one of the following frequency groups:
CHAPTER 15 15.0-2 REV. 20, SEPTEMBER 2020
- a. Incidents of moderate frequency - These are accidents that may occur from once during a calendar year to once per 20 years for a particular plant. These events are referred to as "anticipated (expected) operational transients."
- b. Infrequent incidents - These are accidents that may occur occasionally during the life of a particular plant, ranging in time from once in 20 years to once in 100 years.
These events are referred to as "abnormal (unexpected) operational transients."
- c. Limiting faults - These are accidents that are not expected to happen, but are postulated because they may result in the release of significant amounts of radioactive material. These events are referred to as "design basis (postulated) accidents."
- d. Normal operation - Operations of high frequency are not discussed here, but are examined, along with (a), (b), and (c), in the nuclear systems operational analyses in Section 15.9.
15.0.3.1.1 Unacceptable Results for Incidents of Moderate Frequency - Anticipated (Expected)
Operational Transients The following are considered to be unacceptable safety results for incidents of moderate frequency (anticipated operational transients):
- a. A release of radioactive material to the environs that exceeds the limits of 10CFR20.
- b. Reactor operation induced fuel cladding failure.
- c. Nuclear system stresses in excess of those allowed for the transient classification by applicable industry codes.
- d. Containment stresses in excess of those allowed for the transient classification by applicable industry codes.
15.0.3.1.2 Unacceptable Results for Infrequent Incidents - Abnormal (Unexpected) Operational Transients The following are considered to be unacceptable safety results for infrequent incidents (abnormal operational transients):
- a. Release of radioactivity that results in dose consequences that exceed a small fraction of 10CFR50.67.
- b. Failure of fuel cladding which could cause changes in core geometry such that core cooling would be inhibited.
- c. Generation of a condition that results in consequential loss of function of the reactor coolant system.
- d. Generation of a condition that results in a consequential loss of function of a necessary containment barrier.
CHAPTER 15 15.0-3 REV. 20, SEPTEMBER 2020
- e. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.
15.0.3.1.3 Unacceptable Results for Limiting Faults - Design Basis (Postulated) Accidents The following are considered to be unacceptable safety results for limiting faults (DBAs):
- a. Radioactive material release that results in dose consequences that exceed the guideline values of 10CFR50.67.
- b. Failure of fuel cladding which could cause sufficient changes in core geometry such that core cooling would be inhibited.
- c. Nuclear system stresses in excess of those allowed for the accident classification by applicable industry codes.
- d. Containment stresses in excess of those allowed for the accident classification by applicable industry codes when containment is required.
- e. Radiation exposure to plant operations personnel in the main control room in excess of 5 rem TEDE (total effective dose equivalent).
15.0.3.2 Sequence of Events and System Operation Each transient, or accident, is discussed and evaluated in terms of the following:
- a. A step-by-step sequence of events, from initiation to final stabilized condition.
- b. The extent to which normally operating plant instrumentation and controls are assumed to function.
- c. The extent to which plant and reactor protection systems are required to function.
- d. The credit taken for the functioning of normally operating plant systems.
- e. The operation of engineered safety systems that is required.
- f. The effect of a single active failure, or of a single operator error.
- g. The effects of plant equipment out-of-service.
15.0.3.2.1 Single Active Failures or Single Operator Errors 15.0.3.2.1.1 General This paragraph discusses a very important concept pertaining to the application of single active failures and single operator errors in analyses of the postulated events. Single active failure criteria have been required, and successfully applied, in past NRC-approved docket applications to DBA categories only. Reference 15.0-1 infers that "single active failures and single operator errors" requirements should be applied to transient events (including high, moderate, and low probability occurrences) as well as to accident (very low probability) situations.
Transient evaluations have been judged against a criterion of one single active failure, or one single operator error, as the initiating event, with no additional single failure assumptions to the protective sequences, although a great majority of these protective sequences are utilized in safety systems that can accommodate single active failures aspects. Even under these postulated CHAPTER 15 15.0-4 REV. 20, SEPTEMBER 2020
LGS UFSAR transients, or accidents, the plant damage allowances, or limits, were very much the same as those for normal operation.
Reference 15.0-1 suggests that the transient and accident scenarios should now include multifailure event sequences. The format requested follows:
- a. For initiating occurrence 1- An equipment failure or an operator error, and
- b. For single active failure 2- Another equipment failure or operator error analysis or failures and/or another operator error or errors.
Most transients, or accidents, postulated for consideration are the result of a single active failure or a single operator error that have been postulated during any normal or planned mode of plant operations. The types of operational single active failures and single operator errors considered as initiating events, and subsequent protective sequence challenges, are identified in the paragraphs below.
15.0.3.2.1.2 Initiating Event Analysis
- a. The undesired opening or closing of any single valve (a check valve is not assumed to close against normal flow), or
- b. The undesired starting or stopping of any single component, or
- c. The malfunction or maloperation of any single control device, or
- d. Any single electrical component failure, or
- e. Any single operator error.
Operator error is defined as "an active deviation from written operating procedures or nuclear plant standard operating practices." The result of a single operator error is the set of actions that follows a single erroneous decision. The set of actions is limited as follows:
- a. Those actions that could be performed by one person.
- b. Those actions that would have constituted a correct procedure had the initial decision been correct.
- c. Those actions that are subsequent to the initial operator error and have an effect on the designed operation of the plant, but are not necessarily directly related to the operator error.
Examples of single operator errors are as follows:
- a. An increase in power above the established flow control power limits from control rod withdrawal in the specified sequences.
- b. The selection and complete withdrawal of a single control rod out-of-sequence.
CHAPTER 15 15.0-5 REV. 20, SEPTEMBER 2020
- c. The incorrect calibration of an APRM.
- d. Manual isolation of the main steam lines as a result of operator misinterpretation of an alarm or indicator.
15.0.3.2.1.3 Single Active Failure or Single Operator Error Analysis
- a. The undesired action or maloperation of a single active component, or
- b. Any single operator error as defined in Section 15.0.3.2.1.2.
15.0.3.2.2 Analyzed Transients and Nonsafety-Grade Systems or Components The thermal and pressure safety limits are not compromised by inclusion of the simulated response of nonsafety-grade systems when analyzing transients.
Referring to Table 15.0-6, the analysis for each of the transients is based on the single failure criterion associated with abnormal transients (i.e., abnormal transients are defined as events that occur as a result of equipment malfunctions as a result of a single active component failure or operator error). Following this single failure, the resulting transient is simulated in a conservative fashion to show the response of primary system variables and how the various plant systems would interact and function. In the transients, the consideration of any additional failures is not considered appropriate within the realm of the abnormal transient definition, but shifts them to infrequent events (infrequent events being those not expected in the 40 year plant lifetime).
Although certain transient events assume the operation of specific nonsafety-grade equipment to provide a realistic transient signature, failures of such equipment would not make these events more thermal or pressure limiting than the limiting accidents already addressed in Chapters 5 and
- 15. In fact, many of the events that have a Level 8 turbine trip (nonsafety-grade trip) would be less severe if the Level 8 trip was assumed not to function.
For example, failure of the Level 8 turbine trip or failure of the bypass to open when the Level 8 trip does occur was studied for a BWR similar to the LGS design. The increase in CPR was about 0.02 for a delay in the turbine trip and 0.08 for failure of bypass. Although thermal margins are reduced, no significant (if any) fuel damage is expected. The offsite doses (if any) would be negligible and therefore would have no impact from a health and safety viewpoint. The loss of feedwater event is analytically about the same with or without the recirculation runback ahead of the Level 2 trip.
15.0.3.3 Core and System Performance 15.0.3.3.1 Introduction Reactor core and system performance analysis must demonstrate that:
- 1. The margin of safety for Anticipated Operational Occurrences (AOOs) remain within all applicable criteria.
- 2. All fuel and thermal mechanical transient overpowers are within the applicable design bases.
CHAPTER 15 15.0-6 REV. 20, SEPTEMBER 2020
- 3. The maximum reactor vessel pressure does not exceed the ASME code allowable peak pressure of 1375 psig.
- 4. Primary containment integrity is not comprised.
Section 4.4 describes the various fuel failure mechanisms. Avoidance of mechanisms (a) and (b) for incidents of moderate frequency is verified statistically with consideration given to data, calculating, manufacturing, and operating uncertainties. An acceptable criterion was determined to be that 99.9% of the fuel rods in the core would not be expected to experience boiling transition (References 15.0-2, 15.0-15, and 15.0-16). Limerick Unit 1 has adopted TSTF-564 (Amendment 236), which established a revised safety limit basis. The revised basis will ensure that there is a 95% probability at a 95% confidence level that no fuel rods will be susceptible to boiling transition using a safety limit based on the critical power ratio statistics. For TRACG applications, an operating limit MCPR (OLMCPR) is calculated for the transient initial condition that will result in no more than 0.1% of the fuel rods susceptible to boiling transition. For non-TRACG AOO analyses, this criterion is met by demonstrating that incidents of moderate frequency do not result in a MCPR less than the established Safety Limit MCPR. The reactor steady-state CPR operating limit is derived by determining the decrease in MCPR for the most limiting transient, or accident. All other transients, or accidents, result in smaller MCPR decreases and are not reviewed in depth in this chapter. The MCPR during significant abnormal transient, or accident, is calculated using a transient core heat transfer analysis computer program. The computer program for historical non-TRACG AOO analysis is based upon a multinode, single channel thermal-hydraulic model that requires simultaneous solution of the partial differential equations for the conservation of mass, energy, and momentum in the bundle, and that accounts for axial variation in power generation.
The primary inputs to the model include a physical description of the bundle, channel inlet flow and enthalpy, and pressure and power generation as functions of time.
A detailed description of the analytical model may be found in Reference 15.0-2 or Reference 15.0-13 for TRACG reload AOO methodology. The initial condition assumed for all full power transient MCPR calculations is that the bundle is operating at or above the Safety Limit MCPR documented either in the Technical Specifications (for Unit 2) or in the cycle-specific Core Operating Limits Report (COLR) (for Unit 1). Maintaining MCPR greater than the safety limit MCPR is a sufficient, but not necessary, condition to assure that no fuel damage occurs.
For situations in which fuel damage is sustained, the extent of damage is determined by correlating fuel energy content, cladding temperature, fuel rod internal pressure, and cladding mechanical characteristics.
These correlations are substantiated by fuel rod failure tests, and are discussed in Section 4.4 and Section 6.3.
The closure of all MSIVs causes an abrupt pressure increase in the reactor vessel. System pressure increase is mitigated by the actuation of the SRVs within their design and operating limits.
Operating limits are placed on all RCPB component to ensure compliance to ASME overpressure protection criteria. Limits are also placed on reactor dome operating pressure and on SRVs out-of-service. These limits assure that the ASME code allowable value for peak vessel pressure is not exceeded and RCPB integrity is maintained.
The Mark II primary containment is designed to accommodate pressures, temperatures, and dynamic loads resulting from pipe breaks within the drywell or reactor blowdown through the SRV CHAPTER 15 15.0-7 REV. 20, SEPTEMBER 2020
LGS UFSAR discharge and thereby limit the release of radioactive material to the plant and its environs. Core and containment cooling systems assure a coolable fuel geometry and control drywell and wetwell pressure and temperature conditions within primary containment design limits. Limits placed on reactor and core operating conditions assure that containment integrity is maintained.
15.0.3.3.2 Input Parameters and Initial Conditions for Analyzed Events In general, the transients, or accidents, analyzed within this section have values for input parameters and initial conditions as specified in Table 15.0-2, for the initial core, and in Table 15.0.2A for power rerate. Analyses that assume data inputs different from these values are designated accordingly in the appropriate event discussion.
The transient analyses herein includes an RPT actuated by either fast closure of the turbine control valves or closure of the turbine stop valve.
For the original Cycle 1 transient event evaluations, low water level MSIV closure was simulated at Level 2. Subsequent design modifications have lowered the closure setpoint to Level 1. However, HPCI and RCIC initiation at Level 2 will prevent the water level from dropping to Level 1, and no MSIV closure will occur. Because no safety limits are approached during events for which the level is predicted to reach Level 2, reanalysis for the setpoint change is not required for the Cycle 1 analyses. The power rerate analysis utilized the Level 1 MSIV closure setpoint.
The UFSAR evaluates a wide range of process disturbances and component failures of varying severity to demonstrate conformance to plant safety and licensing criteria (Reference 15.0-1).
Generic guidelines for uprating BWRs (Reference 15.0-8) and established LGS reload licensing practice identify transient and accident events that are limiting to BWRs or are otherwise sufficient to demonstrate that all NRC protection criteria are met for LGS power rerate operation. The evaluations, where appropriate, are based on the characteristics of the LGS Unit 1 Cycle 5 core configuration. Comparisons of the results of the baseline evaluations for power rerate conditions and originally licensed operating conditions using improved models and methods are provided.
Input parameters consist of heat balance information, core characteristics, and reactor protection specifications. The inputs include the initial power and flow conditions, core pressure drop, nuclear dynamic parameters (scram times, void fraction, Doppler coefficient) and system set points (SRVs,reactor scram, recirculation and feedwater pump trips, etc.). The analyses cover the full spectrum of core conditions from the beginning to the end of the fuel cycle, whichever is more limiting for the event in consideration.
The analyses are based on the core loading characteristic of LGS Unit 1 Cycle 5. The GEMINI methodology is applied as recommended in the generic power uprate guidelines (Reference 15.0-8), which is consistent with the LGS reload licensing practice.
The key system input parameters used in the power rerate transient analysis are shown in Table 15.0-2A; corresponding evaluation results are summarized in Table 15.0-1A.
15.0.3.3.3 Initial Power/Flow Operating Constraints The analysis basis for most of the transient and accident analyses is the most limiting point on the power/flow operating map. Typically, this is at the maximum licensed core thermal power.
Depending on the event being analyzed, the core thermal power is adjusted, either directly or CHAPTER 15 15.0-8 REV. 20, SEPTEMBER 2020
LGS UFSAR indirectly, to account for the required licensing power uncertainty as described in GESTAR II (Reference 4.1-1) (See Section 15.0.4, Regulatory Guide 1.49). The limiting core flow rate is also dependent on the event being analyzed.
The operating power/flow map shown in Figure 15.0-1 includes the Maximum Extended Load Line Limit (MELLL) and Increased Core Flow (ICF) to 110% core flow operating domain.
The following performance improvement features are also included in the transient analyses: the FFWTR option used in conjunction with ICF at the end of the cycle, TBSOOS (formally known as
'TBVOOS'), EOC-RPTOOS, TCVOOS and/or TSVOOS, PLUOOS, and PROOS. Additional details related to the combination of equipment OOS options with ARTS, MELLL, and ICF operation can be found in References 15.0-10 and 15.0-11.
The operating and performance improvement features described above are part of the LGS licensed operating domain. A detailed discussion of the LGS licensed operating domain is found in Appendix 15B.
Certain localized events are evaluated at other than the above mentioned conditions. These other conditions are discussed with the appropriate transient, or accident.
15.0.3.3.4 Results The results of analytical evaluations are provided for each transient, or accident. In addition, critical parameters are shown in Table 15.0-1 for Cycle 1 conditions and in Table 15.0-1A for power rerate conditions. From the data in Table 15.0-1, an evaluation of the limiting event for that particular category and parameter can be made. In Table 15.0-3, a summary of applicable accidents is provided. This table compares the GE calculated amount of failed fuel to that used in worst case radiological calculations.
The results of each transient or accident for subsequent cycles can be found in the Supplemental Reload Licensing Report.
15.0.3.4 Barrier Performance This section primarily evaluates the performance of both the RCPB and the containment system during transients and accidents.
During transients that occur with no release of coolant to the containment, only RCPB performance is considered. If release to the containment occurs, as in the case of limiting faults, then challenges to the containment are evaluated as well.
Containment integrity is maintained as long as internal pressures remain below the maximum allowable values. The design internal pressures are as follows:
Drywell (primary containment) 55 psig Suppression Chamber (Primary Containment) 55 psig Secondary Containment 7 in H2O CHAPTER 15 15.0-9 REV. 20, SEPTEMBER 2020
LGS UFSAR The LOCA radiological analyses account for the radiation released from the secondary containment during the time that the pressure exceeds minus 0.25 inch wg.
Damage to any of the radioactive material barriers as a result of accident-initiated fluid impingement, and jet forces, is considered in the other portions of the UFSAR where mechanical design features of the systems and components are described. Design basis accidents are used in determining the size and strength requirements of the essential nuclear system components. A comparison of the accidents considered in this section with those used in the mechanical design of equipment reveals that either the applicable accidents are the same, or that the accident in this section results in less severe stresses than those assumed for mechanical design.
15.0.3.5 Radiological Consequences In this chapter, the consequences of radioactivity release during the three types of events are considered:
- a. Incidents of moderate frequency (anticipated operational transients)
- b. Infrequent incidents (abnormal operational transients)
- c. Limiting faults (DBA).
For all transients, or accidents, whose consequences are limiting, a detailed quantitative evaluation is presented. For nonlimiting transients, or accidents, a qualitative evaluation is presented, or results are referenced from a more limiting or enveloping case.
The original plant design basis included the analyses of radiological consequences based on the source terms of TID-14844 and Regulatory Guides 1.3, 1.5 and 1.25.
Regulation 10CFR50.67, "Accident Source Term," provides a mechanism to replace the traditional TID-14844 accident source term with an "Alternative Source Term" (AST). The methodology of approach to this replacement is provided in Regulatory Guide 1.183 and its associated Standard Review Plan 15.0.1.
In support of a full scope implementation of AST in accordance with Regulatory Guide 1.183, AST radiological consequence analyses were performed for the four Design Basis Accidents that result in offsite exposures. These include the Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB). Fuel Handling Accident (FHA) and Control Rod Drop Accident (CRDA). The dose consequences for these accidents are discussed elsewhere in Chapter 15 and result in doses that are within the guidelines of 10CFR50.67.
Although only the four major accidents have been evaluated using the AST methodology, the AST analytical methods described in Regulatory Guide 1.183 and dose limits defined in 10CFR50.67 comprise the design basis for Limerick for all design basis accidents.
Short-term, site specific X/Qs were calculated as described in Section 2.3 and are shown in Table 15.0-4.
15.0.4 REGULATORY GUIDE CONFORMANCE The regulatory guides pertinent to accident analyses, and LGS conformance, are as follows:
CHAPTER 15 15.0-10 REV. 20, SEPTEMBER 2020
LGS UFSAR Regulatory Guide 1.3 (Radiological Consequences of a LOCA)
The Limerick original LOCA dose consequences were determined in accordance with Regulatory Guide 1.3. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose consequence analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.3. LGS is in conformance with Regulatory Guide 1.183 requirements.
Regulatory Guide 1.5 (Radiological Consequences of a Steam Line Break)
The Limerick original main steam line break dose consequences were determined in accordance with Regulatory Guide 1.5. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose consequence analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.5. LGS is in conformance with Regulatory Guide 1.183 requirements.
Regulatory Guide 1.25 (Radiological Consequences of a Fuel Handling Accident)
The Limerick original fuel handling accident dose consequences were determined in accordance with Regulatory Guide 1.25. With the implementation of Alternative Source Term in accordance with 10CFR50.67, the dose analytical methodology of Regulatory Guide 1.183 applies and supercedes the methodology of Regulatory Guide 1.25. LGS is in conformance with Regulatory Guide 1.183 requirements as noted in NRC Safety Evaluation Reports dated September 8, 2006, and March 15, 2017.
Regulatory Guide 1.49 (Power Levels of Nuclear Power Plants).
The power levels assumed in the analyses are in accordance with this guide.
NOTE: Transient analyses were performed at the licensed rated thermal power of 3515 MWt for the first reload for MUR operation. Radiological consequences evaluated for the Power Rerate Project are bounding because they were performed at a power level of 3527 MWt (102% of the Power Rerate Project thermal power of 3458 MWt).
Regulatory Guide 1.98 (radiological consequences of an offgas system failure).
LGS is in conformance with this guide, with the following clarifications:
- a. In reference to Paragraph c.4.a of the guide, the LGS total whole body dose is calculated based upon the radiation at a depth of 5 cm, the average depth of the blood-forming organs. This is standard practice and is endorsed for use in Appendix E, Paragraph 3, of Regulatory Guide 1.109 (doses for routine releases).
- b. Dose conversion factors are taken from the most recent data available, rather than the reference given in Paragraph c.4.b of the guide.
Regulatory Guide 1.183 (Alternative Source Terms for Evaluating Design Basis Accidents)
Regulation 10CFR50.67, "Accident Source Term, "provides a mechanism to replace the traditional TID-14844 accident source term with an "Alternative Source Term" (AST). The CHAPTER 15 15.0-11 REV. 20, SEPTEMBER 2020
LGS UFSAR methodology of approach to this replacement is provided in Regulatory Guide 1.183 and its associated Standard Review Plan 15.0.1.
In support of a full scope implementation of AST in accordance with Regulatory Guide 1.183, AST radiological consequence analyses were performed for the four Design Basis Accidents that result in offsite exposures. These include the Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA) and Control Rod Drop Accident (CRDA). The dose consequences for these accidents are discussed elsewhere in Chapter 15 and result in doses that are within the guidelines of 10CFR50.67.
Although only the four major accidents have been evaluated using the AST methodology, the AST analytical methods described in Regulatory Guide 1.183 and dose limits defined in 10CFR50.67 comprise the design basis for Limerick for all design basis accidents.
LGS is in conformance with the requirements of Regulatory Guide 1.183 as noted in NRC Safety Evaluation Reports dated September 8, 2006, and March 15, 2017.
15.0.5 NUCLEAR SAFETY OPERATIONAL ANALYSIS RELATIONSHIP Section 15.9 is a comprehensive, total plant, system level, qualitative FMEA, relative to all the Chapter 15 events considered, the protective sequences utilized to accommodate the transients, or accidents, and their effects, and the systems involved in the protective actions.
Interdependency of analysis, and cross-referral of protective actions, are an integral part of this chapter and the section.
A summary table that classifies events by frequency only (i.e., not just within a given category such as decrease in core coolant temperature) is in Section 15.9.
15.0.6 LICENSING BASIS VS. EMERGENCY PROCEDURE GUIDELINES The NRC Staff review of the BWR Owners' Group Emergency Procedure Guidelines (EPGs),
Revision 4 (NEDO-31331, March 1987) is documented in an NRC Safety Evaluation Report (SER) dated September 12, 1988. In this SER, the NRC Staff concluded that the guidelines are acceptable for implementation; however, the NRC stated that each BWR Licensee who wishes to incorporate Revision 4 of the EPGs should assure that the EPGs will not impact its licensing bases.
To ensure that implementation of EPGs, Rev. 4 did not conflict with the LGS licensing based analyses, a review of the Cycle 1 analyzed transients was conducted. This review (documented in reference 15.0-6) identified the Pressure Regulator Failure-Open Direction event as the only analyzed transient in which operator action, as instructed by the Transient Response Implementation Plan (TRIP) Procedures, could interfere with the analyzed transient response as discussed in Section 15. For the Pressure Regulator Failure-Open Direction transient, it was concluded that procedural actions are sufficient to make the end result for the transient the same as that analyzed in Section 15.
This review was performed based on the following position regarding Licensing Basis vs. EPGs:
Implementation of the TRIP procedures for events within the design basis does not conflict with the licensing basis as long as the successful implementation of operator actions CHAPTER 15 15.0-12 REV. 20, SEPTEMBER 2020
LGS UFSAR makes the end result for the transient response the same as or more conservative than that analyzed in the UFSAR.
The Revision 4 BWROG EPGs already included, to a considerable degree, operator actions required to prevent or mitigate what are termed severe accidents (considered to begin with the onset of core damage). Subsequent to the issue of the Revision 4 EPGs, the preparation of Individual Plant Examinations (IPE) for nuclear plants, in conjunction with industry research, have provided additional severe accident mitigation information that was not available during the development of the Revision 4 EPGs. To ensure that the EPG strategies reflect the most current severe accident mitigation information available, a review of the EPG strategies, to the additional available severe accident mitigation information, was conducted. As a result of this review, the BWROG developed the Emergency Procedure and Severe Accident Guidelines (EPG/SAG). The SAG, together with the modified EPGs, form an integrated set of symptomatic instructions that attempt to cover all possible mechanistic accident sequences. The EPGs contain strategies applicable prior to the transition to a severe accident, and the SAG contain strategies applicable after the transition. EPG/SAG has superseded EPG, Revision 4 as the basis for the Emergency Operating Procedures (EOPs) at LGS. An NRC SER does not exist for the Emergency Procedure and Severe Accident Guidelines (EPG/SAG), Rev. 3.
To ensure that the implementation of EPG/SAG did not conflict with the LGS licensing-based analysis, a review of the SAR analyzed accidents, transients, and special events was conducted.
The conclusions of this review are contained in the 10CFR50.59 Reviews prepared for the Plant Specific Technical Guidelines (PSTGs) and Plant Specific Severe Accident Management Guidelines (PSSAMGs) which support the transition from EPG, Revision 4 to EPG/SAG. Plant-unique variations from the EPG/SAG guidance have been evaluated in the 10CFR50.59 Reviews, the Plant Specific Technical Guidelines (PSTGs), and the Plant Specific Severe Accident Management Guidelines (PSSAMGs).
15.
0.7 REFERENCES
15.0-1 Regulatory Guide 1.70 (Rev 3), "Standard Format and Content of Safety Analysis Report for Nuclear Power Plants, Light-Water Reactor Edition," NRC, (November 1978).
15.0-2 "General Electric BWR Thermal Analysis Basis (GETAB): Data, Correlation and Design Application," NEDO-10958-A, GE, (January 1977).
15.0-3 R.B. Linford, "Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor", NEDO-10802, GE, (April 1973).
15.0-4 NEDO-24154, "Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", GE, (October 1978).
15.0-5 F. Odar et al, "Safety Evaluation for the General Electric Topical Report:
Qualification of the One-Dimensional Core Transient Model for Boiling Water Reactors", NEDO-24154 and NEDE-24154-P, Volumes I, II, III, GE, (1980).
15.0-6 Design Analysis dated May 14, 1990, for resolution of Justification for Continued Operation L-90-050-001, Mode Switch Position Vs. Accident Analysis.
15.0-7 "Power Rerate Safety Analysis Report for Limerick Generating Station Units 1 and 2, " NEDC-32225P, GE, (September 1993).
CHAPTER 15 15.0-13 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.0-8 "Generic Guidelines for General Electric Boiling Water Reactor Power Uprate,"
NEDO-31897, GE, (February 1992), and NEDC-31897P-A, GE (May 1992).
15.0-9 "Generic Evaluations of General Electric Boiling Water Reactor Power Uprate,"
Volume I, NEDC-31984P, GE, (July 1991).
15.0-10 "Maximum Extended Load Line Limit and ARTS Improvement Program Analyses for Limerick Generating Station Units 1 and 2", NEDC-32193P, Revision 2, GE, (October 1993).
15.0-11 "Safety Review for Limerick Generating Station Units 1 and 2 110% Increased Core Flow Operation", NEDC-32224P, July 1993.
15.0-12 General Electric Standard Application for Reactor Fuel, including the United States Supplement, NEDE-24011-P-A and NEDE-24011-P-A-US, (Latest Approved Revision).
15.0-13 Migration to TRACG04 / PANAC11 from TRACG02 / PANAC10 for TRACG AOO and ATWS Overpressure Transients, NEDE-32906P Supplement 3-A, Revision 1, April 2010.
15.0-14 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit", October 2008.
15.0-15 "Methodology and Uncertainties for Safety Limit MCPR Evaluations," NEDC-32601P-A, August 1999.
15.0-16 "Power Distribution Uncertainties for Safety Limit MCPR Evaluations," NEDC-32694-A, August 1999.
CHAPTER 15 15.0-14 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 15.0-1* (See Note)
SUMMARY
OF INITIAL CORE TRANSIENTS MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1)
DOWN (sec) 15.1 DECREASE IN CORE COOLANT TEMPERATURE 15.1.1 15.1-2 Loss of Feedwater Heater, Manual Flow Control 127.7 1030.0 1069.0 1016.0 119.4 0.16 a 0 0.0 15.1.2 15.1-3 Feedwater Controller Failure, Maximum Demand, 135.4% Flow(3) 156.3 1168 1194 1165 105.0 0.06 a 14 6.0 15.1.2 15.1-1 Feedwater Controller Failure Maximum Demand, Bypass Off 135.4% Flow(3) 216.6 1204 1231 1200 110.2 0.11 b 14 15.1.3 15.1-4 Pressure Regulator Failure - Open 104.3 1149.0 1165.0 1148.0 100.3 <0.06(4) a 5 3.2 15.1.4 - Inadvertent Opening of Safety or Relief Valve See Section 15.1 b 15.1.6 - Inadvertent RHR Shutdown Cooling Operation See Section 15.1 a 15.2 - INCREASE IN REACTOR PRESSURE 15.2.1 - Pressure Regulator Failure - Closed See Sections 15.2.2 and 15.2.3 (Bypass on) a 15.2.2 15.2-1 Generator Load Rejection, Trip Scram, Bypass, and RPT - On(3) 178.5 1169 1193 1164 101.2 0.03 a 14 6.0 CHAPTER 15 15.0-15 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.0-1 (Cont'd)*
MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF PRESSUR UFSAR FIGURE FLUX PRESSURE PRESSURE E % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.2.2 15.2-2 Generator Load Rejection, Trip Scram, Bypass - Off, 222.5 1200 1225.0 1196.0 106.2 0.08 a(6) 14 12.7 RPT - On(3) 15.2.3 15.2-3 Turbine Trip, Trip Scram, and RPT - On 163.3 1174.0 1196.0 1169.0 102.0 <0.16(4) a 14 5.8 15.2.3 15.2-4 Turbine Trip, Trip Scram, Bypass - Off, RTP - On(3) 198.4 1198 1223.0 1195.0 104.5 0.06 a(6) 14 12.6 15.2.4 15.2-5 MSIV Closure, Position Switch Scram 190.9 1187.0 1220.0 1185.0 100.0 <0.06(4) a 14 11.5 (4) 15.2.5 15.2-6 Loss of Condenser Vacuum 160.9 1172.0 1194.0 1168.0 101.9 <0.06 a 14 10.8 15.2.6 15.2-7 Loss of Auxiliary Power Transformer See Loss of All Grid Connections 15.2.6 15.2-8 Loss of All Grid Connections 178.5 1168.4 1175.4 1164.2 101.3 <0.06(4) a 14 4.8 15.2.7 15.2-9 Loss of All Feedwater Flow 104.3 1144.0 1155.0 1144.0 100.0 <0.06(4) a 5 2.2 15.2.8 - Feedwater Line Break See Table 15.0-3, event 15.6.6 15.2.9 - Failure of RHR Shutdown Cooling See Section 15.2 15.3 - DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 15.3-1 Trip of One Recirculation Pump Motor 104.3 1021.0 1057.0 1011.0 100.0 <0.06(4) a 0 0.0 CHAPTER 15 15.0-16 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.0-1 (Cont'd)*
MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.3.1 15.3-2 Trip of Both Recirculation Pump Motors 104.3 1149.0 1160.0 1148.0 100.1 <0.06(4) a 5 3.0 15.3.2 - Recirculation Flow Control Failure - Decreasing Flow See Section 15.3.1 a 15.3.3 15.3-3 Seizure of One Recirculation Pump 104.3 1023.0 1057.0 1013.0 102.2 <0.16(4) c 0 0.0 15.3.4 - Recirculating Pump Shaft Break See Section 15.3.3 c 15.4 - REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1.1 - Rod Withdrawal Error -
Refueling See Section 15.4 b 15.4.1.2 - Rod Withdrawal Error -
Startup See Section 15.4 b 15.4.2 - Rod Withdrawal Error -
At Power See Section 15.4 b 15.4.3 - Control Rod Misoperation See Sections 15.4.1 and 15.4.2 b 15.4.4 15.4-2 Abnormal Startup of Idle (5)
Recirculation Loop 454.9 981.0 996.0 977.0 150.8 a 0 0.0 15.4.5 15.4-3 Recirculation Flow Control (5)
Failure - Increasing Flow 382.3 982.0 1001.0 978.0 145.1 a 0 0.0 15.4.7 - Misplaced Bundle Accident See Section 15.4 b 15.4.9 - Rod-Drop Accident See Section 15.4 c CHAPTER 15 15.0-17 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.0-1 (Cont'd)*
MAXIMUM CORE AVERAGE MAXIMUM SURFACE NO. OF MAXIMUM MAXIMUM MAXIMUM STEAM HEAT VALVES DURATION NEUTRON DOME VESSEL LINE FLUX 1ST OF UFSAR FIGURE FLUX PRESSURE PRESSURE PRESSURE % OF FREQUENCY BLOW- BLOWDOWN SECTION NO. DESCRIPTION % NBR (psig) (psig) (psig) INITIAL CPR(2) CATEGORY(1) DOWN (sec) 15.5 - INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 15.5-1 Inadvertent HPCI Pump Start 118.8 1020.0 1059.0 1007.0 107.6 <0.16(4) a 0 0.0 15.5.3 - BWR Transients See appropriate events in Sections 15.1 and 15.2 (1) a = Incidents of moderate frequency b = Infrequent incidents c = Limiting faults (2)
CPRs are based on initial CPR that would yield a MCPR of 1.06.
(3)
Results do not include adjustment factors and utilize EOC parameters (Reference 15.0-4).
(4)
Estimated value, based on comparison with the most severe transient in the pressurization or nonpressurization category.
(5)
These events are postulated to occur at low power and low flow conditions; a larger thermal margin is maintained above the safety limit prior to the event occurrence. Therefore, the resulting MCPR is well above 1.06.
(6)
These events are classified as moderate frequency events for analysis purposes, pending the final resolution of this generic issue, as discussed in Sections 15.2.2.1.2.2 and 15.2.3.1.2.2.
- NOTE: The information in this table is based on the original design conditions. The results of transient analyses performed rerated conditions are tabulated in Table 15.0-1A CHAPTER 15 15.0-18 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.0-1A TRANSIENT ANALYSIS RESULTS (Power Rerate Conditions)
Unit 1 Cycle 5 Characteristics PEAK PEAK PEAK NEUTRON HEAT VESSEL SYSTEM UFSAR INITIAL (B) FLUX FLUX PRESS CPR (c) RESPONSE SECTION TRANSIENT(A) POWER/FLOW (%NBR) (%NBR) (psig) GE8x8NB/GE11 CURVES 15.2.3 TTNBP 100RP/100F 446 119 1271 0.17/0.25 Fig. 15.2-4 TTNBP(h) 100RP/110F 328 113 1265 0.21 TTNBP 100RP/110F 482 120 1272 0.17/0.24 TTNBP 100RP/81F 362 117 1269 0.12/0.25 TTNBP(d) 100RP/110F 638 126 1276 0.22/0.30 TTNBP(d) 100RP/81F 415 120 1270 0.14/0.27 15.2.2 LRNBP 100RP/100F 429 118 1270 0.15/0.25 Fig. 15.2-2 LRNBP(h) 100RP/110F 332 115 1266 0.22 LRNBP(d) 100RP/110F 631 128 1276 0.22/0.32 Fig. 15.2-14 15.1.2 FWCF(e) 100RP/100F 348 122 1218 0.15/0.22 Fig. 15.1-3 FWCF(e) 100RP/100F 348 122 1218 0.15/0.22 FWCF(e) 100RP/81F 314 119 1217 0.11/0.22 FWCF(e,f) 100RP/110F 500 129 1259 0.21/0.28 Fig.15.1-1 FCWF(e,f) 100RP/81F 450 127 1260 0.16/0.29 FWCF(d,e,f) 100RP/110F 647 136 1263 0.24/0.33 FWCF(d,e,f) 100RP/81F 509 131 1261 0.18/0.31 15.5.1 HPCI,BOC 102RP/100F 112 109 1082 N/A Fig. 15.5-1 HPCI,BOC 102RP/81F 112 110 1077 N/A 15.0.1 LFWH,EOC 100RP/110F N/A N/A N/A 0.08 LFWH,BOC 100RP/81F N/A N/A N/A 0.09 LFWH,MOC 100RP/81F N/A N/A N/A 0.09 15.4.2 RWE 100RP/100F N/A N/A N/A 0.13 15.3.3 RPSE,EOC 102RP/100F 102 102 1085 N/A Fig. 15.3-3 15.2.4 MSIVF 102RP/110F 536 131 1314 N/A MSIVF(g) 102RP/110F 536 131 1342 N/A Fig. 15.2-1 CHAPTER 15 15.0-19 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 15.0-1A (Contd)
TRANSIENT ANALYSIS RESULTS FOR POWER RERATE (UNIT 1 CYCLE 5 CHARACTERISTICS)
Footnote (a) TTNBP = turbine trip with no bypass LRNBP = load rejection with no bypass FWCF = feedwater controller failure to maximum demand MSIVF = main steam isolation valve closure, flux scram HPCI = inadvertent actuation of high pressure coolant injection system LFWH = loss of 100F feedwater heating RWE = rod withdrawal error BOC, MOC, EOC = beginning-of-cycle 5, mid-of-cycle 5, end-of-cycle 5 RPSE = recirculation pump seizure (b) 100RP = rerate power of 3458 MWt 100F = rated core flow of 100.0 Mlb/hr 110F = ICF flow point (110M lb/hr) at rerate power 81F = MELLL flow point (81M lb/hr) at rerate power (c) CPR based on initial CPR which yields MCPR = 1.07, uncorrected for ODYN options A and B for TTNBP, LRNBP and FWCF events. GE8x8NB refers to the most limiting of all the 8x8 array fuel types in LGS Units 1 Cycle 5 core.
(d) EOC-RPT out-of-service (EOC-RPTOOS)
(e) Reduced feedwater temperature 320F (105F reduction at rerate conditions).
(f) Turbine bypass valves out-of service (TBVOOS)
(g) Three SRVs out-of-services (3SRVOOS)
(h) Unit 1, Cycle 8, TCV modified for full arc admission, GE 13 fuel.
CHAPTER 15 15.0-20 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 15.0-2 INPUT PARAMETERS AND INITIAL CONDITIONS FOR INITIAL CORE TRANSIENTS*
- 1. Thermal power level, MWt Warranted value 3.293x10+3 Analysis value - radiological 3.458x10+3 consequence
- transient analysis 3.435x10+3
- 2. Steam flow, lb/hr Warranted value 1.416x10+7 Analysis value 1.486x10+7
- 3. Core flow, lb/hr 1.0x10+8
- 4. Feedwater flow rate, lb/sec Warranted value 3.958x10+3 Analysis value 4.129x10+3
- 5. Feedwater temperature,F 4.25x10+2
- 6. Vessel dome pressure, psig 1.020x10+3
- 7. Vessel core pressure, psig 1.031x10+3
- 8. Turbine bypass capacity, % NBR 2.5x10+1
- 9. Core coolant inlet enthalpy, Btu/lb 5.266x10+2
- 10. Turbine inlet pressure, psig 9.6x10+2
- 11. Fuel lattice P8x8R
- 12. Core average gap conductance, Btu/sec-ft2-F 0.1744
- 13. Core leakage flow, % 12
- 14. Required MCPR operating limit See Figure 15.0-3 and Table 15.0-5
- 15. MCPR safety limit 1.06
- Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.
CHAPTER 15 15.0-21 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.0-2 (Cont'd)*
- 16. Doppler coefficient, -¢/F Nominal EOC-1 2.29x10-1 Analysis data(3) 2.06x10-1
- 17. Void coefficient, -¢/% Rated voids Nominal EOC-1 7.61 Analyses data for power increase events(3) 1.271x10+1 Analyses data for power decrease events 3.63
- 18. Core average rated void fraction, % 4.345x10+1
- 19. Scram reactivity, $k Analysis data(3) Figure 15.0-2
- 20. CRD speed, position versus time Figure 15.0-2
- 21. Jet pump ratio, M 2.0
- 22. SRV capacity, % NBR At 1142.0 psig 8.74x10+1 Manufacturer Target Rock Quantity installed 14
- 23. Safety/relief function delay, seconds 4.0x10-1
- 24. Safety/relief function response, seconds 1.5x10-1
- 25. Setpoints for SRVs(2)
Safety/relief function, psig 1142.0, 1152.0, 1162.0
- 26. Number of valve groups simulated Safety/relief function, Number 3
- 27. High flux trip, % NBR Analysis setpoint (121.0 x 1.043) 1.262x10+2
- 28. High pressure scram setpoint, psig 1.071x10+3
- Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.
CHAPTER 15 15.0-22 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.0-2 (Cont'd)*
- 29. Vessel level trips, feet above bottom of separator skirt (42.83 ft above vessel zero)
Level 8 - (L8), feet 6.018 Level 4 - (L4), feet 3.625 Level 3 - (L3), feet (4) 1.750 Level 2 - (L2), feet -3.708
- 30. Recirculation pump trip delay, seconds 1.75x10-1
- 31. Recirculation pump trip inertia time constant for analysis, seconds (1) 4.5
- 32. Total steam line volume, ft3 6.015x10+3 (1)
The inertia time constant is defined by the expression:
t = 2Jon gTo where t = inertia time constants (sec)
Jo = pump motor inertia (lb-ft2) n = pump speed (rps) g = gravitational constant (ft/sec2)
To = pump shaft torque (lb-ft)
(2)
Safety analyses are conservatively based on these setpoints. Actual setpoints are 1130 psig, 1140 psig, and 1150 psig.
(3)
Applicable to events analyzed using model described in Reference 15.0-3.
(4)
The L3 Analytical value in this table may be slightly different for various events due to a steam flow induced process measurement error. However, as described in Reference 15.0-13 the impact of the change is not significant and the event descriptions or conclusions need not be modified.
- Information for Cycle 1 analysis. The inputs and initial conditions for power rerate are tabulated in Table 15.0-2A.
CHAPTER 15 15.0-23 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.0-2A INPUT PARAMETERS AND INITIAL CONDITIONS FOR TRANSIENTS (Unit 1, Cycle 5)(5)
- 1. Thermal power level, MWt Rated value 3458 Analysis value - radiological 3527 consequence
- transient analysis 3458
- 2. Steam flow, lb/hr (rated) 15.0x106
- 3. Core flow, lb/hr (maximum core flow assumed) 1.1x108
- 4. Feedwater flow rate, lb/hr (rated) 15.0x106
- 5. Feedwater temperature,F 425
- 6. Vessel dome pressure, psig 1045
- 7. Vessel core pressure, psig 1060
- 8. Turbine bypass capacity, % NBR(4) 20.1
- 9. Core coolant inlet enthalpy, Btu/lb 532.9 (Corresponding to 110% core flow)
- 10. Turbine inlet pressure, psig 990
- 11. Fuel lattice GE8x8NB, GE11
- 12. Core average gap conductance, Btu/sec-ft2-F 0.3568
- 13. Core leakage flow, % 12
- 14. Required MCPR operating limit See Figure 15.0-3 and Table 15.0-5
- 15. MCPR safety limit 1.07 CHAPTER 15 15.0-24 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.0-2A (Cont'd)
- 16. Doppler coefficient, -¢/F (at 100% rerated power, 0.19 100% rated core flow)
- 17. Void coefficient, -¢/% Rated voids (at 100% rerated power, 10.18 100% rate core flow)
- 18. Core average rated void fraction, % 4.061
- 19. Scram reactivity, $k Analysis data(3) Figure 15.0-2
- 20. CRD speed, position versus time Figure 15.0-2
- 21. Jet pump ratio, M 2.0
- 22. SRV capacity, % NBR At 1142.0 psig 8.74x10+1 Manufacturer Target Rock Quantity installed 14
- 23. Safety/relief function delay, seconds 4.0x10-1
- 24. Safety/relief function response, seconds 1.5x10-1
- 25. Setpoints for SRVs(2)
Safety/relief function, 1182, 1192 1202
- 26. Number of valve groups simulated Safety/relief function, Number 3
- 27. High flux trip, % NBR Analysis setpoint (121.0 x 1.05) 1.27.05
- 28. High pressure scram setpoint, psig 1111 CHAPTER 15 15.0-25 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.0-2A (Cont'd)
- 29. Vessel level trips, inches above vessel zero Level 8 - (L8), inches 586.5 Level 4 - (L4), inches 556 Level 3 - (L3), inches (6) 535 Level 2 - (L2), inches 469.5
- 30. Recirculation pump trip delay, seconds 1.75x10-1
- 31. Recirculation pump trip inertia time constant for analysis, seconds (1) 4.5
- 32. Total steam line volume, ft3 6.015x10+3 (1)
The inertia time constant is defined by the expression:
t = 2Jon gTo where t = inertia time constants (sec)
Jo = pump motor inertia (lb-ft2) n = pump speed (rps) g = gravitational constant (ft/sec2)
To = pump shaft torque (lb-ft)
(2)
Power Re-Rate safety analyses are conservatively based on these setpoints. Re-analysis for +3% setpoint tolerance used 1205, 1215, and 1226 psig (nominal +3% setpoint). Actual setpoints are 1170 psig, 1180 psig, and 1190 psig.
(3)
Applicable to events analyzed using model described in Reference 15.0-3.
(4)
Assuming 7 of 9 valves operable. Total capacity of bypass system is 25.8% NBR (9 valves)
(5)
The data in this table is historical. For current Unit 1 and Unit 2 input parameters, see the cycle specific reload documents.
(6)
The L3 Analytical value in this table may be slightly different for various events due to a steam flow induced process measurement error. However, as described in Reference 15.0-13 the impact of the change is not significant and the event descriptions or conclusions need not be modified.
CHAPTER 15 15.0-26 REV. 17, SEPTEMBER 2014
SUMMARY
OF ACCIDENTS FAILED FUEL RODS GE NRC WORST UFSAR CALCULATED CASE SECTION TITLE VALUE ASSUMPTION 15.3.3 Seizure of One None -
Recirculation Pump 15.3.4 Recirculation Pump None -
Shaft Break 15.4.9 Control Rod-Drop <770(1) 770(1)
Accident 15.6.2 Instrument Line Break None None 15.6.4 Steam System Pipe Break None None Outside Containment 15.6.5 LOCA Within RCPB None 100%
15.6.6 Feedwater Line Break None None 15.7.1.1 Main Condenser Offgas N/A N/A Treatment System Failure 15.7.3 Liquid Radwaste Tank N/A N/A Failure 15.7.4 Fuel Handling Accident <212 212 15.7.5 Cask-Drop Accident N/A N/A (1)
Evaluation of the dose consequences of the control rod drop accident using the methodology of Regulatory Guide 1.183 utilized a failure of 1200 fuel rods.
CHAPTER 15 15.0-27 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.0-4 ATMOSPHERIC DISPERSION PARAMETERS TIME PERIODS - X/Q VALUES(1) 0-2 hr 0-8 hr 8-24 hr 1-4 days 4-30 days Exclusion Area 3.18x10-4 - - - -
Boundary (731 Meters)
Low Population - 5.79x10-5 4.10x10-5 1.95x10-5 6.68x10-6 Zone (2043 Meters)
(1)
Units for X/Q values are sec/m3.
CHAPTER 15 15.0-28 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.0-5 REQUIRED OPERATING LIMIT CPR VALUES FOR INITIAL CORE TRANSIENTS*
Pressurization Events:
CPR (Option A)(1) CPR (Option B)(1)
Load Rejection Without Bypass 1.19 1.11 Turbine Trip Without Bypass 1.17 1.10 Feedwater Controller Failure 1.17 1.14 Load Rejection 1.14 1.07 Feedwater Controller Failure 1.22 1.19 Without Bypass Feedwater Controller Failure 1.30 1.23 Without Bypass and With EOC RPT Out-of-Service Load Rejection Without 1.28 1.17 Bypass and with EOC RPT Out-of-Service Nonpressurization Events:
CPR Rod Withdrawal Error(3) 1.21 Loss of Feedwater Heater 1.22(2)
(1)
Includes adjustment factors as specified in Reference 15.0-5.
(2)
Required OLCPR using either Option A or Option B adjustment factor without bypass with operable EOC RPT.
(3)
OLCPR value is obtained for the 107% rod block setpoint, control cell core analysis.
- Applies to Cycle 1 only. The updated rerate analysis information is contained in Table 15.0-1A.
CHAPTER 15 15.0-29 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.0-6 TRANSIENTS WHERE NONSAFETY-GRADE SYSTEMS/COMPONENTS ARE ACTUATED DURING THE COURSE OF THE EVENT UFSAR NONSAFETY-GRADE SECTION TRANSIENT SYSTEM OR COMPONENT 15.1.2 Feedwater Controller Level 8 Turbine and Failure - Maximum Demand Feedwater Trip, Turbine Bypass 15.1.3 Pressure Regulator Level 8 Turbine and Failure - Open Feedwater Trip, Turbine Bypass 15.2.2 Generator Load Rejection Turbine Bypass(1) 15.2.3 Turbine Trip Turbine Bypass(1) 15.2.5 Loss of Condenser Vacuum Turbine Bypass 15.2.6 Loss of Ac Power Turbine Bypass 15.2.7 Loss of Feedwater Flow Recirculation Runback(2) 15.3.1 Recirculation Pump Trip - Level 8 Turbine Trip, Two Pumps Turbine Bypass 15.3.2 Recirculation Flow Control Level 8 Turbine Trip, Failure - Decreasing Flow Turbine Bypass 15.4.1 Rod Withdrawal Error - Low Rod Worth Minimizer Power System 15.4.2 Rod Withdrawal Error - At Rod Block Monitor Power (1)
Level 8 (high water level) trip potentially activated following the initial part of these events, but it is not a significant factor in fuel or vessel protection evaluation.
(2)
Neglected in the analysis.
CHAPTER 15 15.0-30 REV. 13, SEPTEMBER 2006
LGS UFSAR 15.1 DECREASE IN REACTOR COOLANT TEMPERATURE 15.1.1 LOSS OF FEEDWATER HEATING 15.1.1.1 Identification of Causes and Frequency Classification 15.1.1.1.1 Identification of Causes Feedwater heating can be lost in at least two ways:
- a. Steam extraction line valves to one heater string are closed.
- b. Feedwater train is isolated automatically by high water level in either the first or second heaters.
The first case produces a gradual cooling of the feedwater. The second case produces a slight cooling of the feedwater. In both cases the reactor vessel receives cooler feedwater. The maximum number of feedwater heaters that can be isolated by a single event represents the most severe transient for analysis considerations. This transient has been conservatively estimated to incur a loss of up to 100F of the feedwater heating capability of the plant and causes an increase in core inlet subcooling. This increases core power due to the negative void reactivity coefficient.
The design specification of the feedwater heater system requires that the maximum temperature decrease caused by a single failure should be less than or equal to 100F. In the unlikely event that a drop in feedwater temperature in excess of 100F occurs, and assuming no operator action, the decrease in the MCPR and increase in reactor power would still be bounded by the limiting event (i.e. generator load rejection trip with failure of bypass).
15.1.1.1.2 Frequency Classification The feedwater heating system is designed to provide and maintain adequate heating such that under any single failure condition, the loss of feedwater heating is limited to less than 100F. The loss of feedwater heating event is categorized as an incident of moderate frequency in the General Electric Standard Application for Reactor Fuel (Supplement for United States) (GESTAR II). This event is considered to be one of the limiting Anticipated Operational Occurrences (AOOs) events.
Therefore, this transient is analyzed as an incident of moderate frequency; a 100F drop of feedwater temperature at full power is postulated.
15.1.1.2 Sequence of Events and System Operation 15.1.1.2.1 Sequence of Events Table 15.1-2 lists the sequence of events for this transient. An APRM Simulated Thermal Power Upscale alarm alerts the operator to insert control rods or to reduce recirculation flow. The operator should determine from existing tables the maximum allowable turbine-generator output with feedwater heaters out of service. If reactor scram occurs, the operator should monitor the reactor water level, pressure controls, and turbine-generator auxiliaries during coast-down.
CHAPTER 15 15.1-1 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.1.2.2 System Operation In establishing the expected sequence of events and simulating plant performance, it is assumed that normal functioning occurs in the plant instrumentation and controls, plant protection, and reactor protection systems.
Required operation of ESF is not expected in either case for this transient. The APRM Simulated Thermal Power - Upscale scram is the primary protection system trip in mitigating the consequences of this event.
15.1.1.2.3 The Effect of Single Failures and Operator Errors This transient generally leads to an increase in reactor power level. Single failures are not expected to result in a more severe transient than analyzed. See Section 15.9 for a detailed discussion of this subject.
15.1.1.3 Core and System Performance 15.1.1.3.1 Mathematical Model Due to its slow progression, this event is treated as a quasi-steady-state transient and is analyzed with a steady-state, three dimensional BWR core simulator. The core simulator is used to evaluate the differences, including thermal margins, between the initial conditions of the event and the final equilibrium state point after the loss of feedwater heating.
15.1.1.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2A. The events are analyzed for full cycle exposures at the BOC, MOC, and EOC conditions in order to bound the LGS operating domain described in Appendix 15B.
In addition to the inadvertent loss of feedwater heating event, consideration has also been given to planned operation with partial feedwater heating as follows.
There are two distinct periods of concern when operating with reduced feedwater temperature:
- a. Before EOC - Reducing the feedwater temperature before EOC may occur during routine maintenance. The peak pressure will be lower because of the reduced steam production. The basis for the plant safety analysis covers this operating condition, and a cycle specific analysis is performed to confirm the plant safety.
- b. After EOC - Operating with reduced feedwater temperature may occur as a result of an extended fuel cycle. The basis for the plant safety analysis covers this operating condition, and a cycle specific analysis is performed to confirm the plant safety.
The safety analyses for operation with reduced feedwater temperature evaluates: anticipated operational transients, including the LFWH event; Design Basis Accidents, including LOCA containment response; thermal-hydraulic instability; and reactor vessel internals, including feedwater nozzle and sparger fatigue. (Refer to Sections 15B.1.2 and 15B1.3 for more information.)
CHAPTER 15 15.1-2 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.1.3.3 Results The LFWH event is initiated from a closure of a steam extraction line to a feedwater heater or when feedwater is bypassed around one or more feedwater heaters. In either case, the feedwater temperature is reduced and core inlet subcooling is gradually increased. As a result, core power increases due to the negative void reactivity coefficient.
Vessel steam flow increases and the system pressure increase is slight so the RCPB is not threatened. The increased core inlet subcooling aids core thermal margins and the minimum MCPR is maintained above the safety limit MCPR. The CPR for this event is 0.09 which is significantly less than the CPR for the limiting event (generator load rejection with bypass failure).
Therefore, the safety limit is satisfied.
Sensitivity studies have shown that the effect of initial power level on core thermal margin is negligible, with the event occurring at high power slightly more severe.
The results at the low core flow condition (MELLL case) are actually slightly more severe than for the high core flow condition (ICF case) because of increased inlet subcooling into the reactor core.
15.1.1.3.4 Considerations of Uncertainties Important factors (such as reactivity coefficient, scram characteristics, magnitude of the feedwater temperature change) are assumed to be at the worst configuration so that any deviations seen in the actual plant operation reduce the severity of the transient.
15.1.1.4 Barrier Performance As noted above consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function as designed.
15.1.1.5 Radiological Consequences Since this transient does not result in any additional fuel failures or any release of primary coolant to either the secondary containment or the environment, there are no radiological consequences associated with this transient.
15.1.2 FEEDWATER CONTROLLER FAILURE - MAXIMUM DEMAND 15.1.2.1 Identification of Causes and Frequency Classification 15.1.2.1.1 Identification of Causes This transient is postulated on the basis of a single failure of a control device, specifically one which can directly cause an increase in coolant inventory by increasing the feedwater flow. The most severe applicable transient is a feedwater controller failure during maximum flow demand. The feedwater controller is forced to its upper limit at the beginning of the transient.
CHAPTER 15 15.1-3 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.2.1.2 Frequency Classification This transient is considered to be an incident of moderate frequency.
15.1.2.2 Sequence of Events and System Operation 15.1.2.2.1 Sequence of Events With excess feedwater flow the water level rises to the high level reference point at which time the feedwater pumps and the main turbine are tripped and a scram is initiated. Table 15.1-3 lists the sequence of events for Figure 15.1-3. The figure shows the changes in important variables during this transient.
The operator should:
- a. Observe that high feedwater pump trip has terminated the failure event.
- b. Switch the feedwater controller from automatic to manual control in order to try to regain a correct output signal.
- c. Identify causes of the failure and report all key plant parameters during the transient.
15.1.2.2.2 System Operation To properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems. Important system operational actions for this transient are high level tripping of the main turbine, turbine stop valve scram trip initiation, RPT, and low water level initiation of the RCIC system and the HPCI system to maintain long-term water level control following tripping of feedwater pumps.
15.1.2.2.3 The Effect of Single Failures and Operator Errors In Table 15.1-3 the first sensed event to initiate corrective action to the transient is the vessel high water level (Level 8) trip. Multiple level sensors are used to sense and detect when the water level reaches the Level 8 setpoint. At this point in the logic, a single failure will not initiate or prevent a turbine trip signal. Turbine trip signal transmission, however, is not built to single failure criterion. The result of a failure at this point would have the effect of delaying the pressurization "signature." High levels in the turbine's moisture separators will result in a trip of the unit before high moisture levels enter the low pressure turbine.
Scram trip signals from the turbine are designed such that a single failure neither initiates nor impedes a reactor scram trip initiation. See Section 15.9 for a discussion of this subject.
CHAPTER 15 15.1-4 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.2.3 Core and System Performance 15.1.2.3.1 Mathematical Model The predicted dynamic behavior has been determined using a computer simulated, analytical models of a generic direct-cycle BWR. The models are described in detail in Reference 15.0-4 (ODYN) and Reference 15.0-13 (TRACG). These computer models have been improved and verified through extensive comparison of their predicted results with BWR test data.
The nonlinear computer simulated analytical model is designed to predict associated transient behavior of this reactor. Some of the significant features of the ODYN model are:
- a. An integrated one-dimensional core model is assumed which includes a detailed description of hydraulic feedback effects, axial power shape changes, and reactivity feedbacks.
- b. The fuel is represented by an average cylindrical fuel and cladding node for each axial location in the core.
- c. The steam lines are modeled by eight pressure nodes incorporating mass and momentum balances which will predict any wave phenomena present in the steam line during pressurization transient.
- d. The core average axial water density and pressure distribution is calculated using a single channel to represent the heated active flow and a single channel to represent the bypass flow. A model, representing liquid and vapor mass and energy conservation, and mixture momentum conservation, is used to describe the thermal-hydraulic behavior. Changes in the flow split between the bypass and active channel flow are accounted for during transient events.
- e. Principal controller functions such as feedwater flow, recirculation flow, reactor water level, and pressure and load demand, are represented together with their dominant nonlinear characteristics.
- f. The ability to simulate necessary reactor protection system functions is provided.
- g. The control systems and reactor protection system models are, for the most part, identical to those employed in the point reactor model, which is described in detail in Reference 15.0.4-2 and used in analysis for other transients.
The TRACG model has similar features except it is a three-dimensional model.
15.1.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with the plant conditions as tabulated in Table 15.0-2A.
This event is typically analyzed at the limiting EOC (all-rods-out) statepoint, and at the limiting conditions (i.e. core flow, feedwater temperature, etc.), which bound the allowable LGS operating domain (see Appendix 15B). The cycle-specific maximum feedwater system runout capability is CHAPTER 15 15.1-5 REV. 19, SEPTEMBER 2018
LGS UFSAR specified, with 5% additional feedwater runout capability applied for conservatism. The results presented (LGS Unit 1, Cycle 5) are based on a 149% runout capability (144% + 5%) (where 100%
feedwater flow is defined as 15.0x106lb/hr).
15.1.2.3.3 Results The simulated feedwater controller transient is shown in Figure 15.1-3. The high water level turbine trip and feedwater pump trip are initiated at approximately 8.6 seconds. Scram occurs simultaneously from stop valve closure and limits the neutron flux peak and fuel thermal transient so that no fuel damage occurs. MCPR remains considerably above the safety limit. The turbine bypass system opens to limit peak pressure at the bottom of the vessel to about 1218 psig.
Consequently, the nuclear system process barrier pressure limit is not endangered.
The bypass valves subsequently close to re-establish pressure control in the vessel during shutdown. The level would gradually drop to the low level isolation reference point, activating the RCIC/HPCI systems for long-term level control.
15.1.2.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., relief setpoints, scram stroke time, and reactivity characteristics).
Expected plant behavior is, therefore, expected to lead to a less severe transient.
15.1.2.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed; therefore, these barriers maintain their integrity and function as designed.
15.1.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in yearly integrated exposure level.
15.1.2.6 Additional Transients Evaluated Additional transients have been considered for LGS. Table 15.0-1A shows the peak transient responses for the various cases analyzed. For the ICF and the MELLL conditions, the FWCF event becomes more limiting due to the TBSOOS and the EOC-RPTOOS analysis assumptions. The fuel thermal margin results are within the acceptable limits for the fuel types analyzed. The sequence of events with an inoperative bypass system is shown on Table 15.1-3 and the transient parameters are on Figure 15.1-1. The MCPR values for these transients are also shown in Table 15.0-1A.
CHAPTER 15 15.1-6 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.3 PRESSURE REGULATOR FAILURE - OPEN 15.1.3.1 Identification of Causes and Frequency Classification 15.1.3.1.1 Identification of Causes The total steam flow rate to the main turbine resulting from a pressure regulator malfunction is limited by a maximum flow limiter imposed at the turbine controls. This limiter is set to limit maximum steam flow to approximately 115% NBR.
If the controlling regulator fails, the backup controller will take over control with a bumpless switchover. If both controllers fail to the open position, the turbine control valves can be fully opened and the turbine bypass valves can be partially or fully opened until the maximum steam flow is established.
15.1.3.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.
15.1.3.2 Sequence of Events and System Operation 15.1.3.2.1 Sequence of Events This is a non-limiting event that has not been reanalyzed for power rerate. The sequence of events presented in Table 15.1-4 are based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown.
Table 15.1-4 lists the sequence of events for Figure 15.1-4.
When a fault is detected with the controlling pressure regulator and preceded by spurious or erratic behavior of the controlling device, an automatic "bumpless" failover will occur to the back-up redundant pressure regulator controller. The operator does not have the ability to select the primary or backup controller. If both controllers fail to the open position, and if the reactor scrams as a result of the isolation caused by the low pressure at the turbine inlet in the run mode, the following is the sequence of operator actions expected during the course of the Once isolation occurs the pressure will increase to a point where the relief valves open.
Operator actions for the case where high level (Level 8) trip occurs before the isolation are essentially identical. The operator should:
- a. Monitor that all rods are in.
- b. Monitor reactor water level and pressure.
- c. Observe turbine coast-down and break vacuum before the loss of steam seals.
Check turbine auxiliaries.
- d. Observe that the reactor pressure relief valves open at their setpoint.
CHAPTER 15 15.1-7 REV. 19, SEPTEMBER 2018
- g. Monitor reactor water level and continue cooldown per the normal procedure.
- h. Complete the scram report and initiate a maintenance survey of pressure regulator before reactor restart.
15.1.3.2.2 System Operation To simulate the expected sequence of events properly, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems except as otherwise noted.
Initiation of HPCI and RCIC system functions will occur when the vessel water level reaches the Level 2 setpoint. Normal startup and actuation can take up to 30 seconds before full flow is realized. The 30 seconds is based on the cycle 1 conditions. This event was not reanalyzed for power rerate. If these events occur, they will follow sometime after the primary concerns of fuel thermal margin and overpressure effects have occurred, and are expected to be less severe than those already experienced by the system.
15.1.3.2.3 The Effect of Single Failures and Operator Errors This transient leads to a loss of pressure control such that the increased steam flow demand causes a depressurization. Instrumentation for pressure sensing of the turbine inlet pressure is designed to be single failure proof for initiation of MSIV closure.
Reactor scram sensing, originating from limit switches on the turbine stop valves, is designed to be single failure proof. It is therefore concluded that the basic phenomenon of pressure decay is adequately terminated. See Section 15.9 for a detailed discussion of this subject.
15.1.3.3 Core and System Performance 15.1.3.3.1 Mathematical Model The nonlinear dynamic model described in Reference 15.0-3 is used to simulate this transient.
15.1.3.3.2 Input Parameters and Initial Conditions This transient is simulated by assuming both the primary and backup regulator outputs to a high value, which causes the turbine admission valves and the turbine bypass valves to open fully.
Regulator failure with 135% steam flow was simulated as a worst case since 115% is the normal maximum flow limit.
A 5 second isolation valve closure instead of a 3 second closure is assumed when the turbine pressure decreases below the turbine inlet low pressure setpoint for main steam line isolation initiation. This is within the specification limits of the valve and represents a conservative assumption.
This analysis has been performed, unless otherwise noted, using Cycle 1 plant conditions as listed in Table 15.0-2.
15.1.3.3.3 Results CHAPTER 15 15.1-8 REV. 19, SEPTEMBER 2018
LGS UFSAR The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
A Pressure Regulator Failure-Open (PRFO), is non-limiting for fuel cladding integrity because the Critical Power Ratio (CPR) increases during the event, and they are not typically included in the scope of reload evaluations including uprate conditions and or raising the MSIV low pressure isolation setpoint. The following evaluation predicts that reactor vessel water level would swell during a PRFO transient; the depressurization would be terminated by a high level turbine trip.
Reactor vessel water level swell is difficult to predict and the reactor vessel water level swell portion of transient models have larger uncertainties than other portions of the transient models.
Recent evaluations by GE with improved transient models have determined that the reactor vessel water level swell may not be sufficient to reach the high level trip, in which case the depressurization could be terminated by MSIV closure at the LPIS. The analysis of this scenario is provided In References 15.1-2, 15.1-3 and 15.1-4.
Figure 15.1-4 shows the response of important nuclear system variables for this transient. The water level rises to the high level trip setpoint and initiates trip of the main turbine and feedwater turbines. Closure of the turbine stop valves initiates scram and RPT. After the pressurization resulting from the turbine stop valve closure, pressure again drops and continues to drop until the turbine inlet pressure is below the low turbine pressure isolation setpoint when the main steam line isolation finally terminates the depressurization.
Reactor high level trip limits the duration and severity of the depressurization so that no significant thermal-stresses are imposed on the nuclear system process barrier. After the rapid portion of the transient is complete, the MSRVs operate intermittently to relieve the pressure rise that results from decay heat generation. No significant reductions in fuel thermal margins occur. Because the rapid portion of the transient results in only momentary depressurization of the nuclear system, the MSRVs need operate only to relieve the pressure increase caused by decay heat, the nuclear system process barrier is not threatened by high internal pressure for this pressure regulator malfunction.
15.1.3.3.4 Consideration of Uncertainties If the maximum flow limiter were set higher or lower than normal, there would result a faster or slower loss in nuclear steam pressure. The rate of depressurization may be limited by the bypass capacity. For example, the turbine valves will open to the wide open state admitting slightly more than the rated steam flow, and with the limiter in this analysis set to fail at 135%, no more than 25%
is expected to be bypassed. This is therefore not a limiting factor on this plant. If the rate of depressurization does change it will be terminated by the low turbine inlet pressure trip setpoint.
The depressurization rate has a proportional effect upon the voiding action of the core. If it is not large enough, the sensed vessel water level trip setpoint (Level 8) may not be reached and a turbine and feedwater pump trip will not occur in the transient. In this case, the turbine inlet pressure will drop below the low pressure isolation setpoint and the expected transient signature will conclude with an isolation of the main steam lines. The reactor will be shut down by the scram initiated from MSIV closure.
CHAPTER 15 15.1-9 REV. 19, SEPTEMBER 2018
LGS UFSAR 15.1.3.4 Barrier Performance This is a non-limiting event that has not been reanalyzed for power rerate or for raising the MSIV low pressure isolation setpoint. The results presented are based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown. Raising the MSIV low pressure isolation setpoint would terminate the event sooner and be less limiting.
Barrier performance analyses are not required since the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which fuel, pressure vessel, or containment are designed. Peak pressure in the bottom of the vessel reaches 1165 psig which is below the ASME code limit of vessel dome pressure, 1375 psig for the RCPB. Vessel dome pressure reaches 1149 psig, just slightly below the setpoint of the second pressure relief group.
15.1.3.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.1.4 INADVERTENT MAIN STEAM RELIEF VALVE OPENING 15.1.4.1 Identification of Causes and Frequency Classification 15.1.4.1.1 Identification of Causes Cause of inadvertent MSRV opening is attributed to malfunction of the valve or an operator initiated opening. Opening and closing circuitry at the individual valve level (as opposed to groups of valves) is subject to a single failure event. It is therefore simply postulated that a failure occurs and the transient is analyzed accordingly. Detailed discussion of the valve design is provided in Chapter 5.
15.1.4.1.2 Frequency Classification This transient is categorized as an infrequent incident. However, it is analyzed as an incident of moderate frequency.
15.1.4.2 Sequence of Events and System Operation 15.1.4.2.1 Sequence of Events This is a non-limiting event that has not been reanalyzed for the power rerate. The sequence of events is based on Cycle 1 conditions. An analysis of this event for rerate conditions is not expected to result in a change in the general trends and characteristics as shown.
Table 15.1-5 lists the sequence of events for this transient.
CHAPTER 15 15.1-10 REV. 19, SEPTEMBER 2018
LGS UFSAR The plant operator must "reclose" the valve as soon as possible and check that reactor and turbine-generator output return-to-normal. If the valve cannot be closed, plant shutdown should be initiated.
The operator will have the time period between the valve first sticking full open and the bulk pool temperature reaching 110F before he must scram the reactor to be in compliance with the Technical Specifications.
If it is assumed that the suppression pool is at its maximum operating temperature (95F) and minimum operating volume with no pool cooling systems in operation when the valve first opens, the operator will have more than 6 minutes before the pool scram temperature of 110F is reached.
If the above worst case assumptions were relaxed, the time for operator action would increase.
Delaying the reactor scram to 10 minutes after the valve sticks full open would have no adverse effect on plant safety. Even though the suppression pool temperature would approach 120F at the time of scram, the maximum allowable suppression pool temperature limits would not be exceeded.
15.1.4.2.2 System Operation This transient assumes normal functioning of normal plant instrumentation and controls, specifically the operation of the pressure regulator and levels control systems.
15.1.4.2.3 The Effect of Single Failures and Operator Errors Failure of additional components (e.g., pressure regulator, feedwater flow controller) is discussed elsewhere in this chapter.
15.1.4.3 Core and System Performance 15.1.4.3.1 Mathematical Model The computer model used to simulate this transient is discussed in detail in Reference 15.1-1. It has been determined that this transient is not limiting from a core performance standpoint.
Therefore, a qualitative presentation of results is described below.
15.1.4.3.2 Input Parameters and Initial Conditions This event is based on Cycle 1 conditions (see Table 15.0-2).
For this event it is assumed that the reactor is operating at an initial power level of 3458 MWt when an MSRV is inadvertently opened. Flow through the valve at normal plant operating conditions stated above is approximately 7% of original rated steam flow.
15.1.4.3.3 Results This is a non-limiting event that has not bee reanalyzed for power rerate. The results presented are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
The opening of an MSRV allows steam to be discharged into the suppression pool. The sudden increase in the rate of steam flow leaving the reactor vessel causes a mild depressurization transient.
The pressure regulator senses the nuclear system pressure decrease and within a few seconds closes the turbine control valve far enough to stabilize reactor vessel pressure at a slightly lower CHAPTER 15 15.1-11 REV. 19, SEPTEMBER 2018
LGS UFSAR value, and reactor power settles at nearly the initial power level. Thermal margins decrease only slightly through the transient, and no fuel damage results from the transient. MCPR is essentially unchanged and therefore the safety limit margin is unaffected.
15.1.4.4 Barrier Performance As discussed above, the transient resulting from an inadvertent MSRV opening is a mild depressurization which is within the range of normal load-following and therefore has no significant effect on RCPB and containment design pressure limits.
15.1.4.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with the established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.1.5 SPECTRUM OF STEAM SYSTEM PIPING FAILURES INSIDE AND OUTSIDE OF CONTAINMENT IN A PWR This event is not applicable to BWR plants.
15.1.6 INADVERTENT RHR SHUTDOWN COOLING OPERATION 15.1.6.1 Identification of Causes and Frequency Classification 15.1.6.1.1 Identification of Causes At design power conditions no conceivable malfunction in the shutdown cooling system could cause temperature reduction.
If the reactor were critical or near critical in a startup or cooldown condition, a very slow increase in reactor power could result. A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for the RHR heat exchangers. The resulting temperature decrease would cause a slow insertion of positive reactivity into the core. If the operator did not act to control the power level, a high neutron flux reactor scram would terminate the transient without violating fuel thermal limits and without any measurable increase in nuclear system pressure.
15.1.6.1.2 Frequency Classification Although no single failure could cause this transient, it is conservatively categorized as a transient of moderate frequency.
15.1.6.2 Sequence of Events and System Operation 15.1.6.2.1 Sequence of Events CHAPTER 15 15.1-12 REV. 19, SEPTEMBER 2018
LGS UFSAR A shutdown cooling malfunction leading to a moderator temperature decrease could result from misoperation of the cooling water controls for RHR heat exchangers. The resulting temperature decrease causes a slow insertion of positive reactivity into the core. Scram will occur before any thermal limits are reached if the operator does not take action. The sequence of events for this transient is shown in Table 15.1-1.
15.1.6.2.2 System Operation A shutdown cooling malfunction causing a moderator temperature decrease must be considered in all operating states. However, this transient is not considered while at power operation since the nuclear system pressure is too high to permit operation of the RHR shutdown cooling mode.
No unique safety actions are required to avoid unacceptable safety results for transients as a result of a reactor coolant temperature decrease induced by misoperation of the shutdown cooling heat exchangers. In startup or cooldown operation, where the reactor is or nearly is critical, the slow power increase resulting from the cooler moderator temperature would be controlled by the operator in the same manner normally used to control power in the source or intermediate power ranges.
15.1.6.2.3 The Effect of Single Failures and Operator Errors No single failures can cause this transient to be more severe. If the operator takes action, the slow power rise will be controlled in the normal manner. If no operator action is taken, scram will terminate the power increase before thermal limits are reached (Section 15.9).
15.1.6.3 Core and System Performance The increased subcooling caused by misoperation of the RHR shutdown cooling mode could result in a slow power increase due to the reactivity insertion. This power rise would be terminated by a flux scram before fuel thermal limits are approached. Therefore, only a qualitative description is provided here.
15.1.6.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed, therefore, these barriers maintain their integrity and function as designed.
15.1.6.5 Radiological Consequences Since this transient does not result in any fuel failures, no analysis of radiological consequences is required for this transient.
15.
1.7 REFERENCES
15.1-1 R.B. Linford, "Analytical Methods of Plant Transient Evaluations for the General Electric Boiling Water Reactor," NEDO-10802, (April 1973).
15-1-2 General Electric "10 CFR 21 Reportable Condition Notification: Potential to Exceed Low Pressure Technical Specification Safety Limit," March 29, 2005.
CHAPTER 15 15.1-13 REV. 19, SEPTEMBER 2018
LGS UFSAR 15-1-3 NEDC-33743, Revision 0, "BWR Owner's Group Reload Analysis and Core Management Committee SC05-03 Analysis Report," GE Hitachi Energy, April 2012.
15-1-4 EC 400057, Revision 0, SC05-03 Assessment for Limerick, Units 1 and 2.
CHAPTER 15 15.1-14 REV. 19, SEPTEMBER 2018
LGS UFSAR Table 15.1-1 SEQUENCE OF EVENTS FOR INADVERTENT RHR SHUTDOWN COOLING OPERATION TIME (min) EVENT 0 Reactor at states B or D (Section 15.9) when RHR shutdown cooling inadvertently activated.
0-10 Slow rise in reactor power.
+10 Operator may take action to limit power rise. Flux scram will occur if no action is taken.
CHAPTER 15 15.1-15 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.1-2 SEQUENCE OF EVENTS FOR LOSS OF FEEDWATER HEATING TIME (sec) EVENT 0 Initiate a 100F temperature reduction into the feedwater system.
25.0 (approx.) Initial effect of unheated feedwater to raise core power level and steam flow.
65.0 (approx.) Bypass valves open to accommodate the increasing steam flow.
120.0 (approx.) New higher power, steady-state conditions reached CHAPTER 15 15.1-16 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.1-3 SEQUENCE OF EVENTS FOR FEEDWATER CONTROLLER FAILURE TIME (sec) EVENT(1) (WITH TURBINE BYPASS) 0 Initiate simulated failure of feedwater controller to upper limit on feedwater flow.
8.4 Level 8 vessel level setpoint trips main turbine and feedwater pumps.
8.4 Reactor scram trip actuated from main turbine stop valve position switches.
8.4 RPT actuated by stop valve position switches.
8.6 Main turbine stop valves closed and turbine bypass valves start to open.
8.6 Recirculation pump motor circuit breakers open causing recirculation drive flow to start to coast down.
11.2 First group of SRVs open due to high pressure.
TIME (sec) EVENT(2) (WITHOUT TURBINE BYPASS) 0 Initiate simulated failure of feedwater controller to upper limit on feedwater flow.
8.3 Level 8 vessel level setpoint trips main turbine and feedwater pumps.
8.3(est) Reactor scram trip actuated from main turbine stop valve position switches.
8.3 RPT actuated by stop valve position switches.
8.5 Turbine bypass valves fail to open.
8.5 Main turbine stop valves closed.
8.6 Recirculation pump motor circuit breakers open causing recirculation drive flow to coast-down.
10.5 First groups 1 to 3 actuated due to high pressure.
(1)
See Figure 15.1-3.
(2)
See Figure 15.1-1.
CHAPTER 15 15.1-17 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.1-4 SEQUENCE OF EVENTS FOR PRESSURE REGULATOR FAILURE(1)
TIME (sec) EVENT 0 Simulate maximum limit flow to main turbine.
0.4 Main turbine bypass opens.
0.7(est) Turbine control valves open wide.
4.7 Vessel water level (Level 8) trip initiates main turbine and feedwater turbine trips.
4.7 Main turbine stop valve position initiates reactor scram and RPT.
4.8 Turbine stop valves closed.
4.9 Recirculation pump motor circuit breakers open causing decrease in core flow to natural circulation.
46.8 Main steam line isolation on low turbine inlet pressure.
51.8 MSIVs closed. Bypass valves remain open, exhausting steam in steam lines downstream of isolation valves.
52.0 RCIC AND HPCI systems initiation on low level (Level 2).
>100.0 Group 1 MSRVs actuate and cycle.
(1)
See Figure 15.1-4.
NOTE: This is a non-limiting event that has not been re-analyzed for power rerate or for raising the MSIV low pressure isolation setpoint. The results of this event are based on Cycle 1 conditions. An analysis of this event for the rerate conditions is not expected to result in a change in the general trends and characteristics as shown. Raising the MSIV low pressure isolation setpoint would terminate the event sooner and be less limiting.
CHAPTER 15 15.1-18 REV. 19, SEPTEMBER 2018
LGS UFSAR Table 15.1-5 SEQUENCE OF EVENTS FOR INADVERTENT MAIN STEAM RELIEF VALVE OPENING TIME (sec) EVENT 0 Initiate opening of one MSRV.
0.5(est) MSRV flow reaches full flow.
15.0(est) System establishes new steady-state operation.
NOTE: This is a non-limiting event that has not been re-analyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for the rerate conditions is not expected to result in a change in the general trends and characteristics as shown.
CHAPTER 15 15.1-19 REV. 13, SEPTEMBER 2006
LGS UFSAR 15.2 INCREASE IN REACTOR PRESSURE 15.2.1 PRESSURE REGULATOR FAILURE - CLOSED 15.2.1.1 Identification of Causes and Frequency Classification 15.2.1.1.1 Identification of Causes The Digital Electro-Hydraulic Control (DEHC) pressure regulator control function is performed via application software running on redundant controllers. The main steam pressure indications and pressure setpoint adjustments and indications are located on the HMI workstation of the turbine control panel. Each functional controller in the redundant pair executes the same application program, although only one controller at a time accesses the I/O and runs in the control mode. The partner processor runs in the backup mode. The transfer between the primary and the backup regulator controllers is automatic. The operator does not have the ability to select the primary or backup regulator controller. It is assumed, for the purposes of this transient analysis that a single failure occurs, erroneously causes the controlling regulator processor to close the main turbine control valves. Failure of the primary controlling regulator processor results in the automatic bumpless transfer between the primary and the backup regulator controllers, thereby preventing an increase in reactor pressure.
15.2.1.1.2 Frequency Classification This transient is treated as a moderate frequency event.
15.2.1.2 Sequence of Events and System Operation 15.2.1.2.1 Sequence of Events When a fault is detected with the controlling pressure regulator processor, as discussed in Section 15.2.1.1.1, an automatic "bumpless" failover will occur to the back-up redundant regulator controller. The pressure increase will be small, if any. Both regulators receive the same setpoint value from the operator input via the HMI, thus, pressure will be controlled at approximately the same value prior to the assumed failure.
15.2.1.2.2 Systems Operation Normal plant instrumentation and control is assumed to function. This transient requires no protection system, or safeguard systems, operation.
15.2.1.2.3 The Effect of Single Failures and Operator Errors The nature of the first assumed failure produces a slight pressure increase in the reactor until the backup processor gains control. The control system is designed to provide a bumpless transfer between control modes and various control functions throughout the reactor power range (0-100%), such as primary to backup pressure regulator controller, valve tests, and automatic cool down. Also, upon detection of a primary controller fault, the control of the I/O interface is automatically transferred to the backup controller. To minimize the effects from transferring control from the primary to backup regulator control processor (bumpless transfer),
the algorithms track the output values, pass the information upstream, and apply the data during the first pass of execution. Each processor has its own network connection that is integrated CHAPTER 15 15.2-1 REV. 20, SEPTEMBER 2020
LGS UFSAR into the process module and provides complete redundancy. To ensure redundant communications, each processor in the redundant pair is attached to a different switch. This ensures that there is no single point of failure. The term "bumpless" is defined as not exceeding 2 psi as set forth for pressure control. This means that mode changes and switching of functions will not cause a step change in throttle pressure greater than 2 psi operating throttle pressure variations.
15.2.1.3 Core and System Performance The disturbance is mild, similar to a pressure setpoint change, and no significant reductions in fuel thermal margins occur. This transient is much less severe than the generator and turbine trip transients described in Sections 15.2.2 and 15.2.3.
15.2.1.3.1 Mathematical Model Qualitative evaluation provided only.
15.2.1.3.2 Input Parameters and Initial Conditions Qualitative evaluation provided only.
15.2.1.3.3 Results Response of the reactor during this primary pressure regulator control processor failure is such that the pressure change at the turbine inlet is small, and no pressure disturbance in the vessel.
Thus, neutron flux and pressure trip margins will be maintained.
15.2.1.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., relief setpoints, scram stroke time, and worth characteristics). Normal plant behavior is, therefore, expected to reduce the actual severity of the transient.
15.2.1.4 Barrier Performance The consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed. Therefore, these barriers maintain their integrity and function as designed.
15.2.1.5 Radiological Consequences Because this transient does not result in any fuel failures, or any release of primary coolant to either the secondary containment or to the environment, there are no radiological consequences associated with this transient.
15.2.2 GENERATOR LOAD REJECTION 15.2.2.1 Identification of Causes and Frequency Classification 15.2.2.1.1 Identification of Causes CHAPTER 15 15.2-2 REV. 20, SEPTEMBER 2020
LGS UFSAR Fast closure of the turbine control valves is initiated whenever electrical grid disturbances occur that result in significant loss of electrical load on the generator. The turbine control valves are required to close as rapidly as possible to prevent excessive overspeed of the turbine-generator.
Closure of the main turbine control valves will cause a sudden reduction in steam flow that results in an increase in system pressure and a reactor shutdown.
15.2.2.1.2 Frequency Classification 15.2.2.1.2.1 Generator Load Rejection This transient is categorized as an incident of moderate frequency.
15.2.2.1.2.2 Generator Load Rejection with Bypass Failure Frequency Basis: Thorough searches of domestic plant operating records have revealed three instances of bypass failure during 628 bypass system operations. This gives a probability of bypass failure of 0.0048. Combining the actual frequency of a generator load rejection with the failure rate of the bypass yields an event frequency of a generator load rejection with bypass failure of 0.0036/plant year.
15.2.2.2 Sequence of Events and System Operation 15.2.2.2.1 Sequence of Events 15.2.2.2.1.1 Generator Load Rejection - Turbine Control Valve Fast Closure A loss of generator electrical load from high power conditions produces the sequence of events listed in Table 15.2-1.
15.2.2.2.1.2 Generator Load Rejection with Failure of Bypass A loss of generator electrical load at high power with bypass failure produces the sequence of events listed in Table 15.2-2.
15.2.2.2.1.3 Identification of Operator Actions The operator should:
- a. Verify proper bypass valve operation.
- b. Observe that the feedwater/level controls have maintained the reactor water level at a satisfactory value.
- c. Observe that the pressure regulator is controlling reactor pressure at the desired value.
- d. Record peak power and pressure.
- e. Verify relief valve operation.
15.2.2.2.2 System Operation CHAPTER 15 15.2-3 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.2.2.2.1 Generator Load Rejection with Bypass This is a non-limiting event that has not been reanalyzed for power rerate.
In order to properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems, unless stated otherwise.
Turbine control valve fast closure initiates a trip signal for power levels greater than 30% NBR. In addition, RPT is initiated. Both of these trip signals satisfy single failure criteria, and credit is taken for these protective features.
The nuclear pressure relief system, which operates the MSRVs independently when system pressure exceeds relief valve instrumentation setpoints, is assumed to function normally during the time period analyzed.
15.2.2.2.2.2 Generator Load Rejection with Failure of Bypass This is the same as Section 15.2.2.2.2.1, except that failure of the main turbine bypass valves is assumed for the entire transient.
15.2.2.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase, the basic nature of this transient, is accomplished by the RPS functions. Turbine control valves trip and RPT are designed to satisfy single failure criteria. An evaluation of the most limiting single failure (i.e., failure of the bypass system) was considered in this transient. Single failure analysis can be found in Section 15.9.
15.2.2.3 Core and System Performance 15.2.2.3.1 Mathematical Model The computer models described in Section 15.1.2.3.1 are used to simulate this transient.
15.2.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2A for rerate conditions.
The turbine EHC system detects load rejection before a measurable speed change takes place.
The closure characteristics of the turbine control valves are assumed to have a full stroke closure time, from fully open to fully closed, of 0.15 seconds.
Auxiliary power would normally be independent of any turbine- generator overspeed effects, and be continuously supplied at rated frequency as automatic fast transfer to auxiliary power supplies occurs. For the purposes of worse case analysis, the recirculation pumps are assumed to remain tied to the main generator, and thus increase in speed with the turbine-generator overspeed until tripped by the RPT system.
CHAPTER 15 15.2-4 REV. 20, SEPTEMBER 2020
LGS UFSAR The reactor is operating in the manual flow control mode when load rejection occurs.
The bypass valve opening characteristics are simulated, using the specified delay together with the specified opening characteristic required for bypass system operation.
Actual closure of MSIVs as caused by low water level trip (Level 1), and actual flow from initiation of RCIC and HPCI core cooling system functions do not occur during the duration of the simulation.
If these events occur, they will follow sometime after the primary concerns of fuel margin and overpressure effects have passed and are expected to result in effects less severe than those already experienced by the reactor system.
15.2.2.3.3 Results 15.2.2.3.3.1 Generator Load Rejection with Bypass The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Figure 15.2-1 shows the results of the generator trip from 104.3% rated power. Peak neutron flux rises to 178.5% of NBR conditions.
The average surface heat flux peaks at 101.2% of its initial value. The change in CPR for this event is only 0.03, and CPR does not significantly decrease below its initial value.
15.2.2.3.3.2 Generator Load Rejection with Failure of Bypass Beginning with Cycle 8 of Unit 1, the turbine control valves (TCV) have been modified to operate in full arc admission. In this configuration the TCVs close sooner than the turbine stop valves to shut off steam flow. As a result, the Generator Load Rejection with Failure of Bypass event (LRNBP) is more limiting than the turbine trip with failure of bypass (TTNBP). Table 15.0-1A provides the results of the LRNBP analyses for several different conditions, including one for the TCVs in full arc admission configuration. Figure 15.2-2 depicts the transient response of various plant parameters following a LRNBP event. The LRNBP is also analyzed assuming the EOC-RPT function is inoperable to provide a basis for this possible mode of operation. A similar analysis has been performed to address power load unbalance (PLU) function failure. For cycle specific reload licensing analysis the LRNBP event is evaluated at the limiting operating domain condition (see Appendix 15B).
Additionally, an analysis of Generator Load Rejection and Turbine Trip events with simultaneous Failure of Bypass and End of Cycle Recirculation Pump Trip (EOC-RPT) was performed using the ODYN code. The Generator Load Rejection event bounds the turbine trip. Table 15.2-14 presents a summary of the initial conditions and significant results for the Generator Load Rejection with no bypass and no EOC-RPT event, while Figure 15.2-14 shows its time history.
15.2.2.3.4 Consideration of Uncertainties The full stroke closure time of the turbine control valves of 0.15 seconds is conservative. Typically, actual closure time is more like 0.2 seconds. Thus, the shorter time chosen for closure results in a more severe pressurization effect.
CHAPTER 15 15.2-5 REV. 20, SEPTEMBER 2020
LGS UFSAR All systems utilized for protection in this transient were assumed to have the poorest allowable response (e.g., relief setpoints, scram stroke time, and work characteristics). Anticipated plant behavior is, therefore, expected to reduce the actual severity of the transient.
15.2.2.4 Barrier Performance 15.2.2.4.1 Generator Load Rejection Peak pressure remains within normal operating range and no threat to the barrier exists.
15.2.2.4.2 Generator Load Rejection with Failure of Bypass As shown in Table 15.0-1A the peak nuclear system pressure at the bottom of the vessel remains well below the nuclear barrier transient pressure limit of 1375 psig.
15.2.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is restricted to the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.2.3 TURBINE TRIP 15.2.3.1 Identification of Causes and Frequency Classification 15.2.3.1.1 Identification of Causes A variety of turbine or nuclear system malfunctions will initiate a turbine trip. Some examples are:
moisture separator and heater drain tank high levels, operational lockout, loss of control fluid pressure, low condenser vacuum, and reactor high water level.
15.2.3.1.2 Frequency Classification 15.2.3.1.2.1 Turbine Trip with Bypass This transient is categorized as an incident of moderate frequency. In defining the frequency of this transient, turbine trips that occur as a by-product of other transients, such as loss of condenser vacuum or reactor high level trip events, are not included. However, spurious low vacuum or high level trip signals, which cause an unnecessary turbine trip, are included in defining the frequency.
In order to get an accurate event-by-event frequency breakdown, this division of initiating causes is required.
CHAPTER 15 15.2-6 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.3.1.2.2 Turbine Trip with Failure of the Bypass Frequency Basis: As discussed in Section 15.2.2.1.2.2, the failure rate of the bypass is 0.0048.
Combining this with the turbine trip frequency of 1.33 events/plant year yields the frequency of 0.0064/plant year.
15.2.3.2 Sequence of Events and System Operation 15.2.3.2.1 Sequence of Events 15.2.3.2.1.1 Turbine Trip with Bypass This event is non-limiting and was not reanalyzed at power rerate conditions. A turbine trip at high power with bypass produces the sequence of events listed in Table 15.2-3 for Cycle 1 conditions.
15.2.3.2.1.2 Turbine Trip with Failure of the Bypass A turbine trip at high power with bypass failure produces the sequence of events listed in Table 15.2-4.
15.2.3.2.1.3 Identification of Operator Actions The operator should:
- a. Verify automatic transfer of buses supplied by generator to incoming power. If automatic transfer does not occur, manual transfer must be made.
- b. Monitor and maintain reactor water level at required level.
- c. Check turbine for proper operation of all auxiliaries during coast-down.
- d. Depending upon conditions, initiate normal operating procedures for cooldown, or maintain pressure for restart purposes.
- e. Put the mode switch in the shutdown position and verify all control rods are inserted.
- f. Secure the RCIC operation if automatic initiation occurred due to low water level.
- h. Cool down the reactor per standard procedure if a restart is not intended.
15.2.3.2.2 System Operation 15.2.3.2.2.1 Turbine Trip with Bypass All plant control systems maintain normal operation unless otherwise noted.
Turbine stop valve closure initiates a reactor trip via position signals to the protection system.
Credit is taken for successful operation of the RPS.
CHAPTER 15 15.2-7 REV. 20, SEPTEMBER 2020
LGS UFSAR Turbine stop valve closure initiates RPT, thereby terminating the jet pump drive flow.
The nuclear pressure relief system, which consists of the MSRVs that operate independently when system pressure exceeds relief valve setpoints, is assumed to function normally during the time period analyzed.
15.2.3.2.2.2 Turbine Trip with Failure of the Bypass Same as Section 15.2.3.2.2.1 except that failure of the main turbine bypass system is assumed for the entire transient time period analyzed.
15.2.3.2.2.3 Turbine Trip at Low Power with Failure of the Bypass Same as Section 15.2.3.2.2.1 except that failure of the main turbine bypass system is assumed.
It should be noted that, below 30% NBR power level a main stop valve trip inhibit signal is actuated by the first-stage pressure of the turbine. This is done to eliminate the stop valve trip signal from scramming the reactor, provided the bypass system functions properly. In other words, the bypass would be sufficient at this low power to accommodate a turbine trip without the necessity of shutting down the reactor. All other protection system functions remain operative as before, and credit is taken for those protection system trips.
15.2.3.2.3 The Effect of Single Failures and Operator Errors 15.2.3.2.3.1 Turbine Trips at Power Levels Greater Than 30% NBR Mitigation of pressure increase, the basic nature of this transient, is accomplished by RPS functions. The main stop valve closure trip is designed to satisfy the single failure criterion.
15.2.3.2.3.2 Turbine Trips at Power Levels Less Than 30% NBR This is the same as in Section 15.2.3.2.3.1, except RPT and stop valve closure trip is normally inoperative. Since protection is still provided by high flux, high pressure, etc., these factors will scram the reactor should a single failure occur.
15.2.3.3 Core and System Performance 15.2.3.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate these transients with normal bypass operation. The infrequent event of turbine trip with bypass failure is simulated with the computer models in Section 15.1.2.3.1.
15.2.3.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2 for Cycle 1 and in Table 15.02A for rerate.
Turbine stop valves full stroke closure time is 0.1 second.
CHAPTER 15 15.2-8 REV. 20, SEPTEMBER 2020
LGS UFSAR A reactor scram is initiated by position switches on the stop valves when the valves are not fully open. This stop valve trip signal is automatically bypassed when the reactor is below 30% NBR power level.
Reduction in core recirculation flow is initiated by position switches on the main stop valves that trip the recirculation pumps.
15.2.3.3.3 Results 15.2.3.3.3.1 Turbine Trip with Bypass The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
A turbine trip with the bypass system operating normally is simulated at 104.3% NBR steam flow conditions in Figure 15.2-3.
Neutron flux increases rapidly because of the void reduction caused by the pressure increase.
However, the flux increase is limited to 163.3% of rated value by the stop valve scram and the RPT system. Peak fuel surface heat flux does not exceed 102% of its initial value. The CPR is less than that for turbine trip with assumed bypass failure (Section 15.2.3.3.3.2) and the MCPR remains well above the safety limit.
15.2.3.3.3.2 Turbine Trip with Failure of Bypass The TTNBP event is caused by the rapid closure of the turbine stop valves. A reactor scram signal is immediately initiated from the position switches on the TSVs. The turbine bypass system is conservatively assumed to be inoperable.
With the TCVs configured for full arc admission, the TTNBP is bounded by the LRNBP event. The TTNBP event is also analyzed assuming the EOC-RPT function is inoperable to provide a basis for this possible mode of operation. The TTNBP transient results are summarized in Table 15.0-1A.
The system response curves are shown in Figure 15.2-4. The fuel transient thermal and mechanical overpower results are below the design criteria.
15.2.3.3.3.3 Turbine Trip with Bypass Valve Failure, Low Power This transient is less severe than a similar one at high power. Below 30% of rated power, the turbine stop valve and turbine control valve closure scrams are automatically bypassed. At these lower power levels, the turbine first-stage pressure is used to initiate the scram logic bypass. The scram which terminates the transient is initiated by high neutron flux or high vessel pressure. The bypass valves are assumed to fail; therefore, system pressure will increase until the pressure relief setpoints are reached. At this time, because of the relatively low power of this transient event, relatively few MSRVs will open to limit reactor pressure. Peak pressures are not expected to greatly exceed the MSRV setpoints, and will be significantly below the RCPB transient limit of 1375 psig. Peak surface heat flux and peak fuel center temperature remain at relatively low values, and MCPR remains well above the GETAB safety limit.
CHAPTER 15 15.2-9 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.3.3.4 Consideration of Uncertainties Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics. The most conservative values are used in all the analyses. For example:
- a. Control rod scram speed based on conservative statistical aproach consistent with GEMINI methodology option A/B.
- b. Scram worth shape for all rod-out conditions is assumed.
- c. Minimum specified MSRV capacities are utilized for overpressure protection.
- d. Setpoints of the MSRVs include errors (high) for all valves.
15.2.3.4 Barrier Performance 15.2.3.4.1 Turbine Trip with Bypass NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
Peak pressure in the bottom of the vessel reaches 1196 psig, which is below the ASME code limit of 1375 psig for the RCPB. Vessel dome pressure does not exceed 1174 psig. The severity of turbine trips from low initial power levels decreases to the point where a scram can be avoided if auxiliary power is available and the power level is within bypass capability.
15.2.3.4.2 Turbine Trip with Failure of the Bypass The MSRVs open and close sequentially as the stored energy is dissipated and the pressure falls below the setpoints of the valves. As shown in Table 15.0-1A, the peak nuclear system pressure at the vessel bottom remains below the RCPB transient pressure limit of 1375 psig.
15.2.3.4.2.1 Turbine Trip with Failure of Bypass at Low Power Qualitative discussion is provided in Section 15.2.3.3.3.3.
15.2.3.5 Radiological Consequences Although the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.2.4 MSIV CLOSURES 15.2.4.1 Identification of Causes and Frequency Classification CHAPTER 15 15.2-10 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.4.1.1 Identification of Causes Various steam line and nuclear system malfunctions, or operator actions, can initiate MSIV closure.
Examples are: low steam line pressure, high steam line flow, low water level, or manual action.
15.2.4.1.2 Frequency Classification 15.2.4.1.2.1 Closure of All Main Steam Isolation Valves This transient is categorized as an incident of moderate frequency. To define the frequency of this transient, as an initiating transient and not the byproduct of another transient, only the following contribute to the frequency: manual action (purposely or inadvertent), spurious signals such as low pressure, low reactor water level, low condenser vacuum, etc.; and, finally, equipment malfunctions such as faulty valves or operating mechanisms. A closure of one MSIV may cause an immediate closure of all the other MSIVs, depending upon reactor conditions. If this occurs, it is also included in this category. During the MSIV closure, position switches on the valves provide a reactor scram if the valves in three or more main steam lines are not fully open, except for interlocks which permit proper plant startup. Protection system logic, however, permits the test closure of one valve without initiating scram from the position switches.
15.2.4.1.2.2 Closure of One Main Steam Isolation Valve This transient is categorized as an incident of moderate frequency. RPS logic allows for one MSIV at a time to be closed without generating a half scram signal. Operator error or equipment malfunction may cause a single MSIV to be closed inadvertently. If reactor power is greater than approximately 90% when this occurs, a high flux scram or high steam line flow scram may result. If all MSIVs close as a result of the single closure, the transient is considered as a closure of all MSIVs.
15.2.4.2 Sequence of Events and System Operation 15.2.4.2.1 Sequence of Events This is a non-limiting event that has not been reanalyzed for power rerate. The sequence of events is Table 15.2-5 is based on Cycle 1 conditions. The general trend and characteristics shown here are not expected to change for current conditions.
Table 15.2-5 lists the sequence of events for Figure 15.2-5.
The following is the sequence of operator actions expected during the course of the transient, assuming no restart of the reactor. The operator should:
- a. Observe that all rods have been inserted.
- b. Observe that the relief valves have opened for reactor pressure control.
- c. Check that RCIC/HPCI automatically starts on the impending low reactor water level condition.
- d. Switch the feed pump controllers to the manual position.
CHAPTER 15 15.2-11 REV. 20, SEPTEMBER 2020
- e. When the reactor vessel level has recovered to a satisfactory level, secure RCIC/HPCI.
- f. When the reactor pressure has decayed sufficiently, initiate shutdown cooling.
- g. Before resetting the MSIV isolation, determine the cause of valve closure.
- h. Observe turbine coast-down and break vacuum before the loss of sealing steam.
Check turbine-generator auxiliaries for proper operation.
- j. Reset and open MSIVs if conditions warrant and assure that the pressure regulator setpoint is above vessel pressure.
15.2.4.2.2 System Operation 15.2.4.2.2.1 Closure of All Main Steam Isolation Valves MSIV closures initiate a reactor scram trip through position signals to the protection system. Credit is taken for successful operation of the protection system.
The nuclear pressure relief system, which opens the MSRVs when system pressure exceeds relief valve setpoints, is assumed to function normally during the time period analyzed.
All plant control systems maintain normal operation unless otherwise noted.
15.2.4.2.2.2 Closure of One Main Steam Isolation Valve The closure of a single MSIV at any given time will not initiate a reactor scram. This is because the valve position scram trip logic is designed to accommodate single valve operation and testability during normal reactor operation at limited power levels. Credit is taken for the operation of the pressure and flux signals to initiate a reactor scram.
All plant control systems maintain normal operation unless otherwise noted.
15.2.4.2.3 The Effect of Single Failures and Operator Errors Mitigation of pressure increase is accomplished by initiation of the reactor scram via MSIV position switches and the protection system. MSRVs also operate to limit system pressure. All of these functions are designed to single failure criteria, and additional single failures would not alter the results of this analysis.
Failure of a single MSRV to open is not expected to have any significant effect. Such a failure is expected to result in less than a 20 psi increase in the maximum vessel pressure rise. The peak pressure will still remain considerably below 1375 psig. The design basis and performance of the pressure relief system is discussed in Section 5.2.
CHAPTER 15 15.2-12 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.4.3 Core and System Performance 15.2.4.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate these transient events.
15.2.4.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2.
The MSIV closing time is adjustable between 3 and 10 seconds. The worst case, the 3 second closure time, is assumed in this analysis.
Position switches on the valves initiate a reactor scram when the valves are not fully open. Closure of these valves inhibits steam flow to the feedwater turbines, terminating feedwater flow.
Because of the loss of feedwater flow, water level within the vessel decreases sufficiently to initiate the HPCI and RCIC systems.
15.2.4.3.3 Results 15.2.4.3.3.1 Closure of All Main Steam Isolation Valves This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Figure 15.2-5 shows the changes in important nuclear system variables for the simultaneous isolation of all main steam lines while the reactor is operating at 104.3% of NBR steam flow. Peak neutron flux reaches 190.9% of rated value in the first few seconds of the event. At the time of peak neutron flux, the nonlinear valve closure becomes a strong effect, and the conservative scram characteristic assumption has not yet allowed credit for the full shutdown of the reactor. As pressure increases, recirculation pumps trip on the high vessel pressure.
Water level decreases cause initiation of the HPCI and RCIC systems. Although there is a delay of up to 30 seconds before the water supply enters the vessel, there is no change in the thermal margins. The 30 seconds is based on cycle 1 conditions. This event was not reanalyzed for power rerate.
15.2.4.3.3.2 Closure of One Main Steam Isolation Valve This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
RPS logic is such that only one isolation valve at a time can be closed without generating a half scram signal. With a 3 second closure of one MSIV with reactor power greater than approximately 90%, the steam flow disturbance may raise vessel pressure and reactor power enough to initiate a high neutron flux scram. This transient is considerably milder than the closure of all MSIVs at power. No quantitative analysis is furnished for this transient. However, no significant change in CHAPTER 15 15.2-13 REV. 20, SEPTEMBER 2020
LGS UFSAR thermal margins is experienced, and no fuel damage occurs. Peak pressure remains below MSRV setpoints.
For testing purposes, one MSIV at a time is partially slow closed using a test push button to verify the RPS logic.
Inadvertent closure of one or all of the isolation valves while the reactor is shut down (such as operating state C, as defined in Section 15.9) will produce no significant transient. Closures during plant heatup (operating state D) will be less severe than the maximum power cases (maximum stored and decay heat) discussed in Section 15.2.4.3.3.1.
15.2.4.3.4 Consideration of Uncertainties Uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics. In all cases, the most conservative values are used in the analyses. For example:
- a. Slowest allowable control rod scram motion is assumed.
- b. Scram worth shape for all rod-out conditions is assumed.
- c. Minimum specified MSRV capacities are utilized for overpressure protection.
- d. MSRV setpoints are assumed to be 3% higher than the valves nominal setpoints.
Additionally, Unit 2, cycle 4 parameters were used for the performance of the 3%
analysis (Reference 5.3-10).
15.2.4.4 Barrier Performance 15.2.4.4.1 Closure of All Main Steam Isolation Valves The MSRVs begin to open within the first few seconds after the start of isolation. The valves close sequentially as the stored heat is dissipated, but continue to discharge the decay heat intermittently. Peak pressure at the vessel bottom reaches 1220 psig, clearly below the pressure limits of the RCPB. Peak pressure in the main steam line is 1185 psig.
15.2.4.4.2 Closure of One Main Steam Isolation Valve No significant effect is imposed on the RCPB, since if closure of the valve occurs at an unacceptably high operating power level, a flux or pressure scram will result. The main turbine bypass system will continue to regulate system pressure through the other three "live" steam lines.
15.2.4.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with CHAPTER 15 15.2-14 REV. 20, SEPTEMBER 2020
LGS UFSAR established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.2.5 LOSS OF CONDENSER VACUUM 15.2.5.1 Identification of Causes and Frequency Classification 15.2.5.1.1 Identification of Causes Various system malfunctions that can cause a loss of condenser vacuum are designated in Table 15.2-6.
15.2.5.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.
15.2.5.2 Sequence of Events and System Operation 15.2.5.2.1 Sequence of Events This event was not reanalyzed for power rerate. The sequence of events in Table 15.2-7 is based on Cycle 1 conditions.
Table 15.2-7 lists the sequence of events for Figure 15.2-6.
The operator should:
- a. Verify automatic transfer of buses supplied by generator to incoming power. If automatic transfer has not occurred, manual transfer must be made.
- b. Monitor and maintain reactor water level at required level.
- c. Check turbine for proper operation of all auxiliaries during coast-down.
- d. Depending upon conditions, initiate normal operating procedures for cooldown, or maintain pressure for restart purposes.
- e. Put the mode switch in the STARTUP position before the reactor pressure decays to the turbine inlet low pressure setpoint.
- f. Secure RCIC operation if automatic initiation occurred due to low water level.
- h. Cool down the reactor following standard procedures if a restart is not intended.
15.2.5.2.2 System Operation In establishing the expected sequence of events and simulating the plant performance, it was assumed that normal functioning occurred in the plant instrumentation and controls, and plant protection and reactor protection systems.
CHAPTER 15 15.2-15 REV. 20, SEPTEMBER 2020
LGS UFSAR Tripping functions associated with a loss of main turbine condenser vacuum are listed in Table 15.2-8.
15.2.5.2.3 The Effect of Single Failures and Operator Errors This transient does not lead to a general increase in reactor power level due to the protection system initiating a scram.
Failure of the integrity of the offgas treatment system is considered to be an accident situation and is described in Section 15.7.1.
Single failures will not affect the vacuum monitoring and turbine trip devices which are redundant.
The protective sequences of the anticipated operational transient are shown to be single failure proof (Section 15.9).
15.2.5.3 Core and System Performance 15.2.5.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate this transient event.
15.2.5.3.2 Input Parameters and Initial Conditions This analysis was performed with plant conditions tabulated in Table 15.0-2 unless otherwise noted.
Turbine stop valves full stroke closure time is 0.1 second.
A reactor scram is initiated by position switches on the stop valves when the valves are not fully open. This stop valve closure trip signal is automatically bypassed when the reactor is below 30%
NBR power level.
The analysis presented here is a hypothetical case with a conservative 2 in. Hg/sec vacuum decay rate. The bypass system was assumed to be available for several seconds by simulating bypass valve closure at a vacuum level of 10 inches Hg less than the stop valve closure vacuum level.
15.2.5.3.3 Results This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Under this hypothetical 2 in. Hg/sec vacuum decay condition, the turbine bypass valve and MSIV closure would follow main turbine and feedwater turbine trips about 5 seconds after being initiated by the transient. This transient, therefore, is similar to a normal turbine trip with bypass. The effect of MSIV closure tends to be minimal, since the closure of main turbine stop valves, and subsequently the bypass valves, has already shut off the main steam line flow. Figure 15.2-6 shows the transient expected for this event. It is assumed that the plant is initially operating at 105% NBR steam flow conditions. Peak neutron flux reaches 160.9% of NBR power, while CHAPTER 15 15.2-16 REV. 20, SEPTEMBER 2020
LGS UFSAR average fuel surface heat flux reaches 101.9% of rated value. MSRVs open to limit the pressure rise, then sequentially reclose as the stored energy is dissipated.
15.2.5.3.4 Consideration of Uncertainties The reduction, or loss, of vacuum in the main condenser sequentially trip the main and feedwater turbines, and close the MSIVs and bypass valves. While these are the major events occurring, other resultant actions will include scram (from stop valve closure) and bypass opening with the main turbine trip. Because the protective actions are actuated at various levels of condenser vacuum, the severity of the resulting transient is directly dependent upon the rate at which the vacuum is lost. Normal loss of vacuum, due to loss of cooling water pumps or steam jet air ejector problems, produces a very slow rate of loss that is timed in minutes, not seconds (Table 15.2-6). If corrective actions by the reactor operators are not successful, then sequential trips of the main and feedwater turbines and, ultimately, complete isolation by closing the MSIVs and the bypass valves (opened with the main turbine trip), will occur.
A faster rate of loss of the condenser vacuum would shorten the time for the scram and reduce the overall effectiveness of the bypass valves since they would be closed more quickly.
Other uncertainties in these analyses involve protection system settings, system capacities, and system response characteristics.
In all cases, the most conservative values are used in the analyses. For example:
- a. Slowest allowable control rod scram motion is assumed.
- b. Scram worth shape for all rod-out conditions is assumed.
- c. Minimum specified MSRV capacities are utilized for overpressure protection.
- d. Setpoints of the MSRVs are assumed to be at the upper limit of Technical Specifications for all valves.
15.2.5.4 Barrier Performance Peak nuclear system pressure is 1194 psig at the vessel bottom. The overpressure transient is below the RCPB transient pressure limit of 1375 psig. Vessel dome pressure does not exceed 1172 psig. A comparison of these values to those for turbine trip with bypass failure at high power shows the similarities between these two transients. The prime differences are the loss of feedwater and main steam line isolation, and the resulting low water level trips.
15.2.5.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
CHAPTER 15 15.2-17 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.6 LOSS OF AC POWER 15.2.6.1 Identification of Causes and Frequency Classification 15.2.6.1.1 Identification of Causes 15.2.6.1.1.1 Loss of Auxiliary Power Transformers The loss of all plant auxiliary buses due to transformer failure would require the simultaneous loss of three separate auxiliary transformers: the 1 Unit Auxiliary, the 10 Station Auxiliary, and the 20 Regulating transformers. The simultaneous loss of all three transformers is not considered credible without a common mode failure initiating event. Under this scenario, the plant sees a loss of all grid connections which is analyzed in the following sections.
15.2.6.1.1.2 Loss of All Grid Connections Loss of all grid connections can result from major shifts in electrical loads, seismic events, loss of loads, lightning, storms, wind, etc., that contribute to electrical grid instabilities. These instabilities cause equipment damage if unchecked. Protective relay schemes automatically disconnect electrical sources and loads to mitigate damage and regain electrical grid stability.
15.2.6.1.2 Frequency Classification 15.2.6.1.2.1 Loss of All Grid Connections This transient disturbance is categorized as an incident of moderate frequency.
15.2.6.2 Sequence of Events and System Operation 15.2.6.2.1 Sequence of Events 15.2.6.2.1.1 Loss of All Grid Connections This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this events for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Table 15.2-10 lists the sequence of events for Figure 15.2-8.
15.2.6.2.1.2 Identification of Operator Actions The operator should maintain the reactor water level by use of the RCIC or HPCI system, control reactor pressure by use of the relief valves, and verify that the turbine dc oil pump is operating satisfactorily to prevent turbine bearing damage. The operator should also verify proper switching and loading of the emergency diesel generators.
The following is the sequence of operator actions expected during the course of the events when no immediate restart is assumed. The operator should:
- a. Following the scram, verify all rods-in.
CHAPTER 15 15.2-18 REV. 20, SEPTEMBER 2020
- b. Check that diesel generators start and carry the vital loads.
- c. Check that both RCIC and HPCI start when reactor vessel level drops to the initiation point after the relief valve opens.
- d. Break vacuum before the loss of sealing steam occurs.
- e. Check turbine-generator auxiliaries during coast-down.
- f. When both the reactor pressure and level are under control, secure both HPCI and RCIC as necessary.
- g. Continue cooldown following normal procedures.
15.2.6.2.2 System Operation 15.2.6.2.2.1 Loss of All Grid Connections This transient analysis, unless otherwise stated, assumes and takes credit for normal functioning of plant instrumentation and controls, and plant protection and reactor protection systems.
The loss of all grid connections causes the loss of all auxiliary power. This transient consists of a generator load rejection and recirculation pump trip at time t=0. The load rejection immediately closes the turbine control valves and causes a scram.
15.2.6.2.3 The Effect of Single Failures and Operator Errors Loss of all connections to the grid leads to a turbine trip due to load rejection and an immediate scram due to turbine control valve fast closure. Additional failures of other systems designed to protect the reactor would not result in effects different from those reported. Failures of the protective systems have been considered and satisfy single failure criteria, so no change in analyzed consequences is expected. See Section 15.9 for details on single failure analysis.
15.2.6.3 Core and System Performance 15.2.6.3.1 Mathematical Model The computer model described in Section 15.1.1.3.1 was used to simulate this transient.
Operation of the RCIC or HPCI systems is not included in the simulation of this transient, since startup of these pumps does not permit flow in the time period of this simulation.
15.2.6.3.2 Input Parameters and Initial Conditions 15.2.6.3.2.1 Loss of All Grid Connections These analyses have been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2, and under the assumed systems constraints described in Section 15.2.6.2.2.
15.2.6.3.3 Results CHAPTER 15 15.2-19 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.6.3.3.1 Loss of All Grid Connections This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Loss of all grid connections causes simultaneous generator load rejection and loss of all auxiliary power. It essentially takes on the characteristic response of the standard full load rejection discussed in Section 15.2.2. Figure 15.2-8 graphically shows the simulated transient. Peak neutron flux reaches 178.5% of NBR power while fuel surface heat flux peaks at 101.3% of initial value.
15.2.6.3.4 Consideration of Uncertainties The most conservative characteristics of protection features are assumed. Any actual deviations in plant performance are expected to make the results of this transient less severe.
Operation of the RCIC or HPCI systems is not included in the simulation of the first 50 seconds of this transient. Startup of these pumps occurs in the latter part of this time period, but the systems have no significant effect on the results of this transient.
Following turbine control valve closure, the reactor pressure is expected to increase until the MSRV setpoints are reached. During this time the valves operate in a cyclic manner to discharge the decay heat to the suppression pool.
15.2.6.4 Barrier Performance 15.2.6.4.1 Loss of All Grid Connections MSRVs open in the pressure relief mode of operation as the pressure increases beyond their setpoints. The vessel bottom peak pressure is well below the vessel pressure limit of 1375 psig.
15.2.6.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.2.7 LOSS OF FEEDWATER FLOW The Loss of Feedwater Flow (LOFW) event represents the design basis for the performance of the reactor core isolation cooling (RCIC) system. The following criteria are applied to this event:
- 1) The RCIC system shall maintain sufficient water level inside the core shroud to assure that the top of active fuel remains covered throughout the event.
CHAPTER 15 15.2-20 REV. 20, SEPTEMBER 2020
- 2) The RCIC system shall maintain wide range sensed reactor water level high enough that the very low level instrument trip setpoint (Level 1) for low pressure emergency core cooling system initiation and MSIV closure is not activated.
This transient event does not pose any direct challenge to the reactor vessel or core in terms of a power or pressure increase. All unacceptable safety results are avoided. However, it is included in the evaluation to provide assurance that sufficient makeup water capability is available to keep the core covered when all normal feedwater flow is lost.
15.2.7.1 Identification of Causes and Frequency Classification 15.2.7.1.1 Identification of Causes A loss of feedwater flow could occur due to pump failures, feedwater controller failures, operator errors, or reactor system variables such as a high vessel water level (Level 8) trip signal.
15.2.7.1.2 Frequency Classification This transient disturbance is categorized as an incident of moderate frequency.
15.2.7.2 Sequence of Events and System Operation 15.2.7.2.1 Sequence of Events Table 15.2-11 lists the sequence of events for Figures 15.2-9A and 15.2-9B.
The operator should verify RCIC and HPCI actuation, so that water inventory is maintained in the reactor vessel. The operator should also monitor reactor water level, pressure control, and turbine-generator auxiliaries during shutdown.
The following is the sequence of operator actions expected during the course of the event when no immediate restart is assumed. The operator should:
- a. Verify that all rods are in, following the scram.
- c. Verify that the recirculation pumps trip on reactor low level.
- d. Secure HPCI when reactor level and pressure are under control.
- e. Continue operation of the RCIC until decay heat diminishes to a point where the RHR system can be put into service.
- f. Monitor the turbine coast-down, breaking vacuum as necessary.
15.2.7.2.2 System Operation Loss of feedwater flow results in a proportional reduction of vessel inventory, causing the vessel water level to drop. The first corrective action is the low level (Level 3) trip actuation. RPS CHAPTER 15 15.2-21 REV. 20, SEPTEMBER 2020
LGS UFSAR responds within 1.05 seconds after reaching this trip level to scram the reactor. The 1.05 second total response time is equal to the level sensor response time (1.0 seconds) plus the RPS logic delay time (0.05 seconds). The low level (Level 3) trip function meets the single failure criterion.
Pressure control is maintained by the turbine bypass system, since the MSIVs remain open.
Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values in Table 15.2-11 following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.
15.2.7.2.3 The Effect of Single Failures and Operator Errors The nature of this transient, as explained above, results in a lowering of vessel water level. Key corrective actions to shut down the reactor are automatic, and designed to satisfy the single failure criterion.
15.2.7.3 Core and System Performance 15.2.7.3.1 Mathematical Model The computer model described in Reference 6.3.7 was used to simulate this transient.
15.2.7.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions as described in Section 6.3.3.
15.2.7.3.3 Results Feedwater flow termination results in a decrease in subcooling, causing a reduction in core power level and pressure. As power level is lowered, the turbine steam flow starts to drop off because the pressure regulator is attempting to maintain pressure. Water level continues to drop until the vessel level (Level 3) scram trip setpoint is reached, whereupon the reactor is shut down. The trip of the recirc pumps occurs at approximately 13 seconds (after reactor scram) due to vessel water dropping to the Level 2 trip setpoint. Also at this time RCIC operation is initiated. For this analysis the HPCI system is assumed to be unavailable. MCPR remains considerably above the safety limit since increases in heat flux are not experienced.
The timing values in Table 15.2-11 following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.
Water level in the annulus slowly decreases until the boil off from decay heat is matched by the RCIC makeup flow. The LOFW analysis (Reference 15.2.2) assumed 3622 MWt for an initial core thermal power. For these conditions the minimum water level in the annulus region is predicted to reach a minimum of 6.5 feet above the level 1 setpoint, occurring at approximately 800 seconds after the start of the event. Since natural recirculation flow continues through the core, the water level inside the shroud is maintained within the separator elevation.
CHAPTER 15 15.2-22 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.7.3.4 Consideration of Uncertainties EOC scram characteristics are assumed.
This transient is most severe from high power conditions, because the rate of level decrease is greatest, and the amounts of stored and decay heat to be dissipated are highest. As noted the LOFW analysis was conservatively performed at a power level of 3622 MWt. Furthermore, the HPCI systems was assumed to be unavailable. The RCIC system is assumed to inject at rated flow 55 seconds after the level 2 initiation signal.
An additional steam flow induced process measurement error in the Level 3 scram was accounted for in the Loss of Normal Feedwater event. A lowering in the Level 3 Analytical Limit (AL) setpoint was calculated in Reference 15.2-4. It was determined that adequate margin exists to Top of Active Fuel (TAF) uncovery while considering a bounding process measurement error applicable for this event. The consequences of lowering the AL is a bounding reduction in minimum water level in the upper plenum of 12 inches and a bounding reduction in minimum water level of 12 inches in the vessel downcomer region as discussed in Reference 15.2-4. The analysis also shows significant margin to the TAF. The results of the analysis are applicable for power levels up to extended (20%) Power Uprate (3952 MWt). The impact of the change is not significant, and no event descriptions or conclusions in the UFSAR need to be modified.
15.2.7.4 Barrier Performance The consequences of this transient do not result in a temperature or pressure transient. Therefore, the RCPB is not threatened.
15.2.7.5 Radiological Consequences Since this transient does not result in fuel failures or release of reactor coolant, there are no radiological consequences associated with the transient.
15.2.8 FEEDWATER LINE BREAK Refer to Section 15.6.6 15.2.9 FAILURE OF RHR SHUTDOWN COOLING Normally, in evaluating component failure considerations associated with the RHR shutdown cooling mode of operation, active pumps or instrumentation (all of which are redundant for safety system portions) would be assumed to be the likely failed equipment. For purposes of analysis, the single recirculation loop suction valve to the redundant RHR loops is assumed to fail. This failure would, of course, still leave four complete RHR loops for LPCI, or two RHR loops for LPCI and two loops for pool, and containment cooling minus the normal RHR shutdown cooling loop connection. Although the valve could be manually opened, it is assumed to be failed indefinitely. If it is now assumed that the single active failure criterion is applied, the plant operator has at least one complete RHR loop with a heat exchanger available.
Recent analytical evaluations of this transient have required additional worst case assumptions.
These include:
- a. Loss of all offsite ac power.
CHAPTER 15 15.2-23 REV. 20, SEPTEMBER 2020
- b. Utilization of safety shutdown equipment only.
- c. Operator involvement only after 10 minutes after coincident assumptions.
Incorporation of these assumptions changes the initial incident (malfunction of RHR suction valve) from a moderate frequency incident to a classification in the design basis accident status.
However, the transient is evaluated as a moderate frequency event with its subsequent limits.
During cold shutdown or refueling operation conditions, four subsystems of shutdown cooling exist, comprised of the A heat exchanger and A RHR pump, A heat exchanger and C RHR pump, B heat exchanger and B RHR pump, and B heat exchanger and D RHR pump. If two subsystems of shutdown cooling are required to be operable per Technical Specifications and both subsystems are associated with the same heat exchanger, a failure of the shutdown cooling discharge valve or discharge check valve associated with that heat exchanger may require use of the alternate vessel return flowpath, if manual repair of the valve can not be effected. This single failure is considered to be bounded by the single failure of the recirculation loop suction valve to the redundant RHR loops described above in that mitigating actions required to be taken in the event of a suction valve failure (ADS/relief valve with alternate shutdown cooling flowpath) exceed the required actions for a discharge valve failure. Further, a loss of electical power to the shutdown cooling discharge valve following the initial establishment of shutdown cooling would not require a change in cooling flowpath as the motor-operated valve fails in-place, and would be positioned for normal shutdown cooling return.
15.2.9.1 Identification of Causes and Frequency Classification 15.2.9.1.1 Identification of Causes The plant is operating at 3528 MWt when a long-term LOOP occurs, causing multiple MSRV actuation (Section 15.2.6) and subsequent heatup of the suppression pool. Reactor vessel depressurization is initiated to bring the reactor pressure to approximately 75 psig. Concurrent with the LOOP, an additional single failure occurs which prevents the operator from establishing the normal shutdown cooling path through the RHR shutdown cooling lines. The operator then establishes a shutdown cooling path for the vessel through the ADS valves.
15.2.9.1.2 Frequency Classification This transient is evaluated as a moderate frequency event. However, for the following reasons it could be considered an infrequent incident:
- a. No RHR valves have failed in the shutdown cooling mode in BWR total operating experience.
- b. The set of conditions evaluated is for multiple failure as described above and is only postulated (not expected) to occur.
15.2.9.2 Sequence of Events and System Operation 15.2.9.2.1 Sequence of Events CHAPTER 15 15.2-24 REV. 20, SEPTEMBER 2020
LGS UFSAR The sequence of events for this transient is shown in Table 15.2-12. Figures 15.2-10 and 15.2-11 show shutdown cooling paths.
For the early part of the transient, the operator actions are identical to those described in Section 15.2.6 (LOOP transient with isolation/scram).
The operator should do the following:
- a. Within approximately 10 minutes of the isolation/scram, the operator should initiate RPV shutdown depressurization at 100F/hr by manual actuation of the MSRVs.
- b. At approximately 15 minutes into the transient, the operator should initiate suppression pool cooling (again for purposes of this analysis, it is assumed that only one RHR heat exchanger is available).
- c. After the RPV is depressurized to approximately 75 psig, the operator should attempt to open the two RHR shutdown cooling suction valves. This attempt is assumed to be unsuccessful.
- d. The operator then powers open the ADS relief valves to complete blowdown, and floods the RPV with LPCI or core spray to establish a closed cooling path as described in Figure 15.2-11.
15.2.9.2.2 System Operation Plant instrumentation and control is assumed to be functioning normally except as noted. In this evaluation, credit is taken for the plant and reactor protection systems and/or the ESF is used.
15.2.9.2.3 The Effect of Single Failures and Operator Errors The worst case single failure has already been analyzed in this transient. Therefore, no single failure or operator error can make the consequences of this event any worse. See Section 15.9 for a discussion of this subject.
15.2.9.3 Core and System Performance 15.2.9.3.1 Methods, Assumptions, and Conditions A transient that can directly cause reactor vessel water temperature increase is one in which the energy removal rate is less than the decay heat rate. The applicable transient is loss of RHR shutdown cooling. This transient can occur only during the low pressure portion of a normal reactor shutdown and cooldown, when the RHR system is operating in the shutdown cooling mode. During this time, MCPR remains high and nucleate boiling heat transfer is not exceeded at any time. Therefore, the core thermal safety margin remains essentially unchanged. The 10 minute time period assumed for operator action is an estimate of how long it would take before the operator would initiate the necessary actions; it is not a time by which he must initiate action.
CHAPTER 15 15.2-25 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.9.3.2 Mathematical Model In evaluating this transient, the important parameters to consider are reactor depressurization rate and suppression pool temperature. Models used for this evaluation are described in Section 6.2.1.8.
15.2.9.3.3 Input Parameters and Initial Conditions Table 15.2-13 shows the input parameters and initial conditions used in evaluation of this transient.
15.2.9.3.4 Results For most single failures that could result in loss of shutdown cooling, no unique safety actions are required. In these cases, shutdown cooling is simply re-established using an alternate shutdown cooling flow path. In cases where either of the RHR shutdown cooling suction valves cannot be opened, alternate paths are available to accomplish the shutdown cooling function (Figure 15.2-10). An evaluation has been performed assuming the worst single failure that could disable the RHR shutdown cooling valves.
As a result of SIL 636, the failure of RHR cooling transient was re-evaluated to determine the impact of the increased decay heat and was performed at a reactor power of 3528 MWt and a revised K-factor for the RHR heat exchangers. This qualitative evaluation concludes that there no significant changes in the suppression pool temperature profile or shutdown cooling time, more information on the SIL 636 evaluation is provided in Section 6.2.1.8.
The analysis demonstrates the capability to safely transfer fission product decay heat, and other residual heat, from the reactor core so that specified acceptable fuel design limits and the design conditions of the RCPB are not exceeded. The evaluation assures that, for onsite electric power system operation (assuming offsite power is not available), and for offsite electric power system operation (assuming onsite power is not available), the safety function can be accomplished, assuming a worst case single failure.
The alternate cooldown path, chosen to accomplish the shutdown cooling function, utilizes the RHR pumps and heat exchangers, core spray pumps and ADS or normal relief valve systems (Reference 15.2-1 and Figure 15.2-11).
The alternate shutdown systems are capable of performing the function of transferring heat from the reactor to the environment using only safety-grade equipment. Even if it is additionally postulated that all of the ADS or relief valves discharge piping also fails, the shutdown cooling function would eventually be accomplished as the cooling water would run directly out of the ADS or MSRVs, flooding into the drywell and then to the suppression pool.
The systems have suitable redundancy in components so that, for onsite electrical power operation (assuming offsite power is not available), and for offsite electrical power operation (assuming onsite power is also not available), the systems' safety function can be accomplished, even assuming an additional single failure. The systems can be fully operated from the main control room.
The design evaluation is divided into two phases:
- a. Full power operation to approximately 75 psig vessel pressure.
CHAPTER 15 15.2-26 REV. 20, SEPTEMBER 2020
- b. Approximately 75 psig vessel pressure to cold shutdown (200F) conditions.
15.2.9.3.4.1 Full Power to Approximately 75 psig Independent of the transient that initiated plant shutdown (whether it be a normal plant shutdown or a forced plant shutdown), the reactor is normally brought to approximately 75 psig using either the main condenser or, in the case where the main condenser is unavailable, the RCIC/HPCI systems, together with the nuclear boiler pressure relief system.
For evaluation purposes, however, it is assumed that plant shutdown is initiated by a transient event (LOOP) that results in reactor isolation/scram and subsequent relief valve actuation and suppression pool heatup. For this postulated condition, the reactor is shut down and the reactor vessel pressure and temperature are reduced to, and maintained at, saturated conditions at approximately 75 psig. The RPV is depressurized by manually opening selected MSRVs. Reactor vessel makeup water is automatically provided via the RCIC/HPCI systems. While in this condition, the RHR system (suppression pool cooling mode) is used to maintain the suppression pool temperature within design limits.
These systems are designed to routinely perform their functions for both normal and forced plant shutdown. Since the RCIC, HPCI, and RHR systems are divisionally separated, no single failure, together with the LOOP, can prevent reaching the 75 psig level.
For conservatism in the analysis of this event, it was assumed that the reactor vessel makeup water was provided by the feedwater system instead of the HPCI/RCIC system. While feedwater system is not a safety system, this assumption maximizes the energy addition to the vessel and containment due to the residual heat in the feedwater system. This results in a conservative calculation of the vessel depressurization and cooldown and conservative suppression pool temperature results.
15.2.9.3.4.2 Approximately 75 psig to Cold Shutdown The following assumptions are used for the analyses of the procedures for attaining cold shutdown from a pressure of approximately 75 psig:
- a. The vessel is at 75 psig and saturated conditions.
- b. A worst case single failure is assumed to have occurred (i.e., loss of a division of emergency power).
- c. There is no offsite power available.
In the event that the RHR shutdown suction line is not available because of single failure, the first action to be taken will be for personnel to gain access to the suction line and to attempt to effect repairs. For example, if a single electrical failure caused a suction valve to fail in the closed position, a hand wheel is provided on the valve to allow manual operation. If for some reason the normal shutdown cooling suction line cannot be repaired, the capabilities described below will satisfy the normal shutdown cooling requirements and comply with GDC 34.
The RHR shutdown cooling line valves are in two divisions (Division 1 = the outboard valve, and Division 2 = the inboard valve) to satisfy containment isolation criteria. For evaluation purposes, the worst case failure is assumed to be the loss of a division of emergency power, since this also CHAPTER 15 15.2-27 REV. 20, SEPTEMBER 2020
LGS UFSAR prevents actuation of one shutdown cooling line valve. ESF equipment available for accomplishing the shutdown cooling function includes (for the selected path) the following:
- a. ADS (dc Division 1 and dc Division 3)
- b. RHR Loop A (Division 1)
- c. RHR Loop B (Division 2)
- d. HPCI (dc Division 2 and 4)
- e. RCIC (dc Division 1 and 3)
- f. Core Spray A (Division 1 and 3)
- g. Core Spray B (Division 2 and 4).
For failures of Division 1 or 2, the following systems are assumed to be functional:
- a. Division 1 fails, Divisions 2, 3, and 4 are functional:
Failed Systems Functional Systems RHR Pump A HPCI CS Loop A ADS (one solenoid)
RCIC RHR Loop B CS Loop B RHR Pumps B, C, and D
- b. Division 2 fails, Divisions 1,3, and 4 are functional:
Failed Systems Functional Systems RHR Pump B CS Loop A CS Loop B RCIC HPCI RHR Loop A ADS RHR Pumps A, C, and D Assuming the single failure is the failure of Division 1, the safety function is accomplished by establishing one of the cooling loops described in Activity C1 of Figure 15.2-11. If the assumed single failure is Division 2, the safety function is accomplished by establishing one of the cooling loops described as Activity C2 of Figure 15.2-11.
Using the above assumptions, and following the depressurization transient shown in Figure 15.2-12A and 15.2-12B, the suppression pool temperature is shown in Figure 15.2-13.
The failure of RHR shutdown cooling event was evaluated for power rerate at an initial power level of 3694 MWt, ANS 5.1-1979 nominal decay heat values, and RHR heat exchanger K-value of 288.9 BTU/sec-F.
CHAPTER 15 15.2-28 REV. 20, SEPTEMBER 2020
LGS UFSAR A qualitative evaluation was performed for this event considering the increased decay heat loads of SIL 636. Using an initial power level of 3528 MWt and an RHR heat exchanger K-value of 305 BTU/sec-F, the increase in decay values of SIL 636 with 2 sigma uncertainty is not expected to increase the shutdown cooling time beyond the 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br /> calculated for power rerate at 3694 MWt.
(Ref. 15.2-3) 15.2.9.4 Barrier Performance As noted above, the consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel, or containment are designed.
Release of coolant to the containment occurs via MSRV actuation. Release of radiation to the environment is described below.
15.2.9.5 Radiological Consequences While this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.2.10 LOSS OF STATOR COOLING 15.2.10.1 Identification of Causes and Frequency Classification 15.2.10.1.1 Identification of Causes A Loss of Stator Cooling (LOSC) event begins after a sustained Stator Coolant Trouble signal resulting from low coolant flow, low system discharge pressure, or high system return temperature.
15.2.10.1.2 Frequency Classification A LOSC is a moderate frequency event and classified as an AOO.
15.2.10.2 Sequence of Events and System Operation 15.2.10.2.1 Sequence of Events Table 15.2-15 lists the sequence of events for a LOSC event initiated at rated power. The sequence of events presented in Table 15.2-15 is for the analysis conditions. In the most recent analysis both recirculation pumps run back in tandem after a 10 second delay; however, in actuality the recirculation pump runbacks are separated by several seconds as discussed in the Table 15.2-15 footnotes.
CHAPTER 15 15.2-29 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.10.2.2 System Operation Once the LOSC signal is confirmed, both recirculation pumps will runback to 42% speed.
Additionally a runback of the turbine-generator will initiate. The turbine-generator runback will cause the turbine control valves to close slowly. The turbine bypass valves will open in response to the closure of the turbine control valves. Once the available bypass capacity is exceeded, the system will begin to pressurize. The event is terminated when the reactor scrams on high pressure or high neutron flux. The analysis also considers the TBSOOS condition.
15.2.10.2.3 The Effect of Single Failures and Operator Errors The single failure for the LOSC is the failure which initiates the event. No consideration for additional failures is required.
15.2.10.3 Core and System Performance 15.2.10.3.1 Mathematical Model The computer models described in Section 15.1.2.3.1 are used to simulate this transient.
15.2.10.3.2 Input Parameters and Initial Conditions The LOSC is assumed to occur at time zero, as shown in Table 15.2-15. At the same time, both recirculation pumps runback to 42% speed and the turbine-generator runback begins. The turbine-generator runback is assumed to reduce the load set from 105% to 20% over a period of 140 seconds which bounds actual plant response. The first LOSC analysis was done for Unit 1 Cycle 16 and is based on the rated power of 3,515 MWt (Reference 15.2-5).
15.2.10.3.3 Results The LOSC event has the potential to be a limiting AOO and is therefore confirmed to be bounded by other transients as part of each reload's safety analysis.
15.2.10.3.4 Consideration of Uncertainties All systems utilized for protection in this transient were assumed to have the most conservative allowable response (e.g., pressure scram setpoint). Normal plant behavior is, therefore, expected to reduce the actual severity of the transient.
In actuality, the LOSC signal must be present for several seconds before any plant response is initiated. Additionally, the recirculation pump runbacks do not occur simultaneously but are separated by several seconds. This difference does not impact the results of the analysis because core flow reaches the reduced steady state flow well before the pressurization part of the event occurs. Finally, the actual turbine-generator runback times are greater than the assumed value. A shorter runback time results in a greater pressurization rate, increasing the severity of the event.
CHAPTER 15 15.2-30 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.2.10.4 Barrier Performance The consequences of this transient do not result in any temperature or pressure transient in excess of the criteria for which the fuel, pressure vessel or containment are designed.
Therefore, these barriers maintain their integrity and function as designed.
15.2.10.5 Radiological Consequences Because this transient does not result in any fuel failures, or any release of primary coolant to either the secondary containment or to the environment, there are no radiological consequences associated with this transient.
15.2.11 REFERENCES 15.2-1 Letter R.S. Boyd to I.F. Stuart, "Requirements Delineated for RHRS - Shutdown Cooling System - Single Failure Analysis" (November 12, 1975).
15.2-2 "Emergency Core Cooling System Parameter Relaxations for Limerick Generating Station Units 1 & 2, GE-NE-L12-00822, February 1995.
15.2-3 "Limerick Generating Station 1 & 2 SIL 636 Evaluation," GE, GE-NE-0000-0003-3779, June 2003 15.2-4 GE-Hitachi Nuclear Energy, 0000-0077-4603-R1, "BWR Owners Group Evaluation of Steam Flow Induced Error (SFIE) Impact on the L3 Setpoint Analytic Limit,"
October 2008.
15.2-5 GE Hitachi Nuclear Energy document number 000N3759-R0, "Limerick Units 1 and 2 LOSC with Recirculation Runback Off-rated Limits," February 2014.
CHAPTER 15 15.2-31 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 15.2-1 SEQUENCE OF EVENTS FOR TURBINE-GENERATOR LOAD REJECTION WITH BYPASS(1)
TIME (sec) EVENT
-0.015 (approx.) Turbine-generator detection of loss of electrical load 0.0 Turbine-generator power load unbalance devices trip to initiate turbine control valve fast closure.
0.0 Turbine-generator power load unbalance trip initiates main turbine bypass system operation.
0.0 Fast turbine control valve closure initiates scram trip.
0.0 Turbine control valve closure initiates an RPT.
0.07 Turbine control valve closed.
0.14 Turbine bypass valves start to open.
0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flows to coast down.
2.0 Group 1 MSRVs actuated.
2.15 Group 2 MSRVs actuated.
2.40 Group 3 MSRVs actuated.
3.90 Group 1 MSRVs close.
(1)
See Figure 15.2-1.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-32 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-2 SEQUENCE OF EVENTS FOR TURBINE-GENERATOR LOAD REJECTION WITHOUT BYPASS(1)
TIME (sec) EVENT
-0.015 (approx.) Turbine-generator detection of loss of electrical load.
0.0 Turbine-generator power load unbalance devices trip to initiate turbine control valve fast closure.
0.0 Turbine bypass valves fail to operate.
0.0 Fast control valve closure initiates scram trip.
0.0 Turbine control valve closure initiates a recirculation pump trip (RPT).
0.08 (approx.) Turbine control valve closed.
0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flow to begin to coast down.
1.9 MSRV actuation initiated.
>6 MSRV closed.
(1)
See Figure 15.2-2.
CHAPTER 15 15.2-33 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-3 SEQUENCE OF EVENTS FOR TURBINE TRIP WITH BYPASS(1)
TIME (sec) EVENT 0.0 Turbine trip initiates closure of main stop valves.
0.0 Turbine trip initiates bypass operation.
0.01 Main turbine stop valves reach 90% open position and initiates reactor scram trip.
0.01 Main turbine stop valves reach 90% open position and initiates an RPT.
0.1 Turbine stop valves closed.
0.17 Turbine bypass valves start to open to regulate pressure.
2.5 Group 1 MSRVs actuated.
2.7 Group 2 MSRVs actuated.
2.9 Group 3 MSRVs actuated.
8.3 All MSRVs closed.
(1)
See Figure 15.2-3.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-34 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-4 SEQUENCE OF EVENTS FOR TURBINE TRIP WITHOUT BYPASS(1)
TIME (sec) EVENT 0.0 Turbine trip initiates closure of main stop valves.
0.0 Turbine bypass valves fail to operate.
0.01 Main turbine stop valves reach 90% open position and initiate reactor scram trip.
0.01 Main turbine stop valves reach 90% open position and initiate an RPT.
0.1 Turbine stop valves closed.
0.175 Recirculation pump motor circuit breakers open causing the recirculation drive flows to coast down.
1.8 MSRV actuation initiated.
>6 MSRVs closed.
(1)
See Figure 15.2-4.
CHAPTER 15 15.2-35 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-5 SEQUENCE OF EVENTS FOR MSIV CLOSURE(2)
TIME (sec) EVENT 0.0 Initiate closure of all MSIV 0.3 MSIV position trip scram initiated(1) 2.9 Recirculation pump drive motors are tripped 3.1 MSRVs open 3 groups due to pressure relief setpoint action 14.6 All MSRVs closed 26.0 Initiate HPCI and RCIC systems on low-low water level (Level 2)
(1)
The event was simulated with an MSIV position trip at the 90% open position. Using an analytical value of 85% has no significant impact on the CPR and peak system pressure results.
(2)
See Figure 15.2-5.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-36 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-6 TYPICAL RATES OF DECAY FOR CONDENSER VACUUM CAUSE ESTIMATED VACUUM DECAY RATE
- a. Failure or isolation of steam jet air ejectors <1 inch Hg/minute
- b. Loss of sealing steam to shaft gland seals 1 to 2 inches Hg/minute (approx)
- c. Opening of vacuum breaker valves 2 to 12 inches Hg/minute (approx)
- d. Loss of one or more circulating water pumps 4 to 24 inches Hg/minute (approx)
CHAPTER 15 15.2-37 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-7 SEQUENCE OF EVENTS FOR LOSS OF CONDENSER VACUUM(1)
TIME (sec) EVENT
-3.0 Initiate simulated loss of condenser vacuum at 2 inches of Hg per second.
0.0 (est) Low condenser vacuum main turbine trip actuated.
0.0 (est) Low condenser vacuum feedwater trip actuated.
0.01 Main turbine trip initiates reactor scram.
0.01 Main turbine trip initiates RPT.
0.1 Turbine stop valves closed.
0.1 Bypass valves begin to open.
2.5 Group 1 MSRV setpoints actuated.
2.7 Group 2 MSRV setpoints actuated.
2.9 Group 3 MSRV setpoints actuated.
5.0 Low condenser vacuum initiates MSIV closure.
5.0 Low condenser vacuum initiates bypass valve closure.
13.3 All MSRVs close.
16.9 MSRV cyclic actuation on pressure demand.
50.6 HPCI/RCIC system initiation on low level (Level 2) (not included in simulation)
(1)
See Figure 15.2-6.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-38 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-8 TRIP SIGNALS ASSOCIATED WITH LOSS OF CONDENSER VACUUM Condenser Vacuum (Inches of Hg)
Transient Analysis (Table 15.2-7)
- a. Normal Operating -
Range
- b. Main Turbine Trip 20
- c. Feedwater Trip 20
- d. MSIV Closure 10 Initiated
- e. Bypass Valve Closure 10 Initiated (1)
In the plant, the spread between the turbine trip (b) and bypass valve closure (e) conservatively exceeds the analyzed condition. The transient analysis CPR and peak system pressure results remain bounding.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-39 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-9 SEQUENCE OF EVENTS FOR LOSS OF AUXILIARY POWER TRANSFORMER(1)
REFER TO TABLE 15.2-10 (1)
See Figure 15.2-7.
CHAPTER 15 15.2-40 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-10 SEQUENCE OF EVENTS FOR LOSS OF ALL GRID CONNECTIONS(1)
TIME (sec) EVENT
-0.015 (approx.) Loss of grid causes turbine-generator to detect a loss of electrical load.
0.0 Turbine control valve fast closure is initiated.
0.0 Turbine-generator power load unbalance trip initiates main turbine bypass system operation.
0.0 Recirculation system pump motors are tripped.
0.0 Turbine control valve fast closure initiates a reactor scram trip.
0.07 Turbine control valves closed.
0.10 Turbine bypass valves begin to open.
2.0 Feedwater pumps trip on low suction pressure.
2.4 MSRVs open and cycle.
7.2 Initial SRVs closure.
49 Low water Level 2 setpoint reached, HPCI/RCIC initiated (not simulated).
(1)
See Figure 15.2-8.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.
However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.2-41 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-11 SEQUENCE OF EVENTS FOR LOSS OF FEEDWATER FLOW TIME (sec) EVENT 0.0 Trip of all feedwater pumps initiated.
~6 Vessel water level (Level 3)(1) trip initiates scram trip.
~19 Vessel water level (Level 2)* trip initiates RCIC (and HPCI) operation.
~19 Vessel water level (Level 2) trip initiates containment isolation.
~19 Vessel water level (Level 2) trip initiates recirculation pump trip.
~74 Rated RCIC flow is achieved. **
~800 Minimum Level is reached (444 inches above vessel zero),
approx. 45.5 inches above Level 1 trip.***
Note:
(1)
Because of an additional steam flow induced process measurement error in the Level 3 scram, the timing values following Low water level scram based on the L3 Analytical Limit are slightly different. However, as described in Reference 15.2-4, the impact of the change is not significant.
- Level 2 (Analytical Limit) is assumed to be at 457.5 inches above vessel zero.
- A system response time of 55 seconds is assumed.
- Level 1 (NTSP) is 398.5 inches above vessel zero.
CHAPTER 15 15.2-42 REV. 17, SEPTEMBER 2014
LGS UFSAR Table 15.2-12 SEQUENCE OF EVENTS FOR FAILURE OF RHR SHUTDOWN COOLING TIME (min) EVENT 0 Reactor is operating at 3528 MWt when LOOP occurs initiating plant shutdown.
0 Concurrently, loss of one division of power occurs.
10 Controlled depressurization initiated (100%) using selected MSRVs.
15 Suppression pool cooling initiated to prevent overheating from MSRV actuation(1).
157 Blowdown to approximately 75.0 psig completed.
157 Personnel are sent in to open RHR shutdown cooling suction valve; this fails.
187 Actuate core spray into vessel and reopen ADS valves to establish alternate cooling path.
(1)
See Table 15.2-9 for detailed sequence of events for loss of ac power transient.
CHAPTER 15 15.2-43 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-13 INPUT PARAMETERS FOR EVALUATION OF FAILURE OF RHR SHUTDOWN COOLING Initial power level (MWt) 3528 Suppression pool mass (lbm) 7.364x106 RHR (KHX value) (Btu/sec/F) 305 Initial vessel condition Pressure (psia) 1068 Temperature (F) 553 Initial primary fluid inventory (lbm) 6.253x105 Initial pool temperature, (F) 9.500x10+1 Service water temperature, (F) 9.500x10+1 Vessel heat capacity (Btu/lbmF) 1.230x10-1 Core spray flow rate, (lbm/sec) 8.690x10+2 RHR pool cooling flow rate (lbm/sec) 1.390x10+3 CHAPTER 15 15.2-44 REV. 13, SEPTEMBER 2006
LGS UFSAR TABLE 15.2-14 SIGNIFICANT INITIAL CONDITIONS AND RESULTS FOR THE GENERATOR LOAD REJECTION WITHOUT BYPASS AND RPT INITIAL CONDITIONS Initiating Event: Generator Load Rejection Failed Systems Recirculation Pump Trip(1)
Turbine Bypass Valves First Functioning Scram Signal Turbine Control Valve Fast Closure RESULTS Maximum Vessel Pressure (psig) 1276 Time of Maximum Pressure (sec) 2.1 Minimum Critical Power Ratio (MCPR) 0.22/0.32(2)
Time of MCPR (sec) 1.19/1.22(2)
(1)
Initiated by Turbine Control Valve Fast Closure.
(2)
GE8X8NB/GE11 CHAPTER 15 15.2-45 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.2-15 SEQUENCE OF EVENTS FOR LOSS OF STATOR COOLING TIME (sec) EVENT 0.0 Loss of Stator Cooling occurs.
0.0(a) Dual Recirculation Pump to 42% Speed is initiated(b).
0.0 Turbine-Generator Load Set Runback begins from 105%
going to 20% over 140 seconds.
45 (approx.)(a)(c) Turbine-Generator Load Set reaches Turbine Control Valve (TCV) position and starts causing the TCVs to close.
Turbine Bypass Valves (TBV) begin to open in response to the TCV Closure.
75 (approx.)(a)(c) TBVs open to their available capacity. Pressurization begins due to mismatch between steam flow coming from the vessel and the available TCV/TBV capacity.
95 (approx.)(a)(c) Reactor scrams on high pressure or neutron flux.
(a) This timeline assumes the feedwater flow interlock does not inhibit recirculation runback.
(b) In the original LOSC analysis both recirculation pumps runback immediately at time
- 0. In subsequent cycle-specific analyses the pumps are conservatively modeled as running back together after an approximately 10 second delay. In reality, Recirculation Pump 'A' runback is initiated at 1 second and Recirculation Pump 'B' runback is initiated at 10 seconds after event start.
(c) If recirculation runback is inhibited, this time will increase by approximately 45 seconds.
CHAPTER 15 15.2-46 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 RECIRCULATION PUMP TRIP 15.3.1.1 Identification of Causes and Frequency Classification 15.3.1.1.1 Identification of Causes Recirculation pump motor operation can be tripped off either by design for the reduction of other core and RCPB transient effects or by random unpredictable operational failures. Intentional tripping will occur in response to the following:
- a. Reactor vessel water level Level 2 setpoint trip
- b. Turbine control valve fast closure or stop valve closure
- c. Reactor vessel high pressure setpoint trip
- d. Motor branch circuit overcurrent protection
- e. Motor overload protection
- f. Suction block valve not fully open
- g. Discharge valve not fully open
- h. Deleted
- i. Low lube oil pressure
- j. Main unit lockout
- k. Deleted
- l. Deleted
- m. Bus undervoltage
- n. High oil temperature
- o. Manual trip Random tripping will occur in response to the following:
- a. Operator error
- b. Loss of electrical power source to the pumps
- c. Equipment or sensor failures and malfunctions which initiate the above trips.
CHAPTER 15 15.3-1 REV. 18, SEPTEMBER 2016
LGS UFSAR 15.3.1.1.2 Frequency Classification 15.3.1.1.2.1 Trip of One Recirculation Pump This transient is categorized as one of moderate frequency.
15.3.1.1.2.2 Trip of Two Recirculation Pumps This transient is categorized as one of moderate frequency.
15.3.1.2 Sequence of Events and System Operation 15.3.1.2.1 Sequence of Events 15.3.1.2.1.1 Trip of One Recirculation Pump Table 15.3-1 lists the sequence of events for Figure 15.3-1.
15.3.1.2.1.2 Trip of Two Recirculation Pumps Table 15.3-2 lists the sequence of events for Figure 15.3-2.
15.3.1.2.1.3 Identification of Operator Actions 15.3.1.2.1.3.1 Trip of One Recirculation Pump Since no scram occurs for trip of one recirculation pump, no immediate operator action is required.
As soon as possible, the operator should first verify that no operating limits are being exceeded and then reduce the flow of the operating pump to conform to the single pump flow criteria. Also, the operator must determine the cause of failure before following the restart procedure and returning the system to normal.
15.3.1.2.1.3.2 Trip of Two Recirculation Pumps Tripping of two recirculation pumps will cause a reactor water level swell that will trip the main turbine. This in turn will cause a reactor scram. The operator should ascertain that the reactor has been scrammed by the turbine trip resulting from reactor water level swell. The operator should regain control of reactor water level through RCIC operation, monitoring reactor water level and pressure control after shutdown. When both reactor pressure and level are under control, the operator may secure both HPCI and RCIC as necessary. The operator should also determine the cause of the trip before returning the system to normal.
15.3.1.2.2 System Operation 15.3.1.2.2.1 Trip of One Recirculation Pump Tripping a single recirculation pump requires no protection system or safeguard system operation.
This analysis assumes normal functioning of plant instrumentation and controls.
15.3.1.2.2.2 Trip of Two Recirculation Pumps CHAPTER 15 15.3-2 REV. 18, SEPTEMBER 2016
LGS UFSAR Analysis of this transient assumes normal functioning of plant instrumentation and controls as well as plant and reactor protection systems.
Specifically, this transient takes credit for vessel level (Level 8) instrumentation that closes the turbine stop valves. Reactor shutdown relies on scram trips from the turbine stop valves. High system pressure is limited by MSRV operation.
15.3.1.2.3 The Effect of Single Failures and Operator Errors 15.3.1.2.3.1 Trip of One Recirculation Pump Since no corrective action is required, no additional effects of single failures need be discussed. If additional single active failure or single operator error are assumed (for envelope purposes the other pump is assumed tripped), then the following two-pump trip analysis is provided (Section 15.9.6.3.3.g, Table 15.9-2).
15.3.1.2.3.2 Trip of Two Recirculation Pumps Table 15.3-2 lists the vessel level (Level 8) trip event as the first response to initiate corrective action in this transient. The level (Level 8) is intended to prohibit moisture carryover to the main turbine. Multiple level sensors are used to sense and detect when the water level reaches the Level 8 setpoint. At this point, a single failure will neither initiate nor impede a turbine trip signal.
However, turbine trip signal transmission circuitry is not built to the single failure criterion. The result of a failure at this point would have the effect of delaying the pressurization "signature."
However, high moisture levels entering the turbine can trip the turbine via turbine supervisory instrumentation.
Scram trip signals from the turbine are designed so that a single failure will neither initiate nor impede a reactor scram trip initiation (Section 15.9.6.3.3.g, Table 15.9-2).
15.3.1.3 Core and System Performance 15.3.1.3.1 Mathematical Model The nonlinear dynamic model used to simulate this transient is discussed in Reference 15.1-1.
15.3.1.3.2 Input Parameters and Initial Conditions Unless otherwise noted, these analyses have been performed using Cycle 1 plant conditions.
Pump motors and pump rotors are simulated with minimum specified rotating inertias.
15.3.1.3.3 Results The results of these events are based on Cycle 1 conditions. However, with the development of new analysis methodologies and the introduction of new fuel types, a recirculation pump trip does not have as significant of a level response and the Level 8 setpoint is not expected to be reached.
In this scenario, a two recirculation pump trip remains non-limiting. Additionally, other transient events which result in a two recirculation pump trip model the recirculation pump trip as part of the event, and the resulting level response may be different than the historic Cycle 1 response due to the introduction of new fuel types and the use of newer analysis methodologies.
CHAPTER 15 15.3-3 REV. 18, SEPTEMBER 2016
LGS UFSAR 15.3.1.3.3.1 Trip of One Recirculation Pump Figure 15.3-l shows the results of losing one recirculation pump. The tripped loop diffuser flow reverses in approximately 2.7 seconds. However, the ratio of diffuser mass flow to pump mass flow in the active jet pumps increases considerably and produces approximately 154% of normal diffuser flow and 58% of rated core flow. MCPR remains well above the safety limit; thus, the fuel thermal limits are not violated. During this transient, level swell is not sufficient to cause turbine trip and scram.
15.3.1.3.3.2 Trip of Two Recirculation Pumps Figure 15.3-2 shows this transient, with minimum specified rotating inertia, in graph form. MCPR remains unchanged. No scram is initiated directly by pump trip. The vessel water level swell due to rapid flow coast-down is expected to reach the high level trip, thereby shutting down the main turbine and feed pump turbines and scramming the reactor. Subsequent events, such as main steam line isolation and initiation of RCIC and HPCI systems occurring later in this transient, have no significant effect on the results.
15.3.1.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force analytical results to be more severe than those expected under actual plant conditions.
Actual pump and pump motor driveline rotating inertias are expected to be somewhat greater than the minimum design values assumed in this simulation. Actual plant deviations regarding inertia are expected to lessen the severity of the results indicated by this analysis. Minimum design inertias were used as well as the least negative void coefficient, because the primary concern here is flow reduction.
15.3.1.4 Barrier Performance 15.3.1.4.1 Trip of One Recirculation Pump Figure 15.3-1 results indicate a basic reduction in system pressures from the initial conditions.
Therefore, the RCPB barrier is not threatened.
15.3.1.4.2 Trip of Two Recirculation Pumps The results shown in Figure 15.3-2 indicate that peak pressures stay well below the 1375 psig limit allowed by the applicable code. Therefore, the barrier pressure boundary is not threatened.
15.3.1.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there is no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with CHAPTER 15 15.3-4 REV. 18, SEPTEMBER 2016
LGS UFSAR established technical specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.3.2 RECIRCULATION FLOW CONTROL FAILURE - DECREASING FLOW 15.3.2.1 Identification of Causes and Frequency Classification 15.3.2.1.1 Identification of Causes Some causes of recirculation flow control failure are malfunction of the active ASD controller (one of two redundant controllers), malfunction of the PLC supplying command signals to the controllers, or corruption to the communication between these devices (one of two redundant channels).
These malfunctions can result in a rapid flow decrease in only one recirculation loop.
15.3.2.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.
15.3.2.2 Sequence of Events and System Operation 15.3.2.2.1 Sequence of Events 15.3.2.2.1.1 Failure of One Controller - Closed The sequence of events for this transient is similar to, and can never be more severe than, that listed in Table 15.3-1 for the trip of one recirculation pump.
15.3.2.2.1.2 Deleted 15.3.2.2.1.3 Identification of Operator Actions As soon as possible, the operator should verify that no operating limits are being exceeded. If limits are exceeded, corrective action must be initiated. The operator must also determine the cause of the trip before returning the system to normal.
15.3.2.2.2 System Operation Normal plant instrumentation and control is assumed to function. Credit is taken for scram in response to vessel high water level (Level 8) turbine trip if it occurs.
15.3.2.2.3 The Effect of Single Failures and Operator Errors The single failure and operator error considerations for these events are the same as those discussed in Section 15.3.1.2.3 on the RPT. Failure of an ASD and thus an RPT, would be the envelope case for additional single action failure or single operator error (Section 15.9.6.3.3.f, Table 15.9-2).
15.3.2.3 Core and System Performance 15.3.2.3.1 Mathematical Model CHAPTER 15 15.3-5 REV. 18, SEPTEMBER 2016
LGS UFSAR The nonlinear dynamic model used to simulate these transients is discussed in Reference 15.1-1.
15.3.2.3.2 Input Parameters and Initial Conditions These analyses have been performed, unless otherwise noted, with Cycle 1 plant conditions. The lowest negative void coefficient in Table 15.0-2 was used for these analyses.
15.3.2.3.3 Results The results of these events are based on Cycle 1 conditions. An analysis of these events for current conditions is not expected to result in a change in the general trends and characteristics as shown.
In the case of zero demand to both controllers each individual ASD speed controller has internal limits established in its system operating program (SOP) that limits the maximum rate of change of speed in each loop. Thus, the results of these transients can never be more severe than those of the simultaneous trip of both recirculation pumps, as evaluated in Section 15.3.1.3.3.2.
The failure of one controller has two possible outcomes. A detectable failure of the active primary controller will cause swap-over to the back-up controller, resulting in maintaining pump speed at a lower fixed (speed-hold) value. An undetectable malfunction of the primary active controller or malfunction of an active back-up controller (with primary controller inactive) can result in a speed decrease at an uncontrolled rate (step change) to 0% speed. This case is similar to the trip of one recirculation pump, described in Section 15.3.1.3.3.1, and is less severe than the transient that results from the simultaneous trip of both recirculation pumps.
15.3.2.3.4 Consideration of Uncertainties Initial conditions chosen for these analyses are conservative and tend to force the analytical results to be more severe than would otherwise be expected. These analyses, unlike the pump trip series, will be unaffected by deviations in pump/pump motor and driveline inertias because the flow controllers are what cause rapid recirculation decreases.
15.3.2.4 Barrier Performance The barrier performance considerations for these events are the same as those discussed in Section 15.3.1.4.
15.3.2.5 Radiological Consequences While the consequence of this transient does not result in fuel failure, it does result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there will be no exposure to operating personnel. This transient does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment, or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
15.3.3 RECIRCULATION PUMP SEIZURE CHAPTER 15 15.3-6 REV. 18, SEPTEMBER 2016
LGS UFSAR 15.3.3.1 Identification of Causes and Frequency Classification The seizure of a recirculation pump is considered as a DBA. It has been evaluated as being a very mild accident in relation to other DBAs such as the LOCA. The analysis has been conducted with consideration to both single-loop and two-loop operations. A discussion is given in GESTAR II (Reference 4.1-1).
15.3.3.1.1 Identification of Causes The case of recirculation pump seizure represents the extremely unlikely event of instantaneous stoppage of the pump motor shaft of one recirculation pump. This accident produces a very rapid decrease of core flow as the result of the large hydraulic resistance introduced by the stopped rotor.
15.3.3.1.2 Frequency Classification This accident is considered a limiting fault but results in effects that are comparable to those of an accident of greater probability (i.e. infrequent incident classification).
15.3.3.2 Sequence of Events and System Operation 15.3.3.2.1 Sequence of Events Table 15.3-3 lists the sequence of events for Figure 15.3-3. Appropriate operator actions must be taken for recovery after the recirculation pump seizure event.
15.3.3.2.2 System Operation In order to properly simulate the expected sequence of events, the analysis of this accident assumes normal functioning of plant instrumentation and controls, plant protection, and reactor protection systems.
Operation of safe shutdown features, though not included in this simulation, is expected to be utilized in order to maintain adequate water level.
15.3.3.2.3 The Effect of Single Failures and Operator Errors Corrective action by the level control is expected to establish a new stable operating state. The effect of a single failure in the level control system has rather straightforward consequences, including level rise or fall by improper control of the feedwater system. Increasing level will trip the main and feedwater turbines. This trip signal is described in Section 15.1.2.2.3. Decreasing level will automatically initiate scram at the low level (Level 3) trip which is designed to single failure criteria (Section 15.9.6.4.3.e, Table 15.9-2).
15.3.3.3 Core and System Performance 15.3.3.3.1 Mathematical Model The nonlinear dynamic model used to simulate this accident is discussed in Reference 15.1-1.
15.3.3.3.2 Input Parameters and Initial Conditions CHAPTER 15 15.3-7 REV. 18, SEPTEMBER 2016
LGS UFSAR This analysis has been performed, unless otherwise noted, with the plant conditions tabulated in Table 15.0-2A.
For the purpose of evaluating consequences to the fuel thermal limits, this accident is assumed to occur as the result of an unspecified, instantaneous stoppage of one recirculation pump shaft while the reactor is operating at 102% rated power. The reactor is also assumed to be operating at thermally limited conditions.
15.3.3.3.3 Results Figure 15.3-3 presents the results of the accident while operating in two-loop mode. Core coolant flow drops rapidly, reaching its minimum value in approximately 1.7 seconds. The vessel water level rises and feedwater flow reduces to compensate. The reactor stabilizes at a new steady-state operating condition. The peak neutron flux and average surface heat flux did not increase significantly above the initial conditions, therefore no impact on the fuel thermal margins is postulated to occur.
A specific analysis has been performed to model the recirculation pump seizure transient while in single-loop mode and is used to establish a MCPR requirement for single-loop operation. See GE-NE-L12-00884-00-01P, GE14 Fuel Design Cycle-Independent Analyses for Limerick Generating Station Units 1 and 2, March 2001, and Reference 15.7-17.
15.3.3.3.4 Consideration of Uncertainties This transient is predicted to result in a reactor vessel water level increase to slightly below the high level (Level 8) turbine trip setpoint. Slightly different nuclear boiler system operational parameters might result in the level swell causing a turbine trip. Should the vessel water level reach the high water level setpoint (Level 8), main turbine trip, resulting from stop valve closure, and feedwater pump trip would be initiated. Subsequently, reactor scram and the remaining recirculation pump trip would be initiated due to the turbine trip. The vessel water level would eventually be controlled by HPCI and RCIC flow.
Further uncertainties are considered in the GETAB (Reference 15.0-2) analysis.
15.3.3.4 Barrier Performance The bypass valves, and possible momentary opening of some of the MSRVs, limit the pressure well within the range allowed by the ASME vessel code. Therefore, the RCPB is not threatened by overpressure.
15.3.3.5 Radiological Consequences While the consequence of this accident does not result in fuel failure, it could result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there would be no exposure to operating personnel. This accident does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment or discharge it to the environment under controlled release conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
CHAPTER 15 15.3-8 REV. 18, SEPTEMBER 2016
LGS UFSAR 15.3.4 RECIRCULATION PUMP SHAFT BREAK 15.3.4.1 Identification of Causes and Frequency Classification The breaking of the shaft of a recirculation pump is considered an accident. It has been evaluated as a very mild accident in relation to other DBAs such as the LOCA. The analysis has been conducted with consideration to both single-loop and two-loop operation.
This postulated accident is bounded by the more limiting case of recirculation pump seizure.
Quantitative results for this more limiting case are presented in Section 15.3.3.
15.3.4.1.1 Identification of Causes Recirculation pump shaft breakage represents the extremely unlikely event of instantaneous stoppage of one recirculation pump motor. This accident produces a very rapid decrease of core flow as a result of the broken pump shaft.
15.3.4.1.2 Frequency Classification This accident is considered a limiting fault, but results in effects that are comparable to those of an accident of greater probability (i.e., infrequent incident classification).
15.3.4.2 Sequence of Events and System Operation 15.3.4.2.1 Sequence of Events A postulated instantaneous break of the motor shaft of one recirculation pump, as discussed in Section 15.3.4.1.1, will cause the core flow to decrease rapidly and result in water level swell in the reactor vessel but no scram. The core flow and power will stabilize at new equilibrium conditions.
Appropriate operator actions must be taken for recovery after the recirculation pump shaft break event.
15.3.4.2.2 System Operation Normal operation of plant instrumentation and control is assumed. Operation of HPCI and RCIC systems during shutdown is expected in order to maintain adequate water level control.
15.3.4.2.3 The Effect of Single Failures and Operator Errors Effects of single failures are similar to those considered in Section 15.3.3.2.3 .
Refer to Section 15.9.6.4.3.f and Table 15.9-3 for more details.
15.3.4.3 Core and System Performance The severity of this pump shaft break accident is bounded by the pump seizure accident as described in Section 15.3.3. This can be easily demonstrated by consideration of these two accidents as discussed in the section below. Since the shaft break accident is less limiting than the accident discussed in Section 15.3.3 only a qualitative evaluation is provided. Therefore, no CHAPTER 15 15.3-9 REV. 18, SEPTEMBER 2016
LGS UFSAR discussion of mathematical model, input parameters, and consideration of uncertainties, etc., is necessary.
15.3.4.4 Qualitative Results If this extremely unlikely accident occurs, core coolant flow will drop rapidly. The vessel level increases but remains below the trip level (Level 8) of the main and feedwater turbines. The flow in the recirculation loop with the failed pump decreases rapidly. The core flow and then the reactor power stabilize at lower values within less than a minute of the failure.
The severity of this pump shaft break accident is bounded by the pump seizure accident (Section 15.3.3). This can be demonstrated easily by consideration of the two types of accidents. In both accidents, the recirculation drive flow of the affected loop decreases rapidly. In the case of the pump seizure accident, the loop flow decreases faster than the normal flow coast-down as a result of the large hydraulic resistance introduced by the stopped rotor. In the case of the pump shaft break accident, the hydraulic resistance caused by the broken pump shaft is less than that of the stopped rotor for the pump seizure accident. Therefore, the core flow decrease following a pump shaft break effect is slower than the pump seizure accident. Thus, it can be concluded that the potential effects of the hypothetical pump shaft break accident are bounded by the effects of the pump seizure accident.
15.3.4.5 Barrier Performance The bypass valves, and possible momentary opening of some of the MSRVs, limit the pressure well within the range allowed by the ASME vessel code. Therefore, the RCPB is not threatened by overpressure.
15.3.4.6 Radiological Consequences While the consequence of this accident does not result in fuel failure, it could result in the discharge of normal coolant activity to the suppression pool via MSRV operation. Because this activity is contained in the primary containment, there would be no exposure to operating personnel. This accident does not result in an uncontrolled release to the environment, so the plant operator can choose to leave the activity bottled up in the containment, or discharge it to the environment under controlled conditions. If purging of the containment is chosen, the release will be in accordance with established Technical Specifications and, at the worst, would only result in a small increase in the yearly integrated exposure level.
CHAPTER 15 15.3-10 REV. 18, SEPTEMBER 2016
LGS UFSAR Table 15.3-1 SEQUENCE OF EVENTS FOR TRIP OF ONE RECIRCULATION PUMP(1)
TIME (sec) EVENT 0.0 Trip of one recirculation pump initiated.
2.7 Diffuser flow decreases significantly in the tripped loop.
20.0 Core flow stabilizes at new equilibrium conditions.
40.0 Power level stabilizes at new equilibrium conditions.
(1)
See Figure 15.3-1.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.
However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.3-11 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.3-2 SEQUENCE OF EVENTS FOR TRIP OF BOTH RECIRCULATION PUMPS(2)
TIME (sec) EVENT(1) 0.0 Trip of both recirculation pumps initiated.
5.2 Vessel water level (Level 8) trip initiates turbine trip and feedwater pumps trip.
5.2 Turbine trip initiates bypass operation.
5.2 Turbine trip initiates reactor scram trip.
9.9 Group 1 MSRVs open.
12.9 Group 1 MSRVs close.
43.5 Level 2 vessel level setpoint initiates steam line isolation and HPCI/RCIC start.
(1)
For these events, MSIV closure was simulated at Level 2. Subsequent design modifications have lowered the closure setpoint to Level 1. However, HPCI and RCIC initiation at Level 2 will prevent the water level from dropping to Level 1 and no MSIV closure will occur.
Because no safety limits are approached during this event, reanalysis for the setpoint change is not required.
(2)
See Figure 15.3-2.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions. However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.3-12 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.3-3 SEQUENCE OF EVENTS FOR RECIRCULATION PUMP SEIZURE(1)
TIME (sec) EVENT 0.0 Single pump seizure was initiated.
0.7 Jet pump diffuser flow reverses in seized loop.
4.0 Core flow stabilizes at new equilibrium conditions.
40.0 Power stabilizes at new equilibrium conditions.
(1)
See Figure 15.3-3.
CHAPTER 15 15.3-13 REV. 13, SEPTEMBER 2006
LGS UFSAR 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 ROD WITHDRAWAL ERROR - LOW POWER 15.4.1.1 Control Rod Removal Error During Refueling 15.4.1.1.1 Identification of Causes and Frequency Classification The transient considered here is inadvertent criticality due to the complete withdrawal or removal of the highest worth control rod during refueling. The probability of the initial causes alone is considered low enough to warrant its being categorized as an infrequent incident, since there is no postulated set of circumstances that results in an inadvertent rod withdrawal error while in the refueling mode.
15.4.1.1.2 Sequence of Events and System Operation 15.4.1.1.2.1 Initial Control Rod Removal or Withdrawal During refueling operations system interlocks provide assurance that inadvertent criticality does not occur because two control rods have been removed or withdrawn together.
When fuel is being moved from the core to the spent fuel pool during refueling, the refueling interlocks may be disabled for core cells from which the four fuel assemblies have been removed if the conditions contained in technical specification 3.9.10.2 are met and compensating administrative controls are established.
15.4.1.1.2.2 Fuel Insertion With Control Rod Withdrawn To minimize the possibility of loading fuel into a cell containing no control rod, all control rods must be fully inserted when fuel is being loaded into the core. This requirement is backed up by refueling interlocks on rod withdrawal and movement of the refueling platform. When the mode switch is in the REFUEL position, the interlocks prevent the platform from being moved over the core if a control rod is withdrawn and fuel is on the hoist. Likewise, if the refueling platform is over the core and fuel is on the hoist, control rod motion is blocked by the interlocks.
When fuel is being moved from the core to the spent fuel pool during refueling, the refueling interlocks may be disabled for core cells from which the four fuel assemblies have been removed if the conditions contained in technical specification 3.9.10.2 are met and compensating administrative controls are established.
15.4.1.1.2.3 Second Control Rod Removal or Withdrawal When the platform is not over the core (or fuel is not on the hoist) and the mode switch is in the REFUEL position, only one control rod can be withdrawn. Any attempt to withdraw a second rod results in a rod block by the refueling interlocks. Since the core is designed to meet shutdown requirements with the highest worth rod withdrawn, the core remains subcritical even with one rod withdrawn.
CHAPTER 15 15.4-1 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.1.1.2.4 Control Rod Removal Without Fuel Removal Finally, the design of the control rod, incorporating the velocity limiter, does not physically permit the upward removal of the control rod without prior or simultaneous removal of the four adjacent fuel bundles. This precludes any hazardous condition.
15.4.1.1.2.5 Identification of Operator Actions No operator actions are required to preclude this transient since the plant design, as discussed above, prevents its occurrence.
15.4.1.1.2.6 Effect of Single Failure and Operator Errors If any one of the operations involved in initial failure or error is followed by any other single active failure or single operator error, the necessary safety actions (e.g., rod block or scram) are taken automatically prior to limit violation (Section 15.9).
15.4.1.1.3 Core and System Performances Since the probability of inadvertent criticality during refueling is precluded, the core and system performances were not analyzed. The withdrawal of the highest worth control rod during refueling will not result in criticality. This is determined analytically during the core design process.
Shutdown Margin is verified experimentally during the first startup following refueling operations.
(See Section 4.3.2 for a description of the methods and results of the shutdown margin analysis.)
Additional reactivity insertion is precluded by interlocks (Section 7.7). As a result, no radioactive material is ever released from the fuel making it unnecessary to assess any radiological consequences.
No mathematical models are involved in this transient. The need for input parameters or initial conditions is not required as there are no results to report. Consideration of uncertainties is not appropriate.
15.4.1.1.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since there is not a postulated set of circumstances for which this transient could occur.
15.4.1.1.5 Radiological Consequences An evaluation of the radiological consequences was not made for this transient, since no radioactive material is released from the fuel.
15.4.1.2 Continuous Rod Withdrawal During Reactor Startup 15.4.1.2.1 Identification of Causes and Frequency Classification The probability of initial causes or errors of this transient alone is considered low enough to warrant its being categorized as an infrequent incident. The probability of further development of this transient is extremely low because it is contingent upon the failure of the RWM system, together CHAPTER 15 15.4-2 REV. 20, SEPTEMBER 2020
LGS UFSAR with a high worth out-of-sequence rod selection contrary to procedures, and operator failure to acknowledge continuous alarm annunciations prior to safety system actuation.
15.4.1.2.2 Sequence of Events and System Operation 15.4.1.2.2.1 Sequence of Events Control rod withdrawal errors are not considered credible in the startup and low power ranges. The RWM system prevents the operator from selecting and withdrawing an out-of-sequence control rod.
15.4.1.2.2.2 Identification of Operator Actions No operator actions are required to preclude this transient since the plant design, as discussed above, prevents its occurrence.
15.4.1.2.2.3 The Effect of Single Failures and Operator Errors If any one of the operations involved the initial failure or error is followed by another single active failure or single operator error, the necessary safety actions (e.g., rod blocks) are automatically taken prior to any limit violation (Section 15.9). Further development of this event is contingent upon simultaneous failure of two systems as described in Appendix 15A.
15.4.1.2.3 Core and System Performance The performance of the RWM system prevents erroneous selection and withdrawal of an out-of-sequence rod. The core and system performance is not affected by such an operator error.
No mathematical models are involved in this transient. The need for input parameters, or initial conditions, is not required as there are no results to report. Consideration of uncertainties is not appropriate.
15.4.1.2.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since there is no postulated set of circumstances for which this error could occur.
15.4.1.2.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.
15.4.2 ROD WITHDRAWAL ERROR - AT POWER 15.4.2.1 Identification of Causes and Frequency Classification 15.4.2.1.1 Identification of Causes While operating in the power range in a normal mode of operation, the reactor operator makes a procedural error and continuously withdraws a high worth control rod until the RBM system inhibits further withdrawal.
CHAPTER 15 15.4-3 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.2.1.2 Frequency Classification This transient is classified as an incident of moderate frequency.
15.4.2.2 Sequence of Events and System Operation 15.4.2.2.1 Sequence of Events The sequence of events for this transient, as calculated with conservative assumptions, is presented in Table 15.4-1. No operator actions are required during this transient. However, operator procedural actions expected to occur are shown in the above referenced table.
15.4.2.2.2 System Operation The focal point of this transient is localized to a small portion of the core. Therefore, although reactor controls and instrumentation are assumed to function normally, credit is taken only for the RBM system. A discussion of the transient follows below.
While operating in the power range in a normal mode of operation, the reactor operator withdraws high worth control rod until the RBM system inhibits further withdrawal.
Under most normal operating conditions, no operator action is required since the transient which would occur would be very mild.
If the rod withdrawal error is severe enough, the RBM system would sound alarms, at which time the operator would acknowledge the alarm and take corrective action. Even assuming that the operator ignores all alarms and warnings and continues to withdraw the control rod, the RBM system will block further withdrawal of the control rod before the fuel reaches the point of boiling transition or the 1% strain limit imposed on the cladding.
15.4.2.2.3 The Effect of Single Failures and Operator Errors The effect of operator errors has been discussed above. It was shown that operator errors (which initiated this transient) cannot impact the consequences of this transient due to the highly reliable RBM system (Section 15.9).
15.4.2.3 Core and System Performance The Rod withdrawal Error (RWE) event has been analyzed generically to support the Rod Block Monitor (RBM) set points established by the ARTS program. The RWE analysis and the ARTS program for Limerick are discussed in Reference 15.0-10. The generic RWE analysis provides a relationship between CPR and Rod Block Monitor set points. Cycle specific RWE analysis ensures the generic RWE CPR requirements are bounding for the cycle; or provides cycle specific values and references justification for elimination of the generic RWE CPR check requirements.
Reference 15.4-21 justifies elimination of the generic values, except for the 108% RBM setpoint value. Limits are documented in the Supplemental Reload Licensing Report and incorporated in the Core Operating Limits Report for the cycle. If necessary, new RBM set points are established.
The generic RWE analysis also verifies conformance to the fuel thermal-mechanic limit of 1 %
strain.
CHAPTER 15 15.4-4 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.2.4 Barrier Performance An evaluation of the barrier performance was not made for this transient, since this is a localized transient with very little change in the gross core characteristics. Typically, the increase in total core power is less than 5% and the changes in pressure are negligible.
15.4.2.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.
15.4.3 CONTROL ROD MALOPERATION (SYSTEM MALFUNCTION OR OPERATOR ERROR)
This transient is covered by the evaluations cited in Sections 15.4.1 and 15.4.2.
15.4.4 ABNORMAL STARTUP OF IDLE RECIRCULATION PUMP 15.4.4.1 Identification of Causes and Frequency Classification 15.4.4.1.1 Identification of Causes This action results directly from the operator's manual action to initiate pump operation. It assumes that the remaining loop is already operating.
15.4.4.1.1.1 Normal Restart of Recirculation Pump at Power This transient is categorized as an incident of moderate frequency.
15.4.4.1.1.2 Abnormal Startup of Idle Recirculation Pump This transient is categorized as an incident of moderate frequency.
15.4.4.2 Sequence of Events and System Operation 15.4.4.2.1 Sequence of Events Table 15.4-3 lists the sequence of events for Figure 15.4-2.
The normal sequence of operator actions expected in starting the idle loop is as follows. The operator should:
- a. Adjust rod pattern as necessary for new power level following idle loop start.
- b. Determine that the idle recirculation pump suction valve is open, the discharge valve is closed, and the coupler in the idle loop is in the starting position. If they are not, the operator must place them in these configurations.
- c. Readjust flow of the running loop downward to less than one-half of rated flow.
CHAPTER 15 15.4-5 REV. 20, SEPTEMBER 2020
- d. Determine that the temperature differential between the reactor pressure vessel steam space coolant and the bottom head drain line coolant is no more than 145F.
- e. Determine that the temperature difference between the two loops is no more than 50F.
- f. Start the idle loop pump and open the discharge valve by jogging manual circuitry.
- g. Adjust flow to match the adjacent loop flow. Monitor reactor power.
- h. Readjust power, as necessary, to satisfy plant requirements per standard procedure.
The time required to do the above work is approximately 1/2 hour.
15.4.4.2.2 System Operation This transient assumes and takes credit for normal functioning of plant instrumentation and controls, plant protection, and RPS. In particular, credit is taken for high flux scram to terminate the transient. No ESF action occurs as a result of the transient.
15.4.4.2.3 The Effect of Single Failures and Operator Errors This transient leads to a quick rise in reactor power level. Corrective action first occurs in the APRM neutron flux upscale trip and, being part of the RPS, it is designed to the single failure criterion. Therefore, shutdown is assured. Operator errors are not of concern here in view of the fact that automatic shutdown transients follow so quickly after the postulated failure (Section 15.9).
15.4.4.3 Core and System Performance 15.4.4.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this transient.
15.4.4.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions as tabulated in Table 15.0-2.
One recirculation loop is idle and filled with cold water at 100F. (Normal procedure when starting an idle loop with one pump already running requires heating the idle recirculation loop to within 50F of core inlet temperature prior to loop startup.)
The active recirculation loop is operating with about 84% of normal rated diffuser flow going across the active jet pumps.
The core is receiving 38% of its normal rated flow. The remainder of the coolant flows in the reverse direction through the inactive jet pumps.
CHAPTER 15 15.4-6 REV. 20, SEPTEMBER 2020
LGS UFSAR Reactor power is 55% of NBR power conditions. (Normal procedures require startup of an idle loop at a lower power.)
The idle recirculation pump suction valve is open, but the pump discharge valve is closed.
The idle pump fluid coupler is at a setting that approximates 50% generator speed demand.
15.4.4.3.3 Results The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
The transient response to the incorrect startup of a cold, idle recirculation loop is shown in Figure 15.4-2. Shortly after the pump begins to move, a surge in flow from the jet pump diffusers causes the core inlet flow to rise sharply.
When the neutron flux peak reaches the APRM neutron flux upscale scram setpoint, reactor scram is initiated. The neutron flux peaks at 454.9% of NBR. Surface heat flux follows the slower response of the fuel and peaks at 90% NBR. Nuclear system pressures do not increase significantly above the initial pressures. The water level does not reach either the high or low level setpoints.
15.4.4.3.4 Consideration of Uncertainties This particular transient is analyzed for an initial power level that is much higher than that expected for the actual transient. The much slower thermal response of the fuel mitigates the effects of the rather sharp neutron flux spike and, even in this high range of power, no threat to thermal limits is possible.
15.4.4.4 Barrier Performance No evaluation of barrier performance is required for this transient, since no significant pressure increases are incurred.
15.4.4.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.
15.4.5 RECIRCULATION FLOW CONTROL FAILURE WITH INCREASING FLOW 15.4.5.1 Identification of Causes and Frequency Classification 15.4.5.1.1 Identification of Causes Failure of an individual flow controller can cause a speed increase for its associated recirculation pump. The failure of one ASD controller has two possible outcomes. A detectable failure of the active primary controller will cause swap-over to the back-up controller, resulting in maintaining pump speed at a lower fixed (speed-hold) value. An undetectable malfunction of the primary active controller or malfunction of the active back-up controller (with primary controller inactive) can result in a speed decrease at an uncontrolled rate (step change) to 0% speed.
CHAPTER 15 15.4-7 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.5.1.2 Frequency Classification This transient is classified as an incident of moderate frequency.
15.4.5.2 Sequence of Events and System Operation 15.4.5.2.1 Sequence of Events Table 15.4-4 lists the sequence of transients for Figure 15.4-3.
Initial actions by the operator include:
- a. Reducing recirculation flow to minimum
- b. Identifying the cause of the failure.
Reactor pressure will be controlled as required, depending upon whether a restart or cooldown is planned. In general, the corrective action would be to hold reactor pressure and condenser vacuum for restart after the malfunctioning flow controller has been repaired. The following is the sequence of operator actions expected during the course of the transient. The operator should:
- a. Observe that all rods are in.
- b. Check the reactor water level and maintain it above low level (Level 1) trip to prevent MSIVs from isolating.
- c. Switch the reactor mode switch to the STARTUP position.
- d. Continue to maintain vacuum and turbine seals.
- e. Reduce seep demand to 28% or less.
- f. Monitor the turbine coast-down and auxiliary systems.
The time required from first alarm to restart would be approximately one hour.
15.4.5.2.2 System Operation The analysis of this transient assumes and takes credit for normal functioning of plant instrumentation and controls, and the RPS. Operation of engineered safeguards is not expected.
15.4.5.2.3 The Effect of Single Failures and Operator Errors This transient leads to a quick rise in reactor power level. Corrective action first occurs in the APRM neutron flux upscale trip and, being part of the RPS, it is designed to the single failure criterion. Therefore, shutdown is assured (Section 15.9). Operator errors are not of concern here in view of the fact that automatic shutdown transients follow so quickly after the postulated failure.
CHAPTER 15 15.4-8 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.5.3 Core and System Performance 15.4.5.3.1 Mathematical Model The nonlinear dynamic model described briefly in Section 15.1.1.3.1 is used to simulate this transient.
15.4.5.3.2 Input Parameters and Initial Conditions This analysis has been performed, unless otherwise noted, with Cycle 1 plant conditions.
In each of these transients, the most severe transient results when initial conditions are established for operation at the low end of the rated flow control rod line. Specifically, at 57% NBR power and 39.6% core flow.
Maximum change in speed control occurs with a malfunction of one of the two redundant ASD controllers that results in an instantaneous step change to maximum output speed.
15.4.5.3.3 Results The results of this event are based on Cycle 1 conditions. An analysis of this event for current conditions is not expected to result in a change in the general trends and characteristics as shown.
Figure 15.4-3 shows the results of the transient. The changes in nuclear system pressure are not significant with regard to overpressure. Pressure decreases over most of the transient. The rapid increase in core coolant flow causes an increase in neutron flux, which initiates a reactor APRM neutron flux upscale scram.
The peak neutron flux rise reaches 382.3% of NBR flux, and the accompanying transient fuel surface heat flux reaches 82.7% of rated. The MCPR remains above the safety limit, and fuel center temperature increases only 383F. Therefore, the design basis is satisfied.
15.4.5.3.4 Consideration of Uncertainties Some uncertainties in void reactivity characteristics, scram time, and worth are expected to be more optimistic and will therefore produce less severe consequences than those simulated here.
15.4.5.4 Barrier Performance This transient results in a very slight increase in reactor vessel pressure, as shown in Figure 15.4-3, and therefore represents no threat to the RCPB.
15.4.5.5 Radiological Consequences An evaluation of the radiological consequences is not required for this transient, since no radioactive material is released from the fuel.
15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTIONS These are not applicable to BWRs. This is a PWR transient.
CHAPTER 15 15.4-9 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.7 MISPLACED BUNDLE ACCIDENT 15.4.7.1 Identification of Causes and Frequency Classification 15.4.7.1.1 Identification of Causes The accident discussed in this section is the improper loading of a fuel bundle and subsequent operation of the core. Three errors must occur for this accident to take place in the initial core loading. First, a bundle must be loaded into a wrong location in the core. Second, the bundle which was supposed to be loaded where the mislocation occurred would have to be overlooked and also put in an incorrect location. Third, the misplaced bundles would have to be overlooked during the core verification performed following initial core loading.
15.4.7.1.2 Frequency Classification This accident occurs when a fuel bundle is loaded into the wrong location in the core. It is assumed the bundle is misplaced in the worst possible location, and the plant is operated with the mislocated bundle. This accident is categorized as an infrequent incident based upon the following data:
Expected Frequency: 0.004 events/operating cycle The above number is based upon past experience. The only misloading accidents that have occurred in the past were in reload cores where only two errors are necessary. Therefore, the frequency of occurrence for initial cores is even lower since three errors must occur concurrently.
15.4.7.2 Sequence of Events and System Operation The postulated sequence of transients for the misplaced bundle accident is presented in Table 15.4-5.
Fuel loading errors, undetected by incore instrumentation following fueling operations, may result in undetected reductions in thermal margins during power operations. No detection is assumed and, therefore, no corrective operator action or automatic protection system functioning occurs.
15.4.7.2.1 The Effect of Single Failures and Operator Errors This analysis already represents the worst case (i.e., operation of a misplaced bundle with three single active failures or single operator errors) and there are no further operator errors which can make the accident results any worse. It is felt that this section is not applicable to this accident (Section 15.9).
15.4.7.3 Core and System Performance This event is discussed in the corresponding section of GESTAR II (Reference 4.1-1).
Results of analyzing the worst fuel bundle loading error are reported in Table 15.4-6. As can be seen, MCPR remains well above the point where boiling transition would be expected to occur, and the MLHGR does not exceed the 1% strain limit for the cladding. Therefore, no fuel damage occurs as a result of this accident.
CHAPTER 15 15.4-10 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4.7.4 Barrier Performance An evaluation of the barrier performance was not made for this accident since it is very mild and highly localized. No perceptible change in the core pressure would be observed.
15.4.7.5 Radiological Consequences An evaluation of the radiological consequences is not required for this accident since no radioactive material is released from the fuel.
15.4.8 SPECTRUM OF ROD EJECTION ACCIDENTS This is not applicable to BWRs since the BWR has precluded this transient by incorporating into its design mechanical equipment which restricts any movement of the CRD system assemblies. The CRD housing support assemblies are described in Chapter 4.
15.4.9 CONTROL ROD-DROP ACCIDENT 15.4.9.1 Identification of Causes and Frequency Classification Causes and frequency of the control rod-drop accident are described in the corresponding section of GESTAR II (Reference 4.1-1).
15.4.9.2 Sequence of Events and System Operation A description of the sequence of events and the operation of the system during a control rod-drop accident is provided in the corresponding Section of GESTAR II (Reference 4.1-1).
15.4.9.3 Core and System Performance 15.4.9.3.1 Mathematical Model The analytical methods, assumptions and conditions for evaluating the excursion aspects of the control rod-drop accident originally presented in the UFSAR are described in detail in GESTAR II (Reference 4.1-1). In support of the deletion of the MSLRM trip and valve closure functions, a new analysis was performed as described in NEDO-31400A, Reference 15.4-7.
15.4.9.3.2 Input Parameters and Initial Conditions The input parameters and conditions for the control rod-drop accident originally presented in the UFSAR are described in GESTAR II (Reference 4.1-1). In support of the deletion of the MSLRM trip and valve closure functions, a new analysis was performed, with slightly different input parameters, as described in NEDO-31400A, Reference 15.4-7.
15.4.9.3.3 Results The radiological consequences of the control rod drop accident are based on the methodology of Regulatory Guide 1.183 and the assumed failure of 1200 fuel rods of GNF2 10x10 fuel in an 85.6 equivalent pin array with a peaking factor of 1.7.
CHAPTER 15 15.4-11 REV. 20, SEPTEMBER 2020
LGS UFSAR Two cases were evaluated. One with a release pathway through the main condenser where the condenser is assumed to leak radioactivity into the turbine enclosure and then released to the environment. The second pathway is through the Steam Jet Air Ejectors which discharge to the off-gas system. In all cases, the dose for the main condenser leakage pathway bound the off-gas pathway dose.
The offsite dose limits established by Regulatory Guide 1.183 are 6.3 rem TEDE at the exclusion area boundary and 6.3 rem TEDE at the low population zone. The calculated dose at the exclusion area boundary is 0.045 rem TEDE and at the low population zone is 0.032 rem TEDE and are well within the prescribed limits.
The control room dose limit established by 10 CFR 50.67 is 5 rem TEDE. The calculated dose in the control room for the control rod drop accident is 1.55 rem TEDE and is within the prescribed limit.
15.4.9.4 Barrier Performance An evaluation of the barrier performance was not made for this accident, since this is a highly localized accident with no significant change in the gross core temperature or pressure.
15.4.9.5 Radiological Consequences for the CRDA Regulation 10 CFR 50.67, "Accident Source Term," provides a mechanism for power reactor licensees to voluntarily replace the traditional TID-14844 (Ref. 15.4-9) accident source term used in design-basis accident analyses with an "Alternative Source Term" (AST). The methodology of approach to this replacement is given in USNRC Regulatory Guide 1.183 (Ref.
15.4-10) and its associated Standard Review Plan 15.0.1 (Ref. 15.4-11).
Accordingly, Limerick Generating Station, Units 1 and 2, have applied the AST methodology for several areas of operational relief in the event of a Design Basis Accident (DBA), without fully crediting the use of previously assumed safety systems. Amongst these systems are the Control Room Emergency Fresh Air Supply System (CREFAS) and the Standby Gas Treatment System (SGTS).
In support of a full-scope implementation of AST as described in and in accordance with the guidance of Ref. 15.4-10, AST radiological consequence analyses are performed for the four DBAs that result in offsite exposure (i.e., Loss of Coolant Accident (LOCA), Main Steam Line Break (MSLB), Fuel Handling Accident (FHA), and Control Rod Drop Accident (CRDA)).
Implementation consisted of the following steps:
- Identification of the AST based on plant-specific analysis of core fission product inventory,
- Calculation of the release fractions for the four DBAs that could potentially result in control room and offsite doses (i.e., LOCA, MSLB, FHA, and CRDA),
- Analysis of the atmospheric dispersion for the radiological propagation pathways,
- Calculation of fission product deposition rates and removal mechanisms, CHAPTER 15 15.4-12 REV. 20, SEPTEMBER 2020
- Calculation of offsite and control room personnel Total Effective Dose Equivalent (TEDE) doses.
15.4.9.5.1 Regulatory Approach The analyses are prepared in accordance with the guidance provided by Regulatory Guide 1.183 (Ref. 15.4-10).
15.4.9.5.2 Dose Acceptance Criteria The AST acceptance criteria for Control Room dose for postulated major credible accident scenarios such as those resulting in substantial meltdown of the core with release of appreciable quantities of fission products is provided by 10 CFR 50.67, which requires:
"Adequate radiation protection is provided to permit access to and occupancy of the control room under accident conditions without personnel receiving radiation exposures in excess of 0.05 Sv (5 rem) total effective dose equivalent (TEDE) for the duration of the accident."
This limit is applied by Regulatory Guide 1.183 to all of the accidents considered with AST.
The AST acceptance criteria for an individual located at any point on the boundary of the exclusion area (the Exclusion Area Boundary or EAB) are provided by 10 CFR 50.67 as 25 rem TEDE for any 2-hour period following the onset of the postulated fission product release.
The AST acceptance criteria for an individual located at any point on the outer boundary of the low population zone (LPZ) are provided by 10 CFR 50.67 as 25 rem TEDE during the entire period of passage of the radioactive cloud resulting from the postulated fission product release.
These limits are applied by Regulatory Guide 1.183 to events with a higher probability of occurrence (including CRDA, MSLB, and FHA considered herein) to provide the following acceptance criteria:
- For the BWR MSLB for the case of an accident assuming fuel damage or a pre-incident Iodine spike, doses at the EAB and LPZ should not exceed 25 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ). For MSLB accidents assuming normal equilibrium Iodine activity, doses should not exceed 2.5 rem TEDE for the accident duration.
- For the BWR CRDA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 24 hour2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> dose for LPZ).
- For the FHA, doses at the EAB and LPZ should not exceed 6.3 rem TEDE for the accident duration (2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> dose for EAB and 30 day dose for LPZ).
15.4.9.5.3 Computer Codes New AST calculations for the CRDA were prepared to simulate the radionuclide release, transport, removal, and dose estimates associated with the postulated accident scenarios.
The RADTRAD computer code (Ref. 15.4-13) endorsed by the NRC for AST analyses was used in the calculations for the CRDA. The RADTRAD program is a radiological consequence CHAPTER 15 15.4-13 REV. 20, SEPTEMBER 2020
LGS UFSAR analysis code used to estimate post-accident doses at plant offsite locations and in the control room. The CRDA assessment takes no credit for control room isolation, emergency ventilation or filtration of intake air for the duration of the accident event.
Offsite X/Qs were calculated with the PAVAN computer code (Ref. 15.4-14), using the guidance of Regulatory Guide 1.145 (Ref. 15.4-15); control room X/Qs were calculated with the ARCON96 computer code (Ref. 15.4-16). The PAVAN and ARCON96 codes generally calculate relative concentrations in plumes from nuclear power plants at offsite locations and control room air intakes, respectively.
All of these computer codes have been used by the NRC staff in their safety reviews.
15.4.9.5.4 Source Terms Core Inventory The inventory of reactor core fission products used in RADTRAD for the AST CRDA analysis is based on maximum full power operation at a power level of 3527 MWth, which includes a 2%
instrument error per Reg. Guide 1.49 (Ref. 15.4-17). The fission products used for the accidents are the 60 isotopes of the standard RADTRAD input library, determined by the code developer as significant in dose consequences. These were extracted from Attachment A of the LGS Design Analysis LM-0645 (Ref. 15.4-18), and correspond to 24 month cycle burnup parameters, conservatively calculated using the ORIGEN 2.1 code.
Reactor Coolant Inventory The reactor coolant fission product inventory for CRDA analysis is based on the Technical Specification concentration limits.
Release Fraction Current design basis accident evaluations as modified by Regulatory Guide 1.183 (Ref. 15.4-10) were used to determine the specific releases of radioactive isotopes at the given stages of fuel pin failure and provide these releases as a percentage of the total release for each accident, as summarized below.
15.4.9.5.5 Methodology Dose Calculations As per Regulatory Guide 1.183 {Ref. 15.4-10), Total Effective Dose Equivalent (TEDE) doses are determined as the sum of the CEDE and the Effective Dose Equivalent (EDE) using dose conversion factors for inhalation CEDE from Federal Guidance Report No. 11 (Ref. 15.4-19) and for external exposure EDE from Federal Guidance Report No. 12 (Ref. 15.4-20).
Table 15.4-11 lists key assumptions and inputs used in the CRDA analysis. The design basis CRDA involves the rapid removal of a highest worth control rod resulting in a reactivity excursion that encompasses the consequences of any other postulated CRDA. The core performance analysis shows that the energy deposition that results from this event is inadequate to damage fuel pellets or cladding. However, for the dose consequence analysis, it CHAPTER 15 15.4-14 REV. 20, SEPTEMBER 2020
LGS UFSAR was assumed that 1200 fuel pins in the full core were damaged, with melting occurring in 0.77 percent of the damaged rods. This is applicable to the currently limiting assumption of a core loaded solely with 10 x 10 GE14 or GNF2 fuel. A core average radial peaking factor of 1.7 was also assumed in the analysis, consistent with core operating limit report bases, as suggested in Regulatory Guide 1.183.
Releases to the environment are possible via two pathways. The first is through the Main Condenser. The main condenser is assumed to leak activity into the Turbine Building (TB) at a rate of 1% per day. This activity is then released, unfiltered, to the environment by way of the North Vent Stack, taking no credit for holdup in the TB. The north vent stack is the most conservative release point with respect to the Control Room intake, as the normal release pathway via the South Stack is further from the intake, with lower X/Qs.
The second pathway is through the Steam Jet Air Ejectors. When in operation, the Steam Jet Air Ejectors (SJAE) discharge to the augmented off-gas system. The augmented off-gas system charcoal delay beds in this scenario substantially delay noble gas release and essentially eliminate iodine release.
Both were evaluated in Ref. 15.4-12, and the first release scenario, through the main condenser, was found to clearly be the bounding DBA.
The analysis assumptions for the transport, reduction, and release of the radioactive material from the fuel and the reactor coolant are consistent with the guidance provided in Appendix C of Regulatory Guide 1.183, and are provided in the design analysis of Ref. 15.4-12.
15.4.9.5.6 Atmospheric Dispersion Factors (X/Qs)
Table 15.4-12 lists X/Q values used for the control room dose assessments, as derived in UFSAR Chapter 2 and applied for release points applicable to the CRDA.
Table 15.4-12 lists XIQ values for the EAB and LPZ boundaries, as also derived in UFSAR Chapter 2 and applied for release points applicable to the CRDA.
15.4.9.5.7 Summary and Conclusions The radiological consequences of the postulated CRDA are given in Table 15.4-13. As indicated, the control room, EAB, and LPZ calculated doses are within regulatory limits after AST implementation.
15.4.10 REFERENCES 15.4-1 C.J. Paone, "Banked Position Withdrawal Sequence," NEDO-21231, (January 1977).
15.4-2 J.A. Wooley, "Three-Dimensional Boiling Water Reactor, Simulator," NEDO-20953, (May 1976).
15.4-3 "NRC Standard Review Plan", Washington, D.C., (November 24, 1975).
CHAPTER 15 15.4-15 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4-4 P.O. Stancavage and E.J. Morgan, "Conservative Radiological Accident Evaluation
- The CONACO1 Code," NEDO-21143, (March 1976).
15.4-5 D. Nguyen, "Realistic Accident Analysis - The RELAC Code," NEDO-21142, (October 1977).
15.4-6 N.R. Horton, W.A. Williams, and K.W. Holtzclaw, "Analytical Methods for Evaluating the Radiological Aspects of General Electric Boiling Water Reactors," APED-5756, (March 1969).
15.4-7 NEDO-31400A, Safety Evaluation for Eliminating the Boiling Water Reactor Main Steam Line Isolation Valve Closure Function and Scram Function of the Main Steam Line Radiation Monitor, October 1992.
15.4-8 Letter, A.C. Thadani, NRC, to George J. Beck, BWROG, May 15, 1991 -
Subject:
Acceptance for Referencing of Licensing Topical Report NEDO-31400.
15.4-9 U. S. Atomic Energy Commission, Technical Information Document (TID) 14844, "Calculation of Distance Factors for Power and Test Reactor Sites," March 23, 1962.
15.4-10 U.S. Nuclear Regulatory Commission Regulatory Guide 1.183, "Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors," July 2000.
15.4-11 U.S. Nuclear Regulatory Commission Standard Review Plan 15.0.1, "Radiological Consequence Analyses Using Alternative Source Terms," Revision 0, July 2000.
15.4-12 LGS Design Analysis LM-0643, Rev. 2, "Re-analysis of Control Rod Drop Accident (CRDA) Using Alternative Source Terms."
15.4-13 RADTRAD Code, "A Simplified Model for Radionuclide Transport and Removal and Dose Estimation," Version 3.03.
15.4-14 PAVAN Code, "An Atmospheric Dispersion Program for Evaluating Design Bases Accidental Releases of Radioactive Materials from Nuclear Power Stations."
15.4-15 U. S. Nuclear Regulatory Commission Regulatory Guide 1.145, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," Revision 1, November 1982.
15.4-16 ARCON96 Code, "Atmospheric Relative Concentrations in Building Wakes.
15.4-17 U. S. Nuclear Regulatory Commission Regulatory Guide 1.49, "Power Levels of Nuclear Power Plants," Revision 1, December 1973.
15.4-18 LGS Design Analysis LM-0645, Rev. 3, "Re-analysis of Fuel Handling Accident (FHA) Using Alternative Source Terms.
CHAPTER 15 15.4-16 REV. 20, SEPTEMBER 2020
LGS UFSAR 15.4-19 Federal Guidance Report No. 11, "Limiting Values of Radionuclide Intake and Air Concentration and Dose Conversion Factors for Inhalation, Submersion, and Ingestion," 1988.
15.4-20 Federal Guidance Report No. 12, "External Exposure to Radionuclides in Air, Water, and Soil," 1993.
15.4-21 005N2836-R0, "Removal of Generic ARTS Rated RWE DCPR for Limerick Units 1 and 2, Nine Mile Point Unit 2, and Peach Bottom Units 2 and 3," August 2019.
CHAPTER 15 15.4-17 REV. 20, SEPTEMBER 2020
LGS UFSAR Table 15.4-1 SEQUENCE OF EVENTS FOR CONTROL ROD WITHDRAWAL ERROR IN POWER RANGE
- Operator selects (the RBM is automatically normalized) and withdraws high worth control rod.
- The RBM system indicates excessive local peaking. Operator ignores the alarm and continues to withdraw control rod.
- The RBM system initiates a rod block, inhibiting further withdrawal.
- Operator verifies fuel thermal limits are satisfied before renormalizing RBM to further withdraw control rod.
CHAPTER 15 15.4-18 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.4-3 SEQUENCE OF EVENTS FOR ABNORMAL STARTUP OF IDLE RECIRCULATION PUMP(1)
TIME (sec) EVENT 0 Start pump motor.
9.0 Startup loop flow starts to increase significantly.
10.4 APRM neutron flux upscale scram initiated.
>50.0 Vessel level returning to normal and will stabilize quickly.
(1)
See Figure 15.4-2.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.
However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.4-19 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.4-4 SEQUENCE OF EVENTS FOR RECIRCULATION FLOW CONTROL FAILURE WITH INCREASING FLOW TIME (sec) EVENT 0 Simulate failure of single-loop control.
1.7 APRM neutron flux upscale scram trip initiated.
5.5 Turbine control valves start to close upon falling turbine pressure.
20.2 Feedwater decreases upon rising water level.
>100.0 Reactor variables settle into new steady-state.
(1)
See Figure 15.4-3.
NOTE: The results presented here are based on original plant conditions. Because this is not a limiting transient, this event was not reanalyzed for rerated conditions.
However, the general trends and characteristics as shown here are not expected to change.
CHAPTER 15 15.4-20 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.4-5 SEQUENCE OF EVENTS FOR MISPLACED BUNDLE ACCIDENT
- a. During core loading operation, bundle is placed in the wrong location.
- b. Subsequently, the bundle intended for this location is placed in the location of the previous bundle.
- c. During core verification procedure, error is not observed.
- d. Plant is brought to full power operation without detecting misplaced bundle.
- e. Plant continues to operate.
CHAPTER 15 15.4-21 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.4-6 INITIAL CONDITIONS AND RESULTS OF FUEL BUNDLE LOADING ERROR(1)
Reactor Power, % rated 100 Core Flow, % rated 100 For Largest CPR:
Core Exposure, MWD/ST 7810 Location of Error (29, 32)
Initial CPR without Fuel Loading Error 1.40 Minimum CPR with Fuel Loading Error 1.29 CPR 0.11 For Largest MLHGR:
Core Exposure, MWD/ST 5000 Location of Error (21, 54)
Initial LHGR (Assumed at Operating Limit), kW/ft 13.4 LHGR with Fuel Loading Error, kW/ft 16.97 Core Conditions Minimum CPR Operating Limit 1.22 Minimum CPR Safety Limit 1.06 (1)
Core conditions are assumed to be normal for a hot, operating core.
NOTE: This is a non-limiting event that has not been reanalyzed for power rerate. The results of this event are based on Cycle 1 conditions. This event is analyzed only for the initial core.
CHAPTER 15 15.4-22 REV. 14, SEPTEMBER 2008
LGS UFSAR Tables 15.4-7 through 15.4-10 Tables 15.4-7 through 15.4-10 DELETED CHAPTER 15 15.4-23 REV. 13, SEPTEMBER 2006
LGS UFSAR Table 15.4-11 CRDA - RADIOLOGICAL CONSEQUENCES KEY INPUTS AND ASSUMPTIONS KEY CRDA ANALYSIS INPUTS AND ASSUMPTIONS Input/Assumption Value Core Damage 1200 fuel rods failed*
Percent of Damaged Fuel with Melt 0.77%
Radial Peaking Factor 1.7 Condenser Leak Rate 1% per day Release Period 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> CREFAS System Initiation Not utilized Charcoal Delay Bed 816 hours0.00944 days <br />0.227 hours <br />0.00135 weeks <br />3.10488e-4 months <br /> for Xe Noble Gas Delay for SJAE pathway 35.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> for Kr
- A bounding value, per use of 10x10 GE14 or GNF2 fuel and associated 1.7 peaking factor assumptions.
CHAPTER 15 15.4-24 REV. 16, SEPTEMBER 2012
LGS UFSAR Table 15.4-12 X/Q VALUES FOR CRDA Onsite Control Room X/Q Values for the CRDA Releases1 Time Period X/Q (sec/m3) 0 - 2 hrs 6.88E-03 2 - 8 hrs 5.17E-03 8 - 24 hrs 2.04E-03 Note
- 1. North Vent Stack release to Control Room X/Q values based on ARCON96.
Offsite X/Q (sec/m3) Values for the CRDA Releases1 Time Period EAB X/Q (sec/m3) LPZ X/Q (sec/m3) 0 - 2 hrs 3.18E-04 ---
0 - 8 hrs --- 5.79E-05 8 - 24 hrs --- 4.10E-05 Notes:
- 1. North Vent Stack release to offsite locations X/Q values based on Regulatory Guide 1.145 methodology.
CHAPTER 15 15.4-25 REV. 14, SEPTEMBER 2008
LGS UFSAR Table 15.4-13 CRDA RADIOLOGICAL CONSEQUENCES ANALYSIS RESULTS CRDA Radiological Consequence Analysis Scenario 1 (Main Condenser Leakage - DBA)
Regulatory Limit Location Duration TEDE (rem) TEDE (rem)
Control Room 30 days 1.55 5 EAB Maximum, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 0.0454 6.3 LPZ 30 days 0.0318 6.3 Scenario 2 (SJAE Release)
Regulatory Limit Location Duration TEDE (rem) TEDE (rem)
Control Room 30 days 0.0225 5 EAB Maximum, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 0.0231 6.3 LPZ 30 days 0.00835 6.3 CHAPTER 15 15.4-26 REV. 18, SEPTEMBER 2016
LGS UFSAR 15.5 INCREASE IN REACTOR COOLANT INVENTORY 15.5.1 INADVERTENT HPCI STARTUP 15.5.1.1 Identification of Causes and Frequency Classification 15.5.1.1.1 Identification of Causes Manual startup of the HPCI system is postulated for this analysis, i.e., operator error.
15.5.1.1.2 Frequency Classification This transient is categorized as an incident of moderate frequency.
15.5.1.2 Sequence of Events and System Operation 15.5.1.2.1 Sequence of Events Table 15.5-1 lists the sequence of events for Figure 15.5-1.
15.5.1.2.1.1 Identification of Operator Actions Relatively small changes would be experienced in plant conditions as a result of inadvertent HPCI start-up. The operator should, after hearing the alarm that the HPCI has commenced operation, check reactor water level and drywell pressure. If conditions are normal, the operator should shut down the system.
15.5.1.2.2 System Operation In order to properly simulate the expected sequence of events, the analysis of this transient assumes normal functioning of plant instrumentation and controls; specifically, the pressure regulator and the vessel level control which respond directly to this event.
Required operation of engineered safeguards other than what is described is not expected for this transient event.
The system is assumed to be in the manual flow control mode of operation.
15.5.1.2.3 The Effect of Single Failures and Operator Errors Inadvertent operation of the HPCI results in a mild depressurization. Corrective action by the pressure regulator and/or level control is expected to establish a new stable operating state. The effect of a single failure in the pressure regulator will aggravate the transient depending upon the nature of the failure. Pressure regulator failures are discussed in Sections 15.1.3 and 15.2.1.
The effect of a single failure in the level control system has rather straightforward consequences including level rise or fall by improper control of the feedwater system. Increasing level will trip the turbine and automatically trip the HPCI system off. This trip signature is already described in the failure of feedwater controller with increasing flow. Decreasing level will automatically initiate scram at the Level 3 level trip and will have a signature similar to loss of feedwater control -
decreasing flow.
CHAPTER 15 15.5-1 REV. 16, SEPTEMBER 2012
LGS UFSAR 15.5.1.3 Core and System Performance 15.5.1.3.1 Mathematical Model The detailed nonlinear dynamic models described briefly in Section 15.1.2.3.1 are used to simulate this transient.
15.5.1.3.2 Input Parameter and Initial Conditions This analysis has been performed, unless otherwise noted, with plant conditions tabulated in Table 15.0-2.
The water temperature of the HPCI system was assumed to be 40F with an enthalpy of 11.0 Btu/lb.
Inadvertent startup of the HPCI system was chosen for analysis since it provides the greatest auxiliary source of cold water for the vessel.
15.5.1.3.3 Results Figure 15.5-1 shows the simulated transient. It begins with the introduction of cold water into the vessel through the core spray nozzles and the feedwater injection spargers. Within one second the full HPCI flow is established (2,000 gpm through the core spray and 3,600 gpm through the feedwater). The HPCI flow split event is conservative because it maximizes the decrease in the core inlet. No delays were considered because they are not relevant to the analysis.
Addition of cooler water through the feedwater sparger increases core inlet subcooling, causing power to go up. The effect of the cool water through the core sprays, however, is some small condensation of steam in the upper plenum, resulting in a mild depressurization. The loss of steam flow through the condensation process is small when compared to the gain in steam flow that is due to subcooling change. The combined effect is a decrease in reactor pressure, along with some increase in reactor power. The event is a relatively mild transient, and MCPR remains well above the safety limit.
15.5.1.3.4 Consideration of Uncertainties Important analytical factors, including reactivity coefficient and feedwater temperature change, have been assumed to be at the worst conditions so that any deviations in the actual plant parameters will produce a less severe transient.
15.5.1.4 Barrier Performance Figure 15.5-1 indicates a slight pressure reduction from initial conditions, therefore, no further evaluation is required as RCPB pressure margins are maintained.
15.5.1.5 Radiological Consequences Since no activity is released during this transient, a detailed evaluation is not required.
15.5.2 CHEMICAL VOLUME CONTROL SYSTEM MALFUNCTION (OR OPERATOR ERROR)
CHAPTER 15 15.5-2 REV. 16, SEPTEMBER 2012
LGS UFSAR Not applicable to BWR. This is a PWR transient.
15.5.3 OTHER BWR TRANSIENTS WHICH INCREASE REACTOR COOLANT INVENTORY These transients are discussed and considered in Sections 15.1 and 15.2.
CHAPTER 15 15.5-3 REV. 16, SEPTEMBER 2012
LGS UFSAR Table 15.5-1 SEQUENCE OF EVENTS: INADVERTENT HPCI STARTUP(1)
TIME (sec) EVENT 0 Simulate HPCI cold water injection.
1.0 Full flow established for HPCI.
45 Depressurization effect stabilized.
(1)
See Figure 15.5-1.
CHAPTER 15 15.5-4 REV. 13, SEPTEMBER 2006