SNRC-1261, Rev 1 to Transient Analysis Lesson Plan

Rev 1 to Transient Analysis Lesson Plan

ML20198Q787
Person / Time
Site:	Shoreham File:Long Island Lighting Company icon.png
Issue date:	05/30/1986
From:	LONG ISLAND LIGHTING CO.
To:
Shared Package
ML20198Q777	List: ML20198Q774 SNRC-1261, Rev 1 to Transient Analysis Lesson Plan
References
PROC-860530, SNRC-1261, NUDOCS 8606090367
Download: ML20198Q787 (34)

Text

_.

r tE ATTACHMENT 1

. SNRC-1261 I

TRANSIENT ANALYSIS LESSON PLAN HOT LICENSE 960 Prepared by sw Training Instructor / Date f .[r g REV. 1 Approved by: M ,

l '.AieL -'

Of ration Training Spec / Date l

DISC: HOUT27 TA-LP 8606090367 060605  !

CDR ADocx 03000322 PDR l

I

t.

O V

I OBJECTIVES A. Given a transient, state all procedures which must be consulted.

B. Given a transient, state the inmediate actions required by SNPS procedures.

C. Given the control room indications for selected transients, identify that transient.

D. Given a transient and the control room mimic, identify systems and/or components that have failed to automatically operate as required (i.e., failed to initiate, failed to isolate, etc.)

1 E. For those malfunctions covered in objective D, state required i

operation response as per SNPS procedures.

II DEFINITIONS A. ABNORMAL OPERATING TRANSIENTS (A.0.T.)

1. An A0T is a transient that results in parameter changes caused by a single equipment failure or operator error which could be reasonably expected over the lifetime of the plant.

! 2. Unacceptable results for an A0T.

a. A release of radioactive material to the environment that exceeds the limits of 10CFR20.

b. A fuel cladding failure.

, c. A nuclear system stress in excess of that allowed for transients by applicable industry codes.

3. An operator error is defined as an active deviation from written operating procedures or nuclear power plant standard operating practices. It is the set of actions that are a direct consequence of a single erroneous decision. Operator errors are limited to the following:

a. Those actions that could be performed by one person,

b. Those actions that would have constituted a corraet 4

procedure had the initial decision been correct.

c. Those actions that are a subsequent to the initial i

operator error and have an effect on the designed

' operation of the plant, but are not necessarily directly related to operator error.

e' 4 Examples of operator errors:

a. Operation above the 100% rod line by withdrawal of control rods in the specified sequence (unless 105%

CTP/k'T has been analyzed for).

b. Selection and withdrawal of an out of sequence rod.

c. Incorrect calibration of the APRM's.

d. MSIV closure due to misinterpretation of an alarm or indication.

e. Opening or closing of any single valve.

f. Starting or stopping of any single component (pump, etc.)

g. Any single electrical failure.

5. To avoid the consequences of an unacceptable result for an A0T steady y state operating limits are established,

a. Unacceptable results a and b are avoided by requiring that 99.9% of the fuel rods in the core would not be expected to experience boiling transition. This is met if, during abnormal operating transients, MCPR > 1.06.

b. RPV pressure must not exceed 110% of design or 1375 psig.

This requires the steam dome pressure to be less than 1325 psig.

c. Enthalpy of the fuel must be maintained ( 280 cal /gn to give sufficient margin to prompt fuel dispersal.

d. Linear heat generation rate must remain less than 25 kw/ft at the BOC and less than 20 kw/ft at the EOC. This limit is imposed by the requirement that strain on the cladding must be kept to 41% plastic strain.

B. Accidents

1. An accident is a situation that requires the functioning of the engineered safeguards, including contaiment. This implies that one or more of the fis, ion product barriers has failed or is not available.

2. It in not reasonably expected to occur during any phase of plant operation.

3. The consequences of a hypothetical accident are analyzed to demonstrate plant design and safety systems are sufficient to protect the health and safety of the public during all phases of.. station operation.

4. Design Basis Accident (DBA) is a particular accident with the most severe consequences for which the plant was designed to withstand and still protect the environment and public.

5. Plant response to any DBA is considered unacceptable if the following safety criteria are exceeded:

a. Radioactive material release which results in dose consequences that exceed the guide lines in 10CFR100.

b. Catastrophic failure of the fuel cladding including fragmentation of the fuel cladding and excessive fuel enthalpy,

c. Nuclear system stresses in excess of those allowed for accident by applicable codes.

d. Containment stress in excess of those allowed for accidents by applicable industry codes when containment is required.

e. Radiation exposure to plant operations personnel in the control roon in excess of 5 rem whole body, 30 rem inhalation and 75 ren skin.

6. Shoreham's FSAR breaks accidents into the following categories:

a. Decrease in core coolant temperature.

b. Increase in reactor pressure.

c. Decrease in reactor coolant flow.

d. F.eactivity and power distribution anomalies.

e. Increase in reactor coolant inventory.

f. Decrease in coolant inventory.

III ACCIDENT ANALYSIS A. Inadvertant opening of a safety / relief valve.

1. Event description (Figures 1 & 2).

a. The opening of a safety / relief valve allows steam to be discharged into the suppression pool. The sudden increase in the steam flow rate causes a mild depressurization transient.

f Y

2. Results and Consequences.

a. The pressure regulator will sense the pressure drop due to the increase steam flow and shut down on the turbine

, control valves to maintain vessel pressure near constant.

b. MCPR remains above the operating limit at all times.

3. Verification

a. The following are means of verifying an open SRV from the Main Control Room during power operation.

1. High Discharge Pipe Temperature.

2. High Discharge Pipe Pressure.

3. SRV Leaking Alarm.

4. Steam Flow. Feed Flow Mismatch.

~

5. Reactor Water Level will firs swell and then shrink.

(If one SRV opened and stuck open, level will steady out at about 2" below normal).

6. Reactor Power will decrease and then return to its original level (Assuming no Scram).

7. The Turbine control Valves will close dovn.

8. Generator Megawatt output will decrease.

9. Suppression Pool Temperature will increase.

10. If Solenoid actuated the SRV Red Indicating Itght will be on.

4. Annunciators i

a. No. 1337 SRV Leaking - This annunciator indicates that j

one or more SRV's is leaking by or is open. The

' annunciator is initiated by an SRV High Discharge Pipe Temperature from the Temperature Recorder on 4

1H11*PNL-614 If the annunciator comes in the temperature recorder will have to be checked to determine 1 which valve has a high temperature and a reset button on the recorder must be pushed to allow the annunciator to 1

be cleared.

b. No. 1350/1351 ADS System A/B SRV Open or Power Tailure - j This annunciator indicates that one or more ADS or Relief l Valve Solenoids has been energized or that Solenoid Power has been lost.

i 1

t 1

t t

i l

4. -

l l.- '

5. Operator Actions.

1 a. ARP #1337.

1 i

{ 1. Check reactor pressure and level near normal.  !

l i l

2. Determine using steam flow vs. feed flow whether 3 valves weeping or has lifted.

3. Check suppression pool temperature 1 90'F. l 1

I )

] 4. On TR-100 on PNL-614 or PMU-501 on PNL-601, check j where valve is leaking or has lifted.

j 5. If one valve inadvertently opened, try to close the j

valve using the control switch in PNL-602. '

?

i 6. SP 23.116.01 1

1. If Safety Relief Valve fails OPEN:

j CAUTION: Closelv monitor reactor level and pressure. Note '

j the LCO's of Reference 11.2 and 11.3.

4 l ,

a. Attempt to reset the Open Valve by placing valve j switch to the OPEN then CLOSE position two times.

i i

b. If the Relief Valve cannot be reclosed, or if '

) Suppression Pool Temperatures exceed 90*F or within 1

2 minutes SCRAM the Reactor and follow SP29.010.01, I Energency Shutdown.

i i

! c. Start the RHR System in the Suppression Pool cooling j mode, i 2. If a Safety Re"af . Valve leak is indicated

a. Monitor Suppression Pool level and temperature in

] accordance with technical specifications section j 3.6.2.1.

! b. Monitor Safety /Reflief valve tailpipe temperatures, I

and pressure.  !

c. If indications show valve weeping ensure compliance l j with technical specificatons sections 3.4.2 & 3.5.1.  ;

)

• l

! , d. If valve is blowing OPEN and CLOSE valve in an

} attempt to re-seat it. i

\

< \

i -

l l

i 1 l

B. CORE COOLANT TEMPERATURE INCREASE

1. Event Description (Figures 3 & 4)

a. The loss of shutdown cooling capability can only occur during the low pressure portion of a normal shutdown and cooldown. At low pressure in the shutdown and cooldown the main condenser vacuum may be lost because of low steam supply pressure to the steam jet air ejectors or turbine gland seals. The loss of cooling can be caused either by the loss of service water to the shutdown cooling heat exchangers, or by failure of a valve in the loop by which the water is circulated to the heat exchangers. Neither of the failures causing loss of cooling are a threat to safety; cooldown is simply reestablished using other equipment.

b. Alternate methods of decay heat removal and inventory control are available to the operator. A selection should be based upon availability of the systems to be used, the quantity and quality of available makeup water, the stresses to be placed on the system and related system and the expected overall results of their use.

c. Some alternate system / methods of decay heat removal and inventory control:

1. Feedwater system, core spray or low pressure injection system can be used to supply make-up water while pressure is controlled by manual operation of the relief valves.

2. A flow path through safety grade equipment can be established from the vessel through the relief valves to the suppression pool, and from the pool through the LPCI/RHR heat exchangers back to the vessel. The vessel would be depressurized with relief valves to below the shutdown cooling interlock pressure, to avoid damage when flooding the steam lines. With one relief valve held open level would be raised to flood a steamline and establish flow to the pool. The vessel cooldown rate can be controlled by varying the return flowrate to the vessel. Injection may have to be used to hold the vessel above the minimum pressure for opening the relief valves. No unique safety actions are required and fuel barrier integrity is not threatened.

3. Another way to provide a closed circulation path with a heatsink would be to flood the hotwell with clean-up blowdown above the tubes (providing heat

.' transfer across the tubes) and returning water through the condensate pumps.

1-i j

1

4. Other schemes to provide a controlled cooldown would i be use of cleanup non-regenerative heat exchangers

] (although these have only a small heat sink which r will initially be less than decay heat) or one of 4

many " feed and bleed methods" e.g., condensate i storage tank to vessel and clean up reject to Radwaste.

i f d. In order to prevent vessel heatup/ pressurization when j shutdown cooling is established, an accurate measure of

! vessel bulk water conditions should be monitored. For i instance, if shutdown cooling flowrate is very low, 2

vessel suction temperature may not be an accurate

indicator because of heat loss to ambient. Also if the 5 recirc pumps are off and water level is at or below

] normal there may be insufficient natural circulation to i mix the downcomer and core to even temperatures.

i j e. Some or all of the following methods can be used during

{ cold shutdown to ensure adequate decay heat removal and in-core temperature monitoring.

f. If the reactor is under cold shutdown conditions, operate j at least one SDC/RHR pump as required at rated flow.

1 This will provide adequate mixing and with normal heat

, removal capability, temperatures will be maintained below 1 212'F.

i

. g. If the SDC/RHR system requires maintenance that will j render the system inoperable or restrict its performance i for extended periods of time, it is recommended that this 3 maintenance be done during outage periods when the reactor cavity is flooded with the vessel head removed. -

j This will provide extensive amounts of water above the t

core for cooling and a complete circulation path.

Depending on the length of time after shutdown, it may be

helpful to run the fuel pool cooling system to control i pool temperature.

i

h. If the SDC/RHR system is not available and RPV head removal is not feasible, then the vessel metal surface j temperature and pressure should be monitored and the J following implemented: ,

t l

i

! 1. The vessel head spray should be operated as j required, if available.  ;

2. The RPV water level should be raised to above the '

j 1

bottom of the predryarn on the moisture separator. i

! 3. The RWCU system should be operated when possible. ,

with a maximum amount of heat being removed fron the l l -

vessel. '

e i

4

-s-

j i

i

4. A recirculation pump can be periodically started to 3 provide RPV fluid mixing and accurate reactor coolant temperature measurement. CAUTION: Such restarts should be minimized and should follow technical specification limits and other normal f precautions for equipment and pump seal protection.

f 1. If the monitored temperatures and pressure in h above are not being maintained then ensure that the reactor water i level is above the bottom of the predryers and prepare

] the plant for operation above 212*F.

I

2. Results and Consequences l

a. For most single failures that could result in loss of j shutdown, cooling no unique safety actions are required.

In these cases, shutdown cooling is simply reestablished  ;

j using other, normal shutdown cooling equipment. In cases 4

where the RHR shutdown for cooling section line becomes l inoperative, a unique requirement for cooling arises. In 1 operating states in which the reactor vessel head is off, i

the LPCI can be used to maintain water levels. In states

) in which the reactor vessel head is on and the system can i j be pressurized, the low pressure cooling system, relief j valves (manually operated), and RHR suppression pool

{ cooling mode can be used to maintain water level and  ;

1 remove decay heat. The worst single failure which can be j postulated for this transient is failure of the diesel l generator. However, loss of either Division I or II j: diesel does not negate the core cooling capability of the RHR.

• i 1 b. Failure of Division I disables the RHR A and CS A

{ systems. In this case, the RHR B, C, and D loops are j available to cool the core in the shutdown cooling mode, i

j Failure of Division II disables the RHR B and CS B systems. In this case, the RHR A, C, and D loops are available to cool the core in the shutdown cooling mode, t j Failure of Division III disables the RHR C and D loop i

( pumps. In this case, the RHR A and B loops are available l to cool the core in the shutdown mode. t i

\' c. There is no single failure which could simultaneously preclude the RHR system's ability to draw water from the

! suppression pool or recirculation loop.

J

) 3. Verification ,

1 ,

i I a. The following are means of verifying a loss of shutdown cooling.

1. RHR SYS I DISCH HDR'or SHUTDOWN SUCT HI PRESS 1

2. RHR PUMP TRIP i

! i

4 i

, ~.

3. RHR HX DISCH CW HX A or B HI TEMP

., 4. RX Cooldown rate decreases

5. RHR loop flow indicator drops to zero

4. Annunciators

a. The following parameters are annunciated in the Main Control Room:

Annunciator ARP# Control Room Verification

1) RHR HX A/B DISCH COOL 1120 1.a) IE41-TR-100 on *PNL-614 WTR TEX 1' HI b) P41*MOV-034 A(B) valve position.

2) RHR SYS A(B) DISCH HDR/SDC 1122(3) 2.a) A(B) HX SHELL PRESSURE SUCT PRESS HI b) *MOV-047(408) valve position.

, 3) RHR PUMP A(B,C.D) TRIPPED 1134(5,6,7) 7.a) Green stop light illuminated b) White light ' dim' c) ' Red' Flag on control switch for pump

5. Operator Actions

! a. SP 29.020.01 1 1. The operator should immediately attempt to restore i

the affected shutdown cooling loop to operation.

2. If the affected loop cannot be restored one of the

, following methods should be established to renove

decay heat. Plant conditions must be evaluated at this time to determine which method.

3. If shutdown cooling is lost shortly after it was initiated and none of the systems associated with using the main condenser have been altered, reestablish the main condenser as a heat sink.

4. If the alternate RHR loop is unaffected use it for shutdown cooling per of SP 23.121.91, i

i 1

?

1 J

5. Reactor pressure greater than 75 psig.

a) If reactor level is greate. than 54.5" complete the following:

1. Drain the reactor vessel to 33.5".

ii. Ensure that the RCIC steam line is drained by verifying that alarm number 1988 RCIC TURB INLET STM LINE WTR DRAIN POT HI LEV is extinguished, iii. Reset the RCIC Turbine Trip Throttle 1E51*MOV-944 by closing and reopening it.

b) Start RCIC manually by turning the collar of the MANUAL INITIATION pushbutton to the ARMED position and depressing the pushbutton on panel 1H11*PNL-602.

c) Maintain reactor level between 34" and 42".

d) Maintain reactor pressure constant by using RCIC on recirculation flow to the CST per SP 23.119.01.

e) Monitor the suppression pool water temperature.

When the temperature exceeds 90*F initiate suppression pool cooling per operating procedure SP 23.121.91.

6. Reactor pressure less than 75 psig (using the reactor water cleanup system).

a. If necessary, start a second Reactor Water Cleanup (RWCU) pump and filter demineralizer (F/D) per SP 23.799.91.

b. Ensure maximum flow of RBCLCW through the non-regenerative hent exchangers.

i

c. Insure the RBCLCW heat exchanger outlet temperature controllers are set at 95'F to have maximum cooling of the r.on-regenerative heat exchangers.

d. If possible, reject coolant to either the main condenser or radwaste and add water to the vessel using a normal injection subsystem.

4

7. Reactor pressure less than 75 psig (using the Reactor Core Isolation Cooling System).

a. Let the reactor pressure increase above 75 psig, then follow section 4.3 of this procedure.

8. Reactor pressure vessel head off and refueling cavity filled with water.

a. Verify that the gates between the spent fuel storage pool and the refueling cavity are removed.

b. Verify that both Fuel Pool Cooling Pumps IG41*P-923 A & B, and both Fuel Pool Heat Exchangers 1G41*E-19A and B are in operation.

If not, start the idle pump and valve in the heat exchanger,

c. Verify that the fuel pool cooling pump suction is from the refueling cavity and the discharge is to the spent fuel storage pool.

d. Increase RWCU flow per section 4.4 of this procedure if additional cooling is required.

e. If not running, and operation is permissible, start a reactor recirculation pump (s) to prevent stratification in the vessel.

C. ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS).

1. Event description: incomplete control rod insertion event (Fig. 5-10).

a. No BWR has ever experienced an ATWS or even a failure of the RPS and control rod system to effectively perform its function and bring about a substantial power reduction.

On one occasion during plant shutdown a scram was initiated, as part of normal operating procedure, and many control rods failed to fully insert. This has been called an Incomplete Control Rod Insertion Event. An examination of this occurrence will aid understanding of the performance of the control rod / scram system.

b. The plant had commenced a routine shutdown to perform maintenance. The initial power reduction from 1082 MWe to 542 MWe van performed by slowly reducing recirculation

flow through the reactor core by decreasing recirculation

, pump speed.

1

,=

k i

i

c. With the recirculation pumps operating at medium speed, additional power reduction to 400 MWe was acconplished by normal insertion of selected control rods.

d. At this time plant conditions were as follows:

1. Power Level 36% of rated

2. Reactor Pressure 920 psi

3. Vessel Level 35 in.

4. Generator Output 400 MWe

5. Control Rod (CR) 157 CRs were full out Pattern (Shown in 10 CRs were full in Figure SA) 18 CRs were at inter-mediate positions

e. Following a manual scram (NORMAL shutdown procedures for this Plant) some control rods were observed to have not inserted fully. Reactor power and pressure dropped

]

significantly, almost as low as for a complete scram.

Reactor water level fell below the low level (L3) scram setpoint due to void collapse; this is not unusual following a scran.

4 f. Operators carried out the scram and turbine trip procedure and noted that some control rods did not insert fully. They repeatedly bypassed the scram, drained the instrument volume, reset the scram and scrammed again.

The second and third scrams produced a little control rod movement. On the fourth scram, the rods which were not fully inserted scrammed and fully inserted. After this point all rods were fully inserted. The shutdown was continued and the cause of the failure investigated. A more detailed sequence of events'follows in Table I.

i

g. Indications / Alarms.

1) Neutron flux reduction (normal).

> l

2) Pressure drop (normal).

3) Some rods not fully inserted as indicated by full core display.

4) Water level drop to L3 (normal).

h. Operator Actions.

CRD system was repeatedly reset and scrammed.

l l:

TABLE I Time SEOUENCE OF EVENTS C & D) indicated on scale values (Figure 8). The readings of the fully inserted 1RMs were approximately mid-range on range five or six.

During and after this scram no other unusual or unexplained variations in plant parameters were observed. Total steam flow dropped sharply during this scram to approximately 10 to 15% of the prescram value. Reactor pressure decreased from j 920 to approximately 900 psi (this pressure remained approximately constant throughgut the remainder of the event).

4 Core flow decreased to 22 x 10 lb/hr. This decrease was due to the loss of natural circulation driving head when reactor power was reduced. Based on steam flow, the heat generation within the reactor was very close to the heat generation j

expected from decay heat alone, verifying that the insertion of the rods had virtually stopped the fission process.  !

l j 8 sec. Low reactor water level trip occurred. (This corresponds to Level 3, which is 180.5 in above the top of the active fuel).

i The water level decrease was due to void collapse following the scram. From plant recorders, it was later verified that the minimun' water level reached during this event remained

! well above the level required for high pressure injection

systems initiation.

The level variation, including maximum and minimum values, was

] well within the expected range during a normal scram.

j 18 sec. The scram discharge volume "high-high" level was reached.

I This occurred 18 sec. after the manual scram. This normally occurs approximately 40 see after a scram. Subsequent l investigation confirmed that all "high-high" instrument volume {

i level switches were properly calibrated and functioning. The  ;

"high" instrument volume level switches were found to be malfunctioning. i 24 sec. The main turbine was tripped as part of normal procedure.

45 sec. The low reactor water level trip was reset.

Upon achieving normal water level, one feedwater pump, two condensate booster pumps and one condensste pump was secured.

4 sin, 27 see The scram was reset and the hydraulic control unit j

accumulators were recharged until the alarm lights cleared.

! 6 sin, 4 see A second scram was manually initiated for the purpose of i

i .

inserting the remaining seventy rods. Within several seconds after this scram, operating personnel observed that:

o All blue scram lights and accumulator alarm lights were lit and scram pilot lights were out as expected.

! o Rod movement was indicated, but motion appeared slower than normal.

o Some rods were indicated to be not fully inserted.

Subsequent review of plant recorders and printouts indicated that:

1 o A total of 59 rods were still not fully inserted. The a rod pattern at this time is shown by Figure 6A. Maj or j plant parameters (steam flow, core flow, water level and j reactor pressure) remained essentially unchanged throughout the scram.

o Fluctuations of IRM sensor readings prevent determination of actual affects due to the scram.

7 min, 3 sec. The scram was reset and the hydraulic control unit accumulators recharged until the alarm lights cleared.

7 min, 56 sec. A third manual scram was initiated. Operating personnel j observed that:

o All blue scram lights and accumulator alarm lights were lit and scram pilot lights were out.

o Rod movement was indicated, o Some rods were indicated to be not fully inserted.

Information obtained later from plant recorders shows that:

o A total of 47 rods were still not fully inserted. The rod pattern at this time is shown in Figure 6B.

i o LPRM readings (process computer output) all indicated "0" I

except one, which was failed, o All major parameters discussed above remained approximately constant throughout this scram.

i

) 11 min, 21 sec. The scram was reset for the third time and the hydraulic

control unit accumulators were recharged until the lights j cleared.

! 14 min. 01 sec. The operator placed the scram discharge volume (SDV) bypass switch in " normal" which resulted in a scram since the SDV was nog actually fully drained. This is the fourth scram in this se'quence of events.

14 min. 01 sec. Operating personnel observed that:

o- All rods were fully inserted (Figure 7).

o Rod insertion rate appeared normal for a scram. All blue scram lights and accumulator alarm lights were lit.

o Plant parameters and conditions were as normally expected following a scram.

15 min, 14 sec. The operator initiated a manual scram (confirmatory).

16 min, 27 sec. The scram was reset.

{

26 min, 18 sec. The discharge volume high water level trips (50 gal scram trips) cleared. Note that this took substantially longer than

, in the first three scrams.

2. Event description: FSAR transient.

a. The design and performance of the BWR scram system, including both protection system and actuator system

) functions, have been thoroughly described in the past with special emphasis on the extremely high integrity and reliability of the total protection function such that it is virtually incapable of failure. Hence the causes for a complete failure of the BWR scram system remain undefined and the imposition of the new design basis is unnecessary. The following sections describe the approach taken to this postulated event.

b. The reactor is usually assumed to be initially operating at 105 percent of NBR steam flow when an abnormal 4

operational transient occurs; some events, however, are stimulated from lower initial conditions.

c. An abnormal operational transient is initiated and the scram system is postulated to fail to operate as required. All other reactor systems operate properly.

When pressure reaches a preselected high level or when reactor water level drops to a specified low value, the two recirculation pumps are tripped automatically to i

, decrease the power level. Operator action then either initiates a manual scram or injects liquid poison into I

the reactor. ,

3. Results and consequences,

s. The radiological offsite doses calculated for this event are within 10CTR100 guidelines. Tripping of the recirculation pumps is quite effective in keeping reactor

' power, pressure and temperature well below the safety '

• limits associated with the above limitations; thereby allowing ample time for the operator to manually insert

_. _ . _ . _ ~. ~ _. . _ . _ . . _ . . __ .. _ , _ _ .

1 4

j .-

?

\

the control rods or initiate the injection of liquid 1 poison.

r. b. Poorest specified characteristics of all systems such as relief valves, isolation valves and high pressure cooling

, injection (HPCI) pumps were assumed throughout the topical analyses. A conservative multiplier was applied l to the void reactivity coefficient making all power 1 increase and pressurization transients most severe.

Expected variations in plant parameters should therefore

reduce the actual severity of the postulated events.

, 4. Verification.

i a. The following are means of verifying a proper reaction j scram: ,

j i 1. All LPRM downscale lights on. >

2. All rod full in lights on, j 3. Power decreasing at2r- 80 see Period to below range i 1 on IRM's.

) 4. Process computer print out of CRD position.

r j 5. Operator Actions.

! i

! a. FSAR i

l 1. Upon realization of a failure to scram situation the operator is to first attempt a manual scram by the '

numerous methods available from pressing the manual scram button to the breaking of specific pneumatic i lines. Should all these attempts fail, the operator '

is to initiate the injection of liquid poison into the vessel. Up to 10 minutes is available for this

, initiation. I

2. Each abnormal operational transient is assumed to

) occur concurrently with a failure-to-scram event while all other reactor systems operate properly; i i hence a common mode failure in scram is postulated, i Tripping the recirculation pumps is one of the most

l. effective practical power reduction mechanisms in  !

j the event of failure-to-scram because of the inherent shutdown effects associated with a j reduction in reactor coolant flow. A safe operation period of 10 minutes is allowed for the operator to j assess the failure-to-scram situation and attempt a 3 manual insertion of the control rods before

) initiating liquid poison injection into the vessel.

l further resolution is underway.

+

1 h., SP 29.924.91.

4

i *

1. Manually scram reactor per SP 29.919.91 (Emergency Shutdown).

i. Arm and depress manual scram pushbutton,

11. Place the Mode switch in shutdown, iii. Verify all rods are inserted.

. 2. M the reactor scrams AND all rods insert, AND power is decaying, THEN continue in SP 29.919.91.

t

3. Trip the recirculation pumps.

4. Commence suppression pool cooling per SP 23.121.01 (Residual Heat Removal (RHR) System).

5. The following attempts to scram the reactor are to be performed concurrently if manpower is available.

6. Insert those rods not fully inserted with the reactor manual control system as the Rod Sequence

] Control System (RSCS) permits.

7. Bypass the scram discharge volume high level scran {

. switches, reset the RPS trip and verify the vent and '

drain valves open.  ;

a. Alternately RESET the Reactor Protective System and SCRAM the reactor until all rods are fully j inserted.

8. Confirm all scram valves are open by observation of scram valve position lights. E not, THEN perform j the following:

i

! a. Remove fuses from the following panele:

j I

1. H11*PNL-699 Bay Al C71-F18A&E (32nd and 33rd fuse from top of fuse block), Bay I A2 C71-718C&G (33rd and 34th fuse from

.4 top of fuse block).

5 l

11. H11*PNL-611 Bay 51 C71-F18B&F (32nd i

and 33rd fuse from top of fuse block),

Bay B2 C71-F18D&H (33rd and 34th fuse from top of fuse block).

! b. Vent air from the scram air system by closing valve C11-92V-9794 and opening vent valve

]  !

l downstream of C11-91V-7104.

c. WHEN Control Rods are not moving inward, THEN install the fuses AND restore the air valves to normal.

i

I i

l

__ _. - . .~.

, 9. Bypass the scram discharge volume (SDV) high level

scram switches, reset the RPS trip and verify the vent and drain valves open.

a. INDIVIDUALLY SCRAM Control Rods at Local j Hydraulic Control Units (HCU's) by placing both j NORM-TEST-SRI switches to the TEST position.

10. E reactor power is above 6% RPV level cannot be

! maintained OR suppressio'n pool temperature reaches 110*F, THEN perform the following:

j a. Start either A or B standby liqufd control pump

and inject the entire contents of the tank.

11. E RWCU automatic isolation did not occur, THEN

! manually isolate RWCU.

) 12. Terminate all injection into the RPV with th'e

, exception of CRD and RCIC or HPCI to maintain RPV water level above the top of active fuel (TAF).

c. An ATWS is extremely unlikely but will require prompt j

operator action to mitigate the consequences. Operator j concerns are as follows:

,i j 1. Verify Recire. pumps trip.  ;

i

2. Shutdown the reactor.

I

! 3. Limit reactor pressure.

4. Maintain core covered.

]' 5. Limit suppression pool temperature.

6. Place plant in cold shutdevn.

! D. MAIN CONDENSER CAS TREATMENT SYSTEM FAILURE.

I

1. Event Description.

i

a. The offgas system, equipment and piping are designed to i

contain any explosion which has reasonable probability of i occurring. Therefore, an explosion is not considered as i a possible failure mode. The equipment vaults are not accessible during normal operation. Therefore, an operator-induced failure is not considered reasonable.

4 The only credible event which could result in the release l of significant activity to the environment is a tank ruptura due to an earthquake.

a b. Although the two vaults, which contain the offgas system charcoal adsorber tanks, are designed to Seismic Category I requirements and the adsorber tanks are designed for )

350 pais (ASME VII Division 1, 12/72), one charcoal adsorber tank is assumed to rupture during the '

4

,. earthquake, spilling half of its charcoal onto the floor

' ' of the vault. The fraction of fission noble gases, on the spilled charcoal, released to the vault atmosphere is

- 19 -

based on the equilibrium between noble gas in the vault and on the charcoal. The fraction of activity of each isotope released from the charcoal is given in the FSAR.

The charcoal is brought into contact with the vault atmosphere in such a manner to maximize the final concentration of fission noble gases in the vault atmosphere. There are no noble gases in the vault initially. The fission noble gases are released instantaneously from the charcoal and leak from the vault at one vault volume per d:f.

Approximate Event Elapsed Time

1. Event begins - system fails 0

2. Noble gases are released 0

3. Flow element and pressure 4(1 min indicator alarms alert plant personnel

4. Operator actions begin eC 20 min

2. Results and Consequences

a. There is no fuel damage or fission product release from the fuel as a result of this event.

3. Operator Actions

, a. Gross failure of this system requires its isolation from j the main condenser, i

Two flow elements, one upstrecm and one downstream of the charcoal adsorber tanks and a pressure sensor downstream alarm to indicate a rupture. A continuous alarm indicates the need'to isolate the offgas system. System isolation is remote manual, resulting in high condenser pressure and a reactor scram. The time required to isolate the system is less than 2 minutes after operator action begins. After isolation, the operator monitors the turbine generator auxiliaries and breaks vacuum as ,

I soon as possible. The operator notifies personnel to evacuate the area immediately and notifies radiation protection personnel to survey the area and determine requirements for reentry. The subsequent cooldown of the offgas system requires from 4 to 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />.

E. CONTROL ROD DROP ACCIDENT

1. Event Description (Figure 11) l a., The control rod drop accident is the result of a i postulated event in which a high worth control rod is 1

1

)

inserted out-of-sequence into the core. Subsequently, it becomes decoupled from its drive mechanism. The mechanism is withdrawn but the decoupled control rod is assumed to be stuck in place. At a later optimum moment, the control rod suddenly falls free and drops out of the core. This results in the removal of large negative reactivity from the core and results in a localized power excursion.

1) The design of the drive and its coupling uses high quality materials and it receives stringent quality control and testing procedures appropriate to other equipment typically listed in the critical component

{ list for a plant. Additionally, tests conducted under both simulated reactor conditions and conditions more extreme than those expected in reactor service have shown that the drive (or coupling) retains its integrity even after thousands of scram cycles. Tests also show that the drive and coupling do not fail when subjected to forces 20 times greater than that which can be achieved in a reactor.

2) The unlikely set of circumstances, referenced above, makes possible the rapid removal of a control rod.

The dropping of the rod results in high reactivity in a small region of the core. For large, loosely coupled cores, this would result in a highly peaked power distribution and subsequent operation of shutdown mechanisms. Significant shifts in the spatial power generation would occur during the course of the excursion.

3) The rod sequence control system (RSCS) limits the worth of any control rod which could be dropped by regulating the withdrawal sequence. This system prevents the movement of an out-of-sequence rod in the 100 to 75% rod density range, and from the 75%

rod density point to the present power level the RSCS will only allow banked position mode rod withdrawals or insertions.

l 4) The RSCS is assumed to operate throughout the event.

The RWM would provide the same protection as the RSCS if the RSCS was not functioning and the RWM was.

5) The termination of this excursion is accomplished by automatic safety features of inherent shutdown mechanisms. Therefore, no operator action during the excursion is rcquired. Although other normal plant instrumentation and controls are assumed to

.. function, no credit for their operation is taken in the analysis of this event.

6) The CRDA is categorized as a limiting fault because i

it is not expected to occur during the lifetine of

] the plant; but, if postulated to occur, it has j consequences that include the potential for the release of radioactive material from the fuel.

7) Sticking of the control blade in its fully inserted position is highly unlikely because each blade is equipped with rollers that make contact with the nearly flat fuel channel walls, travelling in a gap 4 or approximately 1/2-in. clearance. Since a control blade weighs approximately 186 lbs., even if it i

separates from its drive, gravity forces would tend to make the blade follow its drive movement as if it

, were connected. Control blade friction can be detected by settling differential pressure less than 30 psid and insertion differential pressure greater than 15 psid.

b. Thus, the assumed control rod drive / control blade

, separation does not, of itself, produce any unplanned or uncontrolled perturbation on normal plant operation that requires immediate operator action. This event, therefore, is not of immediate reactor safety consequence as is the LOCA. In most cases, if such a separation l

occurred, it is expected that the blade would not stick, but rather follow its drive movement. The separation  :

would be detected by no neutron monitoring system response during rod movement or at the next full,v withdrawn stroke where the ability to withdraw to the i

overtravel position would signal separation since the

! blade bottoms on a seat prevents withdrawal to the 1

overtravel position if connected. Thus, this drive could be inserted and declared inoperative in accordance with i the technical specifications until the next refueling

outage where it could be repaired. However, for this 1

analysis, it is presumed that the separated blade somehow sticks at the fully inserted position. This assumption sets up a condition whereby, if the drive were withdrawn, 4

the stuck blade could later fall to its drive position and cause a rod drop reactivity insertion accident.

j c. The consequences of a rod drop are mitigated by

! controlling the initial conditions. This is analoFous to j t

controlling APLHGR to mitigate the consequences of a j

} .LOCA.

i i

! d. Therefore this section will emphasize how procedural '

controls act to mitigate the accident and the sensitivity i -to differential critical conditions.

e. The sequence of events is given in Table II.

1 1

< I I

1

-l TABLE II SEQUENCE OF EVENTS FOR ROD DROP ACCIDENT Approximate Elapsed Time Event Reactor is operating at 50% rod density pattern.

RWM is not functioning Maximum worth control rod blade becomes decoupled from the CRD.

Operator selects and withdraws the control rod drive of the decoupled rod along with the other control rods assigned to the RSCS group.

Decoupled control rod sticks in the fully inserted or an intermediate bank position.

O Control rod becomes unstuck and drops to the drive position at the nominal measured velocity plus three j standard deviations. '

401 second Reactor goes on a positive period and initial power increase is terminated by the Doppler coefficient.

+

1C1 second APRM 120%'pewer signal scrams reactor.

405 seconds Scram terminates accident.

2. Results and Consequences

a. The design criteria for GE BWRs is that a rod drop will not produce a peak fuel enthalpy above 280 cal /gm which would cause fuel dispersal and pressure rise rates of 30 psi /sec and is well below the enthalpy (450 cal /gm) which will_(.ause rapid dispersal and pressure rise rates of 600 psi /aec. Although these enthalpies are above the clad failure threshold (170 cal /gm) less than one percent of the fuel is hotter than 170 cal /gm. As with the LOCA

' accidents the limited failure is acceptable and justified

by the low probability of the event. The design basis peak enthalpy of 280 cal /gm is set to prevent dispersal from sending shock waves through the vessel which could

',- damage internals or nozzles and is based on rapid

/ reactivity insertion tests tone at Idaho National Labs.

. b. The radiological evaluations are based on the assumed failure of 770 fuel rods. The number of rods which

' exceed the damage is less than 770 for all plant operating condition or core exposure provided the peak enthalpyislessthantye280 cal /gmdesignlimit.

' ~

e

c. The results of the compliance-check calculation indicate that the maximum incremental rod work is well below the workth required to cause a CRDA which would result in 280 cal /gm peak fuel enthalpy. The conclusion is that the 280 cal /gm design limit is not exceeded and the assumed failure of 770 pins for the radiological evaluation is conservative.

3. Verification

a. Any of the following annunciators may actuate

1) RX AUTO SCRAM (A1/B1 OR A2/B2)

2) NEUTRON MONITORING TRIP A OR B

3) APRM BUS A OR B UPSCALE TRIP OR INOP

4) APRM UPSCALE ALARM

5) LPRM UPSCALE

6) IRM TRIP SYS A OR B UPSCL OR INOP

7) IRM UPSCALE ALARM

8) SRM PERIOD

9) SRM UPSCALE OR INOP

10) 0FFGAS RADIATION HI

11) MAIN STM LN DIV I OR II RADIATION HI

12) RBM UPSCALE OR INOP

13) RX VESSEL HI PRESSURE TRIP A OR B

14) RX VESSEL PRESSURE HI ALARM

b. Prior'to applying this procedure, the operator should verify that no other cause for the power increase exists.

The alarms and transients attendant to the Control Rod drop will vary, depending upon the reactor conditions at the time of the Control Rod drop. I.n any event, the alarms and indications will be indicative of an increasing Neutron Flux.

4. Operator Actions  !

i

a. SP 29.003.01

)

1) Initiate the Emergency Shutdown procedures I SP 29.010.01 F. PIPE BREAK INSIDE THE PRIMARY CONTAINMENT (LOCA)

1. Event Description (Figures 12-18)

a. The initial operating conditions of the reactor and the l conditions under which the break will occur for the i design basis maximum recirculation line break accidents are:

1) Reactor initially at maximum power ( 105% of rated);

N

2) Simultaneous loss of ac auxiliary power;

3) Simultaneous loss of feedwater pumps; and

4) Instantaneous, complete circumferential break of the recirculation pipe at the suction nozzle.

b. Just after the break occurs, the water level and flows between regions would be as shown in Figure 15. The water level is essentially normal, but the flow in the jet pur.p drive lines and diffusers has reversed due to flow out the broken recirculation pipe. Lower plenum pressure decreases, which results in an increase in flow provided by the operating jet pumps since they are pumping against a lower pressure differential. Part of the flow from the operating jet pumps will be diverted out the jet pumps in the broken loop, part will continue

- flowing into the core.

c. At some time t1, the water level in the downcomer has dropped to the level of the jet pump suction shown in Figure 16. Although the operating drive pump would continue to inject some drive flow into the lower plenum, this flow rate is conservatively neglected in the analysis and it is assumed that core flow drops to zero ,

at this time, i

d. The water levele centinue to drop as shown in Figure 17 until the recirculation line suction uncovers at some '

time t At this time, steam blowdown from the downcomer 2

begins and the depressurization rate significantly increases. The rapid formation of voids in the lower plenum caused by flashing of saturated water forcefully expels water from the lower plenum into the core and downcomer. As voids continue to form, the core flow will reach a maximum and then diminish.

1

e. The depressurization, core flow, and break flow transients following a recirculation line break are shown l

in Figure 18. Up to time tg, the blowdown flow is I predominantly liquid. During this period, the depressurization rate is low (only about 15 psi /sec), due a

to the effect of the steam dome which acts like a pressurizer. Pressure differences across internal components are also low, generally less than during rated power operation, due to the low depressurization rate and due to the reduction in core flow caused by the loss of one recirculation loop.

f. After time tg the liquid level in the downcomer has decreased to the level of the jet pump drive nozzle and two phase blowdown begins through the drive nozzles of the broken recirculation loop. This results in a slight increase in the depressurization rate, as noted in Figure

l

18. The level continues to drop and finally uncovers the recirculation loop suction line. This results in a significant increase in the steam blowdown rate as evidenced by the increase in depressurization rate at time t 40 psi /se$.as The thedepressurization rate steam flows to the increases break throughtoboth about the suction line and the drive line nozzles.

g. As shown in Figure 18 core flow initially drops sharply because one of two recirculation loops is now out of service and all of the flow from the operating loop does not go to the core. Part of the flow goes through the core and

h. part of the flow passes directly from the lower plenum to the downcomer via the inoperative diffusers. As core flow decreases, the core pressure drop decreasen and the operating bank of jet pumps moves out to a higher flow operating point on the jet pump driven versus drive flow performance curve.

l

1. One bank of jet pumps is capable of supplying about 80% l of total rated recirculation flow when the second bank is I inoperative. Approximately 65% of this flow goes to the core, and 35% goes through the inoperative diffusers.

Thus, with no pump trip, core flow would be about 50% of rated core flow following a recirculation line break.

j. If a pump trip of the unbroken loop is assumed, then the  ;

pump coastdown must be superimposed on the above results.

For example, at about two seconds after the pump trip, )

l recirculation flow has decreased to about 75% of rated l flow, resulting in core flow of about 35 to 40% as indicated by Figure 18.

k. At time ti, when the jet pump suction is uncovered due to the decrease in water level, core flow again drops sharply because the only flow entering the lower plenum is the drive flow of the unbroken recirculation loop.

However, as discussed previously, this flow is conservatively neglected; thus, the calculated core flow rate goes to zero (Figure 18).

1. The period between yt and t 2corresponds to the time when l the water level is below the jet pump suction but above '

the drive pump suction. When the level has reached the drive pump suction line, rapid vessel depressurization begins, as discussed previously, and the lower plenum flashing occurs.

As the downconer depressurizes, the saturated water in the lower plenum flashes and tends to maintain lower plenum pressure higher relative to the downcomer pressure. The resulting pressure differential forces the l

l

i low quality water from the lower plenum into the core and through the jet pump diffusers into the downcomer,

m. The result of strong flashing in the lower plenum is graphically illustrated by Figure 18. Core flow surges to over 60% of rated flow and then tapers off as voids continue to form in the lower plcnum. The tapering off in core flow is the result of the decreasing saturated water inventory in the lower plenum as water is forced into the core and through the jet pump diffusers into the downcomer.

2. Results and Consequences

a. As identified in the FSAR, the temperature and pressure transients resulting as a consequence of this accident are insufficient to cause perforation of the fuel cladding. Therefore, no clad perforations are considered for this accident,

b. Since this acctdent does not result in any fuel damage, the only activity released to the drywell is that activity contained in the reactor coolant plus any additional activity which may be released as a consequence of reactor scram and vessel depressurization.

c. While not specifically stated in Regulatory Guide 1.3, the assumed release of 100 percent of the core noble gas activity and 50 percent of the iodine activity implies fuel damage approaching melt conditions. Even though this condition is inconsistent with operation of the ECCS system, it is assumed for the evaluation of this accident.

d. As identified in 10CFR100, the distance to the Exclusion Area (EA) and Low Population Zone (LPZ) is based on the condition that the whole body dose shall not exceed 25 Rem or the thyroid (iodine inhalation) dose 300 Rem as a consequence of a 2 hr exposure at the LPZ. Current NRC Regulatory Guides consider the whole body dose to be an external skin dose (the sum of beta and gamma doses).

e. All of the accidents evaluated give doses below the criteria outlined above. Thus the EA (311 meters) and LPZ (3,220 meters) distances are acceptable.

3. Verification

a. The following are means of verifying a LOCA in the containment:

1) Containment Pressure

2) Containment Temperature

3) Reactor level

.~ -

4) Suppression Pool Temperature

5) Suppression Pool Level

6) Reactor Pressure

7) ECCS Auto Start

8) Diesel Generators Auto Start

9) Containment Scene Hi Level

b. Any or all of these indications and annunciators may be indicating a LOCA depending upon the size of break.

4. Operator Actions

a. The operator actions for this accident will be directed by the Emergency Procedures (i.e. level control, containment control, etc.) and consist basically of monitoring the ECCS systems for correct operation and restoring and maintaining vessel level in the normal range.

C. PIPE BREAK OUTSIDE PRIMARY CONTAINMENT

1. Evcat Description (Figure 19)

a. The main steam line is designed to AMSE III, Code Class 2 and Seismic Category I requirements. Therefore, there are no identifiable events which would result in a steam line break accident. However, since such an accident provides an upper limit estimate to the resultant effcmis for this category of pipe breaks, it is assumed without the cause being identified,

b. Accidents that result in the release of radioactive materials outside the primary containment are the results of postulated breaches in piping outside the reactor coolant pressure boundary. A break spectrum analysis for the complete range of reactor conditions indicates that j the design basis accident for breaks outside the primary  !

containment is a complete severence of one of the main .

steam lines. The sequence of events and approximate time required to reach the event is as follows:

Approximate Event Elapsed Time

1. Event begins - postulated instantaneous break of main steam line occurs 0

2. High flow signal initiating MSIV closure (4 0.5 sec

3. Reactor begins scram <( 1. 0 s e e

4. MSIV fully closed g(5.5sec

5. Operator actions begin 600 see

c. The break is postulated to occur outside of the containment between the MSIVs and the steam bypass header as shown on Figure 20. Immediately following the break, the flow in the steam lines accelerates until 200% normal flow is coming from reactor, limited to that value by the pain steam line velocity limiters. The flow is composed of 200% of an individual Main Steam Line's (MSL) normal flow through the flow restrictor of the broken line and 200% of an individual MSL's normal flow through each of the three unbroken lines to the bypass header and out the other side of the break for a total of 200% of plant rated steam flow.

d. This increase in steam flow rate from the reactor vessel causes a sudden depressurization which increases the core voids, effectively shutting down reactor power. The main steam isolation valves receive a close signal within about 200 ms generated by the pressure decrease at the turbine inlet. A second close signal is generated by flow restrictor high flow within 500 ms. MSIV closure signals the reactor to scram in about 0.5 sec. Thus, immediately after the accident the core power is decaying. The core flow is also decaying because the recirculation pumps have been arbitrarily assumed to have lost their source of power and because rapid depressurization will form voids restricting core flow.

The assumption of loss of power also causes the feedwater pumps to stop pumping water into the vessel. The combination of flow and power decay causes the MCHFR to drop slightly at first, then increase to very large values as time increases. The first few seconds of the transient is very similar to a typical pump trip transient from full power.

e. Using the most probable operating condition prior to the postulated break and realistic assumptions, the calculated mixture level in the RPV does not reach the steam line before isolation is complete. Therefore, only steam will issue from the break during the entire transient. The total integrated mass leaving the break is 28,000 lb of steam.

2. ResulysandConsequences

a. Tpere are no clad perforations as a consequence of this

~

accident.

( b. The activity released from the hypothetical steam line break accident is a function of the coolant activity, e

valve closure time and mass of coolant released. A portion of the released coolant exists as steam prior to the blowdown, and as such, does not contain the same concentration per unit of mass as does the steam generated as a consequence of the blowdown. Therefore, it is necessary to subtract the initial steam mass from the total mass released and assign to it only 2 percent of the iodine activity contained by an equivalent mass of primary coolant.

The resulting radiological exposures are presented in Table III. The meteorlogical conditions presented in Regulatory Guide 1.5 and the dose evaluation methods of Regulatory Guide 1.3 were employed.

TABLE III STEAM LINE BREAK ACCIDENT RADIOLOGICAL EFFECTS (REALISTIC ANALYSIS)

Exclusion Area Boundary (311 meters) 0-2 hours Thyroid dose .28 rem Gamma dose 3.2 x 103 rem Beta dose 1.0 x 10~8 rem STEAM LINE BREAK ACCIDENT RADIOLOGICAL EFFECTS (CONSERVATIVE NRC ANALYSIS)

Exclusion Area Boundary (311 meters) 0-2 hours Thyroid dose 20 rem Gamma dose 2.1 x 102 rem Beta dose 1.7 x 102 rem

3. Verification

a. The following are means of verifying a steam line break outside the primary containment.

1) MAIN STEAM LINE HI FLOW

2) LOW PRESSURE MSID ISOLATION

3) AREA RADIATION ALARMS

4) AREA TEMPERATURE (STEAM TUNNEL, etc)

5) REACTOR BLDG DRAIN TANK LEVEL HI

6) ABNORMAL REACTOR BLDG D/P

4. Operator Actions

a. The operator actions for the accident will be directed by

, the Emergency Procedures (i.e. level control, etc) and

. _ ~ - .

.~.

will consist basically of monitoring the ECCS systems for correct operation and restoring and maintaining level in the Normal Range.

H. FEEDWATER SYSTEM PIPING BREAK

1. Event Description

a. Accidents that result in the release of radioactive materials outside the primary containment are the results of postulated breaches in the reactor coolant pressure boundary. A break spectrum analysis for the complete range of reactor conditions indicates that the design basis accident for breaks outside the primary containment is a complete severence of one of the main steam lines as  !

described in Section. The feedwater system piping break l is less severe than the main steam line break. l Approximate

1) Sequence of Events Elapsed Time f a) Feedwater pipe circumferentially breaks 0.0 between the last high pressure heater i and the outboard feedwater check valve.

Approximate

b. Sequence of Operator Actionn Elepced Time l I

b) Feedwater flow into vessel reaches zero 4.0 see

' and feedwater check valves in the broken lina isolate the reactor from the break, i

c) Low reactor vessel water level scrams 8 see the reactor and the main turbine trips from load mismatch. '

6 d) Low water level in the reactor closes the 30 sec MSIV's.

e) Steam for the turbine driven reactor feed pumps has been exhausted either from the main turbine cross-around piping or the '

steamlines between the MSIV's and the main turbine stop valves. Reactor feedpumps will [

continue to windmill with flow from the condensate booster pumps.

f) Inventory of water in the main condenser 7 min hotwell is completely pumped out of the I break by the condersate and/or condensate booster pumps.

I

g) The feedwater lines between the last 15 min.

feedvater heater and the break complete draining out of the break.

b. A postulated guillotine break of the feedwater system piping outside the primary containment results in a mass loss of 111,000 lb from the break. The flow from the break is realistically determined with the following assumptions and conditions.

1) The reactor is operating at 100 percent feedwater flow.

2) A sudden circumferential break occurs in one of the feedwater lines between the last feedvater heater and the turbine building - reactor building interface.

3) Nuclear system pressure is initially at 1,060 psi.

4) The feedwater checkvalves operate immediately to isolate the break from the reactor pressure vessel.

5) The condensate and/or the condensate booster pumps are assumed to pump all of the water from the hotwell out of the feedwater line break.

6) The mass of water pumped out of the break from the complete drainage of the feedwater piping downstream of the last feedwater heater, and the trapped condensed steam in the turbine piping are considered negligible compared to the inventory in the hotwell.

2. Results and Consequences

a. There are no clad perforations as a result of this event

b. The Radiological Effects are based on a puff release to the atmosphere.

1) The dose at the exclusion area boundary (311 meters) for 0-2 hrs is 0.3 rem thryoid.

1

3. Verification

)

a. The following are means of verifying a feedwater line break:

1) Main Condenser Low level

2) Feedwater Heater low level

3) Main Condenser low vacuum,

4) Hotwell Normal & Emergency M/U Open 1

5) Condensate Demin Trouble

6) Turbine Bldg Sump Hi Level Alarms

7) Turbine Bldg Area Temperature Alarms

8) Feedpump low Suction Pressure

9) Feedpump Trip

4. Operator Actions

a. The operator maintains adequate reactor coolant inventory with RCIC and/or HPCI. The feedwater line check valves isolate the reactor from the break;,no operator actions are necessary to effect reactor isolation.

Approximate

b. Sequence of Operator Actions Elapsed Time

1) Event begins - failure occurs 0

2) The operator determines that line 5 min.

break has occurred and evacuates the area of the turbine building. ,

The operator shuts down the condensate  !

and/or condensate booster pumps.

ij The operator is not required to take any action to prevent primary reactor system mass loss, but should insure reactor is shut down and that RCIC and/or HPCI are operating normally.

4) The operator must initiate operation of the RHR system in the steam condensing mode.

5) The main condenser vacuum breaker valve should be opened as soon as it is determined a loss of turbine shaft sealing steam is imminent in order to prevent cold air being drawn in through the seals, possibly damaging the het turbine rotor.

6) If possible, the operator will de-energize any electrical equipment which may be damaged by the feedwater in the turbine building.

7) When the reactor pressure has decreased below 150 psi, the operator must initiate

i RHR in the shutdown cooling mode to con-tinue cooling down the reactor.

I FAILURE OF AIR EJECTOR LINES

1. Event Description

a. An evaluation of those events which could cause a failure of the air ejector line indicates that a seismic event more serious than the system is designed to withstand is the only event which could rupture the lines. The lines are designed to withstand the effects of a hydrogen explosion,

b. It is assumed that the line leading from the steam jet air ejector to the offgas treatment system fails. This results in activity normally processed by the offgas treatment system being discharged directly to the turbine building and subsequently through the ventilation system to the environment. This failure results in a

" loss-of-flow to the offgas system" signal.

2. Results and Consequences

a. There are no clad perforations as a result of this event.

b. The dose at the exclusion area boundary (311 m) are:

1) 0.1 R Thyroid

2) 0.4 R Gamma

3) 0.49 R Beta

3. Verification

a. The following are means of verifying an air ejector line failure:

1) Condenser low vacuum

2) Turbine Bldg Area Radiation Alarms

3) Off-Gas low flow

4. Operator Actions

a. The operator will initiate a normal shutdown of the reactor to reduce the gaseous activity being discharged.

The operator will isolate the main condenser, which results in high condenser pressure and a reactor scram.

The operator will notify personnel to evacuate the area immediately and notify radiation protection personnel to survey the area and determine requirements for re-entry.

I