ML16021A423

NUREG-2187, Vol. 1, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Byron Unit 1. Chapters 1 to 8, Appendices a to C.

ML16021A423
Person / Time
Site:	Byron
Issue date:	01/31/2016
From:	Alysia Bone, Buell R, James Corson, Don Helton, Khatib-Rahbar M, Laura Kozak, Alfred Krall, Margaret Tobin Energy Research, Idaho National Lab, Office of Nuclear Regulatory Research, NRC/RGN-III
To:
Meyd, Donald
References
NUREG-2187 V01
Download: ML16021A423 (361)

Text

NUREG-2187 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1 Chapters 1 to 8 Appendices A to C Office of Nuclear Regulatory Research

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material Non-NRC Reference Material As of November 1999, you may electronically access Documents available from public and special technical NUREG-series publications and other NRC records at libraries include all open literature items, such as books, NRCs Library at www.nrc.gov/reading-rm.html. Publicly journal articles, transactions, Federal Register notices, released records include, to name a few, NUREG-series Federal and State legislation, and congressional reports.

publications; Federal Register notices; applicant, Such documents as theses, dissertations, foreign reports licensee, and vendor documents and correspondence; and translations, and non-NRC conference proceedings NRC correspondence and internal memoranda; bulletins may be purchased from their sponsoring organization.

and information notices; inspection and investigative reports; licensee event reports; and Commission papers Copies of industry codes and standards used in a and their attachments. substantive manner in the NRC regulatory process are maintained at NRC publications in the NUREG series, NRC regulations, The NRC Technical Library and Title 10, Energy, in the Code of Federal Regulations Two White Flint North may also be purchased from one of these two sources. 11545 Rockville Pike Rockville, MD 20852-2738

1. The Superintendent of Documents U.S. Government Publishing Office These standards are available in the library for reference Mail Stop IDCC use by the public. Codes and standards are usually Washington, DC 20402-0001 copyrighted and may be purchased from the originating Internet: bookstore.gpo.gov organization or, if they are American National Standards, Telephone: (202) 512-1800 from Fax: (202) 512-2104 American National Standards Institute 11 West 42nd Street

2. The National Technical Information Service New York, NY 10036-8002 5301 Shawnee Rd., Alexandria, VA 22312-0002 www.ansi.org www.ntis.gov (212) 642-4900 1-800-553-6847 or, locally, (703) 605-6000 Legally binding regulatory requirements are stated only in A single copy of each NRC draft report for comment is laws; NRC regulations; licenses, including technical speci-available free, to the extent of supply, upon written fications; or orders, not in NUREG-series publications. The request as follows: views expressed in contractorprepared publications in this series are not necessarily those of the NRC.

Address: U.S. Nuclear Regulatory Commission The NUREG series comprises (1) technical and adminis-Office of Administration trative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX), (2)

Publications Branch proceedings of conferences (NUREG/CP-XXXX), (3) reports Washington, DC 20555-0001 resulting from international agreements (NUREG/IA-XXXX),

E-mail: distribution.resource@nrc.gov (4) brochures (NUREG/BR-XXXX), and (5) compilations of Facsimile: (301) 415-2289 legal decisions and orders of the Commission and Atomic and Safety Licensing Boards and of Directors decisions Some publications in the NUREG series that are posted under Section 2.206 of NRCs regulations (NUREG-0750).

at NRCs Web site address www.nrc.gov/reading-rm/ DISCLAIMER: This report was prepared as an account doc-collections/nuregs are updated periodically and may of work sponsored by an agency of the U.S. Government.

differ from the last printed version. Although references to Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, material found on a Web site bear the date the material or assumes any legal liability or responsibility for any third was accessed, the material available on the date cited partys use, or the results of such use, of any information, may subsequently be removed from the site. apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-2187 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1 Chapters 1 to 8 Appendices A to C Manuscript Completed: May 2015 Date Published: January 2016 Prepared by:

J. Corson,1 D. Helton,1 M. Tobin,1 A. Bone1 M. Khatib-Rahbar,2 A. Krall2 L. Kozak3 R. Buell4 1Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 2Energy Research Inc.

P.O. Box 2034 Rockville, MD 20847-2034 3Region III U.S. Nuclear Regulatory Commission 2443 Warrenville Road, Suite 210 Lisle, IL 60532-4352 4Idaho National Laboratory P.O. Box 1625 Idaho Falls, ID 83415

ABSTRACT This report extends the work documented in NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Surry and Peach Bottom to the Byron Station, Unit 1. Its purpose is to produce an additional set of best-estimate thermal-hydraulic calculations that can be used to confirm or enhance specific success criteria (SC) for system performance and operator timing found in the agencys probabilistic risk assessment (PRA) tools. Along with enhancing the technical basis for the Agencys independent standardized plant analysis risk (SPAR) models, these calculations are expected to be a useful reference to model end-users for specific regulatory applications (e.g.,

the Significance Determination Process). The U.S. Nuclear Regulatory Commission selected Unit 1 of the Byron Station for this study because it is generally representative of a group of four-loop Westinghouse plants with large, dry containment designs.

This report first describes major assumptions used in this study, including the basis for using a core damage (CD) surrogate of 2,200 degrees Fahrenheit (1,204 degrees Celsius) peak cladding temperature (PCT). The justification for this PCT is documented in NUREG/CR-7177, Compendium Of Analyses To Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition And Success Criteria Modeling Issues. The major plant characteristics for Byron Unit 1 are then described, in addition to the MELCOR model used to represent the plant.

Finally, the report presents the results of MELCOR calculations for selected initiators and compares these results to SPAR SC, the licensees PRA sequence timing and SC, or other generic studies.

The study results provide additional timing information for several PRA sequences, confirm many of the existing SPAR model modeling assumptions, and provide a technical basis for a few specific SPAR modeling changes. Potential SPAR model changes supported by this study include:

• Small-Break Loss-of-Coolant Accident (SLOCA) Sequence Timing for Alignment of Sump RecirculationFor sequences where operator cooldown is credited as an alternative to high-pressure recirculation (HPR), the SPAR success criteria related to containment cooling could be enhanced by requiring one containment fan cooler to prevent containment spray actuation. Avoiding spray actuation extends the time available prior to refueling water storage tank depletion and allows the operators to successfully depressurize the plant using the post-LOCA procedures for cases when HPR is not available.

• SLOCA Success Criteria for Steam Generator (SG) Depressurization and Condensate FeedAction to depressurize the SGs early and align condensate feed is a candidate for inclusion in the SPAR model. This would provide an additional success path for a loss of auxiliary feedwater event. If this is done, hotwell refill or alignment of alternate feedwater later in the scenario would also need to be modeled. Early depressurization to achieve condensate feed was not found to require primary-side depressurization actions (e.g., opening a power-operated relief valve (PORV)).

• SLOCA Success Criteria for Primary Side Bleed and Feed (B&F)These calculations have demonstrated a potential conservatism that can be removed from the applicable SPAR models. It is proposed that the SC for SLOCA B&F be changed from (one safety iii

injection (SI) or centrifugal charging pump (CCP) and two PORVs) to (one SI pump and two PORVs) or (one CCP and one PORV). In other words, for SLOCAs the requirement for availability of a second PORV can be removed when a CCP is available.

• Loss of DC Bus-111 - Unavailable Diesel-Driven Auxiliary Feedwater, and Subsequent Primary Side B&FThese calculations are generally representative of non-loss-of-coolant accident (non-LOCA) B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is proposed that the SC for non-LOCA B&F be changed from (one SI or CCP and two PORVs) to (one CCP and one PORV). In other words, the same one CCP and one PORV enhancement as above is credited, but credit is eliminated for cases with no CCP available. This initiator was chosen because it was qualitatively felt to be more restrictive than those scenarios categorized as general transients in the PRA, and thus the conclusions are believed to be applicable to those initiators as well. Note that the applicability of the loss of DC bus SC may vary, (e.g., due to the unique reactor coolant pump trip situation that this initiator creates) and should be evaluated on a case-by-case basis before implementation for other plant models.

• SGTR - Spontaneous Steam Generator Tube Rupture with No Operator ActionFor sequences with successful high-pressure injection (HPI) and auxiliary feedwater, but with steam generator isolation having failed, an additional success path or additional recovery credit may be justifiable pending additional consideration of closely-related accident sequence and human reliability modeling assumptions.

• Medium-Break Loss-of-Coolant Accident (MLOCA) - Injection SC For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functional Restoration Procedure (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The time available to implement these actions following the FRP entry criterion being met could be short. The accident sequence modeling and human reliability analysis associated with secondary-side cooldown for these situations (MLOCA with HPI failed) should be reviewed.

iv

FOREWORD The U.S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk (SPAR) models are used to support a number of risk-informed initiatives. The fidelity and realism of these models is ensured through a number of processes, including cross-comparison with industry models, review and use by a wide range of technical experts, and confirmatory analysis. The following reportprepared by staff in the Office of Nuclear Regulatory Research in consultation with staff from the Office of Nuclear Reactor Regulation, experts from Energy Research Incorporated and Idaho National Laboratory, and the agencys senior reactor analystsrepresents a major confirmatory analysis activity.

Probabilistic risk assessment (PRA) models for nuclear power plants rely on underlying modeling assumptions known as success criteria (SC) and sequence timing assumptions.

These criteria and assumptions determine what combination of system and component availabilities will lead to postulated core damage (CD), as well as the timeframes during which components must operate or operators must take particular actions. This report investigates certain thermal-hydraulic aspects of a particular SPAR model (which is generally representative of other models within the same class of plant design), with the goal of further strengthening the technical basis for decisionmaking that relies on the SPAR models. This report augments the existing collection of contemporary Level 1 PRA SC analyses, and as such, supports (1) maintaining and enhancing the SPAR models that the NRC develops, (2) supporting the NRCs risk analysts when addressing specific issues in the accident sequence precursor program and the significance determination process, and (3) informing other ongoing and planned initiatives. This analysis employs the MELCOR computer code and uses a plant model developed for this project.

The analyses summarized in this report provide the basis for confirming or changing SC in the SPAR model for the Byron Station Unit 1. Further evaluation of these results will be performed to extend the results to similar plants. In addition, future work is planned to perform similar analysis for other design classes, and past work has already considered other design classes (see NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models - Surry and Peach Bottom). In addition, work has been recently completed to scope other aspects of this topical area, including the degree of variation typical in common PRA sequences and the quantification of conservatisms associated with CD surrogates (see NUREG/CR-7177, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues). Where applicable, insights from that work are referenced in this report. The confirmation of SC and other aspects of PRA modeling using the agencys state-of-the-art tools (e.g., the MELCOR computer code) is expected to receive continued focus as the agency continues to develop and improve its risk tools.

v

CONTENTS ABSTRACT ...............................................................................................................................iii FOREWORD ............................................................................................................................. v CONTENTS ..............................................................................................................................vii LIST OF FIGURES ....................................................................................................................ix LIST OF TABLES ......................................................................................................................xi ABBREVIATIONS AND ACRONYMS .....................................................................................xiii

1. INTRODUCTION AND BACKGROUND ............................................................................. 1

2. MAJOR ASSUMPTIONS .................................................................................................... 3 2.1 Selection of a Core Damage Surrogate........................................................................ 5

3. RELATIONSHIP TO THE AMERICAN SOCIETY OF MECHANICAL ENGINEERS/AMERICAN NUCLEAR SOCIETY PROBABILISTIC RISK ASSESSMENT STANDARD .............................................................................................. 9

4. MAJOR PLANT AND MELCOR MODEL CHARACTERISTICS........................................13 4.1 Byron Station Unit 1 ....................................................................................................13 4.2 Byron MELCOR Model ...............................................................................................14 4.3 MELCOR Validation ....................................................................................................15

5. MELCOR RESULTS..........................................................................................................17 5.1 Small-Break Loss-of-Coolant Accident-Sequence Timing for Alignment of Sump Recirculation.....................................................................................................18 5.2 Small-Break Loss-of-Coolant Accident-Success Criteria for Steam Generator Depressurization and Condensate Feed .....................................................................29 5.3 Small-Break Loss-of-Coolant Accident-Success Criteria for Primary Side Bleed and Feed ..........................................................................................................35 5.4 Loss of DC Bus 111, Unavailable DD-AFW, and Subsequent Primary Side Bleed and Feed ..........................................................................................................42 5.5 Spontaneous Steam Generator Tube Rupture with No Operator Action......................50 5.6 Medium-Break LOCA Injection Success Criteria .........................................................59 5.7 Medium-Break LOCA Cooldown Timing for Low-Pressure Recirculation ....................67 5.8 Loss of Shutdown Cooling ..........................................................................................76 5.8.1 Changes to the MELCOR Input Deck for Loss of Shutdown Cooling Calculations .........................................................................................................77 5.8.2 Mode 4 Calculations ............................................................................................77 5.8.3 Mode 5 Calculations ............................................................................................82

6. APPLICATION OF MELCOR RESULTS TO THE SPAR MODELS ..................................87

7. CONCLUSIONS ................................................................................................................93

8. REFERENCES ..................................................................................................................95 APPENDIX A DETAILED INFORMATION ON BASE MELCOR MODEL A.1 Byron MELCOR Input Model Description..................................................................... A-1 A.2 Input Deck Revisions and MELCOR Code Versions .................................................... A-6 A.3 Additional Notes on MELCOR ..................................................................................... A-7 A.4 References .................................................................................................................. A-7 vii

APPENDIX B DETAILED SMALL-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS B.1 Small-Break Loss-of-Coolant Accident - Sequence Timing for Alignment of Sump Recirculation .................................................................................................... B-1 B.2 Small-Break Loss-of-Coolant Accident - Success Criteria for Steam Generator Depressurization and Condensate Feed.................................................................... B-85 B.3 Small-Break Loss-of-Coolant Accident - Success Criteria for Primary Side Bleed and Feed ....................................................................................................... B-133 APPENDIX C DETAILED LOSS OF DC BUS 111 ANALYSIS RESULTS C.1 Loss of DC Bus 111 and Unavailable DD-AFW, Leading to Primary Side Bleed and Feed ........................................................................................................... C-1 APPENDIX D DETAILED STEAM GENERATOR TUBE RUPTURE ANALYSIS RESULTS D.1 Spontaneous SG Tube Rupture with No Operator Action ............................................ D-1 APPENDIX E DETAILED MEDIUM-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS E.1 Medium-Break Loss-of-Coolant Accident Injection Success Criteria ............................ E-1 E.2 Medium-Break Loss-of-Coolant Accident Cooldown Timing for Low-Pressure Recirculation.............................................................................................................. E-91 APPENDIX F DETAILED LOSS OF SHUTDOWN COOLING RESULTS F.1 Mode 4 Calculations .................................................................................................... F-1 F.2 Mode 5 Calculations .................................................................................................. F-47 APPENDIX G EVENT TREE MODELS FOR STUDIED INITIATORS G.1 Byron SPAR Model Event Trees..................................................................................G-1 viii

LIST OF FIGURES Main Report Figure 1 Example of variation in core damage timing from (NRC, 2014b) ............................ 6 Figure 2 Schematic of the Byron MELCOR RCS model ..................................................... 15 Figure 3 Time of RWST depletion as a function of RWST volume ...................................... 27 Figure 4 Peak containment pressure as a function of containment volume and the number of available fan coolers for Case 11 ................................................... 28 Appendix G Figure G-1 Small-break loss-of-coolant accident (SLOCA) event tree .................................. G-2 Figure G-2 Loss of 125V vital DC bus 111 event tree ........................................................... G-3 Figure G-3 Steam generator tube rupture (SGTR) event tree ............................................... G-4 Figure G-4 Medium-break loss-of-coolant accident (MLOCA) event tree .............................. G-5 ix

LIST OF TABLES Main Report Table 1 Summary of Accident Scenarios Examined ............................................................ 2 Table 2 Major Assumptions ................................................................................................. 4 Table 3 Comparison of this Project to the ASME/ANS PRA Standard ............................... 10 Table 4 Major Plant Characteristics for Byron Unit 1 ......................................................... 13 Table 5 SLOCA-Sump Recirculation Boundary Conditions............................................... 19 Table 6 SLOCA-Sump Recirculation Results.................................................................... 20 Table 7 SLOCA-Sump Recirculation Key Event Timings .................................................. 21 Table 8 SLOCA-Sump Recirculation Margins ................................................................... 22 Table 9 SLOCA-Sump Recirculation Cooldown Rates ..................................................... 22 Table 10 SLOCA-Sump Recirculation Sensitivity Studies ................................................... 23 Table 11 SLOCA-Condensate Feed Boundary Conditions ................................................. 30 Table 12 SLOCA-Condensate Feed Results ...................................................................... 30 Table 13 SLOCA-Condensate Feed Key Event Timings .................................................... 31 Table 14 SLOCA-Condensate Feed Margins ..................................................................... 31 Table 15 SLOCA-Condensate Feed Cooldown Rates ........................................................ 32 Table 16 SLOCA-Condensate Feed Sensitivity Studies ..................................................... 33 Table 17 SLOCA-Bleed and Feed Boundary Conditions .................................................... 36 Table 18 SLOCA-Bleed and Feed Results ......................................................................... 37 Table 19 SLOCA-Bleed and Feed Key Event Timings........................................................ 37 Table 20 SLOCA-Bleed and Feed Margins ........................................................................ 38 Table 21 SLOCA-Bleed and Feed Sensitivity Studies ........................................................ 39 Table 22 Loss of DC Bus 111 Boundary Conditions ............................................................ 43 Table 23 Loss of DC Bus 111 Results ................................................................................. 43 Table 24 Loss of DC Bus 111 Key Event Timings ............................................................... 44 Table 25 Loss of DC Bus 111 Margins ................................................................................ 44 Table 26 Loss of DC Bus 111 Sensitivity Studies ................................................................ 46 Table 27 SGTR Boundary Conditions ................................................................................. 52 Table 28 SGTR Results ...................................................................................................... 53 Table 29 SGTR Key Event Timings ..................................................................................... 54 Table 30 SGTR Margins...................................................................................................... 55 Table 31 SGTR Sensitivity Studies ..................................................................................... 56 Table 32 MLOCA Injection Success Criteria Boundary Conditions ...................................... 60 Table 33 MLOCA Injection Success Criteria Results ........................................................... 60 Table 34 MLOCA Injection Success Criteria Key Event Timings ......................................... 61 Table 35 MLOCA Injection Success Criteria Margins .......................................................... 62 Table 36 MLOCA Injection Success Criteria Sensitivity Studies .......................................... 64 Table 37 MLOCA Cooldown Timing Boundary Conditions .................................................. 68 Table 38 MLOCA Cooldown Timing Results ....................................................................... 68 Table 39 MLOCA Cooldown Timing Key Event Timings ...................................................... 70 Table 40 MLOCA Cooldown Timing Margins....................................................................... 71 Table 41 MLOCA Cooldown Timing Cooldown Rates ......................................................... 71 Table 42 MLOCA Cooldown Timing Sensitivity Studies ...................................................... 72 Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions ................................... 78 Table 44 Loss of Shutdown Cooling (Mode 4) Results ........................................................ 78 Table 45 Loss of Shutdown Cooling (Mode 4) Key Event Timings ...................................... 79 xi

Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions ................................... 82 Table 47 Loss of Shutdown Cooling (Mode 5) Results ........................................................ 83 Table 48 Loss of Shutdown Cooling (Mode 5) Key Event Timings ...................................... 84 Table 49 Mapping of MELCOR Analyses to the Byron SPAR (8.27) Model ......................... 88 Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results ..................... 89 Appendix A Table A-1 Reactor Trip Signals ............................................................................................ A-1 Table A-2 Charging Pump Performance ............................................................................. A-2 Table A-3 SI Pump Performance ........................................................................................ A-2 Table A-4 RHR Pump Performance ..................................................................................... A-3 Table A-5 Reactor Coolant Pump Motive and Control Power Configuration ......................... A-5 Table A-6 Opening and Closing Pressures for Pressurizer PORVs and SRVs..................... A-5 Table A-7 Input Models Used for Documented Calculations ................................................ A-6 xii

ABBREVIATIONS AND ACRONYMS

°C degree(s) Celsius

°C/hr degree(s) Celsius per hour

°F degree(s) Fahrenheit

°F/hr degree(s) Fahrenheit per hour T temperature difference ACC accumulator ADAMS Agencywide Documents Access and Management System AFW auxiliary feedwater ANS American Nuclear Society ASME American Society of Mechanical Engineers ASP accident sequence precursor B&F bleed and feed BAF bottom of active fuel BEP Byron Emergency Procedure BWR boiling-water reactor CCP centrifugal charging pump CCW component cooling water CD core damage CDF core damage frequency CET core exit temperature CFR Code of Federal Regulations cm centimeter(s)

CNMT containment COR MELCOR core package CS containment spray CST condensate storage tank CVH control volume hydrodynamics (MELCOR package)

CVTR Carolinas Virginia Tube Reactor DC direct current DD-AFW diesel-driven auxiliary feedwater ECA emergency contingency action ECCS emergency core cooling system EOP emergency operating procedure EPRI Electric Power Research Institute ESF Engineered Safety Features FCL fan cooler FRP functaionl restoration procedure FSAR Final Safety Analysis Report ft foot/feet ft3 cubic foot/feet FW feedwater gal gallon(s) gpm gallon(s) per minute HEM homogeneous equilibrium model HEP human error probability HFM homogeneous frozen model HPI high-pressure [ECCS] injection xiii

HPR high-pressure [ECCS] recirculation hr hour(s)

HS heat structure in. inch(es) iPWR integral pressurized-water reactor K Kelvin kg kilogram(s) kg/s kilogram(s) per second kPa kilopascal(s) lb/s pound(s) per second LBLOCA large-break loss-of-coolant accident lbm/hr pound(s) mass per hour LOCA loss-of-coolant accident LoDCB-111 loss of DC bus 111 LOFT loss-of-fluid test LPI low pressure [ECCS] injection LPR low pressure [ECCS] recirculation LTOP low temperature overpressure protection m meter(s) m3 cubic meter(s) m3/min cubic meter(s) per minute m3/s cubic meter(s) per second MAAP4 Modular Accident Analysis Program version 4 MD-AFW motor-driven auxiliary feedwater MELCOR Not an acronym MFW main feedwater min minute(s)

MLOCA medium-break loss-of-coolant accident MPa megapascal(s)

MPa abs megapascal(s) absolute MSIV main steam isolation valve MUR measurement uncertainty recapture MW megawatt(s)

MWt megawatt(s) thermal NPSH net positive suction head NR narrow range [water level]

NRC U.S. Nuclear Regulatory Commission PCT peak cladding temperature PORV power- (or pilot-) operated relief valve PRA probabilistic risk assessment PRT pressurizer relief tank PSA Probabilistic Safety Assessment psi pound(s) per square inch psia pound(s) per square inch absolute psid pound(s) per square inch differential psig pound(s) per square inch gage PWR pressurized-water reactor PZR pressurizer RCFC reactor containment fan cooler RCP reactor coolant pump RCS reactor coolant system xiv

recirc recirculation RHR residual heat removal RHR HX residual heat removal heat exchanger RPS reactor protection system RPV reactor pressure vessel RWST refueling water storage tank s second(s)

SC success criterion/criteria SDP significance determination process scfm standard cubic foot/feet per minute SG steam generator SG-x steam generator in loop x SGTR steam generator tube rupture SI safety injection SLOCA small-break loss-of-coolant accident SOARCA State-of-the-Art Reactor Consequence Analyses SPAR standardized plant analysis risk SRV safety relief valve TAF top of active fuel Tavg loop average temperature TBV turbine bypass valve TCL cladding temperature TRACE TRAC/RELAP5 Advanced Computational Engine VCT volume control tank WR wide range [water level]

xv

1. INTRODUCTION AND BACKGROUND The success criteria (SC) for system performance and operator timing in the U.S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk (SPAR) models are largely based on the SC used in the associated licensee probabilistic risk assessment (PRA) model. 1 Licensees have used a variety of methods to determine SC, including conservative design-basis analyses and more realistic best-estimate methods. Consequently, in some situations plants that should behave similarly from an accident sequence standpoint have different SC for specific scenarios. In addition, concerns periodically arise when reviewing licensee sequence timing and SC analyses in the course of performing event or condition risk assessments that could be better resolved with an updated set of thermal-hydraulic SC calculations. For these reasons, this report, as well as its predecessor NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models Surry and Peach Bottom (NRC, 2011a), seeks to provide such a set of information while simultaneously providing the basis to confirm or change specific SPAR SC.

This analysis in the present report used the Byron Station Unit 1. The staff chose this plant because it is reasonably representative of a class of 4-loop Westinghouse plants with large, dry containments. Specifically, Byron Unit 1 is generally similar to the following other plants:

• Byron Unit 2

• Braidwood Units 1 and 2

• Callaway

• Comanche Peak Units 1 and 2

• Diablo Canyon Units 1 and 2

• Indian Point Units 2 and 3

• Millstone Unit 3

• Salem Units 1 and 2

• Seabrook

• South Texas Units 1 and 2

• Vogtle Units 1 and 2

• Wolf Creek It should be noted, however, that all of these plants have design, operational, and licensing differences that should be considered before applying the results of this study to these plants.

The sequences analyzed are not necessarily the most probable sequences because of the assumed unavailability of systems or the assumed lack of operator action. Rather, the sequences were selected because they have assumptions and sequence timing issues that periodically arise during significance determination process (SDP) or accident sequence precursor (ASP) evaluations.

This report summarizes the analyses that have been performed, including the following topics:

• major assumptions, including the basis for the core damage definition employed 1 In some cases, success criteria (SC) are based on other sources, such as NRC studies (e.g., NUREG/CR-5072, Decay Heat Removal Using Feed-and-Bleed for U.S. Pressurized Water Reactors, issued June 1988 (NRC, 1988)).

1

• consideration of the relevant supporting requirements documented in the American Society of Mechanical Engineers/American Nuclear Society PRA standard (ASME/ANS, 2009)

• major plant characteristics for Byron Unit 1 and a description of the Byron MELCOR models used

• results of various MELCOR calculations

• application of the MELCOR results to the SPAR models The SC calculations contained herein are intended to be confirmatory in nature, and while suitable for their intended use in supporting the SPAR models, they are not intended to be used by licensees for risk-informed licensing submittals.

The eight accident scenarios completed in this report are highlighted in Table 1 below.

Table 1 Summary of Accident Scenarios Examined Section Description Key Assumptions Section 5.1 Small-Break Loss-of-Coolant Accident- See Table 5 SLOCA-Sump Sequence Timing for Alignment of Sump Recirculation Boundary Conditions Recirculation Section 5.2 Small-Break Loss-of-Coolant Accident- See Table 11 SLOCA-Condensate Success Criteria for Steam Generator Feed Boundary Conditions Depressurization and Condensate Feed Section 5.3 Small-Break Loss-of-Coolant Accident- See Table 17 SLOCA-Bleed and Feed Success Criteria for Primary Side Bleed and Boundary Conditions Feed Section 5.4 Loss of DC Bus 111, Unavailable DD-AFW, See Table 22 Loss of DC Bus 111 and Subsequent Primary Side Bleed and Boundary Conditions Feed Section 5.5 Spontaneous Steam Generator Tube See Table 27 SGTR Boundary Rupture with No Operator Action Conditions Section 5.6 Medium-Break LOCA Injection Success See Table 32 MLOCA Injection Success Criteria Criteria Boundary Conditions Section 5.7 Medium-Break LOCA Cooldown Timing for See Table 37 MLOCA Cooldown Timing Low-Pressure Recirculation Boundary Conditions Section 5.8 Loss of Shutdown Cooling See Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions and Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions 2

2. MAJOR ASSUMPTIONS Assumptions made during the conduct of this study are documented throughout this report.

For instance, MELCOR modeling assumptions are discussed in the section (and in the appendix) describing the MELCOR model (i.e., Section 4 and Appendix A), assumptions related to particular calculations are discussed in the section where those calculations are documented, etc. This section collects major assumptions into one concise table.

3

Table 2 Major Assumptions Topic Area Assumption Comments Core damage A peak clad temperature of 2,200 °F (1,204 °C) is used throughout.

General surrogate The basis for this selection is described later in this section.

RWST initial It is assumed that the initial volume of water in the RWST volume and ECCS corresponds to the Tech Spec minimum value water level of delivered 89% instrument span.

volumes It is assumed that operators fail to take action to prevent the Operator control pressurizer from going water-solid by controlling the rate of ECCS ECCS of ECCS injection (i.e., by shutting off ECCS pumps when pressurizer level injection exceeds a certain value, as described in the plant procedures),

except where noted otherwise.

Time required to The plant operators must perform a number of steps in order to switch ECCS switch the ECCS pump suction source from the RWST to the suction from containment sump. It is assumed that it takes the operators ECCS RWST to 10 minutes to complete the necessary steps. During this switchover containment time, the ECCS pumps continue to draw suction from the RWST, as sump is suggested by the relevant plant procedure.

AFW actuates following a reactor trip. The current treatment in the MELCOR input model assumes AFW injects at a rate equal to AFW and 9.99 kg/s (22.02 lb/s) whenever the SG water level drops below the condensate AFW target setpoint (24.25 m, approximately equal to the steady-state booster pump operating value). The condensate booster pumps also follow this logic logic in the event that AFW is unavailable, SG pressure is below the booster pump shutoff head, and the condenser hotwell is not empty.

In some of the cases studied for the present analysis, the pressurizer PORV is assumed to fail open, fail partially open, or fail closed after 251 cycles. This number corresponds to a cumulative failure probability of 0.5 assuming a constant failure probability per demand derived from industry data, as presented in NUREG/CR-7037 (NRC, 2011b). This treatment assumes a constant failure probability per Pressurizer PORV failure demand, regardless of whether the valve is passing steam, water, or a two-phase mixture. As such, it is not intended to mechanistically represent the actual valve behavior, but rather to provide a convenient threshold for exploring calculational sensitivity to valve re-closure. Refer to NUREG-1953 for a discussion of the treatment of PORV failure in MELCOR (NRC, 2011a).

In the LOCA cases studied for this analysis, the pipe break is located in the horizontal section of the cold leg in the loop containing the Break location Piping pressurizer. This location is a modeling choice, and it is not for LOCA cases expected that the location of the break will make a significant difference in the results, so long as it is in the RCS piping.

4

Table 2 (continued)

Topic Area Assumption Comments At times, MELCOR predicts significant holdup of water in the pressurizer when the hot leg and the top of the RPV are voided.

This is due to counter-current flow limitation in the pressurizer, as predicted by MELCOR. While significant holdup in the pressurizer can occur under some conditions, there is modeling uncertainty inherent in the way that codes like MELCOR capture this physics.

This modeling uncertainty is reduced by performing validation studies against relevant experiments and events (such as the Three Mile Island accident). In MELCOR, counter-current flow is affected by a phenomenological parameter called the momentum exchange length, which affects the degree of coupling between the liquid and Holdup of water vapor phases in a flow path. (Larger values result in increased Pressurizer in the coupling, while lower values result in decreased coupling between pressurizer the phases.) For these calculations, the momentum exchange length for flow paths in the surge line is set to 0.1 m. Note that sensitivity calculations in which the momentum exchange length is set to 0.01 m and 1.0 m have been performed for a loss of DC bus scenario as part of a separate study [see page A-51 of (NRC, 2014b)]. The results from these sensitivity calculations show that the momentum exchange length has a modest effect on key event timings (e.g., time to SG dryout), though it does not significantly affect the overall accident progression for the particular accident scenario in that study. Thus, the current treatment of counter-current flow in the pressurizer surge line is reasonable for the current study.

2.1 Selection of a Core Damage Surrogate To perform supporting analysis of success criteria (SC), it is necessary to define what is meant by core damage (CD) (i.e., sequence success versus failure) because no universal quantitative definition of CD exists. The American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) probabilistic risk assessment (PRA) standard RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, issued March 2009 (ASME/ANS, 2009) defines CD as uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage are anticipated and involving enough of the core, if released, to result in offsite public health effects. The standard later requires the analysis to specify the plant parameters used to determine CD in Section 2-2.3, Supporting Requirement SC-A2 (ASME/ANS, 2009). The CD surrogate provides the linkage between the qualitative definition above and the quantitative, measurable computer code outputs. The surrogate is necessary since a full Level 3 PRA is not being performed.

A number of surrogates have traditionally been used in PRAs, several of which are called out in the PRA standard (Section 2-2.3) (ASME/ANS, 2009). These include various parameters associated with collapsed reactor vessel water level, peak core-exit thermocouple temperature, and peak cladding temperature (PCT). NUREG-1953 presented a set of calculations in Section 2 that provided the basis for that reports usage of PCT of 2,200 degrees Fahrenheit (F)

(1,204 degrees Celsius (C)) as the CD surrogate.

5

Since that time, additional calculations were performed to look at other plant designs and scenarios. These analyses were published in the U.S. Nuclear Regulatory Commission (NRC) contractor report NUREG/CR-7177, entitled, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definitions and Success Criteria Modeling Issues (NRC, 2014b). That report suggests that for selection of CD surrogates for at-power accidents, a PCT of 2,200 degrees F (1,204 degrees C) is an appropriate choice for a CD surrogate for MELCOR SC applications, because it is not overly conservative or overly nonconservative. See Figure 1 for an example of a CD surrogate comparison for a specific accident sequence from (NRC, 2014b). For shutdown conditions, a single metric may not be sufficient for prescribing a realistic surrogate for CD. Rather, a combination could be used including low water level (one-third of the fuel height); PCT temperature above 2,200 degrees F (1,204 degrees C)); and a cesium class release fraction (3 percent released from fuel). If only one metric is used, the current limited pressurized-water reactor (PWR) analyses would suggest a one-third active fuel height as a precursor to fuel damage and a PCT above 2,200 degrees F (1,204 degrees C) as a precursor to significant fuel damage (NRC, 2014b).

4 PCT > 1922K Max. oxidized depth > 17% of clad thickness PCT > U.H. transition (1853K)

PCT > 1644K PCT > 1478K Hydrogen production > 1%

Cesium release > 3% of initial inventory Time to Core Damage [hr]

Xenon release > 0 kg 3 CET > 922K PCT > 922K Core level < 1/3 AF Core level < 2/3 AF Core level < TAF 2

1 4 3 5 1 6 7 8 9 2 Case Number Figure 1 Example of variation in core damage timing from (NRC, 2014b) 6

A PCT of 2,200 degrees F (1,204 degrees C) as a reactor, at power, CD surrogate achieves all of the following characteristics:

• It always precedes the fuel cladding run away oxidation transition.

• It is not overly conservative.

• It is equally applicable for both PWRs and boiling-water reactors.

• The timing between 2,200 degrees F (1,204 degrees C) and oxidation transition is relatively similar among the different sequences analyzed.

• It is consistent with the criteria contained in Title 10 of the Code of Federal Regulations (10 CFR) 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors (10 CFR, 2007).

With regard to the final bullet, the conservatism (i.e., safety margin) in 10 CFR 50.46 is because of uncertainty in large-break loss-of-coolant accident thermal-hydraulic analysis. For PRA usage, the margin has, in part, a different reason: the desire to have a specific criterion that can be used for all sequences combined with overall analysis uncertainty.

For the reasons stated above, a PCT of 2,200 degrees F (1,204 degrees C) is the surrogate used to define CD for the MELCOR analyses in this report. This decision is intrinsically tied to the aforementioned supporting analyses. Other computer codes would be expected to behave differently, depending on considerations such as the nodalization scheme and two-phase flow modeling. As a point of comparison, a PCT of 1,800 degrees F (982 degrees C) is the recommended CD surrogate for use in Modular Accident Analysis Program version 4 (MAAP4)

SC analyses (EPRI, 2010).

7

3. RELATIONSHIP TO THE AMERICAN SOCIETY OF MECHANICAL ENGINEERS/AMERICAN NUCLEAR SOCIETY PROBABILISTIC RISK ASSESSMENT STANDARD Core damage (CD) specification is one of several aspects of success criteria (SC) analysis covered by the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) probabilistic risk assessment (PRA) standard (ASME/ANS, 2009) 2. Although the present project is confirmatory in nature, it is still prudent to cross-check the effort against the PRA standard requirements (see Table 3). Capability Category II is used for comparison, since this is the category identified in Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, issued March 2009, as current industry good practice (NRC, 2009).

Because the current report focuses primarily on the actual thermal-hydraulic and accident progression analysis and defers the actual PRA model changes for a subsequent report, there are some cases where the comparison to the standard has limited applicability. Table 3 notes these instances as appropriate.

2 There is a more recent version of this Standard; however, it has not yet been endorsed in a revision of Regulatory Guide 1.200.

9

Table 3 Comparison of this Project to the ASME/ANS PRA Standard PRA Standard Supporting Requirement for Capability Category II This Project SC-A1: Use provided CD The standard provides a qualitative CD definition. The definition used definition or justify the here is believed to be consistent with the definition, but is necessarily definition used.

quantitative. The basis for the definition (in terms of quantitative SC-A2: Specify the accident analysis and comparison of alternatives) is provided in quantitative surrogate used Section 2.

for CD and provide basis.

SC-A3: Specify SC for The existing SPAR model essentially satisfies the requirement. Any each safety function for changes proposed to the SC should not inappropriately remove criteria each accident sequence. for important safety functions.

SC-A4: Identify systems In the context of this project, this requirement applies only to changes in shared by units and how which the SC is modified to include systems that are shared by multiple they perform during units that were not previously in the SC. This is not believed to be the initiating events affecting case for any of the changes proposed.

both units.

SC-A5: Specify the These calculations generally use a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In several mission times being used cases, calculations are run further than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to establish whether (and use appropriate conditions are safe and stable.

mission times).

The MELCOR input model was developed, and the calculation boundary conditions were selected, after a detailed review of the plants design (e.g., Final Safety Analysis Report), operating envelope (e.g., Technical Specifications, Emergency Operating Procedures), and analytical basis SC-A6: Confirm that the (e.g., PRA systems notebooks). In cases where assumptions are made bases for the SC are that deviate from the operating philosophy of the plant (either due to consistent with the limitations in available information, limitations in the capability of the operating philosophy of the MELCOR model, or limitations in the scope of this project), these plant.

assumptions are documented. In addition, the site has had involvement with particular aspects of the project in order to further promote realism in this regard, including commenting on the factual basis of both this report and the underlying MELCOR calculation notebook.

For this project, the use of realistic plant-specific analyses means that SC-B1: Use realistic Capability Category III is being met, though the last clause in Category III generic analyses about using no assumptions that could yield conservative criteria is evaluations.

debatable.

SC-B2: Do not use expert Other than cases in which MELCOR models are based on expert judgment except when judgment, or judgment is used for selecting operator timings, these sufficient analyses do not use expert judgment. Some judgment will be inevitable information/analytical when the analyses are translated to specific changes in the SC for other methods are unavailable. similar plants.

SC-B3: Use analysis that is appropriate to the This requirement is clearly met by the use of MELCOR on a scenario and contains the scenario-specific basis for the sequences being studied.

necessary level of detail.

10

Table 3 Comparison of this Project to the ASME/ANS PRA Standard (continued)

PRA Standard Supporting Requirement for Capability Category II This Project MELCOR is not formally assessed in the same manner as a design-basis analysis code, but it does undergo some of the same steps (e.g., comparison of results against relevant experimental results). The SC-B4: Use appropriate documentation for this project provides some high-level information models and codes, and about this assessment but does not attempt to make a comprehensive use them within their limits argument for MELCORs applicability. In general, MELCOR is of applicability.

considered an appropriate tool for this application, and areas where it is known to have higher uncertainty (namely large-break LOCAs) are not studied.

SC-B5: Confirm that the All analyses have been reviewed by multiple experienced engineers to analyses results are confirm that the results are reasonable and acceptable. In addition, the reasonable and results for many analyses have been compared to similar previous acceptable. analyses performed by either the NRC or the nuclear industry.

SC-C1: Document the The analyses are being comprehensively documented. The judgment analyses to support PRA used in applying the analyses as the basis for making specific SPAR applications, upgrades, model changes will be documented separately.

and peer review.

SC-C2: Document the overall analysis comprehensively, including In general, the level of documentation being provided with these consideration of a provided analyses is consistent with this Supporting Requirement.

list of documentation areas.

SC-C3: Document the Numerous sensitivity studies have been performed and documented to sources of model capture relevant model uncertainties. Assumptions are documented uncertainty and related throughout, and major assumptions are captured in Section 2.

assumptions.

11

4. MAJOR PLANT AND MELCOR MODEL CHARACTERISTICS The following subsections describe aspects of the analyzed plant and the associated MELCOR model that are germane to the analysis performed in this report.

4.1 Byron Station Unit 1 Byron Station Unit 1 is a four-loop Westinghouse plant with a large dry containment. It has two high-head centrifugal charging pumps (CCPs), two intermediate-head safety injection (SI) pumps, two low-head SI (a.k.a., residual heat removal (RHR)) pumps, 3 and four cold-leg accumulators (ACCs) (one per loop). RHR pumps are required for high-pressure recirculation (HPR) (in order to provide sufficient net positive suction head to the high-head pumps when using the containment sump as a water source). The minimum technical specification refueling water storage tank (RWST) volume is 1,495 cubic meters (m3) (395,000 gallons (gal)).

Operators initiate the transfer of the water source for the emergency core cooling system (ECCS) pumps from the RWST to the containment sump when the RWST water level drops below 46-percent level, which is the RWST Lo-2 setpoint. It has been assumed that this transfer operation takes 10 minutes to account for the time required to perform the relevant procedural steps.

The containment spray (CS) system in injection mode relies on two pumps rated at 12.93 and 14.86 cubic meters per minute (m3/min) (3,415 and 3,925 gallons per minute (gpm)) for the A and B trains, respectively. Containment spray automatically actuates at 0.248 megapascal (MPa) (35.9 pounds per square inch absolute (psia)) containment pressure. Table 4 summarizes major plant characteristics.

Byron Unit 2 and Braidwood Units 1 and 2 are substantively similar to Byron Unit 1.

Table 4 Major Plant Characteristics for Byron Unit 1 Characteristic Value Design Type 4-loop Westinghouse Containment Type Large Dry Power Level 3,586.6 MWt (see text below)

Number of CCPs / SI Pumps 2/2 Number of RHR / CS Pumps 2/2 Shutoff Head for Charging/SI 17.9/10.7 MPa (2,600/1,550 psid)

Shutoff Head for RHR 1.31 MPa (190 psid)

Lowest PORV Opening/Closing Setpoint 16.2/16.067 MPa (2,350/2,330 psia)

Number of Cold-Leg Accumulators 1 per loop (4 total)

Nominal Operating Pressure 15.5 MPa (2,250 psia)

RWST Minimum Volume Technical Specification 1,495 m3 (395,000 gal)

The power level used in this report is the power level before a 1.63-percent power uprate approved in February 2014 (NRC, 2014a), since the majority of work was completed prior to that date. However, as later sensitivities will show, there is a compensating effect between the lower power level used versus the somewhat conservative decay heat curve used.

3 The low-head safety injection pumps are also used for residual heat removal (RHR). Byron documentation frequently refers to these pumps as RHR pumps. This convention is adopted in this report.

13

4.2 Byron MELCOR Model The Byron model used for this analysis is based on the as-built, as-operated plant, as understood from information compiled from discussions with plant operation and engineering staff, site visits, and review of plant documentation and operating procedures. Where information about Byron Unit 1 was unavailable, the model uses applicable data from a Seabrook TRACE model or from a Surry MELCOR model. 4 The input model was developed using MELCOR 1.8.6 and then converted to MELCOR 2.1 input format. All calculations were performed using MELCOR 2.1.

Appendix A of this report outlines the basic features of the Byron model. Included are the reactor trip signals modeled; the ECCS injection setpoints; the charging, SI, and residual heat removal (RHR) pump curves; details of the switchover of ECCS suction from the RWST to the containment sump; accumulator characteristics; CS system characteristics; containment fan cooler characteristics; and relief valve setpoints.

Figure 2 shows a plan view of the MELCOR model for the Byron reactor coolant system (RCS).

All four RCS loops are modeled individually. The detailed nodalization of the RCS loop piping as well as the reactor core and vessel upper plenum allows modeling of the in-vessel and hot-leg counter-current natural circulation during core heatup. This feature has been shown to be relevant even within the temperature ranges of interest in the analysis (i.e., those preceding core damage). The reactor coolant pumps (RCPs) are tripped on power failure, containment pressure greater than 1.36 bar (20 pounds per square inch gage (psig)), simultaneous RCS pressure less than 9.93 MPa (1,425 psig) and SI injection flow greater than 0.38 m3/min (100 gpm), or voiding in the coolant loop. 5 The core region is nodalized into 10 axial thermal response nodes (the MELCOR core package (COR)) mapped to 5 axial hydrodynamic volumes (the MELCOR control volume hydrodynamics package (CVH)), and comprises 5 radial rings.

Safety systems are modeled using injection points, and the relevant portions of the reactor protection system and control systems are modeled using MELCOR control functions. For the secondary side, both motor-driven auxiliary feedwater and diesel-driven auxiliary feedwater are modeled (including provisions for water level control). The containment is modeled as a single control volume. Containment sprays and fan coolers are also modeled.

The core decay power is based on the decay heat curve in the Byron Final Safety Analysis Report (FSAR). Note that the decay power from the Byron FSAR is noticeably higher than the default decay heat curve in MELCOR based on the 1979 American Nuclear Society (ANS) standard. The decay heat curve in the Byron FSAR is also based on the 1979 ANS Standard; however, the Byron FSAR curve incorporates a number of assumptions that result in a higher decay power relative to the curve in MELCOR that is based on the same ANS standard.

4 This is the same Surry model used in NUREG-1953.

5 Since the present analyses do not credit operator actions to trip the RCPs for some cases (which are identified in the associated sections), a global void fraction in the vicinity of the pumps of 10 percent is selected to represent a condition in which pump cavitation would prompt shutdown of these pumps. A system-level code such as MELCOR does not have the capability to directly model actual pump performance under degraded conditions.

14

Figure 2 Schematic of the Byron MELCOR RCS model To investigate the sensitivity of calculation results to the potential failure of pressurizer power-operated relief valves (PORVs) due to repeated cycling, some calculations assume that the valve fails open, partially open, or closed after 251 cycles. This value is derived from the median cumulative failure probability (using a per-demand failure probability obtained from (NRC, 2011b) and the number of demands). This simplified approach assumes that the per-demand failure rate of the valve is constant (i.e., no degradation in valve performance following repeated lifts) and the valve failure rate is insensitive to either steam, water, or a two-phase mixture passing through the valve. Generally speaking, the standardized plant analysis risk models treat the situation in a binary fashionthe valve is either stuck open after the first demand or it operates normally.

4.3 MELCOR Validation The MELCOR code is designed to run best-estimate accident simulations (NRC, 2005). The code has been assessed against a number of experiments and plant calculations. The current test suite for MELCOR contains over 170 separate input decks. MELCOR has been used for FSAR audit calculations (related to engineered safety feature design and performance, containment design and performance, design-basis accident analysis, and severe accident analysis); the post-September 11, 2001, security assessments; and the State-of-the-Art Reactor Consequence Analyses project. It has also been used to assess significance determination process issues. For these reasons, it is an ideal tool to use in this project.

15

Specific experiments and plant calculations relevant to this project for which MELCOR has been assessed include the following:

• Quench experiment 11, simulating a small-break loss-of-coolant accident with late vessel depressurization to investigate response of overheated rods under flooding conditions (Hering, 2007)

• the Three Mile Island Unit 2 accident (NRC, 1980)

• loss-of-fluid test (LOFT) LP-FP-2, simulating a large-break loss-of-coolant accident (Adams, 1985)

• Russian Academy of Sciences MEI experiments involving a spectrum of loss-of-coolant accident sizes to study critical flow and vessel response (e.g., Dementiev, 1977)

• NEPTUN experiments to test pool boiling models and void fraction treatment (NRC, 1992)

• General Electric level swell and vessel blowdown experiments characterizing single- and two-phase blowdown, liquid carryover, and water level swell (e.g., Appendix A to NRC, 1981)

• General Electric Mark III tests with steam blowdown into the suppression pool investigating vent clearing and heat transfer models

• containment thermal-hydraulic phenomena studied in various experimental facilities, including Nuclear Power Engineering Corporation for mixing and stratification (e.g., NUPEC, 1993), Heissdampfreaktor for blowdown into containment, and Carolinas Virginia Tube Reactor for steam condensation in the presence of noncondensables (SNL, 2008)

• small-scale experiments to test condensation models, including Wisconsin flat plate experiments (e.g., Huhtiniemi, 1993) and Dehbi tests 16

5. MELCOR RESULTS The detailed results for Byron are provided in Appendices B-F. 6 The following subsections summarize these results in a standard format: (1) a description of the scenario and calculation results, (2) a table of key assumptions and operator actions, (3) a table of results, (4) table(s) of the timing to key events and figures of merit, and (5) the results of sensitivity studies 7.

The following scenarios were analyzed for Byron:

• Small-break loss-of-coolant accident (SLOCA) to investigate the sequence timing for alignment of sump recirculation (Section 5.1)

• SLOCA to investigate the success criteria for steam generator (SG) depressurization and condensate feed (Section 5.2)

• SLOCA to investigate the sequence timing and minimal success criteria (SC) for feed and bleed (Section 5.3)

• The loss of DC bus 111 (LoDCB-111) with no diesel-driven auxiliary feedwater (DD-AFW) to investigate the sequence timing and minimal SC for feed and bleed (Section 5.4)

• Steam generator tube rupture (SGTR) events to investigate the sequence timing in the absence of successful operator actions (Section 5.5)

• Medium-break loss-of-coolant accident (MLOCA) to look at the minimal injection SC (Section 5.6)

• MLOCA to investigate the timing for low-pressure recirculation (LPR) (Section 5.7)

• Loss of shutdown cooling to investigate timing for recovery actions (Section 5.8)

In many cases, the analyzed sequence progressions make assumptions about the unavailability of systems and about operator actions that are not taken. These assumptions often stem from the particular sequence in the event tree that is being studied, which may not be the most probable sequence. In other cases, these characteristics are not included because of resource constraints. In all cases, the relevant subsections note these assumptions.

Note that after much of the analyses described in this report had been completed, a concern was raised regarding MELCORs treatment of liquid water in any air space (referred to as fog 6 Plots of reactor vessel water level in Appendices B-F show the actual water level rather than collapsed liquid level (i.e., they include two-phase effects where appropriate).

7 In describing the results of the sensitivity studies, the term negligible is intended to denote trivial changes in the timing figures of merit, relative to the precision of the simulation (e.g., ones of minutes). Meanwhile, terms such as little impact denote situations where there is generally no change in the sequence of events, the change in figures of merit would have no effect on PRA applications of the results, and the changes are the same order of magnitude as would be expected for many other unstudied uncertainties.

17

in MELCOR), when the hygroscopic model is activated in conjunction with the flashing model. 8 The MELCOR code developers are aware of the issue and are working to address this concern.

To determine the impact of the concern on the results presented in this report, several calculations have been rerun with the hygroscopic model turned off. There are no significant differences in the results, though changes on the order of minutes are seen in some key event timings (e.g., time of refueling water storage tank (RWST) depletion, time at which reactor coolant system (RCS) pressure falls below the residual heat removal (RHR) pump shutoff head) prior to core damage (CD) (or its avoidance). In rare cases, there are more noticeable effects (e.g., key event timing changes by an hour) later in the accident sequences when RCS conditions stabilize near the RHR pump shutoff head. However, these differences do not significantly affect the key conclusions made in this report.

5.1 Small-Break Loss-of-Coolant Accident-Sequence Timing for Alignment of Sump Recirculation This series of cases investigates the timing to RWST depletion (and thus switchover to sump recirculation) for SLOCAs in which safety injection (SI) and auxiliary feedwater (AFW) are available and high-pressure recirculation (HPR) is assumed to be unavailable. For these cases, plant operators are assumed to initiate SG cooldown to depressurize the primary system to allow for low-pressure sump recirculation. Other than actions taken to depressurize the SGs, very few operator actions are modeled. In reality, operators would enter Byron Emergency Procedure (BEP)-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment and start equipment as needed); transition to BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip reactor coolant pumps (RCPs), reduce RCS injection flow); and later transition to BEP ES-1.2, Post-LOCA Cooldown and Depressurization (e.g., dump steam to the condenser, fill the pressurizer).

The varied parameters are equivalent diameter break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), the available injection systems (one charging pump or one SI pump), and the SG cooldown initiation time and target depressurization rate. The cooldown initiation times are selected to envelope the time used in the licensee probabilistic risk assessment (PRA). In all cases, the break is located in the horizontal section of the cold leg in the loop containing the pressurizer. This location is a modeling choice, and it is not expected that the location of the break should make a significant difference in the results. Also, the SG power-operated relief valves (SG PORVs, a.k.a, atmospheric relief valves - the former is the term used in the Byron emergency procedures) are opened to commence secondary-side cooldown (in reality, either the SG PORVs or the condenser steam dump valves could be used to perform the cooldown). 9 Additional sensitivity cases (1a and 7a) were performed to study the consequences of the operators failing to initiate SG cooldown.

8 The concern with this situation is that MELCOR may not be correctly conserving mass during conditions where both the hygroscopic model and flashing model are active.

9 The SC for secondary-side cooldown in the Byron SPAR model is 3/4 SG PORVs or 1/12 turbine bypass valves (TBVs). For this analysis, 4/4 SG PORVs are used, due in part to the simplified approach taken for the secondary side of the Byron MELCOR model. For instance, the steam dump model has been tuned to avoid an early safety injection signal in normal transients, and so use of the TBVs for secondary-side cooldown may be unrealistic.

(Also, steam dumps would be unavailable following MSIV closure, at which point the SG PORVs would be used for the cooldown.) Using 3/4 SG PORVs challenges the steam header/MSIV/turbine control valve behavior, which is not a focus of the Byron model development. Thus, the Byron model is not well-suited to test the required valve lineup for secondary-side cooldown. Furthermore, results of sensitivity case 11j show that there is little difference between 3/4 SG PORVs and 4/4 SG PORVs for this scenario, as predicted by the MELCOR analysis.

18

The modeling uses a simplified approach and does not necessarily reflect actual plant operating procedures in some cases. 10 For this reason, the results should be used with caution.

Boundary conditions for this scenario are listed in Table 5 and Table 6. Results are provided in Table 6 through Table 9. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.1. Additional sensitivity studies and their results are listed in Table 10. Finally, in order to assist with extrapolation of these results to other situations, Figure 3 shows a plot of the time to sump switchover as a function of RWST delivered flow while Figure 4 shows a plot of peak containment pressure as a function of the number of fan coolers available and the containment free volume. In Figure 4, the situation with zero fan coolers triggers containment sprays (CSs), which is why the containment pressure is capped at 21 pounds per square inch gauge (psig) (which is the CS setpoint).

Table 5 SLOCA-Sump Recirculation Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable) 11 Primary side

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm

• 1 of 1 motor-driven auxiliary feedwater (MD-AFW) trains; 0 of 1 diesel-driven auxiliary feedwater (DD-AFW) trains Secondary side

• Condenser steam dumps available until main steam isolation valve (MSIV) closure due to high containment pressure

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps

• 2 of 2 containment spray (CS) trains ECCS/ESF

• 1 of 4 reactor containment fan cooler (RCFC) units

• 1 of 2 low-pressure recirculation (LPR) trains

• No high-pressure recirculation (HPR) pumps available

• RHR pumps are secured during dead-head phase, available upon demand

• No RWST/CST refill

• Actions to open pressurizer PORV for additional RCS depressurization are Operator actions not modeled (see text)

• Switchover of the ECCS injection source from the RWST to the containment sump is assumed to begin when the RWST level is at 46% (the procedural trigger for switchover) and to take 10 minutes to complete

• CCW to residual heat removal heat exchanger (RHR HX) is available (except Other as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

10 For instance, no effort is made to throttle charging pump or SI flow to control pressurizer level. As a result, the reactor coolant system (RCS) becomes water-solid for the 0.83-in. (2.11-cm) break cases. In the plant operating procedures, the operators are instructed to terminate safety injection if plant conditions (subcooling margin, secondary-side heat removal, RCS pressure, pressurizer level) are acceptable to prevent pressurizer overfill.

11 The choice of 50% open was simply a decision to explore an intermediate state that could be more limiting, wherein the valve is not fully open or fully closed. In the case of the valve failing closed, pressure would increase to the setpoint of the 2nd PORV, causing it to cycle.

19

Table 6 SLOCA-Sump Recirculation Results Equivalent Number of Diameter Target SG Cooldown Core Uncovery Core Damage b Case Charging/

Break Size Rate a (hh:mm) (hh:mm)

SI Pumps (in.)

100 °F/hr (55.6 °C/hr) 1 1/0 No No starting at 1.75 hr 1a 1/0 No Cooldown 10:41 12:15 100 °F/hr (55.6 °C/hr) 2 0/1 No No 0.83 starting at 1.75 hr 3 1/0 75 °F/hr (41.7 °C/hr) No No 4 0/1 starting at 2.25 hr No No 5 1/0 100 °F/hr (55.6 °C/hr) No No 6 0/1 starting at 2.75 hr No No 100 °F/hr (55.6 °C/hr) 7 1/0 00:33 No starting at 1.75 hr 7a 1/0 No Cooldown 00:33 06:41 100 °F/hr (55.6 °C/hr) 8 0/1 00:32 No 1.66 starting at 1.75 hr 9 1/0 75 °F/hr (41.7 °C/hr) 00:33 No 10 0/1 starting at 2.25 hr 00:32 No 11 1/0 100 °F/hr (55.6 °C/hr) 00:33 No 12 0/1 starting at 2.75 hr 00:32 No a Times for SG depressurization are from time = 00:00 b Defined as peak cladding temperature (PCT) = 2,200 °F (1,204 °C)

For the 1.66-in. (4.22-cm) break cases, the RCS depressurizes because of the break. The system depressurizes further as a result of the operator-initiated SG cooldown, until the RCS pressure drops below the RHR dead-head pressure. After the RWST level decreases to 46 percent (RWST Lo-2), the RHR system is realigned to sump recirculation. The LPR flow is sufficient to refill the pressurizer and keep the core cool. The results for Case 7a clearly show that RCS pressure does not fall below the RHR pump dead-head pressure unless the operators initiate SG cooldown. In Case 7a, the operators fail to initiate cooldown, and CD occurs after the loss of high-pressure injection (HPI) due to RWST depletion (HPR is not modeled for these cases).

For the 0.83-in. (2.11-cm) break case without SG cooldown, the RCS does not depressurize below the RHR dead-head pressure. Thus, CD occurs in Case 1a because the RCS remains at high pressure and HPR is assumed to be not available. For the other 0.83-in. (2.11-cm) break cases, SG cooldown allows the RHR system to operate in sump recirculation mode to prevent CD. However, the pressure does not fall below the RHR dead-head pressure until after HPI stops. The end of HPI upon RWST low level causes the reduction in pressure because the coolant lost through the cold leg break is no longer replaced by water from the RWST.

For both equivalent break sizes, there is little difference in the sequence of events when RCS injection is provided by either the charging pump or the SI pump (recall that AFW is available for removing decay heat). In general, RWST depletion occurs minutes to tens of minutes earlier for the SI pump cases. This is because the SI pump has a greater capacity at pressures below about 1,100 psi (7.6 megapascals (MPa)) and because the RCS is below 1,100 psi (7.6 MPa) for much of the accident in all cases except Case 1a (0.83-in. (2.11-cm) break without SG cooldown).

20

Table 7 SLOCA-Sump Recirculation Key Event Timings Case 1 Case 1a Case 2 Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 00:06 00:06 00:06 Charging pump 00:06 00:06 -- 00:06 -- 00:06 --

injection SI pump injection -- -- 00:07 -- 00:07 -- 00:07 RCP trip 00:39 00:39 00:08 00:39 00:08 00:39 00:08 MSIVs close 02:12 02:52 02:12 02:49 02:49 03:09 03:10 RHR injection from RWST RWST Lo-2 a 06:07 07:14 05:50 06:17 06:08 06:20 06:16 Switchover to sump recirc 06:17 07:24 06:00 06:27 06:18 06:30 06:26 completed Start of injection 06:28 -- 06:10 06:46 06:36 06:53 06:42 from the sump Core uncovery -- 10:41 -- -- -- -- --

Core damage -- 12:15 -- -- -- -- --

Case 7 Case 7a Case 8 Case 9 Case 10 Case 11 Case 12 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 Charging pump 00:01 00:01 -- 00:01 -- 00:01 --

injection SI pump injection -- -- 00:02 -- 00:02 -- 00:02 RCP trip 00:02 00:02 00:02 00:02 00:02 00:02 00:02 MSIVs close 00:22 00:22 00:21 00:22 00:21 00:22 00:21 RHR injection 03:32 -- 03:09 04:23 04:01 04:21 03:48 from RWST RWST Lo-2 a 04:21 05:45 03:50 05:28 04:30 05:02 04:26 Switchover to sump recirc 04:31 05:55 04:00 05:38 04:40 05:12 04:36 completed Start of injection 04:32 -- 04:01 06:02 04:41 05:15 04:36 from the sump Core uncovery 00:33 00:33 00:32 00:33 00:32 00:33 00:32 Core damage -- 06:41 -- -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

These SLOCA cases assume operators take action to depressurize the secondary system.

However, plant operating procedures also direct the operators to use the pressurizer PORVs to depressurize the RCS while they are using the SG PORVs to depressurize the secondary system. This action is not included in the MELCOR model for simplicity reasons and because it is not part of the minimal SC in the licensees model. The Byron SPAR model requires a pressurizer PORV for successful RCS cooldown and depressurization. MELCOR results support the licensees PRA treatment of this scenario for equivalent break sizes larger than 0.83 in. (2.11 cm). For smaller breaks, a pressurizer PORV may be needed to prevent CD.

Alternatively, throttling of SI/charging or use of auxiliary spray may be sufficient.

21

Table 8 SLOCA-Sump Recirculation Margins Case Case Case Case Case Case Case 1 1a 2 3 4 5 6 1,204 °C (2,200 °F) minus a 852 CD a 852 a 852 a 852 a 852 a 852 PCT (in °C)

Completion of sump realignment-RHR entry -00:11 c -- -00:11 -00:19 -00:17 -00:23 -00:15 time b (hh:mm)

CS setpoint-peak 94.0 50.7 96.3 87.0 92.4 83.5 90.4 containment pressure (kPa

[13.6] [7.4] [14.0] [12.6] [13.4] [12.1] [13.1]

[psi])

Case Case Case Case Case Case Case 7 7a 8 9 10 11 12 1,204 °C (2,200 °F) minus 847 CD a 852 847 a 852 847 a 852 PCT (in °C)

Completion of sump realignment-RHR entry 00:59 c -- 00:51 01:15 00:40 00:51 00:48 time b (hh:mm)

CS setpoint-peak 32.5 16.4 34.8 24.8 23.6 22.1 20.4 containment pressure (kPa

[4.7] [2.4] [5.0] [3.6] [3.4] [3.2] [3.0]

[psi])

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b This parameter measures the difference between the time at which RCS pressure drops below the RHR shutoff head (i.e., the time at which low-pressure injection (LPI) can begin) and the time at which operators realign RHR pump suction to draw from the containment sump. This is important because HPR is assumed to be not available for this accident scenario.

c The RCS pressure never drops below the RHR pump dead-head pressure.

Table 9 SLOCA-Sump Recirculation Cooldown Rates Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Target a 100 100 75 75 100 100 1 hr after start of cooldown 125 128 111 113 134 137 2 hr after start of cooldown 107 109 94 96 111 113 3 hr after start of cooldown 88 90 83 84 90 92 Case 7 Case 8 Case 9 Case 10 Case 11 Case 12 Target a 100 100 75 75 100 100 1 hr after start of cooldown 101 100 78 81 104 102 2 hr after start of cooldown 100 103 75 73 95 88 3 hr after start of cooldown 82 66 61 61 77 59 a Rates are in F/hr In these cases, the condenser steam dumps open immediately following the reactor trip, as is expected, but the steam dumps cause SG and RCS pressure to drop more severely than one would expect, for reasons that have not yet been determined. However, a subsequent calculation in which the steam dumps were disabled was performed. Results from this sensitivity study show that, while the RCS pressure behavior immediately after the trip is different, the RCS pressure quickly matches the pressure trend for the case with the steam dumps enabled. Thus, the early steam dump actuation has little impact on overall system behavior.

22

Table 10 SLOCA-Sump Recirculation Sensitivity Studies Case Sensitivity Justification Results 5a Extend to This case was run until When Case 5 is extended to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> without CST refill CST depletes at approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

to see if CST refill shortly (Note that this case assumes that the CST after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should be level is at the minimum allowed by the plant noted as a consideration in Technical Specifications. The SGs dry out at the accident sequence 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. If one assumes that the CST is full analysis (which represents a significantly larger volume over the Tech Spec minimum level), CST depletion would be further delayed by at least 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> based on the average AFW flow rate at 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.) After CST depletion, RCS pressure begins increasing. The RHR pump is quickly dead-headed by the rising pressure, thus ending injection to the RCS. Core water level begins falling just before the end of the calculation. CD does not occur before 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, but it is imminent.

11a 1 CCP AND This is a nonminimal In this case, the RWST level reaches Lo-2 at 1 SI pump combination, which in this 2:40, as opposed to 5:02 in Case 11. As a case may lead to earlier result, there is no ECCS injection for RWST depletion, potentially 20 minutes, between the time at which the increasing the severity of RWST depletes and the time at which RCS the accident pressure falls below the RHR pump shutoff head. There is no heatup during this period because the RCS water level is several meters above TAF.

11b 4/4 RCFC This will reduce Containment pressure and temperature are containment temperature lower with 4/4 fan coolers available compared and pressure to the case with 1/4 fan coolers. This has a minor impact on heat losses from the RCS in the first few hours of the accident, which in turn impacts RCS pressure and thus ECCS flow rates. As a result, RWST depletion occurs about 25 minutes earlier in Case 11b than in Case 11.

11c Set target SG Current logic simplistcly There is less water on the secondary side of water level in uses normal operating level the SGs due to the lower AFW target level.

AFW logic to (24.25m, which is ~60% The lesser mass of water heats up and boils 22.90 m (it is NR) as the target. more rapidly than the greater mass of water in 24.25 m Procedure BEP 0 instructs the base case, resulting in more SG relief otherwise) operators to maintain SG valve cycling before actions are taken to cool water level above 31% NR down the plant in the sensitivity case.

level for adverse Otherwise, the SG water level has little impact containment conditions on the plant thermal hydraulic response in this (containment pressure scenario.

>5 psig)b.

23

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11d Model This step is included in the The procedural conditions required to secure operator EOPs, notably in both ECCS pumps (i.e., adequate subcooling and actions to BEP-1 (Loss of Reactor or pressurizer level) are not met until after the throttle pumps Secondary Coolant) and switchover to recirculation. Normally, to prevent BEP ES-1.2 (Post LOCA operators would secure all pumps except pressurizer Cooldown and one charging pump, and use that charging from going Depressurization) pump to maintain adequate pressurizer level solid and RCS subcooling. However, this scenario assumes that HPR is unavailable, so charging pumps are unavailable for controlling level. If the RHR pumps are stopped, RCS subcooling would quickly become unacceptable, triggering the yellow indicator on the core cooling critical safety function status tree. This in turn would prompt operators to restart available ECCS pumps, per procedure 1BFR-C.3. If pumps are not restarted, the result would be CD. If the pumps are restarted, then the scenario would progress as if no action was taken to stop and restart the pump. This has been confirmed by MELCOR calculations.

11e Use the The model used for critical The HFM critical flow model yields slightly Homogenous flow can have a significant greater two-phase and single-phase steam Frozen Model impact on flow through the break flow rates compared to the HEM, though (HFM) instead cold leg break the slight increase in break flow has little of the impact on key event timings.

Homogneous Equilirbium Model (HEM) for critical flow 11f 1.63% power 1.63% MUR power uprate The higher power level results in slightly higher increase that was recently approved auxiliary feedwater and SG relief valve flow by NRC (NRC, 2014a)a rates compared to the base case, but has little impact on key event timings and calculation figures of merit.

11g Delay RCP BEP 0 directs operators to Delaying RCP trip by 10 minutes results in trip by trip RCPs if SI flow greater losses through the break. As a result, 10 minutes >100 gpm and RCS RHR injection begins 30 minutes earlier in pressure <1,425 psig; Case 11g than in Case 11. RWST depletion however, this action occurs occurs approximately 20 minutes earlier in at Step 20, so there will be Case 11g than in Case 11 due to the earlier a delay from reactor trip RHR injection.

(shortly after which the above two conditions are true) until operators take action to trip RCPs 24

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11h Use the ANS The MELCOR model The ANS standard decay heat curve decay heat currently uses a decay heat implemented in MELCOR yields lower decay standard as curve from the plants heat relative to the Byron FSAR decay heat encoded in FSAR curve. As a result, the RCS cools significantly MELCOR even before actions are taken to initiate cooldown using the SG PORVs. However, there is little impact on the time of RWST depletion.

11i Adjust core This is approximately equal Increasing the core bypass flow has little bypass flow to to the maximum bypass impact on key event timings.

6% of total flow cited in the FSAR RCS flow 11j Use 3/4 SG The SC for secondary-side This case shows that 3/4 SG PORVs is PORVs for cooldown is 3/4 SG PORVs sufficient for secondary-side cooldown for this cooldown or 1/12 TBVs particular scenario. Disabling the SG PORV instead of on one of the SGs has little effect on key event 4/4 SG timings.

PORVs 11k Use This case will show if CSs With no fan coolers available, containment 0/4 RCFC actuate in the absence of pressure reaches the CS setpoint at fan coolers, and if so, the 80 minutes. With both spray trains running, effect on the time to sump the RWST reaches Lo-2 approximately switchover 25 minutes after spray initiation, or approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before operators begin the controlled cooldown. At this time, RCS pressure is significantly above the RHR pump shutoff head, so LPR is unavailable immediately after RWST depletion. As a result, core water level quickly drops below the TAF, and CD occurs at approximately 02:25 (i.e., 20 minutes before operators initiate the cooldown). This case shows that at least one fan cooler is required to prevent CS actuation, which results in rapid RWST depletion and CD unless operators take earlier action to initiate SG cooldown.

25

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11l Use 2/2 This case will show the In this case, RWST level decreases much charging effect of maximum injection more rapidly than it does in Case 11. Not all of pumps and on the time to sump the procedural requirements to reduce ECCS 2/2 SI pumps, switchover flow are met, so all high- and with control of intermediate-pressure ECCS pumps continue Pressurizer to inject to the RCS. RWST Lo-2 occurs at level 1:34 minutes, compared to 5:02 in Case 11.

Assuming that operators stop injection 10 minutes after RWST Lo-2 as part of the switchover to sump recirculation, and given that HPR is unavailable, only LPR is available from 1:44 until the end of the transient.

Operators do not begin the cooldown until 2:45, so there is a long period of time during which there is no injection to the RCS. Water level drops below TAF at 2:46 and falls to about 1/3 active fuel height by 3:22, when RCS pressure finally drops below the RHR pump shutoff head. LPR quickly refills the RCS and quenches the fuel. PCT is approximately 800 °C (1472 °F), which is below the CD surrogate temperature of 2200 °F. (Note that inadequate core cooling would also prompt a depressurization at generally the same time as is assumed here.)

a Note that most technical work for the present study preceded approval of the power uprate.

b The adjustment here includes an additional reduction of 0.33 m to account for the difference between normal operating level in the Byron reference material (24.3 m) and steady-state level calculated by MELCOR (23.97 m).

Note that in the 0.83-in. break cases, the cooldown rate in the first hour following operator action to initiate cooldown is greater than the target value. This is illustrated by Table 9, which shows the cooldown rate at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after operator action to initiate cooldown. The first-hour cooldown rate is up to 40 degrees Fahrenheit/hour (F/hr) greater than the target rate.

However, the cooldown rate averaged over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the start of the cooldown is less than the target rate for Cases 1, 2, 5, and 6, and less than 10 degrees F/hr greater than the target in Cases 3 and 4. It is worth noting that RWST depletion occurs more than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the start of cooldown, and that RCS temperature is relatively constant at the time of RWST depletion.

Furthermore, the faster cooldown would most likely have little impact on the time to RWST depletion because charging and SI pumps are operating at their maximum flow rates for much of the cooldown period (as demonstrated by the consistent time of RWST depletion for Cases 1, 3, and 5 and for Cases 2, 4, and 6). For these reasons, there would be little difference in the plant response if the cooldown rate was maintained at the target rate over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, compared to the actual results (in which the cooldown rate was much higher than the target for the first hour and then less than the target later in the cooldown period). Thus, the 0.83-in. break cases are acceptable given that the high initial cooldown rate does not affect the takeaways from this scenario.

For the 1.66-in. break cases, cooldown rates greatly exceeded the target rates, which necessitated major modifications of the cooldown logic implemented in the MELCOR model.

26

After rerunning the cases with the improved cooldown logic (i.e., adjustments to the logic that the MELCOR model uses to emulate the operators actions to cooldown the plant), cooldown rates are approximately equal to the target rates for the 1.66-in. break cases. Results for the 1.66-in. break cases presented in this report use the improved cooldown logic.

Figure 3 Time of RWST depletion as a function of RWST volume All of the cases described above assume that the component cooling water (CCW)-to-residual heat removal heat exchanger (RHR HX) is available throughout the transient. The RHR HX provides a means of decay heat removal during the emergency core cooling system (ECCS) recirculation from the containment sump. This heat removal mechanism acts together with the AFW system and the containment fan cooler to accomplish long-term decay heat removal. The above cases have been rerun assuming the RHR HX is unavailable. These sensitivity calculations show no differences in the results up to the time of RWST depletion, and little differences during ECCS recirculation. Thus, the RHR HX is not needed to prevent CD for the SLOCA Sump Recirculation scenario. This is because AFW is assumed to be available and is removing most of the decay heat, so ECCS is needed primarily to keep the fuel covered and to remove a small fraction of the decay heat.

27

Figure 4 Peak containment pressure as a function of containment volume and the number of available fan coolers for Case 11 The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (i.e., one train of centrifugal charging pump (CCP) or SI and one train of RHR) and the unavailability of HPR.

• For the smaller breaks in the SLOCA range, SG depressurization is sufficient for achieving RHR conditions at the time of RWST switchover if SI/charging injection is manually reduced allowing the RCS pressure to decrease. Otherwise, operator action to use the PORV to further depressurize the primary side is required. Alternatively, CD is still averted if RCS pressure is allowed to naturally drop below the RHR dead-head pressure as a ramification of losing high-head injection during switchover (since HPR is failed in these cases).

• For the larger break studied in the SLOCA range, SG depressurization is sufficient to reduce the RCS pressure below the RHR shutoff head, allowing RHR injection and preventing CD.

• For all break sizes, AFW is sufficient for late decay heat removal, and the RHR HX is not required as an additional minimal SC. Condensate storage tank (CST) refill after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> would be needed, if only the Technical Specification CST volume is credited (see Sensitivity Case 5a).

28

• A sensitivity study for a 4.2-cm (1.66-in.) break considered the case of no containment fan coolers and predicted that CSs would actuate, resulting in earlier RWST depletion and CD.

• General caution: The situations with greater than minimal ECCS flow will result in earlier RWST depletion. Those in the smaller break size of the SLOCA range may also experience greater repressurization later in the transient due to the smaller break sizes inability to relieve pressure out of the break as quickly as the larger breaks.

5.2 Small-Break Loss-of-Coolant Accident-Success Criteria for Steam Generator Depressurization and Condensate Feed This series of cases investigates a scenario in which SI and condensate feed (due to an assumed lack of AFW) are used to mitigate an SLOCA. To utilize condensate feed, operators must take action early in the accident to depressurize the SGs below the shutoff head of the condensate booster pumps at 670 psig. Other than actions to depressurize the SGs and to restart the booster pumps for injection, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed); transition to BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip RCPs, reduce RCS injection flow);

and later transition to BEP ES-1.2, Post-LOCA Cooldown and Depressurization (e.g., dump steam to the condenser, fill the pressurizer). Operators would also be directed by BEP-0 to perform actions in BFR-H.1, Response to Loss of Secondary Heat Sink, due to insufficient feed flow to the SGs.

The varied parameters for this scenario are equivalent break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), available HPI (one charging pump or one SI pump), and the time at which operators begin SG cooldown (10 minutes or 20 minutes). In all cases, the break is located in the horizontal section of the cold leg in the loop containing the pressurizer. Also, the SG PORVs are opened to commence secondary-side cooldown. 12 Boundary conditions for this scenario are listed in Table 11. Results are shown in Table 12 through Table 15. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.2.

Sensitivity studies and their results are listed in Table 16.

For the 0.83-in. (2.11-cm) break cases, SG cooldown and loss of HPI (due to depletion of the RWST) together cause RCS pressure to drop below the shutoff head of the RHR pumps, thus allowing for LPR flow. In all cases, LPR quickly follows RWST depletion. Eventually, the SGs boil completely dry due to the loss of all feedwater (FW) injection following depletion of the condenser hotwell. (Refill or alignment of alternative sources of water is not considered here.)

Once the secondary heat sink is lost, RCS pressure increases quickly because the break is not large enough to accommodate the expansion of RCS coolant volume associated with the core heatup. The rise in pressure cuts off LPR, causing the level in the vessel to drop to below the top of active fuel (TAF). The pressure continues to rise until it reaches the pressurizer PORV setpoint. Valve cycling causes the PORV to fail open, thus causing pressure to decrease, but the drop in pressure occurs too lateCD occurs due to the lack of makeup to the RCS.

12 Specifically, 4/4 SG PORVs are used instead of 3/4 SG PORVs or 1/12 TBVs. See footnote 9 for more information.

29

Table 11 SLOCA-Condensate Feed Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable)

Primary side

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm

• 0 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• Condenser steam dumps available until MSIV closure Secondary side

• SG PORVs do not fail open a

• Feedwater source is assumed to be the condenser hotwell

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps

• 0 of 2 CS trains ECCS/ESF

• 1 of 4 RCFC units

• LPR

• HPR unavailable

• RHR pumps are secured during dead-head phase, available upon demand

• No RWST/CST refill Operator actions

• Switchover of the ECCS injection source from the RWST to the containment sump is assumed to begin when the RWST level is at 46% (the procedural trigger for switchover) and to take 10 minutes to complete Other

• CCW to RHR HX is available (except as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

Table 12 SLOCA-Condensate Feed Results Equivalent Number of Core Uncovery Core Damage Case Break Size Charging/ SG Cooldown a (hh:mm) (hh:mm) b (in.) SI Pumps 1 1/0 100 °F/hr (55.6 °C/hr) 11:33 12:22 c 2 0/1 starting at 10 min 11:41 12:41 c 0.83 3 1/0 100 °F/hr (55.6 °C/hr) 11:39 12:38 c 4 0/1 starting at 20 min 11:44 12:44 c 5 1/0 100 °F/hr (55.6 °C/hr) 00:37 --

6 0/1 starting at 10 min 00:36 --

1.66 7 1/0 100 °F/hr (55.6 °C/hr) 00:35 --

8 0/1 starting at 20 min 00:34 --

a Note that the licensees assumptions on the time to initiate SG cooldown were somewhat ambiguous based on the documentation available, but that the implementation time used here (either 10 or 20 minutes after reactor trip, depending on the case) is believed to be consistent with the intent of the relevant plant procedures b Defined as PCT = 2,200 °F (1,204 °C) c Early depressurization and condensate feed were successful in preventing CD early; CD occurs late due to lack of hotwell refill (or alignment of an alternate FW source) 30

Table 13 SLOCA-Condensate Feed Key Event Timings Case 1 Case 2 Case 3 Case 4 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 Charging pump injection 00:06 -- 00:06 --

SI pump injection -- 00:08 -- 00:08 RCP trip 00:19 00:08 00:28 00:08 MSIVs close 00:57 00:54 01:04 01:02 RHR injection -- -- -- --

Condenser hotwell depletion 03:00 02:57 03:08 03:05 RWST Lo-2 a 05:48 05:14 05:50 05:17 Switchover to sump recirc completed 05:58 05:24 06:00 05:27 Start of injection from the sump 05:59 05:26 06:01 05:29 Core uncovery 11:33 11:41 11:39 11:44 Core damage 12:22 12:41 12:38 12:44 Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 Charging pump injection 00:01 -- 00:01 --

SI pump injection -- 00:02 -- 00:02 RCP trip 00:03 00:02 00:03 00:02 MSIVs close 00:23 00:23 00:21 00:21 RHR injection 02:03 02:05 02:11 02:10 Condenser hotwell depletion 02:58 02:58 03:06 03:07 RWST Lo-2 a 02:58 02:54 03:06 03:05 Switchover to sump recirc completed 03:08 03:04 03:16 03:15 Start of injection from the sump 03:09 03:04 03:16 03:15 Core uncovery 00:37 00:35 00:35 00:34 Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

Table 14 SLOCA-Condensate Feed Margins Case 1 Case 2 Case 3 Case 4 1,204 °C (2,200 °F) minus PCT (in °C) CD CD CD CD Completion of sump realignment-RHR entry time

-00:01 -00:02 -00:01 -00:02 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 39.5 [5.7] 39.2 [5.7] 39.5 [5.7] 39.3 [5.7]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) a a 852 a 852 a 852 a 852 Completion of sump realignment-RHR entry time 01:05 00:59 01:05 01:05 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 61.1 [8.9] 59.6 [8.6] 57.0 [8.3] 54.3 [7.9]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

31

Table 15 SLOCA-Condensate Feed Cooldown Rates Case 1 Case 2 Case 3 Case 4 Target a 100 100 100 100 1 hr after start of cooldown 98 108 104 115 2 hr after start of cooldown 99 104 101 107 3 hr after start of cooldown 85 86 85 88 Case 5 Case 6 Case 7 Case 8 Target a 100 100 100 100 1 hr after start of cooldown 102 106 103 104 2 hr after start of cooldown 106 106 110 108 3hr after start of cooldown 89 88 87 90 a Rates are in F/hr.

The transient behavior is markedly different for the 1.66-in. (4.22-cm) break cases. Here, the pressure in the RCS drops rapidly because of loss of coolant through the break combined with secondary-side cooldown initiated early in the transient. Inventory losses through the break and flashing due to the drop in RCS pressure cause the water level in the core to drop just below the TAF within 40 minutes of the start of the accident, though charging or SI pump flow is able to maintain level near the TAF (thus preventing fuel heatup). Condensate booster pump injection to the SGs begins less than 30 minutes after water level drops below the TAF. Together, condensate booster flow to the SGs and charging or SI pump injection to the RCS provide decay heat removal. Meanwhile, the ECCS injection continues to maintain RCS level just below the TAF until RCS pressure drops below the RHR pump shutoff head. At this time, low-pressure injection (LPI) begins and quickly restores RCS level to above the TAF. The RHR pump continues to draw from the RWST until the sump switchover level is reached, at which point operators are assumed to successfully switch the injection source to the sump. After the SGs boil dry, decay heat removal and reactor vessel inventory are maintained by LPR flow, thus preventing CD.

For all cases, the time at which operators begin to depressurize the SGs has little impact on the transient progression. For the smaller break cases, SG depressurization permits early decay heat removal via condensate feed and significantly delays CD (although hotwell refill or alternate FW injection is still required). For the 1.66-in. (4.22-cm) cases, core uncovery occurs at approximately 35 minutes into the accident, and uncovery lasts for approximately the same length of time in each case. There is no fuel heatup for any of the 1.66-in. (4.22-cm) break cases.

Note that this scenario experienced issues with the plant cooldown rate similar to those described in Section 5.1: 0.83-in. cases exceeded the target cooldown rate by a relatively small margin, whereas 1.66-in. cases greatly exceeded the target cooldown rate. For this reason, the 1.66-in. cases were all run with improved cooldown logic (i.e., adjustments to the logic that the MELCOR model uses to emulate the operators actions to cooldown the plant), which yielded the improved results that are presented in this report. Cooldown rates for each case are presented in Table 15.

32

Table 16 SLOCA-Condensate Feed Sensitivity Studies Case Sensitivity Justification Results 4a Model operator This action is part Operators open the PORV for a short period of time actions to of BEP ES-1.2. starting at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the accident. Opening the PORV depressurize Also, the Byron does not reduce RCS pressure below the RHR pump RCS using the SPAR model shutoff head before rising pressurizer level and loss of Pressurizer requires a adequate subcooling would prompt operators to reclose PORV pressurizer PORV the PORV. CD eventually occurs after RWST depletion for successful and SG dryout because RCS pressure remains above cooldown. the RHR pump shutoff head.

(However, the licensees PRA does not.)

7a 1 CCP AND See Table 10 In this case, the RWST level reaches Lo-2 at 2:33, as 1 SI pump opposed to 3:06 in Case 7. In both cases, LPI begins OR before RWST depletion.

2 CCP 7b 4/4 RCFC This will reduce Containment pressure and temperature are lower with containment 4/4 fan coolers available compared to the case with 1/4 temperature and fan coolers, but this has little impact on the accident pressure sequence timings and no impact on PCT for this scenario.

7c Set target SG See Table 10 Modifying the target SG water level from 24.25 m to water level in 22.90 m delays hotwell depletion by approximately AFW logic to 75 minutes but has a negligible impact on other key event 22.90 m timings for this scenario.

7d Model operator See Table 10 Operators are directed in BEP ES-1.2 to secure ECCS actions to pumps if RCS subcooling is acceptable and pressurizer throttle pumps level exceeds a given setpoint. These conditions are not to prevent met until after the switchover to recirculation. See the pressurizer discussion for Case 11d in Table 10.

from going solid 7e Use the HFM The model used The HFM critical flow model yields slightly greater (instead of for critical flow can two-phase and single-phase steam break flow rates HEM) for have a significant compared to the HEM, but the differences in key event critical flow impact on flow timings and calculation figures of merit are negligible.

through the cold leg break 7f 1.63% power 1.63% MUR The higher power level results in slightly higher auxiliary increase power uprate that feedwater and SG relief valve flow rates compared to the was recently base case and slightly earlier RWST depletion, but the approved by NRC differences in key event timings and calculation figures of (NRC, 2014a) merit are negligible.

7g Delay RCP trip See Table 10 Delaying RCP trip by 10 minutes results in slight by 10 minutes differences in the plant thermal hydraulic response, but the differences in key event timings and calculation figures of merit are negligible.

33

Table 16 SLOCA-Condensate Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 7h Use the ANS The MELCOR The ANS standard decay heat curve implemented in decay heat model currently MELCOR yields lower decay heat relative to the Byron standard as uses a decay heat FSAR decay heat curve. As a result, depletion of water encoded in curve from the in the condenser hotwell is delayed by approximately MELCOR plants FSAR 1 hr. compared to Case 7. After RWST depletion, most of the heat is removed by the RHR HX, and so SG dryout occurs significantly later in the sensitivity case compared to the base case (>24 hr. vs. ~17 hr.), due to the lower decay heat load.

7i Adjust core This is approx. Increasing the core bypass flow has little impact on key bypass flow to equal to the event timings.

6% of total maximum bypass RCS flow flow cited in the FSAR 7j Use 3/4 SG The SC for This case shows that 3/4 SG PORVs is sufficient for PORVs for secondary-side secondary-side cooldown for this particular scenario.

cooldown cooldown is instead of 3/4 SG PORVs or 4/4 SG PORVs 1/12 TBVs As in the SLOCA-Sump Recirculation (Section 5.1) cases, the procedural action to depressurize the RCS using the pressurizer PORVs is not modeled in these cases. Instead, this action is included in sensitivity Case 4a. In this sensitivity case, the PORV is opened if subcooling is adequate and if pressurizer level is sufficiently low. These conditions are first met at approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in Case 4a. The PORV is opened for a short period of time, after which pressurizer level quickly increases and subcooling quickly decreases. At this point, the procedure would prompt operators to close the PORV. Results of the sensitivity calculation show that operator action to open the PORV is not sufficient for reducing RCS pressure below the RHR shutoff head. Once the RWST depletes, RCS pressure remains above the RHR pump shutoff head, thus preventing further ECCS injection. Thus, there is little difference between the sensitivity case and Case 4.

From the figures in Appendix B, it appears that the SG PORVs are cycling a large number of times, such that one would expect the PORVs to eventually fail. While this is certainly the case in the calculations, the cycling behavior is a direct result of the modeling approach in MELCOR.

In the MELCOR input model, the fraction that the PORV is open is controlled by the SG depressurization rate. When the depressurization rate is greater than (or less than) the target rate, the PORV is partially closed (or opened). While control functions used to model SG depressurization are smoothed to limit the effects of instantaneous changes in valve open fraction, the valve response is still much more rapid than one might expect from this type of valve. There is also potential departure between the responsiveness of the mathematical representation versus that of an actual operator. Finally, it is also probable that the plant operators would adjust SG PORV position slowly to avoid valve failure due to excessive cycling.

Thus, while the calculation results show excessive valve cycling, these results should be viewed with caution.

Note that the condenser steam dumps cause a greater-than-expected drop in pressure when they open following the reactor scram. (See the discussion in Section 5.1.) To determine the effects of the steam dumps on the accident progression, Case 1 was rerun without the steam dumps. Results from this sensitivity study show that RCS pressure behavior for this case is 34

very similar to the pressure behavior in Case 1. Thus, the early steam dump actuation has little impact on the overall system behavior.

All of the cases described above assume that the CCW to RHR HX is available throughout the transient. For this scenario, the RHR HX acts together with the containment fan cooler to accomplish long-term decay heat removal (again recall that refill of alignment of alternative sources of water following hotwell depletion is not considered). The above cases have been rerun assuming the RHR HX is unavailable. For the smaller (0.83-in. (2.11-cm)) break cases, the RHR HX has little effect; these cases go to CD in the long-term whether or not the heat exchanger is available. However, the heat exchanger plays an important role in the larger (1.66-in. (4.22-cm)) break cases. When available, it is sufficient to remove decay heat by cooling the water from the sump before recirculating it through the RCS. However, when the heat exchanger is unavailable, only the containment fan cooler is available to remove decay heat. Decay heat exceeds the heat removed by the fan cooler, and so the average temperature and the pressure in the RCS increase during the ECCS recirculation phase (i.e., following hotwell depletion). Eventually, the RCS pressure exceeds the RHR dead-head pressure. With high-pressure ECCS recirculation unavailable, there is no further injection to the RCS. This situation leads to CD in all four of the 1.66-in. (4.22-cm) break cases. Thus, the RHR HX is necessary to prevent CD for the 1.66-in. (4.22-cm) break cases, if feedwater is not sustained.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (1 Charging or 1 SI pump and 1 RHR pump) and the unavailability of HPR.

• For smaller breaks in the SLOCA range, early SG depressurization and condensate feed is sufficient, but failure to refill the hotwell or align alternate SG injection will result in CD later in the event.

- The same conclusion may apply even if HPR is available.

- For some conditions, throttling of SI/charging or use of the pressurizer PORV may be needed to achieve LPR conditions prior to RWST switchover.

• For larger SLOCAs, early SG depressurization and condensate feed does not prevent core uncovery but does prevent CD; failure to refill the hotwell or align alternate SG injection does not result in CD later in the event due to effective primary-side heat removal (feed from LPR plus bleed through the break). The RHR HX is required during LPR, if feedwater is not sustained.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion. Those in the smaller equivalent break size of the SLOCA range may also experience greater repressurization later in the transient.

5.3 Small-Break Loss-of-Coolant Accident-Success Criteria for Primary Side Bleed and Feed This series of cases investigates an SLOCA scenario where no FW is available and decay heat removal is accomplished by primary-side bleed and feed (B&F) through the pressurizer PORVs.

Other than actions to initiate B&F, very few operator actions are modeled. In reality, operators 35

would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed), then transition to both BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip RCPs, reduce RCS injection flow),

and BFR-H.1, Response to Loss of Secondary Heat Sink (e.g., start B&F, attempt to manually start AFW).

The varied parameters for this scenario are equivalent break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), available HPI (one charging pump or one SI pump), the time at which operators begin B&F, and the number of PORVs used for B&F. The break is located in the horizontal section of the cold leg in the loop containing the pressurizer. Boundary conditions for this scenario are listed in Table 17. Results are shown in Table 18, Table 19, and Table 20. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.3. Sensitivity studies and their results are listed in Table 21.

It is clear from the figures in Appendix B and from Table 18 that none of the SLOCA-B&F cases examined result in CD. However, there are significant phenomenological differences between the 0.83-in. (2.11-cm) and 1.66-in. (4.22-cm) break cases.

Table 17 SLOCA-Bleed and Feed Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable)

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or Primary side (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm or (iv) time to initiation of B&F is less than 2 minutes (assumed based on FR-H.1 guidance to trip RCPs prior to initiating SI)

• 0 of 1 MD-AFW trains; 0 of 1 DD-AFW trains Secondary side

• Condenser steam dumps available until MSIV closure

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps ECCS/ESF

• 0 of 2 CS trains

• 1 of 4 RCFC units

• Low- and high-pressure recirculation available

• RHR pumps are secured during dead-head phase, available upon demand Operator actions

• No RWST/CST refill Other

• CCW to RHR HX is available (except as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

36

Table 18 SLOCA-Bleed and Feed Results Equivalent Number of Time of B&F Core Uncovery Core Damage Case Break Size Charging/ Initiation/

(hh:mm) (hh:mm) b (in.) SI Pumps # of PORVs a 1 35 min / 1 02:08 --

1/0 2 55 min / 1 02:26 --

0.83 3 30 min / 2 01:27 --

0/1 4 50 min / 2 03:54 --

5 35 min / 1 00:49 --

1/0 6 55 min / 1 01:00 --

1.66 7 30 min / 2 00:42 --

0/1 8 50 min / 2 00:56 --

a Times for B&F initiation are from the time of reactor trip.

b Defined as PCT = 2,200 °F (1,204 °C)

Table 19 SLOCA-Bleed and Feed Key Event Timings Case 1 Case 2 Case 3 Case 4 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 Charging pump injection 00:06 00:06 -- --

SI pump injection -- -- 00:08 00:08 RCP trip 00:41 01:01 00:08 00:08 MSIVs close 01:20 01:29 00:55 01:12 RHR injection -- -- -- --

Core uncovery 02:08 02:26 01:27 03:54 RWST Lo-2 a 06:06 06:09 05:10 05:18 Switchover to sump recirc completed 06:16 06:19 05:20 05:28 Start of low-pressure injection from the sump -- -- -- --

Core damage -- -- -- --

Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 Charging pump injection 00:01 00:01 -- --

SI pump injection -- -- 00:02 00:02 RCP trip 00:03 00:03 00:02 00:02 MSIVs close 00:30 00:30 00:31 00:31 RHR injection -- -- -- --

Core uncovery 00:49 01:00 00:42 00:56 RWST Lo-2 a 05:37 05:38 04:46 04:51 Switchover to sump recirc completed 05:47 05:48 04:56 05:01 Start of low-pressure injection from the sump 14:24 14:19 09:25 08:36 Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

37

Table 20 SLOCA-Bleed and Feed Margins Case 1 Case 2 Case 3 Case 4 1,204 °C (2,200 °F) minus PCT (in °C) 833 831 a 852 a 852 Completion of sump realignment-RHR entry time b -- b -- b -- b --

(hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 31.4 [4.6] 31.4 [4.6] 14.6 [2.1] 19.9 [2.9]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) 848 a 852 a 852 a 852 Completion of sump realignment-RHR entry time

-08:21 -07:55 -03:07 -03:03 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 11.5 [1.7] 12.7 [1.8] 10.3 [1.5] 12.6 [1.8]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b The RCS pressure never drops below the RHR pump dead-head pressure.

For the 0.83-in. (2.11-cm) break cases, the fuel experiences only a slight heatup to around the normal operating temperature after an initial period during which the RCS cools down. This heatup occurs relatively early in the transient for Cases 3 and 4 (which have one SI pump available); falling reactor vessel water levels (resulting from break flow exceeding feed flow and reactor vessel level decrease due to RCS cooldown from injection of cold water) causes the fuel heatup for these cases. After about 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (i.e., the time of PCT), the combined flow through the break and the PORVs decreases to below the injection flow rate from the SI pumps (either from the RWST or from the containment sump). This allows the core water level to recover, thus reducing clad temperatures. The water level rises above the TAF at approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, where it remains for the remainder of the simulation.

For Cases 1 and 2, the peak cladding temperature (PCT) occurs much later in the accident, though PCT is only about 20 degrees Celsius (C) higher than the PCT at the start of the transient. Core water level drops rapidly after operators initiate B&F, though the level dips only slightly below the TAF in Case 1 and remains above TAF until later in the accident in Case 2.

RCS injection flow from the charging pump recovers the water level to above the top of the active core at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in Case 1. However, falling RCS pressure flashes water to steam and causes reactor vessel level to decrease, which exposes the top of the core at approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in Case 1 and 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> in Case 2. This causes the cladding in the uppermost core cell to heat up, though the heatup is minor because the decay heat power at the top of the core is relatively low. The top of the fuel remains uncovered at the end of the calculation because ECCS flow rate is lower in Cases 1 and 2 than in Cases 3 and 4 due to the lower capacity of the charging pump compared to the SI pump.

The 1.66-in. (4.22-cm) break cases behave much differently because the larger equivalent break size causes a more rapid depressurization of the primary system. Initiation of B&F causes the water level to decrease further because of increased boiling of coolant due to reduced RCS pressure and due to coolant loss through the PORVs. Pressure decreases more rapidly in Cases 7 and 8 because operators open two pressurizer PORVs, whereas operators only open one PORV in Cases 5 and 6. The core water level recovers due to injection by either the charging pump in Cases 5 and 6 or the SI pump in Cases 7 and 8. Low-pressure injection begins 4-5 hours into the accident in Cases 7 and 8, while the RCS pressure in Cases 5 and 6 remains above the RHR shutoff head until late in the accident. There is a very slight cladding heatup in Case 5, and no cladding heatup in Cases 6, 7, and 8, because only the very top of the active fuel is uncovered in all of these cases.

38

Table 21 SLOCA-Bleed and Feed Sensitivity Studies Case Sensitivity Justification Results 6a Full This is a With the full complement of high-pressure pumps, complement of sensitivity to show RWST water level reaches Lo-2 at 01:32, which is more charging/SI the effect of than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> earlier than in the base case. However, having all pumps with high- and low-pressure recirculation and the RHR available HX available, and adequate bleed paths through the break and through the open PORV, there is no core heatup after RWST depletion.

6b 4/4 RCFC This will reduce Containment pressure is lower with all four fan coolers containment available than with 1/4 available, as in the base case.

temperature and This has a negligible impact on key event timings for pressure this scenario.

6c Set initial SG This is The initial SG water level has little effect on the plant level to approximately response for this scenario, because SG dryout occurs

~22.8 m equal to the low after B&F initiation.

(target SG level alarm secondary- (23% NR level).

side inventory This is a is about reduction of 40,000 kg) approximately 25% of the initial SG inventory compared to the base case. The initial SG inventory is important because there is no AFW for this scenario.

6d Model See Table 10 For this scenario, the pressurizer drains early in the operator transient and remains empty throughout the calculation, actions to so operators would not need to take action to prevent throttle pumps pressurizer overfill.

to prevent pressurizer from going solid 6e Use the HFM See Table 10 Using HFM instead of HEM for critical flow has a (instead of the negligible effect on the results of this scenario.

HEM) for critical flow 6f 1.63% power See Table 10 The increase in power has a negligible effect on the increase results of this scenario.

6g Delay RCP trip See Table 10 Delaying RCP trip by 10 minutes has little effect on the by 10 minutes results of this scenario.

6h Use MELCOR The MELCOR RCS pressure decreases more quickly following decay heat model currently operator action to initiate B&F in this sensitivity case curve uses a decay compared to the base case due to the lower decay heat heat curve from in the sensitivity case. This allows LPR to occur a few the plants FSAR hours earlier, but otherwise, there is little difference between the sensitivity case and the base case.

39

Table 21 SLOCA-Bleed and Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 6i Adjust core This is approx. Increasing the core bypass flow has a negligible effect bypass flow to equal to the on the results of this scenario.

6% of total maximum bypass RCS flow flow cited in the FSAR 2a Extend Investigate the At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the water level in the core is stable at simulation to stability of the approximately 2 ft below the TAF. This is sufficient to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> end-state, given maintain cladding temperatures in the uncovered the core is portion of the core near the PCT during normal uncovered at operations. Water level increases very slowly beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> because the ECCS recirculation flow rate slightly exceeds the combined losses through the break and through the open PORV. At approximately 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br />, water level is at the TAF. Level remains above TAF through the end of the calculation. Thus, the end-state of Case 2 can be considered stable for the purposes of the PRA.

4a 1 SI and Currently this In Case 4a, only 1 PORV is available, compared to 1 PORV at report only 2 PORVs in Case 4. Because only 1 PORV is 50 minutes examines the available, RCS pressure is higher in Case 4a than in (0.83-in. case where 1 SI Case 4. The injection rate from the operating SI pump is break) and 2 PORVs are slightly lower in Case 4a, leading to later RWST successful. This depletion, but also providing less cooling. Also, the sensitivity is to RCS temperature is higher in Case 4a, as a determine consequence of the higher saturation temperature and whether 1 PORV the slightly reduced cooling provided by the lower SI is sufficient. pump injection flow. Immediately following switchover of ECCS pump suction to the sump, water level drops below the TAF in Case 4a, due to the reduced cooling provided by the hotter water from the sump (relative to the water from the RWST, as well as to the water from the sump in Case 4). Inventory losses through the break and through the open PORV are approximately equal to the SI pump injection rate, so water level remains about a foot below TAF. The SI pump finally restores water level above TAF at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, once injection flow exceeds inventory losses due to a gradual reduction in RCS pressure as decay heat decreases.

There is no CD in the sensitivity case because there is sufficient steam cooling at the top of the bundle. In fact, there is no difference in PCT between Case 4 and Case 4a, which suggests that operator action to initiate B&F at 50 minutes using 1 SI pump and 1 PORV is sufficient for preventing CD for a 0.83-in. cold leg break.

Note that in a similar Loss of DC Bus 111 calculation described in Section 5.4, CD occurs when 1 PORV and 1 SI pump are available for B&F. SLOCA - B&F sensitivity Case 4a avoids CD because the break provides additional depressurization capacity, thus preventing dead-heading of the SI pump and CD due to insufficient makeup.

40

Table 21 SLOCA-Bleed and Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 8a 1 SI and See above This case is analogous to Case 4a, but with a larger 1 PORV at break size. The two cases are also similar in that they 50 minutes result in slower depressurization following initiation of (1.66-in. B&F compared to their respective base cases. Like in break) Case 4a, the core water level in Case 8a remains stable below TAF for hours, though there is no difference in PCT between Cases 8 and 8a. This suggests that operator action to initiate B&F at 50 minutes using 1 SI pump and 1 PORV is sufficient for preventing CD for a 1.66-in. cold leg break.

This scenario involves operator action to initiate B&F in response to a loss of secondary heat sink. Operators would be directed to enter procedure FR-H.1 when AFW flow cannot be verified and the narrow range (NR) level in all SGs is less than 10 percent. MELCOR predicts that these conditions will occur at approximately 20 minutes in Cases 1 and 2, 19 minutes in Cases 3 and 4, and in 15 minutes in Cases 5-8. The earliest time at which operators take action to initiate B&F in the MELCOR calculations is 30 minutes (Cases 3 and 7). Given that operators must perform a few steps in FR-H.1 before initiating B&F, the timings assumed for the MELCOR calculations (which were based on the licensees sequence timing assumptions) agree well with the predicted time of FR-H.1 entry.

All of the cases described above assume that the CCW to RHR HX is available throughout the transient. For this scenario, the RHR HX acts together with the containment fan cooler and, to a limited extent, with the SGs to accomplish long-term decay heat removal. The above cases have been rerun assuming the RHR HX is unavailable. The loss of the RHR HX as a decay heat removal mechanism has no impact on the PCT. However, the unavailability of the RHR HX causes the RCS average temperature to be slightly higher later in the transient when compared to the cases where the RHR HX is available. In Cases 5 and 6, the higher temperatures cause the RCS pressure to remain above the RHR shutoff head throughout the transient, thus preventing RHR from injecting directly to the cold legs. (With the RHR HX available, LPR begins about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> into the transient.) However, HPR is available throughout the transient, and thus the inability of the RHR pumps to inject directly to the cold legs has little impact on the overall results of the calculations.

In summary, in cases both with and without the RHR HX, CD is avoided in the SLOCA-B&F cases because HPR is available and because the sump water is cooler than the fuel. HPR enables heat transfer from the fuel to the sump to continue throughout the calculation. Thus, the RHR HX has little or no effect on the outcome of the calculation 13.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (e.g., a single charging or SI pump and a single RHR pump) and minimal pressurizer PORV availability/use (except where noted otherwise in sensitivity cases).

13 The RHR HX has no impact on peak containment pressure because peak pressure occurs before injection from the RWST is lost. Containment pressure and temperature after RWST depletion are slightly higher when the RHR HX is unavailable. Long-term heat removal is provided by one operating containment fan cooler.

41

• For all SLOCA sizes, and for the operator action timings and equipment usages studied, CD does not occur, nor is there significant core uncovery and heatup.

• For all break sizes, either one RCFC or the RHR HX is sufficient for late decay heat removal.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion. Use of more than the minimal number of PORVs could result in additional inventory loss and more core uncovery early in the transient.

5.4 Loss of DC Bus 111, Unavailable DD-AFW, and Subsequent Primary Side Bleed and Feed This series of cases investigates LoDCB-111 with the DD-AFW pump unavailable. LoDCB-111 causes the FW regulating and isolation valves to close, thus causing a loss of main feedwater (MFW). LoDCB-111 also causes a loss of one pressurizer PORV and loss of MD-AFW (Byron has one MD-AFW train per unit). The loss of all FW necessitates operator action to initiate primary-side B&F. Note that LoDCB-111 affects operator actions to trip the RCPs, as described in Appendix A and mentioned in Table 22. Other than actions to initiate B&F, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed), then transition to BFR-H.1, Response to Loss of Secondary Heat Sink (e.g., trip the RCPs, initiate B&F, attempt to manually start AFW).

The varied parameters for this scenario are the available HPI system (one charging pump or one SI pump), the time at which operators begin B&F, and whether or not a pressurizer PORV sticks open due to excessive cycling. Boundary conditions for this scenario are listed in Table

22. Results, key event timings, and margins to key figures of merit are shown in Table 23, Table 24, and Table 25, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix C, Section C.1. Sensitivity studies and their results are listed in Table 26.

Core damage is prevented in all five of the cases with one charging pump available (Cases 1-5). The charging pump is able to prevent CD because it can inject with sufficient capacity at the high pressures encountered in this accident scenario. Thus, the charging pump is able to provide cooling and maintain vessel inventory throughout the transient.

In Cases 6 and 7, CD occurs at 2:04 and 1:52 into the accident, respectively, because the SI pump is dead-headed for significant periods of time. In these cases, inventory losses through the PORV cause the vessel water level to drop. In Case 6, the SI pump begins to inject at 21 minutes, thus maintaining vessel water level above the TAF for a time. However, at 46 minutes, high RCS pressure dead-heads the pump, eventually leading to core uncovery and CD. The SI pump does not operate in Case 7 until after CD has occurred, because the operators do not open the available PORV in time to depressurize the RCS to below the SI pump shutoff head. Together, these cases show that one PORV is not sufficient to maintain reactor pressure below the SI pump shutoff head.

42

Table 22 Loss of DC Bus 111 Boundary Conditions

• RCPs are tripped as follows:

(i) one RCP trips at the time of reactor trip due to the loss of DC bus (ii) two RCPs are tripped if time to initiation of B&F is less than 2 minutes (assumed based on FR-H.1 guidance to trip RCPs prior to initiating SI)

(iii) the RCP in the pressurizer loop is tripped 10 minutes after initiating B&F; this RCP cannot be tripped from the main control room due to loss of DC bus Primary side (iv) all RCPs are tripped if (1) cold leg void fraction >0.1; (2) containment pressure >20 psig; (3) RCS pressure <1425 psig and SI injection >100 gpm

• Only 1 PORV is available (due to initiator)it is the lower setpoint PORV (FL306) based on the dependencies provided in the pressurizer PRA system notebook

• 0 of 1 MD-AFW trains (due to initiator); 0 of 1 DD-AFW trains

• All SG PORVs are available Secondary side

• Steam dumps are unavailable

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps ECCS/ESF

• 0 of 2 CS trains

• 1 of 4 RCFC units

• Low- and high-pressure recirculation is available

• RHR pumps are secured during dead-head phase, available upon demand Operator actions

• No RWST/CST refill Other

• No CCW to RHR HX a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

Table 23 Loss of DC Bus 111 Results Number of Time of B&F PORV Core Uncovery Core Damage Case Charging/ Initiation/

Treatment (hh:mm) (hh:mm)b SI Pumps # of PORVs a 1 20 min / 1 Does not stick N/A N/A 2c open N/A N/A 40 min / 1 3 1/0 Sticks 50% open 03:05 N/A 4 after 251 cycles 02:16 N/A No manual action 5c 01:45 N/A Does not stick 6 20 min / 1 01:27 02:04 0/1 open 7c 40 min / 1 01:18 01:52 a Because reactor trip occurs very early in the accident, times for B&F initiation are from time = 0.

b Defined as PCT = 2,200 °F (1,204 °C) c Caution: The PORV cycles an extraordinary number of times in these cases, but they are present to demonstrate that PORV failure is not a benevolent failure affecting the SC.

43

Table 24 Loss of DC Bus 111 Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 RCP 1A trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 RCP 1B and 1C 00:18 00:38 00:38 01:46 01:21 00:18 00:38 trip Charging pump 00:21 00:41 00:32 00:32 00:45 -- --

injection SI pump injection -- -- -- -- -- 00:21 02:15 RCP 1D (pressurizer loop) 00:30 00:50 00:50 01:46 01:21 00:30 00:50 trip SG dryout 00:54 00:43 00:48 00:48 00:43 00:47 00:43 MSIVs close 01:15 01:08 01:36 01:38 01:14 01:06 01:00 RHR injection -- -- -- -- -- -- --

PORV stuck

-- -- 00:29 00:29 -- -- --

open Core uncovery -- -- 03:05 02:16 01:45 01:27 01:18 Core damage -- -- -- -- -- 02:04 01:52 RWST Lo-2 a 07:32 07:58 11:40 11:48 13:33 -- --

Switchover to sump recirc 07:42 08:08 11:50 11:58 13:43 -- --

completed Start of RHR injection from the -- -- -- -- -- -- --

sump a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

Table 25 Loss of DC Bus 111 Margins Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 1,204 °C (2,200 °F) minus 850 850 786 747 784 CD CD PCT (in °C)

Completion of sump realignment-RHR entry time -- -- -- -- -- -- --

(hh:mm)

CS setpoint-peak contain- 13.7 16.0 18.7 15.3 23.2 18.9 18.4 ment pressure (kPa [psi]) [2.0] [2.3] [2.7] [2.2] [3.4] [2.7] [2.7]

While the pressure drops immediately after the PORV is opened by the operators or fails open due to excessive cycling, the RCS quickly repressurizes, dead-heading the SI pump in Case 6 and causing the safety relief valves (SRVs) to cycle in Cases 2-7. (The pressure does not drop below the SI pump shutoff pressure until after CD occurs in Case 7.) In Cases 1-4, the cooling provided by the charging pump and the decay heat removal through the PORV and the SRVs eventually cause RCS pressure to decrease until it is approximately equal to the secondary-side pressure.

Cases 4 and 5 show the consequences of the operators failure to take action to initialize primary-side B&F. In Cases 3 and 4, the pressurizer PORV sticks 50 percent open due to excessive cycling at 29 minutes. However, the RCS behavior in Case 4 is significantly different from the behavior in Case 3 because the operators fail to trip the RCPs in Case 4. Tripping the RCPs reduces the heat added to the RCS, delays the time of SG dryout, and reduces RCS 44

pressure. By reducing RCS pressure, tripping the RCPs both limits inventory loss through the PORV and increases the amount of water added to the RCS by the charging pumps.

The results show that early action to trip the RCPs in Case 1, combined with removal of some decay heat through the open PORV, delays SG dryout to 54 minutes, versus 43-48 minutes for Cases 2-5. The results also show that manual RCP trip in preparation for B&F prevents core uncovery in Cases 1 and 2 and delays core uncovery in Case 3 relative to Case 4.

The core is partially uncovered for a short period of time in Cases 3-5. Core uncovery occurs in Cases 4 and 5 because the RCPs increase the RCS pressure, thus both reducing makeup from the charging pumps and increasing losses through the SRVs. Eventually, high RCS pressure causes the SRVs to open, which results in a large RCS inventory loss. Inventory loss through the PORV and SRVs and reduced makeup from the charging pumps due to high RCS pressure also cause a large drop in downcomer water level that eventually leads to partial core uncovery.

At the same time, the large RCS inventory loss quickly leads to RCP trip on high cold leg void fraction. 14 Altogether, the loss of inventory, reduced makeup, and RCP trip reduces the RCS pressure, which subsequently reduces inventory losses and increases makeup from the charging pumps. As a result, the charging pump is able to recover core water level after a brief period of partial core uncovery.

Similarly, the core uncovery in Case 3 is due to higher RCS pressure relative to Case 2. In Case 3, the PORV sticks 50% open due to excessive cycling, whereas in Case 2 operators open the PORV 100% as part of B&F actions. The reduced relief capacity through the 50%-stuck-open PORV causes higher RCS pressure, more SRV cycling, and reduced charging pump injection relative to Case 2, leading to eventual core uncovery. Eventually, as decay heat decreases, relief capacity through the PORV is sufficient to depressurize the RCS, which allows the charging pump to recover level to above the TAF.

In Cases 1-5, long-term decay heat removal is accomplished primarily by the single credited containment fan cooler operating in accident mode, though condensation on containment heat structures and heat transfer to the secondary side of the SGs also provides some cooling. By approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> in Cases 1-5, total heat removal from the RCS and containment exceeds the decay heat rate, and thus the total energy of the system decreases from that point until the end of the calculation.

This scenario involves operator action to initiate B&F in response to a loss of secondary heat sink. Operators would be directed to enter procedure FR-H.1 when AFW flow cannot be verified and the NR level in all SGs is less than 10 percent. MELCOR predicts that these conditions will occur within 2 minutes of the loss of FW.15 The earliest time at which operators take action to initiate B&F in the MELCOR calculations is 20 minutes (Cases 1 and 6), which is in turn based on the licensees sequence timing assumption. Thus, the action cue, as predicted by MELCOR, significantly precedes the action time assumed.

14 This criterion is used as a surrogate for pump cavitation, which is not explicitly treated by the simplified RCP model implemented in the Byron input deck.

15 Note that these conditions occur much earlier in the loss of DC bus 111 scenario than in the SLOCA with bleed and feed scenario for two reasons. First, reactor trip occurs later in the loss of DC bus scenario. Second, some of the fission and decay power is removed through the break in the SLOCA scenario, whereas all of the fission and decay energy must be removed by the steam generators (SGs) in the loss of DC bus scenario.

45

Table 26 Loss of DC Bus 111 Sensitivity Studies Case Sensitivity Justification Results 4a Assume PORV Other cases assume the In Case 4a, the pressurizer PORV sticks closed sticks closed valve sticks 50% open at 29 minutes. RCS remains at high pressure after after 251 demands, but it throughout the transient because it is assumed 251 demands is also credible that the that the pressurizer SRVs will continue to cycle valve would instead stick indefinitely. Charging pump flow is lower at this closed. higher pressure than at the lower pressures predicted in Case 4, in which the PORV sticks open at 29 minutes. As a result, the TAF is uncovered for a longer period of time in Case 4a than in Case 4, but there is little impact on the calculated PCT. The PCT for Case 4a is 471 °C, which is <25 °C higher than in Case 4. (Note that this case is also documented in Appendix C.)

6a Manual trip at In this situation, Manually tripping the reactor 15 seconds after 15 s operators have the loss of DC bus increases the remaining indications that the DC secondary-side inventory at the time of trip bus is degrading, and compared to the base case, in which the reactor thus they are prepared to trips automatically on low SG water level at manually trip the reactor ~30 seconds. As a result of the greater when the bus is lost. secondary-side coolant inventory at the time of This allows for a very reactor trip, SG dryout is delayed by early manual reactor trip. approximately 30 minutes in Case 6a. In turn, CD is delayed by 50 minutes.

6b Increase The cases with one SI The greater PORV capacity is still not sufficient PORV pump go to CD because to maintain RCS pressure below the SI pump capacity by the PORV capacity is shutoff head. It also has little impact on the 20% insufficient to maintain times of core uncovery or CD.

pressure below the SI pump shutoff head. This sensitivity will look at whether or not increased PORV capacity will prevent CD.

6c Operators Plant procedures instruct Operation of the head vent valve has little impact open the head operators to open the on this scenario because the relief capacity of vent at 1 hr RPV head vent valves if the head vent valve is less than 20% of the operators cannot open capacity of one pressurizer PORV (see text for both pressurizer PORVs. more information on the head vent modeling).

This action could RCS pressure remains above the SI pump depressurize the RCS shutoff head after the head vent valve is opened, sufficiently to allow the and CD occurs as a result of inadequate core SI pump to resume cooling.

injection.

6d Operators Initiating B&F earlier As expected, initiating B&F at 10 minutes slightly initiate B&F at would allow for earlier SI delays SG dryout relative to the case in which 10 minutes pump injection and operators initiate B&F at 20 minutes.

would likely delay SG Nevertheless, CD occurs at 2:09 dryout. (i.e., approximately the same time as in Case 6) because one pressurizer PORV is insufficient for maintaining RCS pressure below the SI pump shutoff head.

46

Table 26 Loss of DC Bus 111 Sensitivity Studies (continued)

Case Sensitivity Justification Results 2a 4/4 RCFC This will reduce Containment pressure is lower with all four fan containment temperature coolers available than with 1/4 available, as in and pressure the base case. This has a negligible impact on key event timings for this scenario.

2b 1/4 RCFC The RHR HX is The RHR HX decreases the containment sump available, RHR unavailable for the base temperature and RCS temperature and pressure HX available case. Crediting the RHR late in the accident, which would allow operators HX will likely decrease to place RHR in service - and thus end HPR -

RCS pressure during the earlier. Otherwise, the availability of the RHR ECCS recirculation HX has little impact on this scenario.

phase of the accident.

2c Set initial SG See Table 21. Setting the initial SG level to 22.8 m results in level to earlier reactor trip compared to the base case

~22.8 m (16 seconds vs. 33 seconds). However, (target SG because the SG inventory at the time of reactor secondary- trip is the same in Case 2c as in Case 2, there is side inventory little impact on the time of SG dryout. Thus, the is about initial SG water level has little impact on the 40,000 kg) results of this scenario.

2d Use the HFM The model used for Using HFM instead of HEM for critical flow has a (instead of the critical flow can have a negligible effect on the results of this scenario.

HEM) for significant impact on flow critical flow through the cold leg break 2e 1.63% power 1.63% MUR power The increase in power has a negligible effect on increase uprate that was recently the results of this scenario.

approved by NRC (NRC, 2014a) 2f Use the ANS The MELCOR model In the base case, the core water level drops to decay heat currently uses a decay just above the TAF in the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the standard as heat curve from the accident. In Case 2f, core water level is much encoded in plants FSAR higher in the early phase of the accident due to MELCOR the lower decay heat given by the ANS curve with MELCOR default values relative to the decay heat curve used in the base case (based on the decay heat curve in the Byron FSAR).

Also, the lower decay heat requires less pressure relief capability, so one pressurizer PORV is sufficient for overpressure protection.

In contrast, the pressurizer SRVs open several times between 1:26 and 1:42 in the base case, and the PORV cycles approximately twice as many times in the first 40 minutes compared to the sensitivity case. There is very little difference between Case 2f and Case 2 in the later stages of the transient.

2g Adjust core This is approximately Increasing the core bypass flow to 6% has a bypass flow to equal to the maximum negligible effect on the results of this scenario.

6% of total bypass flow cited in the RCS flow FSAR 47

Table 26 Loss of DC Bus 111 Sensitivity Studies (continued)

Case Sensitivity Justification Results 2h Full This is a sensitivity to With all charging and SI pumps available, the complement of show the effect of having vessel remains full throughout the transient. This charging/SI all pumps available. provides adequate cooling water, such that the RCS pressure falls to and remains below the SI pump shutoff head after operators open the PORV to initiate B&F. In comparison, the RCS repressurizes to the pressurizer SRV setpoint after operators initiate B&F with only 1 charging pump available in the base case. With all high-pressure pumps available, the RWST level reaches Lo-2 much earlier than in the base case (3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> vs. 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />).

6e 1 SI and This is a sensitivity to In this sensitivity case, two PORVs are sufficient 2 PORVs at confirm success under for maintaining RCS pressure below the SI pump 20 minutes these conditions. shutoff head. Together, opening two PORVs (EPRI,2011) predicted and initiating one SI pump at 20 minutes is failure for roughly 20% of sufficient for preventing CD in this scenario.

these cases.

7a 1 SI and This is a sensitivity to This sensitivity case shows that opening 2 PORVs at investigate success two PORVs and initiating one SI pump at 40 minutes under these conditions. 40 minutes is not sufficient for preventing CD.

B&F actions initially decrease pressure to just below the shutoff head of the SI pump, allowing for a very brief period of injection. However, the RCS quickly repressurizes and prevents further ECCS injection for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. During the period with no injection, vessel water level quickly drops below the TAF, causing the fuel temperature to rapidly increase above 2,200 °F. At approximately 01:35, pressure falls below the SI pump shutoff head, allowing the pump to inject to recover water level to above the TAF by 02:05, more than 20 minutes after the onset of CD.

Finally, it is worth noting that plant procedures specify that the operators should open the reactor pressure vessel (RPV) head vent valves if they are unable to open both pressurizer PORVs. By definition, operators can only open one PORV during a loss of DC bus event, and thus one would expect the operators to attempt to open the head vent valves when they reach this point in the plant emergency operating procedures (EOPs). However, credit is not given for this action in the PRAs, and so it has not been included in the MELCOR calculations described above. The impact of opening the head vent is included as a sensitivity case, as described in Table 26. Note that based on information provided by Byron engineering after completion of the sensitivity analyses, the flow area of the head vent flow path used in sensitivity Case 6c is approximately 4 times the estimated effective flow area due to large flow losses through the head vent valve. This would further reduce the effectiveness of the head vent as an RCS vent flow path relative to the results of sensitivity Case 6c. Because Case 6c already showed that the head vent valve has little impact on the calculation, even with the larger effective flow area, the sensitivity calculation has not been repeated with a lower head vent path flow area.

48

Numerous studies focusing on B&F success for a loss of FW scenario 16 have been sponsored by both the U.S. Nuclear Regulatory Commission (NRC) and by industry. Examples include (NRC, 1988), (NRC, 2014b), (Gabor, 2005), and (EPRI, 2011). Results of the present study for Byron Unit 1 are largely consistent with results from past studies. For example, (NRC, 1988) and (Gabor, 2005) demonstrate that charging pumps actuated upon high containment pressure are sufficient for preventing CD, even in the absence of operator actions to initiate B&F (e.g. tripping RCPs, opening PORVs, and manually initiating SI). This result is demonstrated in the present study for Byron Unit 1 as well. Furthermore, (EPRI, 2011) and (NRC, 2014b) both conduct uncertainty analyses for a loss-of-MFW event at a four-loop Westinghouse plant. (Note that the study included in (NRC, 2014b) uses the Byron Unit 1 MELCOR input deck, while (EPRI, 2011) uses a MAAP4 deck for an unspecified four-loop plant.) In both studies, CD is predicted for about 60 percent of the cases with one PORV and one SI pump; almost all successful cases with this configuration had a lower initial power level. This suggests that success is unlikely for one PORV and one SI pump during full-power operation. The LoDCB-111 calculations for Byron Unit 1 presented in this report further support this conclusion.

Meanwhile, (EPRI, 2011) and (NRC, 2014b) predicted CD for about 20 percent of cases with two PORVs and one SI pump, and the results presented here show either success or failure for the two sensitivities run with this configuration, depending on the time of B&F initiation.

With that said, success of B&F for loss of MFW is influenced by a number of factors, including the initial reactor power, the timing of operator actions to initiate B&F, and the time of reactor trip relative to loss of FW. As previously mentioned, some past studies (e.g., Gabor, 2005; EPRI, 2011; and NRC, 2014b) include cases in which one PORV and one SI pump are successful in preventing CD. The conditions of these successful cases (e.g., lower initial power level, reactor trip and RCP trip concurrent with loss of MFW, very early operator action to initiate feed and bleed) have not been replicated for the present study, so it is not surprising that all of the one PORV and one SI cases in the present study go to CD. Again, MELCOR results for Byron Unit 1 LoDCB-111 are consistent with results of past studies as long as the boundary conditions are consistent.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection.

• In the cases studied, one charging pump and one PORV or SRV is sufficient for preventing CD.

- For the cases with one charging pump in which operator actions are taken to initiate B&F, core uncovery is also prevented.

- For the cases in which operators take no action to initiate B&F, the core is briefly uncovered, but PCTs remain well below the CD surrogate temperature of 2,200 degrees Fahrenheit (F) (1,204 degrees C).

With no operator action to open the PORV or secure charging, the PORV cycles thousands of times. If the PORV is assumed to fail closed, success is still achieved via SRV cycling.

16 Loss of DC Bus 111 is very similar to loss of main feedwater (MFW). One important distinction is that only one PORV is available for LoDCB-111 due to the initiator, whereas two PORVs may be available for loss of MFW.

49

This situation (failure to initiate B&F when one charging pump is available) is not treated as a success path in this report, owing to the extraordinary number of valve cycles and/or subsequent valve failures.

• In the cases studied, one SI pump is insufficient for preventing CD.

- One pressurizer PORV is insufficient for depressurizing the RCS below the SI pump shutoff head early in the transient. Core damage occurs when one SI pump is available and both charging pumps are unavailable. Thus, one charging pump is needed to prevent CD.

• Although not strictly relevant for this scenario, sensitivity cases were run where one SI train and two PORVs were available. Success or failure depended on the time of B&F initiation. This result is not expected to be sensitive to the availability of one versus two SI trains, since the driving factor is depressurization below SI shutoff head conditions.

The mixed results of this configuration are consistent with past studies.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion and could also result in greater RCS repressurization and inventory loss through the pressurizer PORV and SRVs.

5.5 Spontaneous Steam Generator Tube Rupture with No Operator Action This series of cases investigates spontaneous SGTR with all systems available (except where greater-than-minimal ECCS trains are discounted) but unsuccessful operator actions to isolate the faulted SG, refill the RWST, and execute cooldown procedures. 17 These actions are necessary to limit radiological releases and to prevent SG overfill. Steam generator overfill can significantly aggravate radiological releases through increased flow through the SG PORV or SG PORV failure, and through possible steam line leak or failure due to the increased structural loading of water in the steam lines. 18 This scenario will look at the time to SG overfill as a measure of how much time operators have to complete the required actions.

In most of the cases studied for this scenario, operators are assumed to manually trip the reactor when the pressurizer level drops below 17 percent of instrument span. However, other than the action to manually trip the reactor, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed). High SG radiation levels would direct operators to transition to BEP-3, Steam Generator Tube Rupture, which includes instructions to identify and isolate the faulted SG, initiate cooldown, and secure the ECCS pumps. Operators would then be directed to one of three post-SGTR cooldown procedures, depending upon plant conditions.

The varied parameters for this scenario are minimal or maximal ECCS pumps (one charging pump or two charging and two SI pumps), the number of equivalent tube breaks, condenser 17 This is one of the highest contributing core damage frequency sequence in the Byron SPAR model (3 percent of CDF).

18 Note that this analysis does not include any attempt to evaluate induced steam line failure. Nevertheless, it is mentioned here as one of the reasons why operators are trained to avoid SG overfill.

50

steam dump availability, 19 and whether or not operators manually trip the reactor. A sensitivity case looks at the effects of SG PORV sticking due to two-phase flow through the valve.

Boundary conditions for this scenario are listed in Table 27. Results, key event timings, and margins to key figures of merit are shown in Table 28, Table 29, and Table 30, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix D, Section D.1. Sensitivity studies and their results are listed in Table 31.

Even with few operator actions, the availability of high-pressure ECCS pumps and AFW ensures sufficient makeup early in the accident and decay heat removal late in the accident, respectively. In all cases, the water remains above the TAF throughout the 24-hour mission time. However, operators have relatively little time to prevent SG overfill, especially for the cases with two tube ruptures. In fact, in Case 4, operators have slightly more than 10 minutes from the time of reactor trip until SG level reaches 100 percent instrument span, and 20 minutes until water floods the steam lines. As mentioned, SG overfill may increase releases to the environment and may also lead to SG PORV or main steam line leaks or failures that could both increase radiological releases and complicate safe shutdown of the plant.

The overall system behavior is similar for all cases (except Case 4a). In general, an SGTR event with an equivalent break size of either 0.5 or 2 tubes causes pressurizer level and RCS pressure to drop, triggering either a manual reactor trip on low pressurizer level or an automatic trip on overtemperature T. There is only a small increase in water level and a small decrease in FW flow to the faulted SG before the reactor trip. After the reactor trip and subsequent reduction in steam flow, and the corresponding rapid changes in SG water level caused by the collapse of voids in the SG, level in the faulted SG increases rapidly. This is especially true for the cases in which the maximum number of ECCS pumps are available. The equivalent break size has a lesser, but still noticeable, effect on the flow through the ruptured tubes. This lesser effect is due to the amount of pressure in the RCS. If the injection flow does not maintain pressure in the RCS, then the amount of water that will flow out through the break is less than if pressure were maintained, regardless of the number of tubes ruptured.

Between 20 and 90 minutes into the event (depending on the case), water begins to spill into the steam line of the faulted SG. Because operators fail to manually isolate the SG, the water flows through the steam lines and into the intact SGs.20 High water levels in the intact SGs caused by water backfeeding from the ruptured SG limit the amount of AFW injected.

Eventually, continued ECCS injection depletes the RWST. Because there is little or no water in the sump due to bypass of ECCS water through the ruptured tubes, 21 HPR is unavailable. This 19 The condenser steam dumps would most likely be available until the operators manually close the MSIVs. Thus, the cases in which the steam dumps are available are more representative of the plant response to an SGTR.

Nevertheless, the results show that the steam dumps have only a small effect on most of the event timings.

20 In the revision of the Byron MELCOR model used for these calculations, there is no elevation change in any of the steam lines, based on the information that was available at the time. It has since been determined that the orientation of the steam lines makes it impossible for water to flow from the steam header to the intact SGs until the entire steam header is flooded. However, the amount of water that flows into the secondary side through the ruptured tube(s) over several hours is sufficient to completely flood the steam header and to backfeed intact SGs, especially when all high pressure ECCS pumps are available. Note that this represents an extreme case in which operators fail to take action to isolate the SGs hours into the event.

21 As explained later in this section, during Case 3 the pressurizer PORV cycles thousands of times, causing the pressurizer relief tank rupture disc to rupture. Thus, there is some water in the sump in Case 3, though not enough to establish recirculation. Therefore, boundary conditions were imposed in the model to prevent high-pressure recirculation from being available.

51

leads to a large drop in RCS pressure-particularly for the 0.5-tube break cases, where the RCS pressure is at or near the pressurizer PORV setpoint-and in the subcooling margin. Note that the low subcooling margin immediately following the cessation of injection from the RWST may affect procedural actions to achieve a safe, stable condition in the core.

Table 27 SGTR Boundary Conditions

• If pressurizer level <17% NR prior to an automatic trip signal, it will be assumed that the reactor is manually tripped based on off-normal operating procedure Primary side BOA SEC-8, unless otherwise noted in the calculation matrix

• RCPs will be tripped if cold-leg void fraction >0.1 a

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains Secondary side

• Steam dumps assumed unavailable except as noted

• 4 of 4 accumulators b

• 0 of 2 RHR pumps

• 1 of 4 RCFC units ECCS/ESF

• ECCS will not be secured to prevent SG overfill

• CSs are irrelevant b/c no energy is going in to containment (except for Case 3)

• Recirculation is unavailable due to bypass of ECCS water through SGTR c

• Manual reactor trip if pressurizer level <17% NR prior to an automatic trip Operator actions signal, RCPs tripped if cold leg void fraction >0.1.

a Note that other scenarios credit RCP trip on (i) containment pressure >20 psig and (ii) simultaneous RCS pressure <1,425 psig and SI injection >100 gpm. These criteria are continuous action steps in the SGTR procedure for Byron. Because this analysis assumes that operators fail to perform the actions in BEP-3, these two RCP trip criteria are not credited for the SGTR calculations presented here. The RCP trip criterion on containment pressure is not relevant unless significant primary-side inventory loss through the PORVs occurs. The primary-side pressure criterion only applies if the system naturally depressurizes prior to SGTR diagnosis and implementation of proceduralized actions to perform a controlled cooldown. Inspection of the results shows that the RCS pressure and SI injection criteria would occur before the voiding criteria; however, this would occur late in the transient, so it should not significantly affect the results.

b After these calculations were completed, it was discovered that the accumulator water and gas volumes in the MELCOR model should be 935 ft3 and 415 ft3, respectively, and not 850 ft3 and 500 ft3. However, this error has very little impact on the SGTR results. In fact, the accumulators only inject in Case 4a. The accumulators are not empty at the end of Case 4a, so a greater initial water inventory would make little difference, except that it would impact the hydrostatic head of the accumulators and would thus have a minor effect on the accumulator injection rates.

c Note that in these simulations, when the RWST reaches Lo-2 (the normal trigger for switchover of ECCS pumps to the containment sump), ECCS is assumed to terminate due to the lack of water in the sump (for almost all cases). In reality, operators would determine response not obtained for a proceduralized condition in BEP ES-1.3 related to indication of water in the sump. The operators would then transition to BCA-1.1, whereby ECCS injection from the RWST would be allowed to continue until RWST level reached 9 percent, at which point it would be terminated. However, in these simulations, the continuation of ECCS injection from the RWST would not affect the conclusions regarding core uncovery occurring beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, nor would it affect the overfill timings that precede the time of switchover.

Following RWST depletion, voids begin to form in the RCS, eventually leading to RCP trip on high void fraction. RCP trip ends the forced circulation through the RCS and leads to the formation of a steam bubble at the top of the RPV. However, RCP trip also causes a slight drop in RCS pressure, thus reducing primary-to-secondary leakage.

52

Table 28 SGTR Results Number of Core Core

1. of Reactor Steam SG PORV Case Charging/ Uncovery Damage tubes Trip Dumps Treatment SI Pumps (hh:mm) (hh:mm)a 1 0.5 First Out: No b No b 1/0 2 2 RPS or No b No b Does not stick 3 0.5 manual No No b No b 4 2/2 trip on No b No b 2

4a 17% Sticks open c No b No b 5 0.5 1/0 pressur- No b No b izer level Yes 6 2 2/2 No b No b Does not stick 7 1/0 No b No b 0.5 Auto No 8 2/2 No b No b a Defined as PCT = 2,200°F (1,204°C) b The response is based on a 24-hour mission time. Also, the analyses do not consider induced steam line failure following steam line flooding.

c SG PORV sticks full-open when water first flows through the valve.

For the smaller breaks, the RCS pressure remains slightly above the secondary-side pressure, which allows primary-to-secondary leakage to continue, although at a significantly reduced rate.

There is also a small but steady increase in RCS pressure between the time at which the RCPs trip and the time at which the pressurizer completely drains. Once the pressurizer drains, pressure decreases until it once again steadies slightly above the secondary-side pressure. For the larger breaks, the RCS pressure begins to oscillate about the secondary pressure late in the transient, leading to some reverse flow through the ruptured tubes. Decay heat removal is accomplished through heat transfer from the primary side to the initially large water volume in the SGs due to overfill of the faulted generator. Once a sufficient quantity of this water boils off, AFW is available to provide long-term makeup to the intact SGs. The CST volume is not depleted within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for any of the cases studied.

Case 4a is identical to Case 4 until 10 minutes after the steam lines flood, at which point two-phase flow through the SG PORV is assumed to cause the valve to fail open. This leads to a rapid drop in pressure in the ruptured SG, which in turn causes the MSIVs to close on low steam line pressure, effectively isolating the ruptured SG from the intact generators. Failure of the SG PORV also causes the RCS pressure to fall below the SI pump shutoff head. 22 In this case, RWST depletion and RCP trip occur much earlier than in other cases. It is also worth noting that in Case 4a, the pressure of the RCS is approximately equal to the pressure of the faulted SG, which is significantly below that of the intact generators. This leads to reverse heat transfer from the intact SGs to the primary system. AFW now injects to the faulted SG at a greater rate than AFW injection to the intact SGs in the other cases. Overall, this case would be much more challenging for the plant operators, which in turn demonstrates the potential problems associated with SG overfill.

22 In all of the other cases with the SI trains available, SI did not inject because the charging pumps kept the RCS pressure above the SI pump shutoff head.

53

Table 29 SGTR Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 4a (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Auto reactor trip -- 00:02 -- 00:02 00:02 Manual reactor trip 00:09 -- 00:09 -- --

Charging pump injection 00:19 00:02 00:19 00:02 00:02 SI pump injection -- -- -- -- 00:34 MSIVs close -- -- -- -- 00:58 SG at 100% indicated level 00:53 00:23 00:44 00:13 00:13 Onset of steam line flooding 01:27 00:42 01:07 00:23 00:23 SG PORV fails -- -- -- -- 00:32 Pressurizer goes solid 10:34 -- 01:30 -- --

RWST Lo-2 a 10:36 06:47 07:16 03:48 02:34 Switchover to sump recirc completed 10:46 06:57 07:26 03:58 02:44 (i.e., end of ECCS injection)b RCP trip 17:42 08:40 14:08 06:36 03:33 Core uncovery -- -- -- -- --

Core damage -- -- -- -- --

Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Auto reactor trip -- 00:02 00:12 00:12 Manual reactor trip 00:09 -- -- --

Charging pump injection 00:10 00:02 00:12 00:12 SI pump injection -- -- -- --

MSIVs close -- -- -- --

SG at 100% indicated level 00:52 00:13 00:56 00:44 Onset of steam line flooding 01:27 00:22 01:31 01:10 SG PORV fails -- -- -- --

Pressurizer goes solid 10:19 -- 10:14 01:26 RWST Lo-2 a 10:26 03:48 10:27 07:08 Switchover to sump recirc completed (i.e., end of 10:36 03:58 10:37 07:18 ECCS injection)b RCP trip 17:28 06:23 17:30 13:57 Core uncovery -- -- -- --

Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS and occurs at 46-percent level.

b Note that operators would not switch to sump recirculation when there is no water in the sump (i.e., for all cases except for Case 3). See note c to Table 27 for more information.

The various parameters studied affect the event timings of the SGTR cases in the following ways. The larger breaks cause the RCS pressure to remain well below the pressurizer PORV opening pressure for the entire 24-hour mission time. In contrast, the RCS repressurizes after an initial drop in pressure for the smaller rupture cases. In Case 3, the PORV cycles thousands of times because injection from two charging pumps greatly exceeds the flow rate through the ruptured tube. The larger rupture cases also lead to more rapid SG overfill, RWST depletion, and RCP trip. In other words, the larger ruptures accelerate the event timings. Similarly, the cases with maximum ECCS flow progress more quickly than the cases with only one charging train.

54

Table 30 SGTR Margins Case 1 Case 2 Case 3 Case 4 Case 4a 1,204 °C (2,200 °F) minus PCT (in °C) a 852 a 852 a 852 a 852 a 852 Completion of sump realignment-RHR b -- b -- b -- b -- b --

entry time (hh:mm)

CS setpoint-peak containment pressure 135 135 121 135 137 (kPa [psi]) [19.6] [19.6] [17.6] [19.6] [19.9]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) a 852 a 852 a 852 a 852 Completion of sump realignment-RHR entry time b -- b -- b -- b --

(hh:mm) 135 135 135 135 CS setpoint-peak containment pressure (kPa [psi])

[19.6] [19.6] [19.6] [19.6]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b The RCS pressure never drops below the RHR pump dead-head pressure.

Cases 7 and 8 illustrate the consequences of the operators failure to manually trip the reactor.

For both cases, the consequences are relatively minor. In Case 7, reactor trip (on overtemperature T), SG overfill, and steam line flooding are all delayed by about 3 minutes when compared to the analogous Case 1. More importantly, the relative time between reactor trip and SG overfill is unaffected in Case 7. However, ECCS injection occurs immediately after reactor trip in Cases 7 and 8, whereas in Cases 1 and 3, the ECCS does not inject until 10 minutes after reactor trip. This is because the earlier reactor trip occurs when the reactor pressure is greater, and so the drop in pressure following the reactor trip is not large enough to trigger SI. The reactor pressure is much lower in Cases 7 and 8 at the time of reactor trip on overtemperature T, and so the pressure drops below the ECCS low pressure setpoint after the reactor trip. Earlier SI causes the RWST to deplete and RCPs to trip about 10 minutes earlier in both cases, which is a relatively minor consequence of operator failure to trip the reactor. More significant, given that the operators have a limited time in which to respond to the transient, is the fact that the time between reactor trip and SG level at 100 percent indicating range is reduced by 3 minutes in Case 8, relative to Case 3. 23 In addition, failure to manually trip the reactor is significant because it delays the appropriate operator response to the transient. In this case, the delay in reactor trip because of operator failure to manually trip the reactor is only 3 minutes, but it may be much longer for a break smaller than 0.5 tubes.

23 The time between reactor trip and SG level at 100 percent in Case 7 is not affected by the later reactor trip on overtemperature T because only one charging pump injects in this case. In the analogous Case 1, the charging pump injects to the RCS after reactor trip but before an ECCS signal is received because letdown is isolated upon reactor trip. Thus, in both Case 1 and Case 7, one charging pump injects immediately following reactor trip. In contrast, two charging pumps inject immediately after trip in Case 8, whereas only one charging pump injects in Case 3 until an ECCS signal is received, at which point both charging pumps inject.

55

Table 31 SGTR Sensitivity Studies Case Sensitivity Justification Results 3a Assume In Case 3, the PORV cycles In this sensitivity case, the PORV thousands of times without failing, pressurizer PORV cycles 251 times sticks open which is unrealistic. and sticks open 88 minutes into the after 251 accident. As a result, the small SG demands tube leak becomes a larger leak due to the stuck-open PORV. This causes RCS pressure to drop below the SI pump shutoff head, resulting in injection from both charging pumps and both SI pumps. The RWST level reaches Lo-2 at 3:07. At this time, there is sufficient water in containment to allow for HPR, due to the loss of inventory through the stuck-open PORV. If operators do not align HPRas the calculation assumes core uncovery begins at 7:01, and PCT exceeds 2,200 °F at 8:29. If operators align HPR, they could delay core uncovery as long as there is sufficient water in the sump to run the ECCS pumps. Eventually, CD will occur because water recirculated from the sump will be lost through the ruptured SG tube and will be unavailable for core cooling.

3b Operators BEP-3 instructs operators to secure Securing ECCS pumps to limit flow to secure and ECCS pumps when certain conditions the faulted SG delays steam line reinitiate SI are met, and to reinitiate SI if RCS flooding by approximately half an hour per subcooling is unacceptable or if in this case. It also significantly delays procedure pressurizer level cannot be RWST depletion to 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> after the BEP-3 maintained. Securing ECCS pumps tube break.

will limit the amount of reactor coolant flowing into the faulted SG through the ruptured tube(s) and thus the time to SG overfill.

4b 1.63% 1.63% MUR power uprate that was The higher power level results in power recently approved by NRC (NRC, slightly higher auxiliary feedwater and increase 2014a) SG relief valve flow rates compared to the base case, but the differences in key event timings and calculation figures of merit are negligible.

4c Modify As part of a recently approved MUR SG PORVs uprate, Byron modified its SG PORVs.

This sensitivity calculation was not performed due to insufficient information and project resource constraints, but the entry is retained in this table to note that it could have some impact on the calculation results.

56

Table 31 SGTR Sensitivity Studies (continued)

Case Sensitivity Justification Results 4d Continue This sensitivity shows the relevance of In this case, CST depletion occurs just simulation imposing a 24-hour mission time. before 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. At the end of the to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> calculation, water level is still well above TAF, and SG level is just below the setpoint for AFW. Thus, CD is not imminent, though it is expected to occur within an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if action is not taken to refill the CST or the RWST.

4e Continue This sensitivity shows the impact of If injection is continued until RWST simulation the operators not proceeding with the level reaches 9%, then CST depletion to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> switchover at RWST Lo-2, given the is delayed beyond 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Based on and allow lack of water in the containment sump the AFW flow rate at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, CST continued (see note c for Table 27). depletion is not expected for another injection to 10+ hours.

an RWST level of 9%

The last condition studied, the availability of the condenser steam dumps, has little impact on the event timing. 24 In Cases 5 and 6, the steam dumps slightly accelerate the event progression because they cause the RCS pressure to drop when they open, which causes the SI signal on low pressurizer pressure to occur slightly sooner than in Cases 1 and 4, respectively. This leads to earlier RWST depletion and earlier RCP trip but has almost no impact on the time to SG overfill. These effects are more noticeable in Case 5 because it would take much longer for the RCS pressure to reach the low-pressure SI setpoint because of the smaller equivalent break size. This is evident from a comparison of the time between reactor trip and charging pump injection in Cases 1 and 4 (i.e., 10 minutes versus nearly simultaneous).

It should be noted that, because of the selected user input, there can be no flow of water from the SGs to the steam lines until the uncollapsed water level in an SG reaches the bottom of the steam line. 25 In reality, there may be some carryover of water into the steam lines before the water level reaches the steam line bottom elevation. This means there could be water in the steam lines earlier than is predicted by MELCOR, which in turn means there is the potential for earlier impacts of two-phase flow through the SG PORV, earlier water intrusion past the MSIVs, and increased water flow to FW pump turbines (either the MFW pump turbines for scenarios significantly different from the one studied here or the turbine of a turbine-driven AFW pump in a four-loop Westinghouse plant that uses turbine-driven AFW, such as Vogtle Units 1 and 2).

24 The steam dumps open to maintain RCS loop average temperature (Tavg) at the no-load setpoint. Because RCS Tavg is below the no-load setpoint for significant periods of time in Cases 5 and 6, steam dump valve actuation is limited in these cases. In fact, the steam dump valves open only once in Case 5.

25 MELCOR has a simple entrainment model that uses an input parameter called the momentum exchange length.

Larger values of the momentum exchange length increase the coupling between the phases, while smaller values increase the slip between the phases. In addition, MELCOR uses junction opening heights to determine the elevations from which fluid may be drawn into the flow path. There can be no flow of a phase through a flow path unless that phase is present within either the to or from junction opening height. Thus, carryover of water in the SGs to the steam lines could be modeled by manipulating the junction opening heights and the momentum exchange length. Of course, when varying these parameters, care must be taken to prevent unphysical or unrealistic behavior (such as significant entrainment during the steady-state, normal operations portion of the calculation).

57

Finally, the reader may notice that there are significant differences between these results and the results of the margin to overfill analysis in Section 15.6.3 of the Byron Final Safety Analysis Report (FSAR). It is important to remember that the FSAR calculation is a design-basis calculation. As such, the FSAR analysis follows the normal design basis analysis rules, in which the analyst conservatively biases plant initial conditions (such as power level, pressurizer pressure, and RCS temperatures) and trip setpoints, while at the same time assuming the worst single failure, all to give a conservative answer to the analysis. Conversely, the FSAR calculation credits operator procedural actions to identify and isolate the faulted SG, initiate a plant cooldown, depressurize the primary system, and terminate SI to limit flow to the SGs to arrest the accident progression. In contrast, the calculations presented here use best-estimate initial conditions and nominal trip setpoints and assume all plant systems are available (except where greater-than-minimal ECCS trains are discounted). However, these calculations also assume that operators fail to take the appropriate procedural actions, while the FSAR analysis assumes that operators enter E-3 (which directs them to isolate the secondary side of the ruptured SG, cool down the RCS below saturation, and then depressurize the RCS to below the ruptured SG pressure to terminate break flow). The other major difference between the FSAR calculations and the calculations presented here is that the FSAR calculations involve a single double-ended guillotine tube rupture, whereas the calculations presented here have either half or two equivalent double-ended guillotine tube ruptures.

In the FSAR SGTR design-basis calculations, automatic reactor trip occurs around 4.5 minutes, which is between 2 minutes for Case 2 (with 2 tube ruptures) and 12 minutes for Case 7 (with 0.5 tube ruptures). Auxiliary feedwater injection begins almost immediately following reactor trip in both the FSAR calculation and in the calculations presented here. However, while SI occurs immediately after trip in these calculations, SI does not occur until about 5 minutes following reactor trip in the FSAR calculation. Without more information about the pressure behavior in the FSAR calculation, it is difficult to determine why SI is delayed, though it is likely that the drop in reactor pressure following reactor trip is not as large in the FSAR calculation as it is in the MELCOR calculation. Possible explanations are that the MELCOR model is overpredicting this drop in pressure or that the conservative FSAR boundary conditions (e.g., decay heat) keep pressure higher. Note that this difference will also result in less time to SG overfill in the calculations presented here because injection from the high head ECCS pumps keeps the RCS at a higher pressure, and thus leads to higher flow through the ruptured tubes. By 6.5 minutes after reactor trip in the FSAR calculation, operators isolate the faulted SG, at which point comparisons between the FSAR and these SGTR calculations are no longer valid. 26 Thus, the reader should be cautious when comparing these SGTR calculations, in which operators fail to take action to terminate the accident, and the FSAR calculations, in which operator action prevents SG overfill.

In summary, the key observations from this analysis are:

• A 24-hour mission time is assumed, the analyses do not consider induced steam line failure following steam line flooding and no operator actions are modeled (i.e., SG is not isolated).

26 Note that isolating the faulted SG will cause pressure in the faulted SG to increase more rapidly than if the faulted SG were allowed to communicate with the other SGs through the main steam lines. The increase in faulted SG pressure reduces the break flow and, hence, increases the margin to overfill.

58

• The time of reactor trip ranges between 2 and 12 minutes depending on assumed conditions, with automatic trip (in cases where automatic trip occurs before operators are assumed to manually trip the reactor) occurring due to the overtemperature delta-T reactor protection system (RPS) logic.

• The time between reactor trip and SG overfill (as measured by SG water level reaching the steam line nozzle with no operator actions) is as follows:

- ~60 to 80 minutes for 0.5-tube equivalent leaks

- ~20 to 40 minutes for 2-tube equivalent leaks

• No core uncovery (and thus no CD) occurs in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the main cases.

- However, failure to control pressurizer level in cases with a smaller tube leak and maximum ECCS can lead to a large number of cycles on the pressurizer PORV and potential failure of this component. As shown in one of the sensitivity cases, CD can occur prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if sump switchover is not accomplished (and will occur later, otherwise, due to loss of recirculated water through the ruptured tube(s)).

5.6 Medium-Break LOCA Injection Success Criteria This series of cases investigates the minimal ECCS injection requirements for the injection phase of ECCS operation. If the initial injection is successful and if CD occurred, it would be expected to occur later for the specified conditions. 27 Other than actions to trip the RCPs, very few operator actions are modeled. In reality, operators would enter BEP-0, Reactor Trip or Safety Injection (e.g., verify alignments and component status, try to start components that should be running but are not (e.g., charging pumps), and trip the RCPs if the procedure directs). Operators would then transition to BEP-1, Loss of Reactor Coolant or Secondary Coolant (e.g., trip RCPs if the procedure directs, secure CSs if the procedure directs).

Depending on plant conditions, BEP-1 would prompt operators to enter either ES-1.2, Post-LOCA Cooldown and Depressurization, or ES-1.3, Transfer to Cold Leg Recirculation.

Note that, in this case, operators are assumed to either fail to enter or fail to complete ES-1.3, and thus they do not establish HPR. They are also assumed to fail to perform an emergency cooldown based on the inadequate core cooling functional restoration procedure. However, some of the actions in ES-1.2 are modeled in the MLOCA cooldown timing scenario described in Section 5.7.

The varied parameters for the MLOCA injection SC scenario are the equivalent break size and the available ECCS injection (one SI pump and one RHR pump, or two accumulators 28 and one RHR pump). The equivalent break size range considered is 2 to 6 in. (5.1 to 15.1 cm) equivalent break diameter. Additional sensitivity cases look at variations in the availability of containment heat removal systems.

27 Cooldown timing for low-pressure recirculation is investigated in a different set of MLOCA calculations that are documented in Section 5.7. Functional restoration (FR)-based emergency cooldown is not modeled.

28 Both available accumulators are in intact legs.

59

The boundary conditions for this scenario are listed in Table 32. Results, key event timings, and margins to key figures of merit are shown in Table 33, Table 34, and Table 35, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix E, Section E.1. Sensitivity studies and their results are listed in Table 36.

Table 32 MLOCA Injection Success Criteria Boundary Conditions

• Reactor trip based on RPS signal

• RCPs will be tripped if:

Primary side (i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1,425 psig and SI injection >100 gpm Secondary side

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• 0 of 4 RCFC units

• 2 of 2 CS trains (except for Case 4b)

ECCS/ESF

• Spray recirculation is unavailable (except for Case 4a)

• Low-pressure ECCS recirculation is available / HPR is unavailable Operator actions

• Trip RCPs; align LPR; align CS recirculation (where credited)

Other

• CCW to RHR HX is available (except for Cases 3a and 7a)

Table 33 MLOCA Injection Success Criteria Results Number of Equivalent Charging/ Core Core Diameter Containment Case SI Pumps/ RHR HX Uncovery Damage Break Size Sprays Accumulators/ (hh:mm) (hh:mm)a (in.)

RHR Pumps 1 2 00:21 02:18 2 3.33 Yes 00:08 --

3 0 of 2 / 2 / 2; no recirc 00:05 --

4.67 3a 1 of 2 / No 00:05 --

4 0 of 4 / 00:01 --

1 of 2 2 / 2; recirc 4a 6 00:01 --

available 4b 0/2 Yes 00:01 --

5 2 00:30 00:51 0 of 2 /

6 3.33 00:11 00:21 0 of 2 /

7 2 / 2; no recirc 00:06 --

4.67 2 of 4 /

7a No 00:06 --

1 of 2 8 6 Yes 00:04 --

a Defined as PCT = 2,200 °F (1,204 °C) 60

Table 34 MLOCA Injection Success Criteria Key Event Timings Case 1 Case 2 Case 3 Case 3a Case 4 Case 4a Case 4b (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 00:00 ACC injection -- -- -- -- -- -- --

SI pump injection 00:01 00:00 00:00 00:00 00:00 00:00 00:00 RCP trip 00:02 00:01 00:00 00:00 00:00 00:00 00:00 MSIVs close 00:11 00:04 00:02 00:02 00:01 00:01 00:01 RHR injection -- 00:50 00:19 00:19 00:12 00:12 00:12 Core uncovery 00:21 00:08 00:05 00:05 00:01 00:01 00:01 CS signal 01:02 00:19 00:08 00:08 00:04 00:04 --

RWST Lo-2 a 01:21 00:41 00:26 00:26 00:21 00:21 00:44 Switchover to sump recirc completed 01:31 00:51 00:36 00:36 00:31 00:31 00:54 (i.e., end of ECCS injection)b Start of RHR injection from the -- 00:52 00:37 00:37 00:32 00:32 00:54 sump RWST Lo-3 01:41 01:01 00:40 00:40 00:35 00:35 --

Core damage 02:18 -- -- -- -- -- --

Case 5 Case 6 Case 7 Case 7a Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 Accumulator injection 01:01 00:21 00:11 00:11 00:06 SI pump injection -- -- -- -- --

RCP trip 00:18 00:07 00:03 00:03 00:02 MSIVs close 00:15 00:04 00:02 00:02 00:01 RHR injection -- 00:48 00:25 00:25 00:14 Core uncovery 00:30 00:11 00:06 00:06 00:04 Containment spray signal --c 00:20 00:08 00:08 00:04 RWST Lo-2 a --c 00:45 00:31 00:31 00:24 Switchover to sump recirc completed (i.e.,

--c 00:55 00:41 00:41 00:34 end of ECCS injection)b Start of RHR injection from the sump -- 01:08 00:41 00:41 00:34 RWST Lo-3 --c 01:06 00:45 00:45 00:38 Core damage 00:51 00:21 -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

b Note that operators are assumed to fail to align the SI and charging pumps for HPR.

c This calculation stopped during CD progression, before initiation of CSs on high containment pressure and before RWST depletion and switchover to low-pressure ECCS recirculation. The calculation was not restarted because CD was already in progress.

61

Table 35 MLOCA Injection Success Criteria Margins Case 1 Case 2 Case 3 Case 3a Case 4 Case 4a Case 4b 1,204 °C (2,200 °F) minus CD 575 457 457 378 378 381 PCT (in °C)

Completion of sump realignment-RHR entry --a 00:02 00:17 00:17 00:20 00:20 00:42 time (hh:mm)

CS setpoint-peak containment pressure 0b 0b 0b 0b 0b 0b 0b (kPa)

Case 5 Case 6 Case 7 Case 7a Case 8 1,204 °C (2,200 °F) minus PCT (in °C) CD CD 169 169 454 Completion of sump realignment-RHR entry

--c 00:08 00:16 00:16 00:20 time (hh:mm)

CS setpoint-peak containment pressure (kPa) --c 0b 0b 0b 0b a RHR does not inject in this case.

b Containment sprays are activated in this case (if available). If sprays are unavailable, actual values are negative.

c This calculation stopped during CD progression, before initiation of CSs on high containment pressure and before RWST depletion and switchover to low-pressure ECCS recirculation. The calculation was not restarted because CD was already in progress.

The results 29 show that for Cases 1-4 and their sensitivities, the ECCS system is successful in preventing CD during the early stages of the loss-of-coolant accident (LOCA), prior to RWST depletion which marks the end of the injection phase. In these cases, the SI (for smaller breaks) and RHR (for larger breaks) pumps are able to recover RPV water levels to above the TAF after a brief period of partial core uncovery. This arrests the fuel heatup such that PCTs during core reflood are well below the CD surrogate temperature of 2,200 degrees F (1,204 degrees C). In these cases, CSs actuate on high containment pressure. Once sprays actuate, the rate of RWST depletion increases significantly due to the approximately 7,400 gallons per minute (gpm) flow through the CS pumps (compared to the approximately 5,000-gpm flow through the SI and RHR pumps). In Case 1, depletion of the RWST and assumed unavailability to align HPR leads to CD after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> because the RCS remains above the RHR dead-head pressure. In the other SI cases, the equivalent break size is large enough to depressurize the RCS to below the RHR dead-head pressure before RWST depletion, 30 thus allowing LPR to maintain the RPV water level above the TAF. These cases (with the exception of Case 3a, about which more will be said later) reach a safe, stable state within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the accident initiation. Inventory control is provided by LPR, and long-term cooling is provided primarily by the RHR HX, with some cooling by AFW.

As mentioned, Case 3a examines the impact of the RHR HX on the accident sequence. While the RHR HX has no effect on the success of the initial injection, or on the PCT, it does affect 29 Note that the results typically show that the pressure in one of the intact loop SGs (i.e. SG-B, -C, and -D) is lower than the pressure in the other two intact loop SGs. The lower pressure is caused by loop seal clearing, which affects the thermal-hydraulic behavior in the loop and its associated SG. This behavior is common in LOCA calculations and is explained in more detail in Section 5.2.

30 In Case 2, low-pressure injection begins within the 10-minute period between RWST level Lo-2 and the time at which operators would complete alignment of cold leg recirculation. (Recall that in this case, HPR is assumed to be unavailable.) Still, the break size is large enough and containment heat removal is sufficient to maintain RCS pressure below the RHR dead-head pressure throughout the cold leg recirculation phase.

62

long-term heat removal. In Case 3a, the lack of containment heat removal causes the containment to exceed its design pressure within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the start of the accident.

Note that the operators will receive a cue via the critical safety function status tree for high containment pressure at approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore CSs and align alternate heat removal capability, but these capabilities are assumed unavailable in this case. RCS pressure and temperature increase very slowly but steadily throughout the recirculation phase, though PCTs are only 437 degrees F (225 degrees C) at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Also, the increase in RCS pressure is accompanied by an increase in containment pressure, and so the containment backpressure remains relatively constant throughout cold leg recirculation. Thus, while the RCS is not in a safe, stable state at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the rate of temperature increase is very low, and the operators could most likely achieve a safe, stable state by providing some containment heat removal (either the RHR HX or reactor containment fan cooler (RCFC) units).

On the other hand, the second set of injection criteria (two accumulators and one RHR pump) is not successful in preventing CD during the injection phase for the range of MLOCAs studied here. 31 In particular, CD occurs in Cases 5 and 6 (2-in and 3.33-in breaks, respectively) before the accumulators are able to inject. This shows that these equivalent break sizes are not sufficiently large to allow the RCS to depressurize to below the accumulator injection pressure of 585 psig (4.136 MPa). In these cases, losses through the break cause the water level in the core to quickly fall, exposing a significant portion of the fuel. The accumulators are unable to inject to recover the water level until it is too late, leading to CD.

The accumulators, as well as the RHR pump, are able to inject to recover the core water level in Cases 7 and 8. Specifically, in Case 7, accumulator and RHR injection begin 11 and 25 minutes after initial core uncovery; in Case 8, accumulator and RHR injection begin 6 and 14 minutes following uncovery. Core reflood arrests the fuel heatup and limits the PCT to 1,895 degrees F (1,035 degrees C) and 1,382 degrees F (750 degrees C) for Cases 7 and 8, respectively, which is below the surrogate for CD. Though not the focus of these calculations, modeling of an emergency cooldown upon entry in to the functional restoration procedure (FRP) for inadequate core cooling may allow recovery of the core water level (via accumulator injection) prior to core damage, though the operator time windows may be very short based on the results for Case 6 (core uncovery at 11 minutes and core damage at 21 minutes) and Case 7 (high PCT).

In all of the accumulator cases, the CS pumps actuate on high containment pressure. In Cases 5 and 6, sprays begin after CD, and so they have no effect on the figures of merit for this calculation. In Cases 7 and 8, sprays actuate early in the accident sequence, when the core is uncovered and before the RCS pressure falls below the RHR pump dead-head pressure. The sprays quickly deplete the RWST, but not before the accumulators and LPI quench the fuel.

After depletion of the RWST, the RHR pump suction aligns to the containment sump, and LPR provides adequate inventory makeup to keep the core covered. The RHR HX provides most of the decay heat removal, while the SGs also provide limited cooling to the RCS.

31 After these calculations were completed, it was discovered that the accumulator water and gas volumes in the MELCOR model should be 935 ft3 and 415 ft3, respectively, and not 850 ft3 and 500 ft3. However, this error has little impact on these calculations because the accumulators do not inject until after CD occurs for Cases 5 and 6, while CD is avoided in Cases 7 and 8 even with reduced accumulator inventory. The only impact would be to delay RWST depletion in Cases 7 and 8.

63

Table 36 MLOCA Injection Success Criteria Sensitivity Studies Case Sensitivity Justification Results 6a Trip RCPs This sensitivity is not supported Tripping the RCPs earlier allows the earlier procedurally, but it could be RCS pressure to drop below the RHR interesting, especially since RHR pump shutoff head earlier than in injection begins shortly after CD in Case 6, but accumulator injection still Case 6. begins after CD in this sensitivity case.

3b Increase In Case 3a, containment exceeds its Increasing the containment heat containment design pressure due to lack of decay structure surface area by 20% reduces heat removal heat removal. This case looks into containment pressurization, such that surface area by the effects of heat sink surface area, pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is approximately 20% (with RHR which is justified because the surface 10% lower in Case 3b than in Case 3a.

HX areas in the Byron MELCOR model However, containment pressure is still unavailable) are based on conservative estimates. above the design pressure due to the lack of containment heat removal (i.e., fan coolers or the RHR HX).

4c Use the HFM The model used for critical flow can Using HFM for critical flow results in (instead of the have a significant impact on flow minor changes in the calculated HEM) for through the cold leg break. response of the system, including a critical flow 15 °C (27 °F) increase in PCT. This is insignificant given that PCT is still more than 350 °C (630 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

4d 1.63% power Recently approved 1.63% MUR Increasing core power by 1.63%

increase power uprate (NRC, 2014a) results in minor changes in the calculated response of the system, including a 30 °C (54 °F) increase in PCT. This is insignificant given that PCT is still 349 °C (628 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

4e Delay RCP trip BEP-0 directs operators to trip RCPs Delaying RCP trip reduces PCT by by 10 minutes if SI flow >100 gpm and RCS approximately 100 °C (180 °F).

pressure <1,425 psig; however, this However, flow through the RCPs is action occurs at Step 20, so there will single-phase steam for approximately be a delay from reactor trip (shortly 6 minutes before the RCPs are after which the above two conditions tripped. Note the RCPs are modeled are true) until operators take action to simply as a constant differential trip RCPs. pressure source that has been tuned to match the desired RCS flow and pressure drop during the steady-state portion of the calculation. This differential pressure source does not account for degraded conditions during two-phase flow or single-phase steam flow. Thus, PCT results for this sensitivity case are subject to considerable uncertainty.

64

Table 36 MLOCA Injection Success Criteria Sensitivity Studies Case Sensitivity Justification Results 4f Use the ANS The MELCOR model currently uses a Using the ANS decay heat curve decay heat decay heat curve from the plants instead of the Byron FSAR curve standard as FSAR reduces PCT by 155 °C (297 °F) encoded in relative to Case 4. This is because of MELCOR the lower decay heat given by the ANS curve relative to the decay heat curve used in the base case. There is very little difference between Case 4f and Case 4 in the later stages of the transient.

4g Adjust core This is approximately equal to the Increasing core bypass flow to 6%

bypass flow to maximum bypass flow cited in the results in minor changes in the 6% of total FSAR. calculated response of the system, RCS flow including a 37 °C (67 °F) increase in PCT. This is insignificant given that PCT is still 341 °C (614 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

8a Put one of the This looks at whether the injection See the text of Section 5.6 and figures ACCs in the SC should be 2/4 ACCs or 2/3 intact in Appendix E for the results of this broken leg ACCs. sensitivity calculation.

Two additional cases. Cases 4a and 4b, examine the impact of CSs on containment pressure and the time to RWST depletion. In Case 4a, sprays actuate on high containment pressure, as they did in Case 4. However, in Case 4a, operators are assumed to successfully align the CS pumps to the sump. Containment sprays are assumed to operate in recirculation mode for the remainder of the accident sequence. Containment pressure following transfer of CS pump suction to the sump is slightly higher than in Case 4, in which operators do not switch to CS recirculation, though pressure remains below containment design pressure. There is no effect on PCT or on general RCS behavior.

In Case 4b, CSs are assumed to be unavailable. In this case, RWST Lo-2 setpoint (46.7 percent) is delayed by about 20 minutes. Also, PCT is slightly lower in this case due to a very small difference in break flow caused by higher containment backpressure in Case 4b.

Peak containment pressure without sprays is 27 psig (0.19 MPa-g), which is well below the containment design pressure of 50 psig (0.34 MPa-g).

Caution must be taken when interpreting the effects of containment heat removal systems on the containment thermal-hydraulic behavior. For the current Byron model, the containment is modeled as a single node and includes only the heat transfer surfaces listed in Chapter 6 of the FSAR (which is conservative from the view of limiting containment pressure). Thus, the model does not account for natural circulation in containment, nor does it include all of the heat transfer surfaces present in containment. With that said, the single node containment model is sufficient for the purposes of this study (i.e., selected SC and accident sequence timing) because containment behavior has little impact on whether or not CD occurs in any of the scenarios described in this report.

Finally, it must be noted that for the larger breaks (4.67 in. and 6 in.), MELCOR experienced numerical problems that caused the calculations to run very slowly. In some cases, the numerical problems were so severe as to prevent the calculations from running for the 24-hour 65

problem time. The problems began well after core reflood and fuel quenching, and so the numerical issues are not related to core heat transfer behavior. Instead, the problem appears to be related to feedback between core and downcomer water level (which are in turn affected by the interplay between ECCS injection and break flow). The rapidly varying core and downcomer water levels affect the driving head for flow through the core, and thus core flow oscillates rapidly. This behavior causes rapid changes in pressure in some control volumes, which in turn limits the time step to extremely small values (as low as 1-10 microseconds). The issue is under further investigation, but for now, the affected cases will be assumed to be complete as is. Fortunately, this scenario focuses on the initial injection phase of the accident, and so the key observations for this scenario are unaffected by the numerical problems.

In summary, the key observations from this analysis are:

• One SI pump and one RHR pump are sufficient for preventing CD during the initial injection phase for the full range of MLOCA equivalent break sizes.

• On the other hand, two accumulators and one RHR pump are not sufficient for preventing CD for the smaller end of the MLOCA break spectrum. In these cases, CD occurs before the RCS pressure falls below the accumulator injection setpoint.

o Though not the focus of these calculations, modeling of an emergency cooldown upon entry in to the FRP for inadequate core cooling may allow recovery of the core water level (via accumulator injection) prior to core damage, though the operator time windows may be very short

• Assuming the initial injection is successful, CD will occur for smaller MLOCAs in the absence of either secondary-side cooldown 32 or HPR. For larger equivalent break sizes (3.33 in. and above), the break causes the RCS pressure to eventually drop below the RHR shutoff head, thus allowing for LPR to maintain the RPV water level above TAF.

- This is not surprising, in that 2 in. is the upper end of the SLOCA break range, and SLOCAs are partially defined by an inability to naturally depressurize to low RCS pressure. However, some undocumented calculations were run to scope out the tipping point for success/failure, and they suggest that, for the conditions studied, that point is around 3.33 in. (8.46 cm).

• Containment heat removal systems (e.g., CSs and the RHR HX) have a negligible impact on the initial injection phase of the accident but have a significant impact on the containment conditions later in the accident.

- The biggest impact of the CSs is that they rapidly deplete the RWST.

- The RHR HX removes decay heat late in the accident, though cladding temperatures remain well below the CD surrogate until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> even without the RHR HX in service. If the RHR HX and containment fan coolers are unavailable, the containment will exceed its design pressure due to lack of long-term heat removal.

32 Based on the results in Section 5.7, secondary-side cooldown may not be sufficient for preventing CD for 2-in.

breaks.

66

Effect of Accumulator in Broken Loop Cases 5-8 described above assume that both of the available accumulators are in intact loops.

Cases 7 and 8 have been rerun to determine the effects of placing one of the available accumulators in the broken loop. (Recall that CD occurs before accumulator injection for Cases 5 and 6, so placement of an accumulator in a broken loop would have no impact on the pre-CD phase of the accident.)

One would expect that placing one of the available accumulators in the broken loop would have a detrimental impact on the system response because water from this accumulator would spill out of the break before reaching the core. However, the opposite is true: PCTs are higher when both accumulators are in intact loops than when one accumulator is in an intact loop and the other is in the broken loop. For Case 7, PCT decreases from 1,895 degrees F (1,035 degrees C) to 1,477 degrees F (830 degrees C) when one accumulator is moved from an intact loop to the broken loop. For Case 8, PCT decreases from 1,382 degrees F (750 degrees C) to 1,162 degrees F (628 degrees C). This is because more water reaches the core when the accumulators are in intact loops. The additional water produces more steam, which keeps the pressure above the RHR pump shutoff head longer than in the cases with an accumulator in the broken loop. Thus, the top of the core is uncovered for a longer period of time in the two-intact-loop accumulator case before the RHR pump can inject to recover level, resulting in higher cladding temperatures.

With that said, it is important to emphasize that accumulator injection is still needed to provide some cooling until the RHR pumps can inject. If no accumulators are available, then CD will occur before the low pressure pumps can recover core level and quench the overheated fuel.

The higher predicted PCT for Cases 7 and 8 with two accumulators in intact loops compared to one accumulator in an intact loop and one in a broken loop is a function of the particular break sizes and other conditions chosen.

5.7 Medium-Break LOCA Cooldown Timing for Low-Pressure Recirculation This scenario investigates the time for initiating secondary-side depressurization and cooldown to preclude the need for HPR when the RWST level prompts initiation of switchover. Other than actions to trip the RCPs and to initiate secondary-side cooldown, very few operator actions are modeled. In reality, operators would enter BEP-0, Reactor Trip or Safety Injection (e.g., verify alignments and component status, try to start components that should be running but are not (e.g., charging pumps), and trip the RCPs if the procedure directs). Operators would then transition to BEP-1, Loss of Reactor Coolant or Secondary Coolant (e.g., trip RCPs if the procedure directs, secure CSs if the procedure directs). Depending on plant conditions, BEP-1 would prompt operators to enter either ES-1.2, Post-LOCA Cooldown and Depressurization, or ES-1.3, Transfer to Cold Leg Recirculation.

Minimal ECCS (one SI train and one RHR train) is assumed in all cases. The varied parameters for this scenario are equivalent break size (2 in. or 6 in. (5.1 or 15.1 cm)), the time at which operators initiate the cooldown (20 minutes or 40 minutes), and the available containment heat removal systems. For all cases except Cases 2a and 8a, CS recirculation is assumed to 67

be unavailable. For all cases except Case 8b, the RHR HX is assumed to be available. Note that the SG PORVs are opened to commence secondary-side cooldown. 33 The boundary conditions for this scenario are listed in Table 37. Results, key event timings, and margins to key figures of merit are shown in Table 38, Table 39, and Table 40, respectively.

Meanwhile Table 41 provides the actual cooldown rates achieved. In addition to these tables, results for selected parameters of interest are shown in Appendix E, Section E.2. Sensitivity studies and their results are listed in Table 42.

Table 37 MLOCA Cooldown Timing Boundary Conditions

• Reactor trip based on RPS signal

• RCPs will be tripped if:

Primary side (i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1,425 psig and SI injection >100 gpm Secondary side

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• 0 of 2 charging trains

• 1 of 2 SI trains

• 0 of 4 accumulators ECCS/ESF

• 1 of 2 RHR pumps

• LPR is available

• CS recirculation is unavailable (except for Cases 2a and 8a)

Operator actions

• SG cooldown at specified time; tripping RCPs; aligning LPR Other

• CCW to RHR HX is available (except for Case 8b)

Table 38 MLOCA Cooldown Timing Results Containment Equivalent Core Core Sprays / Reactor Case Diameter SG Cooldown Uncovery Damage Containment Fan Break Size (in.) (hh:mm) (hh:mm)a Coolers 1 2 00:21 --

2 of 2 trains /

2 00:01 --

6 0 of 4 units 2a b 00:01 --

100 °F/hr starting 3 2 0 of 2 trains / 00:21 --

at 20 min.

4 6 0 of 4 units 00:01 --

5 2 0 of 2 trains / 00:21 --

6 6 4 of 4 units 00:01 --

7 2 00:21 --

8 2 of 2 trains / 00:01 --

8a b 6 100 °F/hr starting 0 of 4 units 00:01 --

8b c at 40 min. 00:01 --

9 2 0 of 2 trains / 00:21 --

10 6 0 of 4 units 00:01 --

a Defined as PCT = 2,200 °F (1,204 °C) b Containment spray recirculation is available for Cases 2a and 8a.

c The RHR HX is unavailable for Case 8b.

33 Specifically, 4/4 SG PORVs are used instead of 3/4 SG PORVs or 1/12 TBVs. See footnote 9 on page 18 for more information.

68

Within the first minute of accident initiation all of the 2-in. break cases experience a reactor trip (due to overtemperature T) and an ECCS actuation signal on low pressurizer pressure (although the SI pumps do not begin injecting until RCS pressure falls below the pump shutoff head). Within the first 2 minutes, the SI pumps begin to inject, and RCPs are manually tripped due to low RCS pressure with adequate SI flow (see trip condition (iii) in Table 37). The MSIVs close on high containment pressure at roughly 11 minutes. Core uncovery begins at 21 minutes, regardless of whether or not the operators initiate secondary-side cooldown at 20 minutes. 34 For the cases with all RCFCs unavailable, containment pressure reaches the CS initiation setpoint approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the event. If sprays are available, they quickly deplete the RWST, thus ending all HPI. For these cases (1 and 7), RCS pressure is still above the RHR pump shutoff head at the time of RWST depletion, so there is no injection for approximately half an hour. During this time, water level falls below one-half active fuel height, and the fuel heats rapidly to 1,697 degrees F (925 degrees C) in Case 1 and 1,832 degrees F (1,000 degrees C) in Case 7. At the same time, RCS pressure drops below the RHR pump shutoff head, and the low-pressure pumps inject water from the sump to the RCS to quench the fuel before it exceeds the CD surrogate temperature of 2,200 degrees F (1,204 degrees C). For the cases in which CSs are unavailable, RCS pressure drops below the RHR pump shutoff head, thus allowing continuous injection by the RHR pumps during the transfer of suction from the RWST to the containment sump. There is no fuel heatup for these cases (3, 5, and 9).

For the 6-in. break cases, a number of events occur within the first minute including reactor trip on overtemperature T, initiation of SI, the satisfaction of the RCP trip condition for the combination of low RCS pressure and SI flow greater than 100 gpm, and the closure of MSIVs due to high containment pressure. For the cases where the RCFC units are unavailable, high-high containment pressure is reached at 4 minutes. If CSs are available (i.e., Cases 2 and 8 and their variants), they actuate and quickly drain the RWST, such that Lo-2 and Lo-3 occur at 21 and 35 minutes, respectively. In all cases, RHR begins to inject at 12 minutes, which also contributes to the drawdown of the RWST, such that RWST Lo-2 occurs at 44 minutes if CSs are unavailable. Core uncovery begins about 1 minute into the accident, but the injection from the RHR pumps begins to reflood the core at 12 minutes and eventually quenches the fuel.

Peak cladding temperatures reach a maximum of about 1,520 degrees F (827 degrees C))

before ECCS injection arrests fuel heatup.

34 Note that the results typically show that the pressure in one of the intact loop SGs (i.e., SG-B, -C, and -D) is lower than the pressure in the other two intact loop SGs. The lower pressure is caused by loop seal clearing, which affects the thermal-hydraulic behavior in the loop and its associated SG. This behavior is common in LOCA calculations.

69

Table 39 MLOCA Cooldown Timing Key Event Timings Case 1 Case 2 Case 2a Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 00:00 SI pump 00:01 00:00 00:00 00:01 00:00 00:01 00:00 injection RCP trip 00:02 00:00 00:00 00:02 00:00 00:02 00:00 MSIVs close 00:11 00:01 00:01 00:11 00:01 00:19 00:01 Core uncovery 00:21 00:01 00:01 00:21 00:01 00:21 00:01 CS signal 01:04 00:04 00:04 01:04 a 00:04 a -- b -- b RHR injection -- 00:12 00:12 02:09 00:12 02:09 00:12 RWST Lo-2 c 01:23 00:21 00:21 03:01 00:44 02:58 00:44 Switchover to sump recirc completed 01:33 00:31 00:31 03:11 00:54 03:08 00:54 (i.e., end of ECCS injection) d Start of RHR injection from 02:03 00:32 00:32 03:11 00:54 03:08 00:54 the sump RWST Lo-3 01:43 00:35 00:35 -- -- -- --

Core damage -- -- -- -- -- -- --

Case 7 Case 8 Case 8a Case 8b Case 9 Case 10 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 SI pump injection 00:01 00:00 00:00 00:00 00:01 00:00 RCP trip 00:02 00:00 00:00 00:00 00:02 00:00 MSIVs close 00:11 00:01 00:01 00:01 00:11 00:01 Core uncovery 00:21 00:01 00:01 00:01 00:21 00:01 CS signal 01:03 00:04 00:04 00:04 01:03 a 00:04 a RHR injection -- 00:12 00:12 00:12 02:09 00:12 RWST Lo-2 c 01:22 00:21 00:21 00:21 02:47 00:44 Switchover to sump recirc completed (i.e., end of 01:32 00:31 00:31 00:31 02:57 00:54 ECCS injection) d Start of RHR injection from 02:00 00:32 00:32 00:32 02:57 00:54 the sump RWST Lo-3 01:42 00:35 00:35 00:35 -- --

Core damage -- -- -- -- -- --

a Containment pressure exceeds the CS setpoint, but sprays do not initiate because they are assumed to be unavailable for this case.

b Fan coolers are able to prevent containment pressure from reaching the CS setpoint.

c This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

d Note that HPR is unavailable.

70

Table 40 MLOCA Cooldown Timing Margins Case 1 Case 2 Case 2a Case 3 Case 4 Case 5 Case 6 1,204 °C (2,200 °F) 277 378 378 852 381 852 344 minus PCT (in °C)

Completion of sump realignment-RHR -00:30 a 00:20 00:20 01:02 00:42 00:59 00:42 entry time (hh:mm)

CS setpoint-peak 78.9 containment 0b 0b 0b 0b 0b 0b

[11.4]

pressure (kPa [psi])

Case 7 Case 8 Case 8a Case 8b Case 9 Case 10 1,204 °C (2,200 °F) minus PCT 204 378 378 378 852 381 (in °C)

Completion of sump realignment-RHR entry time -00:27 a 00:20 00:20 00:20 00:48 00:42 (hh:mm)

CS setpoint-peak containment 0b 0b 0b 0b 0b 0b pressure (kPa) a RHR injects after RWST depletion and switchover to sump recirculation.

b Containment sprays are activated in this case (if available). If sprays are unavailable, actual values are negative.

Table 41 MLOCA Cooldown Timing Cooldown Rates Case 1 Case 2 Case 3 Case 4 Case 5 Target a 100 100 100 100 100 1 hr after start of cooldown 118 70 101 72 104 2 hr after start of cooldown 121 38 112 43 110 3 hr after start of cooldown 88 - 87 31 92 Case 6 Case 7 Case 8 Case 9 Case 10 Target a 100 100 100 100 100 1 hr after start of cooldown 50 99 21 101 4 2 hr after start of cooldown 34 101 17 120 8 3 hr after start of cooldown 25 77 11 77 -

a Rates are in F/hr.

71

Table 42 MLOCA Cooldown Timing Sensitivity Studies Case Sensitivity Justification Results 3b Assume The licensee PRA requires either This sensitivity case shows that 2/4 RCFCs are the RHR HX or 2/4 RCFCs for LPR 2/4 RCFCs are sufficient for available and maintaining RCS pressure below the that the RHR RHR pump shutoff head.

HX is unavailable 7b Use 3/4 SG The SC for secondary-side In this case, the SG PORV on one of PORVs for cooldown is 3/4 SG PORVs or the nonbroken loops has been cooldown 1/12 TBVs disabled. As a result of having only instead of 3/4 SG PORVs available for 4/4 SG cooldown, there are slight differences PORVs in the thermal-hydraulic response of the RCS between the sensitivity case and the base case. For example, there are slight differences in SG heat removal rates, loop flow rates, and core water level early in the transient.

In the sensitivity case, less of the core is uncovered, and the uncovery period is shorter, compared to the base case. As a result, PCT is significantly higher in the base case.

This does not imply that 3/4 SG PORVs is better than 4/4 SG PORVs; instead, it shows that there are some nonlinearities in the response (see Case 7c below) and uncertainty in the thermal-hydraulic results.

7c 2/4 SG This will further explore the impact In this case, the SG PORVs in two of PORVs that the number of available the nonbroken loops are disabled.

SG PORVs has on secondary-side However, there is little difference in cooldown the rate of heat transfer to the SGs in the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the transient.

Thus, two SGs are sufficient for reducing RCS pressure below the RHR shutoff head. However, there are multiple periods during which the RHR pump is dead-headed, leading to subsequent cycles of fuel heatup and fuel quenching after injection is restored. Thus, while MELCOR predicts that CD is avoided for Case 7c, there is less margin in this case than in Case 7, for which only one instance of fuel heatup is predicted.

72

Table 42 MLOCA Cooldown Timing Sensitivity Studies (continued)

Case Sensitivity Justification Results 7d Change the Typically cold leg breaks are The hot leg break is less limiting than break location analyzed because they are believed the equivalent cold leg break size for to the hot leg to be more limiting, though it is also the set of available systems in possible that a break could occur in Cases 7 and 7d. The break in the hot leg Case 7d quickly drains the hot leg, so break flow transitions to single-phase steam flow early in the accident. On the other hand, ECCS injection to the cold leg in the cold leg break case prolongs single-phase water and two-phase flow through the break, so the RCS does not depressurize as quickly in the cold leg break case.

The more rapid depressurization in the hot leg break case allows the RHR pump to inject before RWST depletion, so there is no fuel heatup, unlike in the cold leg break case.

8c Use the HFM The model used for critical flow can The PCT is approximately 30 °C (instead of the have a significant impact on flow higher in Case 8c than in Case 8 due HEM) for through the cold leg break to slight differences in break flow critical flow early in the calculation. Otherwise, the critical flow model has little impact on the results for this scenario.

8d 1.63% power Recently approved 1.63% MUR The PCT is approximately 30 °C increase power uprate (NRC, 2014a) higher in Case 8d than in Case 8 due to the slightly higher decay power.

Otherwise, the slight increase in power has little impact on the results for this scenario.

8e Delay RCP trip BEP-0 directs operators to trip Delaying RCP trip by 10 minutes by 10 minutes RCPs if SI flow >100 gpm and RCS slightly delays the time of fuel heatup, pressure <1425 psig; however, this such that PCT occurs 3 minutes later action occurs at Step 20, so there in Case 8e than in Case 8. Also, will be a delay from reactor trip PCT is 100 °C lower in Case 8e than (shortly after which the above in Case 8. This is because the longer two conditions are true) until period of forced flow provides operators take action to trip RCPs additional cooling for the fuel early in the accident and delays fuel heatup such that, when heatup occurs, decay heat is lower. Note, however, that the RCPs are modeled as constant pressure sources. The input model does not account for degraded performance during two-phase flow, nor does it adjust the differential pressure provided by the pump during single-phase steam flow.

Two-phase and single-phase steam conditions are present for much of the 10-minute RCP trip delay, so results of this sensitivity study should be used with caution.

73

Table 42 MLOCA Cooldown Timing Sensitivity Studies (continued)

Case Sensitivity Justification Results 8f Use the ANS The MELCOR model currently uses The PCT is approximately 150 °C decay heat a decay heat curve from the plants lower in Case 8f than in Case 8. This standard as FSAR is because the ANS decay heat curve encoded in from MELCOR is noticeably lower MELCOR than the decay heat curve from the Byron FSAR (as discussed in Section 4.2). Containment temperature and pressure are also lower in Case 8f than in Case 8 due to the lower decay heat, though containment pressure still exceeds the CS setpoint early in the accident sequence.

8g Adjust core This is approximately equal to the The PCT is approximately 35 °C bypass flow to maximum bypass flow cited in the higher in Case 8g than in Case 8.

6% of total FSAR This is because the increase in RCS flow bypass flow results in less coolant flow around the fuel and, thus, less heat removal from the cladding.

Otherwise, the increase in core bypass flow has little impact on the results for this scenario.

For all cases, initial flow through the break is single-phase liquid, though two-phase flow begins once the broken cold leg is nearly dry. 35 In the 2-in. break cases, the interaction between downcomer water level, core water level, and ECCS injection flow rate causes the water level in the broken leg to fluctuate, thus causing spikes in break flow during periods of single-phase liquid flow and depressions when the steam volumetric flow rate is large. Eventually, break flow reverts to single-phase liquid flow, as is shown in Cases 1, 3, 5, 7, and 9. In the 6-in. break cases, two-phase flow through the break significantly decreases the break flow rate from 3.5 minutes until about 11 minutes, at which point ECCS injection is able to reflood the broken leg such that single-phase liquid break flow resumes by 15 minutes. Single-phase break flow continues for the remainder of the calculation.

The results show that the cooldown timing has almost no effect on the key event timings for the first hour of the 6-in. break cases. This is because the break flow is sufficient to quickly depressurize the RCS so that RHR can inject before operators initiate secondary-side cooldown. 36 Late-stage effects of the cooldown timing cannot be determined at this time because of numerical problems that have prevented most of the 6-in. cases from running to completion. 37 35 The cold leg does not dry out completely as long as the ECCS pumps are injecting. The break is assumed to be in the bottom of the cold leg.

36 Note that the cooldown rates during the operator-controlled cooldown portion of the scenario for the 6-in. break cases shown in Table 41 are much less than the target rate of 100 °F/hr because the RCS quickly depressurizes and cools down due to losses from the break in the cold leg. By the time operators initiate secondary-side cooldown, RCS temperature is already more than 200 °F below the RCS and SG secondary-side operating temperatures at 100 percent-power. Thus, the cooldown rate is less than the target rate after operators open the SG PORVs.

37 See Section 5.6 for a description of these numerical problems.

74

The time of cooldown initiation does not have a significant impact on the 2-in. break cases, either. This is because the cooldown rate between 20 and 40 minutes is approximately 100 degrees F/hr regardless of whether or not operators take action to open the SG PORVs at 20 or 40 minutes. This is because there is a significant fraction of steam flow through the break beginning around 20 minutes, which depressurizes the RCS more rapidly than when break flow is single-phase liquid.

Containment cooling system availabilities do have a noticeable impact on calculation results.

For the 2-in. break cases, CSs lead to much more rapid depletion of the RWST, thus leading to significantly higher PCTs than in cases where CSs are unavailable. In comparison, the RCFC units effectively cool the containment without depleting the RWST. In fact, the peak containment pressure in Case 5 is well below the CS setpoint, which shows that all four RCFC units are very effective at cooling containment. For the 6-in. break cases, containment heat removal systems have a small impact on PCTs, such that the more effective containment heat removal system lineups result in slightly higher PCTs. This is because there is a slight increase in flow through the break at lower containment pressures. However, the difference in PCT between Case 4 (i.e., the least effective containment heat removal lineup) and Case 6 (the most effective lineup) is only 67 degrees F (37 K).

Note that lack of long-term containment heat removal capability (i.e., either the fan coolers or the RHR HX) poses challenges to containment integrity. In Case 8b, containment exceeds its design pressure of 50 psig (0.34 MPa-g) at 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />. Sump temperatures are 275 degrees F (135 degrees C) at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which could also challenge the containment.38 On the other hand, the sump temperature is below the RHR pump design temperature (400 degrees F). The pump would continue to inject because net positive suction head (NPSH) is adequate throughout the recirculation phase. 39 Thus, while the unavailability of the RHR HX may challenge containment integrity, the heat exchanger is not needed to prevent CD within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of this accident scenario.

In addition to the cases documented in the tables below, a number of sensitivity cases were run in which operators stopped secondary-side cooldown by closing the SG PORVs after the start of RHR injection. In these otherwise undocumented sensitivity cases, CD is avoided because decay heat removal by the RHR HX is sufficient for maintaining RCS pressure below the RHR pump shutoff head. This demonstrates that SG heat removal is not needed in the later stages of the accident, as long as the RHR HX is available. However, containment would exceed its design pressure before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if fan coolers are unavailable for containment heat removal.

Finally, numerical problems have prevented some of the 6-in. cases from completing their 24-hour simulation time. These problems are discussed in Section 5.6. With that said, CD is not expected for any of the 6-in. cases because the equivalent break size is sufficient to maintain RCS pressure below the RHR pump shutoff head, thus allowing LPR to continue indefinitely. This is substantiated by the fact that, even when there is no containment heat removal in the long term, as in Case 8b, 40 LPR continues until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and PCTs 38 The short-term design temperature of the containment liner is 280 °F (138 °C) [Table 6.2-66 of the Byron FSAR].

39 The calculation of net positive suction head does not account for head losses due to possible sump screen blockage.

40 In Case 8b, the residual heat removal heat exchanger and all four of the RCFC units are assumed to be unavailable, and thus there are no active containment heat removal systems once containment spray ceases on RWST Lo-3.

75

remain well below the CD surrogate. However, the failure to run the cases to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> limits the ability to draw conclusions about the impacts of containment heat removal systems on long-term RCS and containment behavior.

In summary, the key observations from this analysis are:

• Core damage is averted in all of the 6-in. break cases because the break is large enough to maintain RCS pressure below the RHR pump shutoff head.

• Core damage is averted in all of the 2-in. breaks because the operator action to initiate secondary-side cooldown depressurizes the RCS below the RHR pump shutoff head in time to avoid or arrest core heatup.

• Containment heat removal systems have a significant impact on some of the key event timings, particularly the time of RWST depletion, but have little impact on PCTs.

- The biggest impact of the CSs is that they rapidly deplete the RWST.

- RCFC units are very effective in limiting containment pressurization and in cooling the containment atmosphere.

- The RHR HX removes decay heat late in the accident, though cladding temperatures remain well below the CD surrogate until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> even without the RHR HX in service. However, containment exceeds its design pressure if the RHR HX and the RCFCs are unavailable.

5.8 Loss of Shutdown Cooling This scenario investigates a loss of RHR cooling during shutdown. The purpose of these calculations is to determine the effectiveness of various recovery actions and the time to core uncovery and CD if recovery actions are unsuccessful. This scenario is different from previous scenarios in that the loss of shutdown cooling occurs during Mode 4 (hot shutdown) or Mode 5 (cold shutdown), whereas the other events occur with the reactor at full power. Also, while previous scenarios credited few operator actions, the loss of shutdown cooling calculations attempt to represent the actions that operators may take given a loss of RHR initiating event.

Thus, the system availabilities and possible recovery actions are based heavily on information in Byron Operating Abnormal (BOA) procedure PRI-10, Loss of RH Cooling.

The loss of shutdown cooling scenario is divided into two sets based on initial operating conditions. The first set involves loss of shutdown cooling in Mode 4, with RCS pressure at 350 pounds per square inch absolute (psia) (2.41 MPa) and loop average temperature (Tavg) at 275 degrees F (135 degrees C). The second set involves loss of shutdown cooling in Mode 5, with the pressurizer PORVs opened (i.e., RCS at atmospheric pressure), RCS Tavg at 170 degrees F (77 degrees C), and the loop stop valves closed. The initial conditions, boundary conditions, and results for the Mode 4 and Mode 5 calculations are presented in Sections 5.8.2 and 5.8.3 below. In order to achieve these initial conditions and in order to be able to model the recovery actions in BOA PRI-10, some changes were made to the MELCOR input. These changes are described briefly in Section 5.8.1 and in more detail in Sections F.1 and F.2 of Appendix F.

76

5.8.1 Changes to the MELCOR Input Deck for Loss of Shutdown Cooling Calculations The following list identifies some of the changes that were made to the MELCOR input deck in order to perform shutdown calculations.

• Logic has been added to model the shutdown cooling function of the RHR system. This logic is set up such that RHR flow rate is adjusted in order to maintain a constant coolant temperature, up to the maximum flow rate of the system. The logic also includes provisions to achieve a target cooldown rate; however, this feature is not used in any of the shutdown calculations described below.

• Pressurizer level control logic has been modified to control water level during the steady-state portion of the calculation. For the Mode 5 calculations, level control is based on RPV level because the level is assumed to be at the vessel flange, which is below the bottom of the pressurizer.

• Similarly, pressurizer heater logic has been modified to achieve the desired pressure during the steady-state portion of the Mode 4 calculations. For Mode 5, heaters are disabled because the pressurizer is empty.

• Logic that makes it possible to turn off ECCS flow to prevent overfilling the pressurizer has been modified in order to simulate recovery actions in which operators inject using a charging pump when RPV level is low. This feature is exercised in Mode 4 Cases 2 and 5 and Mode 5 Cases 2, 5, and 8.

• The decay heat curves have been shifted in order to simulate the desired times after trip.

For example, the decay heat curve is shifted by 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for Mode 4 Cases 1-5. Note that during the steady-state portion of the calculation, the decay heat is assumed to be constant and to equal the decay heat 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after shutdown. The same is true for all other times since subcriticality that are analyzed below.

5.8.2 Mode 4 Calculations The Mode 4 loss of shutdown cooling calculations begin with RCS temperature and pressure at 275 degrees F (135 degrees C) and 350 psia (2.41 MPa). The RCS temperature is in the middle of the temperature range for Mode 4 (see Table 1.1 of (NRC, 2008)). The RCS pressure represents the pressure at which the RHR system can be placed into service. Pressurizer level is at no-load conditions (i.e., 25-percent level), the secondary-side temperature is equal to the RCS temperature, and the steam dumps are available and are maintaining secondary-side pressure at saturation. The list of boundary conditions is given in Table 43.

77

Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions

• RCS Tavg = 275 °F

• Pressurizer pressure = 337 psig

• Pressurizer water level at no-load conditions (25% level)

Primary side

• LTOP not in service a

• Pressurizer heaters and backup heaters are deenergized following loss of RHR

• SG temperature equal to RCS Tavg

• Secondary side saturated Secondary side

• Pressure controlled by condenser steam dump valves at RCS saturation pressure

• 1 train of RHR operating in shutdown cooling mode until t=0 ECCS/ESF

• Accumulators are isolated

• Operators initiate 4 of 4 RCFCs at 30 minutes (based on direction in Operator actions procedure BOA PRI-10) a Calculations show that LTOP would not cause pressurizer PORVs to actuate for this scenario.

The parameters varied for the Mode 4 calculations are the initial SG water level, the time after shutdown when RHR cooling is lost, and the recovery actions that operators perform.

The results from these calculations are presented in Table 44. Key event timings are presented in Table 45.

Table 44 Loss of Shutdown Cooling (Mode 4) Results Time Since Initial SG Core Core Case Subcriticality Water Recovery Actions a Uncovery Damage b (hr) Level (hh:mm) (hh:mm) 1 None 12:40 14:59 2 Start CCP on low RPV level d -- --

3 18% NR c Recover RHR at 2 hr -- --

4 12 Initiate AFW at 3 hr -- --

5 Initiate B&F at 4 hr -- --

6 Recover RHR at 2 hr -- --

27% WR e 7 Initiate AFW -- --

8 None 10:35 12:30 9 6 18% NR c Recover RHR at 2 hr -- --

10 Initiate AFW at 3 hr -- --

a Timings for recovery actions are from the time at which RHR cooling is lost.

b For this table, CD is defined as PCT >2,200 °F, and limited to the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

c Technical Specification surveillance requirement 3.4.6.2 requires the SG water level to be at least 18 percent for a loop to be considered available for decay heat removal during Mode 4. This suggests operators would maintain SG water level above 18 percent NR span in case the SGs are needed for cooling (such as when RHR is unavailable).

d Operators are assumed to manually initiate one charging pump when RPV level falls below 392 ft.

Operators would fill the vessel to 393.5 ft and then throttle injection flow. Rather than simulate operator actions to throttle the injection flow, Case 2 assumes operators continue to start and stop the charging pump based on RPV level. This approach is taken because the MELCOR deck already has logic built in to stop ECCS injection based on RCS water level. At the same time, this treatment maintains the intent of the procedure, which is to control water level at or above 393.5 ft.

e Per BOA PRI-10, Appendix B (recovery actions for steaming intact SGs), an SG is considered available if SG water level is greater than 27-percent wide range span.

78

Table 45 Loss of Shutdown Cooling (Mode 4) Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

SG dryout 07:08 07:08 -- -- 07:07 Core reaches saturation 08:00 08:00 -- -- 04:45 PRT disk ruptures 09:22 09:22 -- -- 07:19 Core water level at TAF 12:40 -- -- -- --

Core water level at 1/3 AF height 13:20 -- -- -- --

PCT >1200 °F 13:44 -- -- -- --

PCT >2200 °F 14:59 -- -- -- --

Core exit thermocouple T >1200 °F 14:01 -- -- -- --

Core-wide Cs release >3% 14:41 -- -- -- --

Charging pump injection -- 12:25 -- -- 08:31 Case 6 Case 7 Case 8 Case 9 Case 10 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

SG dryout -- -- 05:58 -- --

Core reaches saturation -- -- 09:43 -- --

PRT disk ruptures -- -- 07:48 -- --

Core water level at TAF -- -- 10:35 -- --

Core water level at 1/3 AF height -- -- 11:08 -- --

PCT >1200 °F -- -- 11:27 -- --

PCT >2200 °F -- -- 12:30 -- --

Core exit thermocouple T >1200 °F -- -- 11:40 -- --

Core-wide Cs release >3% -- -- 12:03 -- --

Charging pump injection -- -- -- -- --

The results show that if RHR is lost during Mode 4, the operators have several hours to perform recovery actions before the core reaches saturation. All of the recovery actions in BOA PRI-10 are successful in preventing CD before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, though B&F without further actions (such as to recover RHR, initiate AFW, align charging pump suction to the containment sump, or refill the RWST) will eventually result in CD when B&F is lost after the RWST is emptied.

In each case, RCS temperature increases immediately following loss of shutdown cooling.

The increase in temperature also causes an increase in pressurizer level. RCS temperature levels out by 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> as SG heat removal matches core decay heat via the steam dumps.

If no actions are taken (such as in Cases 1 and 8), the SGs will continue to remove heat until SG dryout. The time of dryout depends on the initial secondary-side water level and on the time since shutdown (i.e., the decay heat load). After SG dryout, RCS temperature and pressure increase until pressurizer pressure reaches the pressurizer PORV opening setpoint. (As indicated by the figures for Case 1 in Appendix F, low temperature overpressure protection (LTOP) would not cause the pressurizer PORVs to open until pressure reaches the normal at-power PORV setpoint.) The PORV continues to cycle, while the water level in the core drops, leading to core uncovery and fuel damage at 12:40 and 14:59 for Case 1 and at 10:35 and 12:30 for Case 8. (Fuel damage times presented here are the times at which PCT

>2,200 degrees F).

Case 2 is the same as Case 1 until water level nears the TAF. At that point, operators are assumed to use one charging pump to maintain level above the TAF, in accordance with BOA PRI-10. This allows operators to delay CD until after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which gives them additional time to recover RHR or to initiate AFW to provide SG cooling. Case 5 is similar to 79

Case 2, except operators fully open one PORV at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, 41 when RCS pressure is at approximately 200 psia (1.4 MPa). (In comparison, the PORV first opens around 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> in Cases 1 and 2). Because the PORV is opened earlier in Case 5 than it opens in Case 2, the RCS inventory loss is greater in Case 5, and thus the required makeup flow is greater as well.

However, the pressurizer PORV cycles a large number of times in Case 2 and a failure of the valve to close due to this cycling would cause Case 2 to behave more like Case 5.

Nevertheless, assuming that operators continue to inject until RWST level reaches 9 percent (as directed in BOA PRI-10), neither Case 2 nor Case 5 experiences fuel heatup within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Based on the average injection rate for Case 5, injection is expected to continue until approximately 33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br />. Core damage would occur shortly afterward because water level is already near the TAF, so operators would need to take additional actions (e.g., refilling the RWST) to prevent CD after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Core damage would occur much later for Case 2 based on the RWST level at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The remaining cases are successful in preventing CD. Cases 3, 6, and 9 show the effects of recovering RHR at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In these cases, RHR steadily decreases RCS temperature and pressure until the end of the calculation at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The SGs are not needed for cooling following RHR recovery, and so SG dryout does not occur in these cases. Also, because RCS pressure does not increase (and thus the pressurizer PORVs do not open) in the 2-hour period between transient initiation and RHR recovery, no RCS inventory is lost. Thus, the system is at a safe, stable state at the end of the calculation.

Cases 4, 7, and 10 show the effects of initiating AFW at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. In each of these cases, natural circulation cooling is sufficient for removing decay heat before AFW initiation. This is true even for Case 7, which begins with reduced SG inventory. After 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, AFW provides sufficient cooling under natural circulation conditions until RCS nears saturation at the secondary-side pressure. At this point, the falling pressure causes voids to form in the upper head, which reduces RPV water level while increasing pressurizer level. At the end of the calculation, RPV level is still falling, though it remains 4 m above TAF. If the calculation is continued beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, water level eventually falls to 3 m above TAF but then increases and stabilizes about 3.5 m above TAF. Throughout the calculation, SGs remove the full decay heat load and maintain the fuel at a safe and stable temperature.

Flashing in the upper head caused by the decrease in RCS pressure to the secondary-side pressure can be prevented by operating the pressurizer proportional heaters or backup heaters to maintain the RCS at a constant pressure. By doing so, flashing in the upper head can be prevented and natural circulation flow can be maintained throughout the 24-hour mission time.

This has been verified by an undocumented sensitivity calculation. The operators could also recover RHR (if possible) to provide adequate cooling if natural circulation cooling is insufficient.

41 The strategy used for Case 5 is Attachment C of BOA PRI-10. Attachment C directs operators to start injection at about the same time that they open a PORV. The rest of Attachment C directs operators to either start an SI pump to supplement the charging pump, or failing that, to throttle charging flow to match the boiloff rate. For simplicity, Case 5 instead uses the logic to start/stop charging to maintain RPV level above TAF that is also used for Case 2. The resulting average charging flow rate is approximately equal to the boiloff rate, so the intent of Attachment C is being met, even though there is a rather large delay between the time at which operators open the PORV and the time at which RPV level falls sufficiently low to trigger charging pump injection. Note that while the time to RWST depletion would change by about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if injection started immediately, the time of CD likely would not change, since the RCS level at the time of RWST depletion would be higher if charging pump injection started earlier.

80

The different initial conditions result in only minor differences in system behavior and event timings for the cases in which recovery actions are credited. Note, however, that SG dryout occurs earlier when the time since shutdown or the initial SG inventory is reduced. 42 Thus, operators have less time to perform recovery actions before the core uncovers.

In these simulations, actions to restore RHR or initiate AFW are performed before the core reaches saturation. Once the core reaches saturation, recovery actions may not be successful.

For cases in which operators initiate AFW, natural circulation may be inhibited by saturated conditions in the RCS. At the same time, RHR performance may be degraded during saturated conditions.

In summary, the key observations from this analysis are:

• Operators have several hours to take action before the core reaches saturation.

• All of the recovery actions modeled here are successful in preventing CD before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, although recovery actions that rely on a charging pump to maintain water level above the TAF must be supplemented by actions to refill the RWST or by actions to recover RHR or AFW to prevent CD beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Flow Rates in Idle Loops During the comment period for this NUREG, Exelon commented that the flow rates in the idle RCS loops during the steady-state portion of the calculation are higher than expected during Mode 4. Specifically, RHR flow is approximately 90 kilograms per second (kg/s), while flow through the idle RCPs is approximately 90 kg/s per loop, or 360 kg/s for all four loops, during the steady-state portion of Cases 1-5. Exelon stated that flow through the idle loops would be much lower than these values calculated by MELCOR.

To address this issue, a sensitivity calculation (Case 4a) has been performed in which the form loss coefficient for the RCPs is set to a very high value. Otherwise, the sensitivity case is the same as Case 4. This reduces the flow through the idle RCPs to approximately 20 kg/s per loop during the steady-state portion of the calculation. The idle loop flow remains relatively constant throughout the transient portion of the calculation.

The lower loop flow results in less efficient heat transfer to the SGs, which means that the hot leg temperature is approximately 36 degrees F (20 degrees C) hotter in Case 4a than in Case 4 in order to facilitate the same decay heat removal rate. However, the hot leg temperature is still less than the saturation temperature. Furthermore, RCS pressure remains below the LTOP 42 Interestingly, core saturation occurs later in Case 8 than in Case 1. However, this is most likely caused by a small difference (2-3 cm) in pressurizer water level at the start of the transient. As the subcooling margin figures in Sections F.1.1 and F.1.8 show, subcooling margin decreases following SG dryout but then increases. The increase in subcooling margin is due to the fact that the saturation temperature increases more rapidly than the core temperature once pressurizer level exceeds a certain point. Note that RCS pressure (and thus saturation temperature) increases more rapidly as the steam bubble in the pressurizer is compressed. Thus, because the initial water level is slightly lower in Case 8, subcooling margin begins to increase before the core reaches saturation. Note that subcooling margin drops below zero and stays there much earlier in Case 8 than in Case 1.

Thus, Case 8 is actually more limiting than Case 1 in terms of time to saturation, at least based on these simulations.

81

setpoint. The SGs provide adequate heat removal, and there are no coolant leaks, so CD is avoided.

To summarize, the larger-than-expected idle loop flows during Mode 4 result in a lower hot leg-to-cold leg temperature difference, but otherwise have little effect on the results of the sensitivity case.

A related issue is whether or not the RCPs would be running at this point in the outage. The plant cooldown procedure is not available for Byron, but the cooldown procedure for a similar plant shows that RCPs would be running. However, this is only relevant for the steady-state analysis, because operators would be directed to quickly trip the RCPs following the loss of RHR. For this reason, the RCPs remain off for this analysis.

5.8.3 Mode 5 Calculations The Mode 5 loss of shutdown cooling calculations begin with the RCS at atmospheric pressure and RCS temperature at 170 degrees F (77 degrees C). The RCS temperature is in the middle of the temperature range for Mode 5 (see Table 1.1 of (NRC, 2008)). RCS level is at the vessel flange, and thus the pressurizer is empty. The pressurizer PORVs are both open and the pressurizer relief tank (PRT) is assumed to be vented to containment through a vent with flow area equivalent to the PRT rupture disk area. The loop stop valves are assumed to be closed.

The list of boundary conditions is given in Table 46.

Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions

• RCS Tavg = 170 °F (77 °C)

• Pressurizer pressure = atmospheric

• RCS level at top of flange Primary side

• Pressurizer PORVs open and unisolable

• PRT vented to containment

• Hot and cold leg loop stop valves closed a Secondary side

• N/A

• 1 train of RHR operating in shutdown cooling mode until t=0 ECCS/ESF

• Accumulators are isolated

• Operators initiate 4 of 4 RCFCs at 30 minutes (based on direction in Operator actions procedure BOA PRI-10)

Other

• None a The loop stop valves are valves in the hot and cold legs that can be closed to isolate the RPV from the SGs to perform maintenance on the SGs. The loop stop valves are used in place of dams in the SG nozzles, which are used in similar pressurized-water reactors. Whether a plant uses loop stop valves or nozzle dams should not greatly affect the results.

The parameters varied for the Mode 5 calculations are the time after shutdown when RHR cooling is lost and the recovery actions that operators perform. The results from these calculations are presented in Table 47. Key event timings are presented in Table 48.

The results show that if RHR is lost during Mode 5 with the SGs isolated and RCS level at the vessel flange, the operators have less than 20 minutes before the core reaches saturation.

However, recovery actions can still be successful after the core reaches saturation, as discussed below.

82

Table 47 Loss of Shutdown Cooling (Mode 5) Results Time Since Core Core Damage b Case Subcriticality Recovery Actions a Uncovery (hh:mm)

(hr) (hh:mm) 1 None 01:37 03:21 2 40 Start CCP on low RPV level c 25:32 27:30 3 Recover RHR d -- -- e 4 None 01:29 03:11 5 30 Start CCP on low RPV level c 22:58 25:00 6 Recover RHR d -- -- e 7 None 01:56 03:57 8 60 Start CCP on low RPV level c 28:44 30:29 9 Recover RHR d -- -- e a Timings for recovery actions are from the time at which RHR cooling is lost.

b For this table, CD is defined as PCT >2,200 °F.

c Operators are assumed to manually initiate one charging pump when RPV level falls below 392 ft.

Operators would fill the vessel to 393.5 ft and then throttle injection flow. Rather than simulate operator actions to throttle the injection flow, Case 2 assumes operators continue to start and stop the charging pump based on RPV level. This approach is taken because the MELCOR deck already has logic built in to stop ECCS injection based on RCS water level. At the same time, this treatment maintains the intent of the procedure, which is to control water level at or above 393.5 ft.

d Operators are assumed to recover RHR shortly after water level in the hot leg reaches the hot leg midplane.

This time corresponds to 23 minutes for Cases 3 and 6 and 27 minutes for Case 9.

e Note that these cases assume that the RHR pump has adequate net positive suction head (NPSH) as long as there is water in the hot leg. The RHR model in the MELCOR input deck is not suited for modeling degraded pump performance due to inadequate NPSH or high void fraction. Thus, these results must be used with caution.

For all cases, loss of RHR cooling at time zero causes RCS temperature to increase until the core reaches saturation. Once coolant in the core begins to boil, a gas (steam and air) bubble expands in the upper head that forces water out of the vessel and into the pressurizer.

For the cases in which no recovery actions are taken (i.e., Cases 1, 4, and 7), coolant boiloff leads to core uncovery within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, beginning as early as 89 minutes in Case 4, which has the highest decay heat load of the three cases. Peak cladding temperatures first exceed 2,200 degrees F (1,204 degrees C) about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after water level reaches the TAF. It is worth noting that PCT exceeds 2,200 degrees F (1,204 degrees C) before water level reaches 1/3 active fuel height. This is different from the Mode 4 calculations, in which the core is almost completely uncovered when PCT first exceeds 2,200 degrees F (1,204 degrees C).

In Cases 2, 5, and 8, the operators take action to maintain RPV water level above the TAF.

This action is successful in delaying core uncovery and heatup until the RWST level falls to 9 percent, prompting operators to stop injection. This occurs at ~24, 21.5, and 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> for Cases 2, 5, and 8, respectively. Water level drops to the TAF about an hour and a half after RWST depletion. Peak cladding temperature first exceeds 2,200 degrees F (1,204 degrees C) about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after water level reaches the TAF.

83

Table 48 Loss of Shutdown Cooling (Mode 5) Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Core reaches saturation 00:13 00:13 00:13 00:13 00:13 00:13 Core water level at TAF 01:37 25:32 -- 01:29 22:58 --

Core water level at 1/3 AF height 04:02 27:51 -- 03:48 25:15 --

PCT >1200 °F 02:40 26:51 -- 02:15 24:17 --

PCT >2200 °F 03:21 27:30 -- 03:11 25:00 --

Core exit thermocouple T 03:03 27:11 -- 02:42 24:38 --

>1200 °F Core-wide Cs release >3% 03:07 27:17 -- 02:46 24:44 --

Charging pump injection -- 00:30 -- -- 00:30 --

RWST level at 9% a -- 24:02 -- -- 21:35 --

Case 7 Case 8 Case 9 (hh:mm) (hh:mm) (hh:mm)

Core reaches saturation 00:16 00:16 00:16 Core water level at TAF 01:56 28:44 --

Core water level at 1/3 AF height 04:28 30:52 --

PCT >1200 °F 03:20 29:55 --

PCT >2200 °F 03:57 30:29 --

Core exit thermocouple T >1200 °F 03:41 30:15 --

Core-wide Cs release >3% 03:43 30:13 --

Charging pump injection -- 00:30 --

RWST level at 9% a -- 26:49 --

a Operators are directed to stop injection from the RWST when RWST level is less than 9 percent.

In Cases 3, 6, and 9, operators recover RHR when the water level reaches the hot leg midplane (at 23 minutes in Cases 3 and 6 and at 27 minutes in Case 9). RHR cooling quickly collapses the steam bubble in the upper head, thus relieving RCS pressure and allowing coolant that was forced into the pressurizer to flow back to the RPV. RHR quickly returns the RCS to a safe, stable state.

Note that the MELCOR model assumes the RHR suction line draws from the bottom of the hot leg. This means that the RHR pump can draw water as long as there is any water in the hot leg. 43 Also note that the line is not modeled explicitly and that there is no attempt to simulate entrainment of steam in the RHR pump suction line. Finally, NPSH requirements and air entrainment in the RHR pumps due to vortexing are not considered in the simplified model of the RHR system. The results presented here could be significantly different if the suction line is assumed to draw from somewhere above the bottom of the hot leg, or if RHR pump performance is degraded due to high void fraction or insufficient NPSH. In fact, using information about the RHR pump elevation relative to the hot leg for a similar plant, there would most likely be insufficient NPSH, and so the pump would likely be cavitating. Furthermore, plant procedures direct operators to focus on aligning a charging or SI pump to increase level instead of recovering RHR. Thus, operators would most likely not take this recovery action because the procedures direct them to focus on increasing level and because RHR is unlikely to run under saturated conditions. Nevertheless, these results demonstrate that recovering RHR would be 43 Note that this is of greater concern for loss-of-decay heat removal accidents (as the one studied here), because the water level spends more time in the range of concern. For a loss-of-inventory event, the water level passes through this elevation quickly, and RHR is lost at similar times regardless of the orientation of the RHR piping (e.g., see Section A.3.2.4 of (NRC, 2014b).

84

successful in preventing CD as long as the RHR pump has adequate NPSH (i.e., before the core reaches saturation.)

In summary, the key observations from this analysis are:

• Operators have significantly less time to take action for this set of initial conditions than they do for the Mode 4 loss of shutdown cooling scenario. This is because the loop stop valves are closed, therefore the SGs are unavailable for cooling and the initial RCS water level is much lower for the Mode 5 calculations.

• Operators can prevent CD by restoring RHR cooling by the time water level reaches the hot leg midplane, but see the text earlier in this section for some significant considerations related to hot leg orientation and NPSH.

• Using a charging pump to provide makeup to the vessel is successful in delaying core uncovery and heatup, but subsequent actions must be taken to prevent CD. Such actions include refilling the RWST, aligning ECCS pumps to the sump, or restoring RHR cooling.

85

6. APPLICATION OF MELCOR RESULTS TO THE SPAR MODELS Table 49 maps the MELCOR calculations presented in Section 5 with the most closely corresponding standardized plant analysis risk (SPAR) model sequences (using the current SPAR model success criteria (SC)) and provides the relative risk contribution of these sequences. Note that at the initiator heading level (e.g., small-break loss-of-coolant accident (SLOCA)), the rightmost column gives the relative contribution of all SPAR sequences from that initiator class (e.g., SLOCA = 22 percent), while the subsequent rows give the relative contributions from the subset of sequences studied in this report (e.g., SLOCA-7 = 0.39 percent). All relevant event trees are provided in Appendix G.

Recall that the SPAR models are most commonly used for events and conditions assessment, meaning that specific portions of the model have relatively more importance in specific applications than their baseline frequencies would suggest. An example of this is primary-side bleed and feed (B&F), for which the two sequences in Table 49 have relatively small contributions. Yet, if an event or condition assessment includes the unavailability of one power-operated relief valve (PORV), successful B&F is no longer possible with the existing SC.

Table 50 below (a) summarizes the scenarios that have been investigated, (b) recaps the boundary and initial condition variations studied using MELCOR, (c) highlights the relevant parts of the existing Byron SPAR SC, and (d) discusses potential changes to the Byron model based on the MELCOR analysis. In addition, the table identifies cases in which these results can be applied to SPAR models for other similar plants. This table is the starting point for a subsequent evaluation by the SPAR model developers to (a) ensure these changes are appropriate and (b) assess whether the same changes can be made to the SPAR models for similar Westinghouse (four-loop) plants.

87

Table 49 Mapping of MELCOR Analyses to the Byron SPAR (8.27) Model Percentage as Part Percentage as SPAR of Initiator Class Part of Total Sequence CDF (Internal Internal Event (see App. B) MELCOR Calculations Events) CDF SLOCA-Sequence Timing for Alignment of Sump RecirculationSection 5.1 of this report 22 SLOCA-1 Cases 1, 2, 3, 4, 7, 8, 9, 10 N/ASuccess Path N/ASuccess Path SLOCA-7 Cases 5, 6, 11, 12 1.8 0.39 SLOCA-Success Criteria for Steam Generator (SG)

Depressurization and Condensate FeedSection 5.2 of this report 22 (Not modeled in Byron SPAR 8.27 Model) All Cases N/ANot Modeled N/ANot Modeled SLOCA-Success Criteria for Primary Side Bleed and Feed (B&F)Section 5.3 of this report 22 SLOCA-19 Cases 3, 7 N/ASuccess Path N/ASuccess Path SLOCA-21 Cases 1, 2, 4, 5, 6, 8 <0.01 <0.01 LoDCB-111-Unavailable DD-AFW, and Subsequent Primary Side B&FSection 5.4 of this report 0.94 LDCA-12 All Cases 54 0.50 SGTR-Spontaneous Steam Generator Tube Rupture with No Operator ActionSection 5.5 of this report 4.1 SGTR-12 All Cases 74 3.0 MLOCA-Injection Success Criteria (SC)Section 5.6 of this report 4.1 MLOCA-4 Cases 1, 2, 3, 4 20 0.83 MLOCA-10 Cases 5, 6, 7, 8 <0.01 <0.01 MLOCA-Cooldown Timing for Low-Pressure Recirculation (LPR)Section 5.7 of this report 4.1 MLOCA-1 Cases 1, 2, 3, 4, 5, 6 N/ASuccess Path N/ASuccess Path MLOCA-4 Cases 7, 8, 9, 10 20 0.83 LOSDC-Loss of Shutdown CoolingSection 5.8 of this report N/ANot Modeled (Not modeled in Byron SPAR 8.27 Model) All Cases N/ANot Modeled N/ANot Modeled 88

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations These calculations have generally confirmed SPAR SC and provide sequence timing information for specific applications.

Results suggest that primary-side depressurization is necessary to reach LPR conditions before the time of sump switchover, but

• Break sizes:

not to avert CD. In specific applications, the primary-side 0.83 in. (2.11 cm),

depressurization criteria could be relaxed, if contextual factors 1.66 in. (4.22 cm)

(i.e., procedural direction and specific failures) would still result SLOCA -

• Injection systems in LPR alignment once RCS pressure had dropped from the loss Sequence Timing available SLOCA sequence timing and of injection.

for Alignment of (1 charging pump mitigation SC for the alignment Sump or 1 SI pump) of the sump The SPAR SC related to containment cooling should be Recirculation b

• SG cooldown revisited, as a sensitivity study suggests that 1 containment fan (Section 5.1) initiation time cooler is necessary to prevent containment spray actuation,

• Target earlier RWST depletion, and CD (for SLOCA sequences relying depressurization on operator cooldown to substitute for HPR).

89 rate Results show that success is not very sensitive to the timing of the start of the operator-induced cooldown or to the availability of the CCW to RHR HX in LPR (due to the availability of AFW).

• Break sizes:

SLOCA - 0.83 in. (2.11 cm), Action to depressurize the SGs early and align condensate feed Sequence Timing 1.66 in. (4.22 cm) is a candidate for inclusion in the SPAR model. If this is done, for SG

• Injection systems hotwell refill or alignment of alternate feedwater later in the Not modeled in the SPAR Depressurization available scenario would also need to be modeled. Early model and Condensate (1 charging pump depressurization to achieve condensate feed was not found to Feed b or 1 SI pump) require primary-side depressurization actions (e.g., opening a (Section 5.2)

• SG cooldown PORV).

initiation time

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations These calculations have demonstrated a potential improvement that can be implemented in the SPAR model. It is proposed that the SC for SLOCA B&F be changed from (1 SI or charging

• Break sizes: pump and 2 PORVs) to (1 SI pump and 2 PORVs) or (1 CCP 0.83 in. (2.11 cm), and 1 PORV).

1.66 in. (4.22 cm)

SLOCA - Success

• Injection systems Sensitivity cases indicate that (1 SI and 1 PORV) may also be SLOCA sequence timing and Criteria for Primary available appropriate, and this should be considered on an mitigation SC for primary-side Side B&F b (1 charging pump application-specific basis.

B&F (Section 5.3) or 1SI pump)

• Bleed-and-feed Results indicate that either 1/4 RCFC or the CCW to RHR HX is initiation time capable of late decay heat removal.

• # PORVs used These calculations can also provide more information on human failure event timings to initiate B&F on an application-specific basis.

These calculations are generally representative of non-LOCA 90 B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is

• Injection systems Loss of DC bus 111 sequence proposed that the SC for non-LOCA B&F be changed from (1 SI available timing and SC with AFW or CCP and 2 PORVs) to (1 CCP and 1 PORV).

(1 charging pump unavailable LoDCB-111 -

or 1 SI pump) [this initiator was chosen Note that the applicability of the loss of DC bus SC may vary, Unavailable because it was qualitatively felt (e.g., due to the unique RCP trip situation that this initiator DD-AFW, and

• Bleed-and-feed to be more restirctive than creates), and should be evaluated on a case-by-case basis Subsequent initiation time those scenarios categorized before implementation for other plants. Meanwhile, for initiators Primary Side B&F

• PORV treatment:

as general transients in the where both PORVs are available, sensitivity calculations (Section 5.4) sticks 50% open PRA, and thus the conclusions suggest that 1 SI and 2 PORVs is successful for some timeing at 251 lifts, does are believed to be applicable assumptions but not others, and this could be considered on an not stick open to those initiators as well] application-specific basis.

These calculations can also provide more information on HEP determinations to initiate B&F on an application-specific basis.

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations For the SPAR SGTR sequence studied (SGTR-12), the results suggest that this sequence could lead to a success end-state for a 24-hour mission time if ECCS injection is controlled in order to

• Injection systems prevent excessive PORV cycling. Termination or control of available safety injection is not currently queried for this sequence, likely (1 charging pump due to the upstream failure of steam generator isolation (which SGTR - or is assumed to result in a kickout to the ECA procedures).

Spontaneous 2 charging pumps Whether additional credit is possible could be reviewed within Steam Generator and 2 SI pumps) SGTR event tree strcutre and the context of the accident sequence and human reliability Tube Rupture with

• # tubes ruptured timing modeling assumptions. Alternatively, the human error No Operator (0.5, 2) probabilities for the existing downstream success paths Action (Section 5.5)

• Condenser steam (SGTR-10 and SGTR-11) could also be reviewed, in light of the dumps available long sequence times.

• Manual reactor trip No other changes to the baseline model are currently being proposed based on these calculations. These calculations, however, can provide more information on HEP determinations 91 on an application-specific basis.

For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functaional Restoration Proceudre (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The

• Break sizes:

time available to implement these actions following the FRP range from 2 to entry criterion being met could be short. The accident sequence 6 in. (5.1 to modeling and human reliability analysis associated with 15.1 cm)

MLOCA - secondary-side cooldown for these situations (MLOCA with HPI

• Injection systems SC for the injection phase for Injection SC c failed) should be reviewed.

available (1 SI the MLOCA event tree (Section 5.6) pump and 1 RHR When HPI is successful, (non-FRP-based) secondary-side pump, or cooldown or HPR was found to be necessary near the transition 2 accumulators between SLOCA and MLOCA, encompassing as much as 33%

and 1 RHR pump) of the 2-in. (5.1-cm) to 6-in. (15.2-cm) break range.

Containment fan coolers or the RHR HX is needed in the long term to prevent containment overpressure.

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations

• Break sizes:

range from 2 to 6 in. (5.1 to 15.1 cm)

• SG cooldown MLOCA - initiation time No changes to the SPAR model are proposed based on these Cooldown Timing

• Available MLOCA sequence timing for calculations. However, these calculations may be useful for for LPR c containment heat cooldown for LPR informing specific applications.

(Section 5.7) removal systems

• Operator action to terminate cooldown if cold leg temperatures are increasing

• Loss of SD cooling in Mode 4:

92 initial SG water level, time RHR cooling is lost, No changes to the SPAR model are being proposed based on LOSDC - Loss of recovery actions Not modeled in the SPAR these calculations. These results will be instead used for Shutdown Cooling

• Loss of SD model application-specific information as well as to aid in (Section 5.8) cooling in Mode 5:

benchmarking a separate NRC shutdown Excel calculator.

time after shutdown when RHR cooling is lost and recovery actions a This table focuses on the baseline results, not the sensitivity analyses.

b Historically, SLOCAs have been 0.5-in (1.3-cm) to 2-in. (5.1-cm) equivalent diameter (NRC, 1990) and (NRC, 1999) Appendix J.

c Historically, MLOCAs have been 2-in. (5.1-cm) to 6-in. (15.2-cm) equivalent diameter or larger (NRC, 1990) and (NRC, 1999) Appendix J.

7. CONCLUSIONS This project used a realistic core damage (CD) definition surrogate based on accident simulations. The project performed MELCOR analyses for the Byron Unit 1 nuclear power plant, looking at various initiating events and sequences of interest. These results have either confirmed existing standardized plant analysis risk (SPAR) assumptions, or provide a technical basis for a few specific model changes.

The study results provide additional timing information for several probabilistic risk assessment sequences, confirm many of the existing SPAR model modeling assumptions, and provide a technical basis for a few specific SPAR modeling changes. Potential SPAR model changes supported by this study include:

• Small-Break Loss-of-Coolant Accident (SLOCA) Sequence Timing for Alignment of Sump RecirculationFor sequences where operator cooldown is credited as an alternative to high-pressure recirculation (HPR), the SPAR success criteria related to containment cooling could be enhanced by requiring one containment fan cooler to prevent containment spray actuation. Avoiding spray actuation extends the time available prior to refueling water storage tank depletion and allows the operators to successfully depressurize the plant using the post-LOCA procedures for cases when HPR is not available.

• SLOCA Success Criteria for Steam Generator (SG) Depressurization and Condensate FeedAction to depressurize the SGs early and align condensate feed is a candidate for inclusion in the SPAR model. This would provide an additional success path for a loss of auxiliary feedwater event. If this is done, hotwell refill or alignment of alternate feedwater later in the scenario would also need to be modeled. Early depressurization to achieve condensate feed was not found to require primary-side depressurization actions (e.g., opening a power-operated relief valve (PORV)).

• SLOCA Success Criteria for Primary Side Bleed and Feed (B&F)These calculations have demonstrated a potential conservatism that can be removed from the applicable SPAR models. It is proposed that the SC for SLOCA B&F be changed from (one safety injection (SI) or centrifugal charging pump (CCP) and two PORVs) to (one SI pump and two PORVs) or (one CCP and one PORV). In other words, for SLOCAs the requirement for availability of a second PORV can be removed when a CCP is available.

• Loss of DC Bus-111 - Unavailable Diesel-Driven Auxiliary Feedwater, and Subsequent Primary Side B&FThese calculations are generally representative of non-loss-of-coolant accident (non-LOCA) B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is proposed that the SC for non-LOCA B&F be changed from (one SI or CCP and two PORVs) to (one CCP and one PORV). In other words, the same one CCP and one PORV enhancement as above is credited, but credit is eliminated for cases with no CCP available. This initiator was chosen because it was qualitatively felt to be more restrictive than those scenarios categorized as general transients in the PRA, and thus the conclusions are believed to be applicable to those initiators as well. Note that the applicability of the loss of DC bus SC may vary, (e.g., due to the unique reactor coolant pump trip situation that this initiator 93

creates) and should be evaluated on a case-by-case basis before implementation for other plant models.

• SGTR - Spontaneous Steam Generator Tube Rupture with No Operator ActionFor sequences with successful high-pressure injection (HPI) and auxiliary feedwater, but with steam generator isolation having failed, an additional success path or additional recovery credit may be justifiable pending additional consideration of closely-related accident sequence and human reliability modeling assumptions.

• Medium-Break Loss-of-Coolant Accident (MLOCA) - Injection SC For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functional Restoration Procedure (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The time available to implement these actions following the FRP entry criterion being met could be short. The accident sequence modeling and human reliability analysis associated with secondary-side cooldown for these situations (MLOCA with HPI failed) should be reviewed.

94

8. REFERENCES (10 CFR, 2007) U.S. Code of Federal Regulations, Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

(Adams, 1985) Adams J.P., et al., Quick Look Report on OECD LOFT Experiment LP-FP-2, OECD LOFT-T-3804, EG&G Idaho, Inc., Idaho Falls, ID, September 1985, Agencywide Documents Access and Management System (ADAMS) Accession No. ML071940358.

(ASME/ANS, 2009) American Society of Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ANS, LaGrange Park, IL, March 2009.

(Dementiev, 1977) Dementiev, B.A., Studying Hydrodynamics of Steam-water Media in Steady-state and Non steady-state Conditions for Nuclear Power Installations, Doctor-of-Science thesis, Moscow Power Engineering Institute, Moscow, 1977 (in Russian).

(EPRI, 2010) Electric Power Research Institute, MAAP4 Applications Guidance, EPRI TR-1020236, July 2010.

(EPRI, 2011) Electric Power Research Institute, Technical Framework for Management of Safety Margins - Loss of Main Feedwater Pilot Application, EPRI TR-1023032, November 2011.

(Gabor, 2005) Gabor, J.R., and D.E. True, Byron and Braidwood Feed and Bleed Analysis Using MAAP4, International Topical Meeting on Probabilistic Safety Assessment and Analysis, PSA 05, September 11-15, 2005, American Nuclear Society, San Francisco, CA.

(Hering, 2007) Hering W., et al., Results of Boil-off Experiment QUENCH-11, FZKA 7247, SAM-LACOMERA-D18, Forschungszentrum Karlsruhe, Karlsruhe, Germany, June 2007.

(Huhtiniemi, 1993) Huhtiniemi, I.K., and M.L. Corradini, Condensation in the Presence of Noncondensable Gases, Nuclear Engineering and Design, 141:429-446.

(NRC, 1980) U.S. Nuclear Regulatory Commission, Three Mile Island: A Report to the Commissioners and to the Public, NUREG/CR-1250, January 1980.

(NRC, 1981) U.S. Nuclear Regulatory Commission, BWR Refill-Reflood Program Task 4.8Model Qualification Task Plan, NUREG/CR-1899/EPRI NP-1527/GEAP-24898, August 1981.

(NRC, 1988) U.S. Nuclear Regulatory Commission, Decay Heat Removal Using Feed-and-Bleed for U.S. Pressurized Water Reactors, NUREG/CR-5072, June 1988.

95

(NRC, 1990) U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

(NRC, 1992) U.S. Nuclear Regulatory Commission, Boil-Off Experiments with the EIR-NEPTUN Facility: Analysis and Code Assessment Overview Report, NUREG/IA-0040, March 1992, ADAMS Accession No. ML062560458.

(NRC, 1999) U.S. Nuclear Regulatory Commission, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

(NRC, 2005) U.S. Nuclear Regulatory Commission, MELCOR Computer Code Manuals, Vol. 1: Primer and Users Guide, Version 1.8.6.2005, NUREG/CR-6119, Rev. 3, 2005.

(NRC, 2008) U.S. Nuclear Regulatory Commission, Exelon Generation Company, LLC Docket No. STN 50-454 Byron Station, Unit No. 1 Facility Operating License, Appendix A, Technical Specifications, February 2008.

(ADAMS Accession No. ML052910365).

(NRC, 2009) Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

(NRC, 2011a) U.S. Nuclear Regulatory Commission, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, NUREG-1953, September 2011.

(NRC, 2011b) U.S. Nuclear Regulatory Commission, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, NUREG/CR-7037, March 2011.

(NRC, 2014a) Wiebe, Joel S., U.S. Nuclear Regulatory Commission, letter to Michael J.

Pacilio, Exelon Generation Company, LLC, February 7, 2014, ADAMS Accession No. ML13281A000.

(NRC, 2014b) U.S. Nuclear Regulatory Commission, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues, NUREG/CR-7177, ERI/NRC 13-210, May 2014, ADAMS Accession No. ML14148A126.

(NRC, 2014c) U.S. Nuclear Regulatory Commission, MELCOR Best Practices as Applied in the State-of-the-Art Reactor Consequence Analyses (SOARCA) Project, NUREG/CR-7008, August 2014, ADAMS Accession No. ML14234A136.

96

(NUPEC, 1993) Nuclear Power Engineering Corporation, Specification of ISP-35 NUPECs Hydrogen Mixing and Distribution Test M-5-5, ISP35-027, Revision 1, November 1993.

(SNL, 2008) Sandia National Laboratories, An Assessment of MELCOR 1.8.6:

Design Basis Accident Tests of the Carolinas Virginia Tube Reactor (CVTR) Containment (Including Selected Separate Effects Tests),

SAND2008-1224, February 2008, ADAMS Accession No. ML080840322.

97

APPENDIX A DETAILED INFORMATION ON BASE MELCOR MODEL

A.1 Byron MELCOR Input Model Description The main body of this NUREG contains descriptions of the Byron input model. This section of the appendix includes descriptions of, and data pertaining to, the following features: the reactor trip signals modeled; the emergency core cooling system (ECCS) injection setpoints; the charging, safety injection (SI), and residual heat removal (RHR) pump curves; details of the switchover of ECCS suction from the refueling water storage tank (RWST) to the containment sump; accumulator characteristics; containment spray system characteristics; containment fan cooler characteristics; modeling of the reactor coolant pumps (RCPs); and relief valve setpoints.

Note that throughout this report (unless otherwise stated), MELCOR elevations are referenced to the elevation of the inside of the reactor pressure vessel lower head.

Reactor Trip Signals Table A-1 indicates the conditions for reactor trip (i.e., if any condition becomes true, then the reactor is tripped).

Table A-1 Reactor Trip Signals Condition Comment 1 Manual Time-based High-temperature difference of coolant across the core (with 2 Overtemperature T pressure dependence)

High-temperature difference of coolant across the core (with 3 Overpower T rate-of-change dependence) 4 Low pressurizer pressure Pressure below 1,885 psig (13.03 MPa abs) 5 High pressurizer pressure Pressure above 2,393 psig (16.60 MPa abs) 6 High pressurizer level Level above 93.5% of instrument span Minimum loop flow (across 4 loops) less than 89.3% steady-state 7 Low RCP flow value 8 Low SG level Level less than 16.1% of instrument span 9 Loss of power 10 Turbine trip Assume MSIV closure trips the reactor 11 ECCS signal See Section A.1.2 of this appendix ECCS Injection Setpoints The SI, RHR, and charging 1 pumps all take suction from the RWST until the RWST level reaches Lo-2, at which point the ECCS pumps take suction from the containment sump. (See Section A.1.4 of this appendix for details of ECCS suction switchover.) The ECCS actuation signals for charging, SI, and RHR are as follows:

• Pressurizer pressure below 1,817 pounds per square inch gage (psig)

(12.632megapascals absolute (MPa abs))

• Containment pressure greater than 4.6 psig (1.334 bar abs) 1 Before receiving an ECCS signal, the charging pumps draw from the VCT.

A-1

• Steamline pressure below 614 psig (4.336 MPa abs)

• Manual operator action In addition, power must be available.

ECCS Pump Curves Flow from the ECCS pumps (charging, SI, and RHR) is directed to the cold legs of the Byron model (control volumes 348 / 448 / 548 / 648). There are two ECCS trains, each with one charging, one SI, and one RHR pump. One train injects into cold legs A and B, while the other train injects to cold legs C and D. Flow from each pump in each train is equally divided between the two respective cold legs. Charging, SI, and RHR pump performance are given in Table A-2, Table A-3, and Table A-4, respectively, as flow per pump (gallons per minute (gpm)).

The pressure used to evaluate pump performance is the average cold leg pressure minus the sum of the source pressure (i.e., the pressure of the RWST or the containment sump) and the hydraulic head.

Table A-2 Charging Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 630 (4.34) 580 (2.20) Runout 700 (4.83) 550 (2.08) 950 (6.55) 520 (1.97) 1,180 (8.14) 490 (1.85) 1,380 (9.51) 460 (1.74) 1,720 (11.9) 400 (1.51) 1,920 (13.2) 355 (1.34) 2,150 (14.8) 300 (1.14) 2,350 (16.2) 240 (0.908) 2,480 (17.1) 190 (0.719) 2,570 (17.7) 100 (0.379) 2,600 (17.9) 0 (0) Shutoff Table A-3 SI Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 740 (5.10) 700 (2.65) Runout 900 (6.21) 620 (2.35) 980 (6.76) 580 (2.20) 1,060 (7.31) 537 (2.03) 1,150 (7.93) 480 (1.82) 1,240 (8.55) 440 (1.67) 1,330 (9.17) 375 (1.42) 1,400 (9.65) 290 (1.10) 1,460 (10.1) 230 (0.871) 1,470 (10.1) 205 (0.776) 1,490 (10.3) 150 (0.568) 1,510 (10.4) 100 (0.379) 1,550 (10.7) 0 (0) Shutoff A-2

Table A-4 RHR Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 110 (0.758) 5,000 (18.9) Runout 124 (0.855) 4,520 (17.1) 136 (0.938) 3,980 (15.1) 147 (1.01) 3,420 (12.9) 153 (1.05) 2,930 (11.1) 159 (1.10) 2,260 (8.56) 164 (1.13) 1,810 (6.85) 171 (1.18) 1,350 (5.11) 176 (1.21) 988 (3.74) 181 (1.25) 494 (1.87) 185 (1.28) 0 (0) Shutoff Switchover of ECCS Suction from the RWST to the Containment Sump ECCS pumps take suction from the RWST until tank level reaches Lo-2, or 46.7 percent of instrument span. At this point, operators take action to switch suction from the RWST to the containment sump. Based on the number of steps involved in the relevant procedure, it is assumed that it will take operators 10 minutes to switch the suction source. In the Byron model, a timer is started when the RWST level reaches Lo-2. When the timer reaches 10 minutes, injection from the RWST ends and injection from the containment sump (control volume 800) begins. Note that injection from the RWST continues during the switchover.

The above treatment is a simplification of the actual response to low RWST level. At Byron, when RWST level reaches Lo-2, the sump to RHR pump suction valves automatically open.

However, operator action is needed to isolate the RHR pump suction from the RWST. Thus, immediately following RWST Lo-2, the RHR pumps draw from both the sump and the RWST; the fraction that the pumps pull from each source depends on source pressure and line losses.

Because the MELCOR input deck for Byron does not explicitly model ECCS piping (as is typical for other MELCOR plant models (NRC, 2011)), it would be difficult to model the actual plant situation in which the RHR pumps draw from both the sump and the RWST. Thus, the input has been simplified so that the RHR pumps continue to draw from the RWST until operators take action to isolate the pumps from the RWST. This simplification is not expected to impact whether or not core damage occurs for any case studied in this report, though it could have a small impact on event timings following RWST Lo-2.

Accumulator Characteristics The four accumulators (one per loop) are modeled as mass and enthalpy sources to cold leg control volumes 348, 448, 548, and 648. Each accumulator contains an initial water volume of 850 cubic feet (ft3) (24.07 cubic meters (m3)) and an initial nitrogen cover gas volume of 500 ft3 (14 16 m3). 2 The actuation pressure is 585 psig (4.136 MPa); the accumulator water 2 There was initially some confusion about the water and gas volumes of the accumulators due to seemingly inconsistent information in the Byron FSAR (actual estimates versus analytical assumptions). Subsequent information suggests that accumulators contain 935 ft3 of water and 415 ft3 of nitrogen. However, this discrepancy does not affect any of the calculations in which accumulators inject, and so the corrected water and gas volumes have not been added to the model. Refer to Section 5.6 for more information.

A-3

temperature is assumed to be 125 degrees Fahrenheit (F) (51.7 degrees Celsius (C)). Control functions are used to calculate accumulator pressure assuming adiabatic expansion of the nitrogen gas. The injection rate is the difference between the calculated accumulator pressure and the cold leg pressure.

Containment Spray System Characteristics The A and B trains of containment sprays contain pumps with nominal flow rates of 3,415 gpm (12.93 cubic meters per minute (m3/min)) and 3,925 gpm (14.86 m3/min), respectively.

Four MELCOR spray modeling components are defined: SPR24 and SPR25 represent trains A and B during normal injection from the RWST, and SPR26 and SPR27 represent trains A and B during sump recirculation mode. Note that the pumps are assumed to run at a constant flow rate. In reality, the pump flow rate would depend on the developed head, and so the spray flow would vary with containment pressure; however, the containment spray pump curves are not available for this study. The parameter that would be most affected by this assumption would be the time to RWST depletion for those cases in which the containment sprays actuate. With that said, the flow variation is not expected to be very large for containment pressures expected in this study (between atmospheric pressure and spray actuation pressure), and so the assumption of constant flow should not have a large effect on the calculations.

The pumps actuate when the containment pressure exceeds 21.2 psig (2.48 bar). The sprays initially take suction from the RWST. When RWST level reaches Lo-3 (12 percent of instrument span), the sprays are switched to recirculation mode. During recirculation mode, containment spray pumps draw suction from the containment sump.

Containment Fan Cooler Characteristics Byron has four containment fan coolers, which operate in both normal (high blower speed) and accident (low blower speed) modes of operation. The four coolers are assumed to be identical for the purpose of this model. The fan coolers switch to accident mode upon receiving an ECCS actuation signal. Before the ECCS signal, they operate in normal mode. Fan coolers have rated flows of 106,700 standard cubic feet per minute (scfm) (50.35 cubic meters per second (m3/s)) and 73,700 scfm (34.78 m3/s), and rated heat removal capacities of 0.5774 megawatts (MW) and 38.685 MW, during normal operations and during accident mode, based on expected containment conditions.

Four fan cooler modeling components are defined in the MELCOR model. The FCL1 and FCL3 represent the coolers during normal operations. FCL1 consists of three lumped coolers, while FCL3 represents the fourth cooler. Coolers are defined using the flow rate and inlet temperature of water to the cooling coils, the flow rate and inlet temperature of the containment gas, the water vapor content of the gas, and the heat extraction rate (all at rated conditions during normal operations). Similarly, FCL2 and FCL4 represent the three lumped coolers and the fourth cooler, respectively, in the accident mode of operation. FCL2 and FCL4 are defined in terms of the rated conditions during the accident mode of operation.

Reactor Coolant Pumps The Byron reactor coolant pumps have a rated head of 293 ft (89.3 m), which corresponds to differential pressure of 89.91 pounds per square inch differential (psid) (619.9 kilopascals (kPa))

assuming cold leg conditions of 588 degrees F (582 degrees Kelvin) and 2,248 pounds per square inch absolute (15.5 MPa). However, the pump head has been adjusted to 104.1 psid A-4

(717.6 kPa) in the MELCOR model 3 to achieve the desired coolant flow (141.8x106 pounds mass per hour (17,866 kilograms per second) from four pumps).

The pump provides a steady head until pump trip. A 60-second coastdown is assumed after pump trip. The RCPs trip when any of the following conditions are met:

• For SLOCA/MLOCA, RCPs trip if containment pressure >20 psig, or [RCS pressure

<1425 psig AND SI injection >100 gpm].

• For SGTR, RCPs do not trip.

• In any scenario, RCPs trip if the void in the inlet of the RCPs reaches 0.1 prior to any of the conditions listed above.

The situation for the Loss of DC Bus 111 scenario is complicated by the initiating event. The at-power configuration of the RCPs is as follows:

Table A-5 Reactor Coolant Pump Motive and Control Power Configuration RCP Motive Power Control Power A Main Generator DC Bus 111 B Main Generator DC Bus 112 C Grid DC Bus 112 Da Grid DC Bus 111 a In this table, RCP D refers to the RCP in the pressurizer loop.

When the reactor trips, RCP A trips because it loses power from the main generator. RCPs B and C can be tripped from the main control room as required by the bleed and feed procedure because they have control power from DC Bus 112. However, the loss of DC Bus 111 prevents operators from tripping the RCP in the pressurizer loop from the main control room. Instead, this RCP must be tripped locally. For the Loss of DC Bus 111 calculations, it is assumed that the operators trip the pressurizer loop RCP 10 minutes after bleed and feed is initiated.

Relief Valve Setpoints The opening and closing pressures for the pressurizer power-operated relief valves and safety relief valves are shown in Table A-5.

Table A-6 Opening and Closing Pressures for Pressurizer PORVs and SRVs Opening Pressure Closing Pressure psig (MPa) psig (MPa)

PORV-1 (FL306) 2,335 (16.2) 2,315 (16.067)

PORV-2 (FL307) 2,349 (16.3) 2,315 (16.067)

SRV-1 (FL308) 2,460.7 (17.067) 2,360.7 (16.378)

SRV-1 (FL309) 2,460.8 (17.068) 2,360.9 (16.379)

SRV-1 (FL312) 2,460.9 (17.069) 2,361.0 (16.380) 3 This pump head applies to Revision 5 of the model. The pump head is adjusted in each subsequent revision to achieve the desired coolant flow, though the head is generally around 715 kPa for all model revisions used for this study.

A-5

A.2 Input Deck Revisions and MELCOR Code Versions MELCOR is a code that is under active development, so it is important to mention the code version used for this analysis, if only to allow users to reproduce the results discussed in this NUREG. All calculations were performed using MELCOR 2.1.3649, which was the latest available code version when the work documented in this NUREG began.

Similarly, the MELCOR input deck used for the calculations described in this report was under active development throughout the project. Numerous corrections were made to correct input errors, to improve the performance of system logic (e.g., cooldown logic), or to reflect feedback received from internal and external stakeholders regarding plant design and operations (e.g., the unique RCP response to loss of DC bus 111). The following table lists the major input deck revisions used for the various calculations documented in this report, as well as any modifications that may have been made to the base input model to address specific scenarios.

Note that sensitivity studies use the same input model as their base cases, with some minor modifications that are described in the various tables documenting the sensitivity analyses.

Table A-7 Input Models Used for Documented Calculations Input Model Scenario Cases Comments Revision #

1-6 Rev. 8 SBLOCA - Sump Includes improved cooldown logic, as discussed Recirculation 7-12 Rev. 8 in Section 5.1 1-4 Rev. 8 SBLOCA -

Includes improved cooldown logic, as discussed Condensate Feed 5-8 Rev. 8 in Section 5.1 SBLOCA - Bleed All Rev. 8 and Feed Loss of DC Includes modified RCP trip logic for LoDCB111, All Rev. 8 Bus 111 as described in Section A.1.8 SGTR All Rev. 7 MLOCA Injection All Rev. 8 Success Criteria Includes improved cooldown logic, as discussed MLOCA 1, 3, 5, 7, 9 Rev. 8 in Section 5.1 Cooldown Timing 2, 4, 6, 8, 10 Rev. 8 Mode 4-specific Loss of Shutdown All input model based Cooling - Mode 4 on Rev. 8 Mode 5-specific Loss of Shutdown All input model based Cooling - Mode 5 on Rev. 8 A.3 Additional Notes on MELCOR This section provides further explanation of behavior predicted by MELCOR that is applicable to many, if not all, scenarios described in this report. This section also provides more information about discontinuities in plotted temperatures.

A-6

Temperature Discontinuities In some cases, plots of temperatures show large discontinuities due to the way MELCOR handles certain plot parameters. For example, the plot of cross-over leg temperatures in Section E.2.1 shows large changes in the loop C liquid temperature. This is because MELCOR uses the vapor temperature for parameter CVH-TLIQ when there is no liquid water present in the control volume. Thus, the loop C liquid temperature jumps to the vapor temperature at about 2.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />, while the liquid temperature is actually the vapor temperature for much of the time after 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. A similar situation occurs for the vapor plot parameter, CVH-TVAP.

On the other hand, COR package component temperatures are set to zero if a component is not present in a cell. This also means that after a component fails, its temperature is zero. Thus, the maximum cladding temperature plotted in Section E.1.5 drops to zero when the last of the cladding has failed due to the collapse of the support plate just after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. (It must also be noted that the smaller discontinuities earlier in the calculation are caused by failure of the cladding in the cell that previously had the maximum cladding temperature. The maximum cladding temperature then occurs in a different cell, where the temperature is, by definition, lower than the previous maximum.)

A.4 References (NRC, 2011) U.S. Nuclear Regulatory Commission, NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, September 2011.

A-7

APPENDIX B DETAILED SMALL-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS

B.1 Small-Break Loss-of-Coolant Accident - Sequence Timing for Alignment of Sump Recirculation Case 1: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 1.75 hr B-1

B-2 B-3 B-4 B-5 B-6 B.1.1.1 Case 1a: 0.83-in. Break LOCA with Chg Pump and No SG Cooldown B-7

B-8 B-9 B-10 B-11 B-12 Case 2: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 1.75 hr B-13

B-14 B-15 B-16 B-17 B-18 Case 3: 0.83-in. Break LOCA with Chg Pump and 75 °F/hr Cooldown at 2.25 hr B-19

B-20 B-21 B-22 B-23 B-24 Case 4: 0.83-in. Break LOCA with SI Pump and 75 °F/hr Cooldown at 2.25 hr B-25

B-26 B-27 B-28 B-29 B-30 Case 5: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 2.75 hr B-31

B-32 B-33 B-34 B-35 B-36 Case 6: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 2.75 hr B-37

B-38 B-39 B-40 B-41 B-42 Case 7: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 1.75 hr B-43

B-44 B-45 B-46 B-47 B-48 B.1.7.1 Case 7a: 1.66-in. Break LOCA with Chg Pump and No SG Cooldown B-49

B-50 B-51 B-52 B-53 B-54 Case 8: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 1.75 hr B-55

B-56 B-57 B-58 B-59 B-60 Case 9: 1.66-in. Break LOCA with Chg Pump and 75 °F/hr Cooldown at 2.25 hr B-61

B-62 B-63 B-64 B-65 B-66 Case 10: 1.66-in. Break LOCA with SI Pump and 75 °F/hr Cooldown at 2.25 hr B-67

B-68 B-69 B-70 B-71 B-72 Case 11: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 2.75 hr B-73

B-74 B-75 B-76 B-77 B-78 Case 12: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 2.75 hr B-79

B-80 B-81 B-82 B-83 B-84 B.2 Small-Break Loss-of-Coolant Accident - Success Criteria for Steam Generator Depressurization and Condensate Feed Case 1: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 10 min B-85

B-86 B-87 B-88 B-89 B-90 Case 2: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 10 min B-91

B-92 B-93 B-94 B-95 B-96 Case 3: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 20 min B-97

B-98 B-99 B-100 B-101 B-102 Case 4: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 20 min B-103

B-104 B-105 B-106 B-107 B-108 Case 5: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 10 min B-109

B-110 B-111 B-112 B-113 B-114 Case 6: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 10 min B-115

B-116 B-117 B-118 B-119 B-120 Case 7: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 20 min B-121

B-122 B-123 B-124 B-125 B-126 Case 8: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 20 min B-127

B-128 B-129 B-130 B-131 B-132 B.3 Small-Break Loss-of-Coolant Accident - Success Criteria for Primary Side Bleed and Feed Case 1: 0.83-in. Break LOCA with Chg Pump and 1 PORV Opened at 35 min B-133

B-134 B-135 B-136 B-137 Case 2: 0.83-in. Break LOCA with Chg Pump and 1 PORV Opened at 55 min B-138

B-139 B-140 B-141 B-142 Case 3: 0.83-in. Break LOCA with SI Pump and 2 PORVs Opened at 30 min B-143

B-144 B-145 B-146 B-147 Case 4: 0.83-in. Break LOCA with SI Pump and 2 PORVs Opened at 50 min B-148

B-149 B-150 B-151 B-152 Case 5: 1.66-in. Break LOCA with Chg Pump and 1 PORV Opened at 35 min B-153

B-154 B-155 B-156 B-157 Case 6: 1.66-in. Break LOCA with Chg Pump and 1 PORV Opened at 55 min B-158

B-159 B-160 B-161 B-162 Case 7: 1.66-in. Break LOCA with SI Pump and 2 PORVs Opened at 30 min B-163

B-164 B-165 B-166 B-167 Case 8: 1.66-i.n Break LOCA with SI Pump and 2 PORVs Opened at 50 min B-168

B-169 B-170 B-171 B-172 APPENDIX C DETAILED LOSS OF DC BUS 111 ANALYSIS RESULTS

C.1 Loss of DC Bus 111 and Unavailable DD-AFW, Leading to Primary Side Bleed and Feed Case 1: 1 Chg Pump, 1 PORV Opened at 20 min, PORV Does Not Stick Open C-1

C-2 C-3 C-4 C-5 C-6 C-7 Case 2: 1 Chg Pump, 1 PORV Opened at 40 min, PORV Does Not Stick Open C-8

C-9 C-10 C-11 C-12 C-13 C-14 Case 3: 1 Chg Pump, 1 PORV Opened at 40 min, PORV Sticks after 251 Cycles C-15

C-16 C-17 C-18 C-19 C-20 C-21 Case 4: 1 Chg Pump, No Manual Action, PORV Sticks after 251 Cycles C-22

C-23 C-24 C-25 C-26 C-27 C-28 C.1.4.1 Case 4a: 1 Chg Pump, No Manual Action, PORV Fails Closed after 251 Cycles C-29

C-30 C-31 C-32 C-33 C-34 C-35 Case 5: 1 Chg Pump, No Manual Action, PORV Does Not Stick Open C-36

C-37 C-38 C-39 C-40 C-41 C-42 Case 6: 1 SI Pump, 1 PORV Opened at 20 min, PORV Does Not Stick Open C-43

C-44 C-45 C-46 C-47 C-48 Case 7: 1 SI Pump, 1 PORV Opened at 40 min, PORV Does Not Stick Open C-49

C-50 C-51 C-52 C-53 C-54

NUREG-2187 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1 Chapters 1 to 8 Appendices A to C Office of Nuclear Regulatory Research

AVAILABILITY OF REFERENCE MATERIALS IN NRC PUBLICATIONS NRC Reference Material Non-NRC Reference Material As of November 1999, you may electronically access Documents available from public and special technical NUREG-series publications and other NRC records at libraries include all open literature items, such as books, NRCs Library at www.nrc.gov/reading-rm.html. Publicly journal articles, transactions, Federal Register notices, released records include, to name a few, NUREG-series Federal and State legislation, and congressional reports.

publications; Federal Register notices; applicant, Such documents as theses, dissertations, foreign reports licensee, and vendor documents and correspondence; and translations, and non-NRC conference proceedings NRC correspondence and internal memoranda; bulletins may be purchased from their sponsoring organization.

and information notices; inspection and investigative reports; licensee event reports; and Commission papers Copies of industry codes and standards used in a and their attachments. substantive manner in the NRC regulatory process are maintained at NRC publications in the NUREG series, NRC regulations, The NRC Technical Library and Title 10, Energy, in the Code of Federal Regulations Two White Flint North may also be purchased from one of these two sources. 11545 Rockville Pike Rockville, MD 20852-2738

1. The Superintendent of Documents U.S. Government Publishing Office These standards are available in the library for reference Mail Stop IDCC use by the public. Codes and standards are usually Washington, DC 20402-0001 copyrighted and may be purchased from the originating Internet: bookstore.gpo.gov organization or, if they are American National Standards, Telephone: (202) 512-1800 from Fax: (202) 512-2104 American National Standards Institute 11 West 42nd Street

2. The National Technical Information Service New York, NY 10036-8002 5301 Shawnee Rd., Alexandria, VA 22312-0002 www.ansi.org www.ntis.gov (212) 642-4900 1-800-553-6847 or, locally, (703) 605-6000 Legally binding regulatory requirements are stated only in A single copy of each NRC draft report for comment is laws; NRC regulations; licenses, including technical speci-available free, to the extent of supply, upon written fications; or orders, not in NUREG-series publications. The request as follows: views expressed in contractorprepared publications in this series are not necessarily those of the NRC.

Address: U.S. Nuclear Regulatory Commission The NUREG series comprises (1) technical and adminis-Office of Administration trative reports and books prepared by the staff (NUREG-XXXX) or agency contractors (NUREG/CR-XXXX), (2)

Publications Branch proceedings of conferences (NUREG/CP-XXXX), (3) reports Washington, DC 20555-0001 resulting from international agreements (NUREG/IA-XXXX),

E-mail: distribution.resource@nrc.gov (4) brochures (NUREG/BR-XXXX), and (5) compilations of Facsimile: (301) 415-2289 legal decisions and orders of the Commission and Atomic and Safety Licensing Boards and of Directors decisions Some publications in the NUREG series that are posted under Section 2.206 of NRCs regulations (NUREG-0750).

at NRCs Web site address www.nrc.gov/reading-rm/ DISCLAIMER: This report was prepared as an account doc-collections/nuregs are updated periodically and may of work sponsored by an agency of the U.S. Government.

differ from the last printed version. Although references to Neither the U.S. Government nor any agency thereof, nor any employee, makes any warranty, expressed or implied, material found on a Web site bear the date the material or assumes any legal liability or responsibility for any third was accessed, the material available on the date cited partys use, or the results of such use, of any information, may subsequently be removed from the site. apparatus, product, or process disclosed in this publication, or represents that its use by such third party would not infringe privately owned rights.

NUREG-2187 Volume 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsByron Unit 1 Chapters 1 to 8 Appendices A to C Manuscript Completed: May 2015 Date Published: January 2016 Prepared by:

J. Corson,1 D. Helton,1 M. Tobin,1 A. Bone1 M. Khatib-Rahbar,2 A. Krall2 L. Kozak3 R. Buell4 1Office of Nuclear Regulatory Research U.S. Nuclear Regulatory Commission Washington, DC 20555-0001 2Energy Research Inc.

P.O. Box 2034 Rockville, MD 20847-2034 3Region III U.S. Nuclear Regulatory Commission 2443 Warrenville Road, Suite 210 Lisle, IL 60532-4352 4Idaho National Laboratory P.O. Box 1625 Idaho Falls, ID 83415

ABSTRACT This report extends the work documented in NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models-Surry and Peach Bottom to the Byron Station, Unit 1. Its purpose is to produce an additional set of best-estimate thermal-hydraulic calculations that can be used to confirm or enhance specific success criteria (SC) for system performance and operator timing found in the agencys probabilistic risk assessment (PRA) tools. Along with enhancing the technical basis for the Agencys independent standardized plant analysis risk (SPAR) models, these calculations are expected to be a useful reference to model end-users for specific regulatory applications (e.g.,

the Significance Determination Process). The U.S. Nuclear Regulatory Commission selected Unit 1 of the Byron Station for this study because it is generally representative of a group of four-loop Westinghouse plants with large, dry containment designs.

This report first describes major assumptions used in this study, including the basis for using a core damage (CD) surrogate of 2,200 degrees Fahrenheit (1,204 degrees Celsius) peak cladding temperature (PCT). The justification for this PCT is documented in NUREG/CR-7177, Compendium Of Analyses To Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition And Success Criteria Modeling Issues. The major plant characteristics for Byron Unit 1 are then described, in addition to the MELCOR model used to represent the plant.

Finally, the report presents the results of MELCOR calculations for selected initiators and compares these results to SPAR SC, the licensees PRA sequence timing and SC, or other generic studies.

The study results provide additional timing information for several PRA sequences, confirm many of the existing SPAR model modeling assumptions, and provide a technical basis for a few specific SPAR modeling changes. Potential SPAR model changes supported by this study include:

• Small-Break Loss-of-Coolant Accident (SLOCA) Sequence Timing for Alignment of Sump RecirculationFor sequences where operator cooldown is credited as an alternative to high-pressure recirculation (HPR), the SPAR success criteria related to containment cooling could be enhanced by requiring one containment fan cooler to prevent containment spray actuation. Avoiding spray actuation extends the time available prior to refueling water storage tank depletion and allows the operators to successfully depressurize the plant using the post-LOCA procedures for cases when HPR is not available.

• SLOCA Success Criteria for Steam Generator (SG) Depressurization and Condensate FeedAction to depressurize the SGs early and align condensate feed is a candidate for inclusion in the SPAR model. This would provide an additional success path for a loss of auxiliary feedwater event. If this is done, hotwell refill or alignment of alternate feedwater later in the scenario would also need to be modeled. Early depressurization to achieve condensate feed was not found to require primary-side depressurization actions (e.g., opening a power-operated relief valve (PORV)).

• SLOCA Success Criteria for Primary Side Bleed and Feed (B&F)These calculations have demonstrated a potential conservatism that can be removed from the applicable SPAR models. It is proposed that the SC for SLOCA B&F be changed from (one safety iii

injection (SI) or centrifugal charging pump (CCP) and two PORVs) to (one SI pump and two PORVs) or (one CCP and one PORV). In other words, for SLOCAs the requirement for availability of a second PORV can be removed when a CCP is available.

• Loss of DC Bus-111 - Unavailable Diesel-Driven Auxiliary Feedwater, and Subsequent Primary Side B&FThese calculations are generally representative of non-loss-of-coolant accident (non-LOCA) B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is proposed that the SC for non-LOCA B&F be changed from (one SI or CCP and two PORVs) to (one CCP and one PORV). In other words, the same one CCP and one PORV enhancement as above is credited, but credit is eliminated for cases with no CCP available. This initiator was chosen because it was qualitatively felt to be more restrictive than those scenarios categorized as general transients in the PRA, and thus the conclusions are believed to be applicable to those initiators as well. Note that the applicability of the loss of DC bus SC may vary, (e.g., due to the unique reactor coolant pump trip situation that this initiator creates) and should be evaluated on a case-by-case basis before implementation for other plant models.

• SGTR - Spontaneous Steam Generator Tube Rupture with No Operator ActionFor sequences with successful high-pressure injection (HPI) and auxiliary feedwater, but with steam generator isolation having failed, an additional success path or additional recovery credit may be justifiable pending additional consideration of closely-related accident sequence and human reliability modeling assumptions.

• Medium-Break Loss-of-Coolant Accident (MLOCA) - Injection SC For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functional Restoration Procedure (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The time available to implement these actions following the FRP entry criterion being met could be short. The accident sequence modeling and human reliability analysis associated with secondary-side cooldown for these situations (MLOCA with HPI failed) should be reviewed.

iv

FOREWORD The U.S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk (SPAR) models are used to support a number of risk-informed initiatives. The fidelity and realism of these models is ensured through a number of processes, including cross-comparison with industry models, review and use by a wide range of technical experts, and confirmatory analysis. The following reportprepared by staff in the Office of Nuclear Regulatory Research in consultation with staff from the Office of Nuclear Reactor Regulation, experts from Energy Research Incorporated and Idaho National Laboratory, and the agencys senior reactor analystsrepresents a major confirmatory analysis activity.

Probabilistic risk assessment (PRA) models for nuclear power plants rely on underlying modeling assumptions known as success criteria (SC) and sequence timing assumptions.

These criteria and assumptions determine what combination of system and component availabilities will lead to postulated core damage (CD), as well as the timeframes during which components must operate or operators must take particular actions. This report investigates certain thermal-hydraulic aspects of a particular SPAR model (which is generally representative of other models within the same class of plant design), with the goal of further strengthening the technical basis for decisionmaking that relies on the SPAR models. This report augments the existing collection of contemporary Level 1 PRA SC analyses, and as such, supports (1) maintaining and enhancing the SPAR models that the NRC develops, (2) supporting the NRCs risk analysts when addressing specific issues in the accident sequence precursor program and the significance determination process, and (3) informing other ongoing and planned initiatives. This analysis employs the MELCOR computer code and uses a plant model developed for this project.

The analyses summarized in this report provide the basis for confirming or changing SC in the SPAR model for the Byron Station Unit 1. Further evaluation of these results will be performed to extend the results to similar plants. In addition, future work is planned to perform similar analysis for other design classes, and past work has already considered other design classes (see NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models - Surry and Peach Bottom). In addition, work has been recently completed to scope other aspects of this topical area, including the degree of variation typical in common PRA sequences and the quantification of conservatisms associated with CD surrogates (see NUREG/CR-7177, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues). Where applicable, insights from that work are referenced in this report. The confirmation of SC and other aspects of PRA modeling using the agencys state-of-the-art tools (e.g., the MELCOR computer code) is expected to receive continued focus as the agency continues to develop and improve its risk tools.

v

CONTENTS ABSTRACT ...............................................................................................................................iii FOREWORD ............................................................................................................................. v CONTENTS ..............................................................................................................................vii LIST OF FIGURES ....................................................................................................................ix LIST OF TABLES ......................................................................................................................xi ABBREVIATIONS AND ACRONYMS .....................................................................................xiii

1. INTRODUCTION AND BACKGROUND ............................................................................. 1

2. MAJOR ASSUMPTIONS .................................................................................................... 3 2.1 Selection of a Core Damage Surrogate........................................................................ 5

3. RELATIONSHIP TO THE AMERICAN SOCIETY OF MECHANICAL ENGINEERS/AMERICAN NUCLEAR SOCIETY PROBABILISTIC RISK ASSESSMENT STANDARD .............................................................................................. 9

4. MAJOR PLANT AND MELCOR MODEL CHARACTERISTICS........................................13 4.1 Byron Station Unit 1 ....................................................................................................13 4.2 Byron MELCOR Model ...............................................................................................14 4.3 MELCOR Validation ....................................................................................................15

5. MELCOR RESULTS..........................................................................................................17 5.1 Small-Break Loss-of-Coolant Accident-Sequence Timing for Alignment of Sump Recirculation.....................................................................................................18 5.2 Small-Break Loss-of-Coolant Accident-Success Criteria for Steam Generator Depressurization and Condensate Feed .....................................................................29 5.3 Small-Break Loss-of-Coolant Accident-Success Criteria for Primary Side Bleed and Feed ..........................................................................................................35 5.4 Loss of DC Bus 111, Unavailable DD-AFW, and Subsequent Primary Side Bleed and Feed ..........................................................................................................42 5.5 Spontaneous Steam Generator Tube Rupture with No Operator Action......................50 5.6 Medium-Break LOCA Injection Success Criteria .........................................................59 5.7 Medium-Break LOCA Cooldown Timing for Low-Pressure Recirculation ....................67 5.8 Loss of Shutdown Cooling ..........................................................................................76 5.8.1 Changes to the MELCOR Input Deck for Loss of Shutdown Cooling Calculations .........................................................................................................77 5.8.2 Mode 4 Calculations ............................................................................................77 5.8.3 Mode 5 Calculations ............................................................................................82

6. APPLICATION OF MELCOR RESULTS TO THE SPAR MODELS ..................................87

7. CONCLUSIONS ................................................................................................................93

8. REFERENCES ..................................................................................................................95 APPENDIX A DETAILED INFORMATION ON BASE MELCOR MODEL A.1 Byron MELCOR Input Model Description..................................................................... A-1 A.2 Input Deck Revisions and MELCOR Code Versions .................................................... A-6 A.3 Additional Notes on MELCOR ..................................................................................... A-7 A.4 References .................................................................................................................. A-7 vii

APPENDIX B DETAILED SMALL-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS B.1 Small-Break Loss-of-Coolant Accident - Sequence Timing for Alignment of Sump Recirculation .................................................................................................... B-1 B.2 Small-Break Loss-of-Coolant Accident - Success Criteria for Steam Generator Depressurization and Condensate Feed.................................................................... B-85 B.3 Small-Break Loss-of-Coolant Accident - Success Criteria for Primary Side Bleed and Feed ....................................................................................................... B-133 APPENDIX C DETAILED LOSS OF DC BUS 111 ANALYSIS RESULTS C.1 Loss of DC Bus 111 and Unavailable DD-AFW, Leading to Primary Side Bleed and Feed ........................................................................................................... C-1 APPENDIX D DETAILED STEAM GENERATOR TUBE RUPTURE ANALYSIS RESULTS D.1 Spontaneous SG Tube Rupture with No Operator Action ............................................ D-1 APPENDIX E DETAILED MEDIUM-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS E.1 Medium-Break Loss-of-Coolant Accident Injection Success Criteria ............................ E-1 E.2 Medium-Break Loss-of-Coolant Accident Cooldown Timing for Low-Pressure Recirculation.............................................................................................................. E-91 APPENDIX F DETAILED LOSS OF SHUTDOWN COOLING RESULTS F.1 Mode 4 Calculations .................................................................................................... F-1 F.2 Mode 5 Calculations .................................................................................................. F-47 APPENDIX G EVENT TREE MODELS FOR STUDIED INITIATORS G.1 Byron SPAR Model Event Trees..................................................................................G-1 viii

LIST OF FIGURES Main Report Figure 1 Example of variation in core damage timing from (NRC, 2014b) ............................ 6 Figure 2 Schematic of the Byron MELCOR RCS model ..................................................... 15 Figure 3 Time of RWST depletion as a function of RWST volume ...................................... 27 Figure 4 Peak containment pressure as a function of containment volume and the number of available fan coolers for Case 11 ................................................... 28 Appendix G Figure G-1 Small-break loss-of-coolant accident (SLOCA) event tree .................................. G-2 Figure G-2 Loss of 125V vital DC bus 111 event tree ........................................................... G-3 Figure G-3 Steam generator tube rupture (SGTR) event tree ............................................... G-4 Figure G-4 Medium-break loss-of-coolant accident (MLOCA) event tree .............................. G-5 ix

LIST OF TABLES Main Report Table 1 Summary of Accident Scenarios Examined ............................................................ 2 Table 2 Major Assumptions ................................................................................................. 4 Table 3 Comparison of this Project to the ASME/ANS PRA Standard ............................... 10 Table 4 Major Plant Characteristics for Byron Unit 1 ......................................................... 13 Table 5 SLOCA-Sump Recirculation Boundary Conditions............................................... 19 Table 6 SLOCA-Sump Recirculation Results.................................................................... 20 Table 7 SLOCA-Sump Recirculation Key Event Timings .................................................. 21 Table 8 SLOCA-Sump Recirculation Margins ................................................................... 22 Table 9 SLOCA-Sump Recirculation Cooldown Rates ..................................................... 22 Table 10 SLOCA-Sump Recirculation Sensitivity Studies ................................................... 23 Table 11 SLOCA-Condensate Feed Boundary Conditions ................................................. 30 Table 12 SLOCA-Condensate Feed Results ...................................................................... 30 Table 13 SLOCA-Condensate Feed Key Event Timings .................................................... 31 Table 14 SLOCA-Condensate Feed Margins ..................................................................... 31 Table 15 SLOCA-Condensate Feed Cooldown Rates ........................................................ 32 Table 16 SLOCA-Condensate Feed Sensitivity Studies ..................................................... 33 Table 17 SLOCA-Bleed and Feed Boundary Conditions .................................................... 36 Table 18 SLOCA-Bleed and Feed Results ......................................................................... 37 Table 19 SLOCA-Bleed and Feed Key Event Timings........................................................ 37 Table 20 SLOCA-Bleed and Feed Margins ........................................................................ 38 Table 21 SLOCA-Bleed and Feed Sensitivity Studies ........................................................ 39 Table 22 Loss of DC Bus 111 Boundary Conditions ............................................................ 43 Table 23 Loss of DC Bus 111 Results ................................................................................. 43 Table 24 Loss of DC Bus 111 Key Event Timings ............................................................... 44 Table 25 Loss of DC Bus 111 Margins ................................................................................ 44 Table 26 Loss of DC Bus 111 Sensitivity Studies ................................................................ 46 Table 27 SGTR Boundary Conditions ................................................................................. 52 Table 28 SGTR Results ...................................................................................................... 53 Table 29 SGTR Key Event Timings ..................................................................................... 54 Table 30 SGTR Margins...................................................................................................... 55 Table 31 SGTR Sensitivity Studies ..................................................................................... 56 Table 32 MLOCA Injection Success Criteria Boundary Conditions ...................................... 60 Table 33 MLOCA Injection Success Criteria Results ........................................................... 60 Table 34 MLOCA Injection Success Criteria Key Event Timings ......................................... 61 Table 35 MLOCA Injection Success Criteria Margins .......................................................... 62 Table 36 MLOCA Injection Success Criteria Sensitivity Studies .......................................... 64 Table 37 MLOCA Cooldown Timing Boundary Conditions .................................................. 68 Table 38 MLOCA Cooldown Timing Results ....................................................................... 68 Table 39 MLOCA Cooldown Timing Key Event Timings ...................................................... 70 Table 40 MLOCA Cooldown Timing Margins....................................................................... 71 Table 41 MLOCA Cooldown Timing Cooldown Rates ......................................................... 71 Table 42 MLOCA Cooldown Timing Sensitivity Studies ...................................................... 72 Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions ................................... 78 Table 44 Loss of Shutdown Cooling (Mode 4) Results ........................................................ 78 Table 45 Loss of Shutdown Cooling (Mode 4) Key Event Timings ...................................... 79 xi

Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions ................................... 82 Table 47 Loss of Shutdown Cooling (Mode 5) Results ........................................................ 83 Table 48 Loss of Shutdown Cooling (Mode 5) Key Event Timings ...................................... 84 Table 49 Mapping of MELCOR Analyses to the Byron SPAR (8.27) Model ......................... 88 Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results ..................... 89 Appendix A Table A-1 Reactor Trip Signals ............................................................................................ A-1 Table A-2 Charging Pump Performance ............................................................................. A-2 Table A-3 SI Pump Performance ........................................................................................ A-2 Table A-4 RHR Pump Performance ..................................................................................... A-3 Table A-5 Reactor Coolant Pump Motive and Control Power Configuration ......................... A-5 Table A-6 Opening and Closing Pressures for Pressurizer PORVs and SRVs..................... A-5 Table A-7 Input Models Used for Documented Calculations ................................................ A-6 xii

ABBREVIATIONS AND ACRONYMS

°C degree(s) Celsius

°C/hr degree(s) Celsius per hour

°F degree(s) Fahrenheit

°F/hr degree(s) Fahrenheit per hour T temperature difference ACC accumulator ADAMS Agencywide Documents Access and Management System AFW auxiliary feedwater ANS American Nuclear Society ASME American Society of Mechanical Engineers ASP accident sequence precursor B&F bleed and feed BAF bottom of active fuel BEP Byron Emergency Procedure BWR boiling-water reactor CCP centrifugal charging pump CCW component cooling water CD core damage CDF core damage frequency CET core exit temperature CFR Code of Federal Regulations cm centimeter(s)

CNMT containment COR MELCOR core package CS containment spray CST condensate storage tank CVH control volume hydrodynamics (MELCOR package)

CVTR Carolinas Virginia Tube Reactor DC direct current DD-AFW diesel-driven auxiliary feedwater ECA emergency contingency action ECCS emergency core cooling system EOP emergency operating procedure EPRI Electric Power Research Institute ESF Engineered Safety Features FCL fan cooler FRP functaionl restoration procedure FSAR Final Safety Analysis Report ft foot/feet ft3 cubic foot/feet FW feedwater gal gallon(s) gpm gallon(s) per minute HEM homogeneous equilibrium model HEP human error probability HFM homogeneous frozen model HPI high-pressure [ECCS] injection xiii

HPR high-pressure [ECCS] recirculation hr hour(s)

HS heat structure in. inch(es) iPWR integral pressurized-water reactor K Kelvin kg kilogram(s) kg/s kilogram(s) per second kPa kilopascal(s) lb/s pound(s) per second LBLOCA large-break loss-of-coolant accident lbm/hr pound(s) mass per hour LOCA loss-of-coolant accident LoDCB-111 loss of DC bus 111 LOFT loss-of-fluid test LPI low pressure [ECCS] injection LPR low pressure [ECCS] recirculation LTOP low temperature overpressure protection m meter(s) m3 cubic meter(s) m3/min cubic meter(s) per minute m3/s cubic meter(s) per second MAAP4 Modular Accident Analysis Program version 4 MD-AFW motor-driven auxiliary feedwater MELCOR Not an acronym MFW main feedwater min minute(s)

MLOCA medium-break loss-of-coolant accident MPa megapascal(s)

MPa abs megapascal(s) absolute MSIV main steam isolation valve MUR measurement uncertainty recapture MW megawatt(s)

MWt megawatt(s) thermal NPSH net positive suction head NR narrow range [water level]

NRC U.S. Nuclear Regulatory Commission PCT peak cladding temperature PORV power- (or pilot-) operated relief valve PRA probabilistic risk assessment PRT pressurizer relief tank PSA Probabilistic Safety Assessment psi pound(s) per square inch psia pound(s) per square inch absolute psid pound(s) per square inch differential psig pound(s) per square inch gage PWR pressurized-water reactor PZR pressurizer RCFC reactor containment fan cooler RCP reactor coolant pump RCS reactor coolant system xiv

recirc recirculation RHR residual heat removal RHR HX residual heat removal heat exchanger RPS reactor protection system RPV reactor pressure vessel RWST refueling water storage tank s second(s)

SC success criterion/criteria SDP significance determination process scfm standard cubic foot/feet per minute SG steam generator SG-x steam generator in loop x SGTR steam generator tube rupture SI safety injection SLOCA small-break loss-of-coolant accident SOARCA State-of-the-Art Reactor Consequence Analyses SPAR standardized plant analysis risk SRV safety relief valve TAF top of active fuel Tavg loop average temperature TBV turbine bypass valve TCL cladding temperature TRACE TRAC/RELAP5 Advanced Computational Engine VCT volume control tank WR wide range [water level]

xv

1. INTRODUCTION AND BACKGROUND The success criteria (SC) for system performance and operator timing in the U.S. Nuclear Regulatory Commissions (NRCs) standardized plant analysis risk (SPAR) models are largely based on the SC used in the associated licensee probabilistic risk assessment (PRA) model. 1 Licensees have used a variety of methods to determine SC, including conservative design-basis analyses and more realistic best-estimate methods. Consequently, in some situations plants that should behave similarly from an accident sequence standpoint have different SC for specific scenarios. In addition, concerns periodically arise when reviewing licensee sequence timing and SC analyses in the course of performing event or condition risk assessments that could be better resolved with an updated set of thermal-hydraulic SC calculations. For these reasons, this report, as well as its predecessor NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk Models Surry and Peach Bottom (NRC, 2011a), seeks to provide such a set of information while simultaneously providing the basis to confirm or change specific SPAR SC.

This analysis in the present report used the Byron Station Unit 1. The staff chose this plant because it is reasonably representative of a class of 4-loop Westinghouse plants with large, dry containments. Specifically, Byron Unit 1 is generally similar to the following other plants:

• Byron Unit 2

• Braidwood Units 1 and 2

• Callaway

• Comanche Peak Units 1 and 2

• Diablo Canyon Units 1 and 2

• Indian Point Units 2 and 3

• Millstone Unit 3

• Salem Units 1 and 2

• Seabrook

• South Texas Units 1 and 2

• Vogtle Units 1 and 2

• Wolf Creek It should be noted, however, that all of these plants have design, operational, and licensing differences that should be considered before applying the results of this study to these plants.

The sequences analyzed are not necessarily the most probable sequences because of the assumed unavailability of systems or the assumed lack of operator action. Rather, the sequences were selected because they have assumptions and sequence timing issues that periodically arise during significance determination process (SDP) or accident sequence precursor (ASP) evaluations.

This report summarizes the analyses that have been performed, including the following topics:

• major assumptions, including the basis for the core damage definition employed 1 In some cases, success criteria (SC) are based on other sources, such as NRC studies (e.g., NUREG/CR-5072, Decay Heat Removal Using Feed-and-Bleed for U.S. Pressurized Water Reactors, issued June 1988 (NRC, 1988)).

1

• consideration of the relevant supporting requirements documented in the American Society of Mechanical Engineers/American Nuclear Society PRA standard (ASME/ANS, 2009)

• major plant characteristics for Byron Unit 1 and a description of the Byron MELCOR models used

• results of various MELCOR calculations

• application of the MELCOR results to the SPAR models The SC calculations contained herein are intended to be confirmatory in nature, and while suitable for their intended use in supporting the SPAR models, they are not intended to be used by licensees for risk-informed licensing submittals.

The eight accident scenarios completed in this report are highlighted in Table 1 below.

Table 1 Summary of Accident Scenarios Examined Section Description Key Assumptions Section 5.1 Small-Break Loss-of-Coolant Accident- See Table 5 SLOCA-Sump Sequence Timing for Alignment of Sump Recirculation Boundary Conditions Recirculation Section 5.2 Small-Break Loss-of-Coolant Accident- See Table 11 SLOCA-Condensate Success Criteria for Steam Generator Feed Boundary Conditions Depressurization and Condensate Feed Section 5.3 Small-Break Loss-of-Coolant Accident- See Table 17 SLOCA-Bleed and Feed Success Criteria for Primary Side Bleed and Boundary Conditions Feed Section 5.4 Loss of DC Bus 111, Unavailable DD-AFW, See Table 22 Loss of DC Bus 111 and Subsequent Primary Side Bleed and Boundary Conditions Feed Section 5.5 Spontaneous Steam Generator Tube See Table 27 SGTR Boundary Rupture with No Operator Action Conditions Section 5.6 Medium-Break LOCA Injection Success See Table 32 MLOCA Injection Success Criteria Criteria Boundary Conditions Section 5.7 Medium-Break LOCA Cooldown Timing for See Table 37 MLOCA Cooldown Timing Low-Pressure Recirculation Boundary Conditions Section 5.8 Loss of Shutdown Cooling See Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions and Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions 2

2. MAJOR ASSUMPTIONS Assumptions made during the conduct of this study are documented throughout this report.

For instance, MELCOR modeling assumptions are discussed in the section (and in the appendix) describing the MELCOR model (i.e., Section 4 and Appendix A), assumptions related to particular calculations are discussed in the section where those calculations are documented, etc. This section collects major assumptions into one concise table.

3

Table 2 Major Assumptions Topic Area Assumption Comments Core damage A peak clad temperature of 2,200 °F (1,204 °C) is used throughout.

General surrogate The basis for this selection is described later in this section.

RWST initial It is assumed that the initial volume of water in the RWST volume and ECCS corresponds to the Tech Spec minimum value water level of delivered 89% instrument span.

volumes It is assumed that operators fail to take action to prevent the Operator control pressurizer from going water-solid by controlling the rate of ECCS ECCS of ECCS injection (i.e., by shutting off ECCS pumps when pressurizer level injection exceeds a certain value, as described in the plant procedures),

except where noted otherwise.

Time required to The plant operators must perform a number of steps in order to switch ECCS switch the ECCS pump suction source from the RWST to the suction from containment sump. It is assumed that it takes the operators ECCS RWST to 10 minutes to complete the necessary steps. During this switchover containment time, the ECCS pumps continue to draw suction from the RWST, as sump is suggested by the relevant plant procedure.

AFW actuates following a reactor trip. The current treatment in the MELCOR input model assumes AFW injects at a rate equal to AFW and 9.99 kg/s (22.02 lb/s) whenever the SG water level drops below the condensate AFW target setpoint (24.25 m, approximately equal to the steady-state booster pump operating value). The condensate booster pumps also follow this logic logic in the event that AFW is unavailable, SG pressure is below the booster pump shutoff head, and the condenser hotwell is not empty.

In some of the cases studied for the present analysis, the pressurizer PORV is assumed to fail open, fail partially open, or fail closed after 251 cycles. This number corresponds to a cumulative failure probability of 0.5 assuming a constant failure probability per demand derived from industry data, as presented in NUREG/CR-7037 (NRC, 2011b). This treatment assumes a constant failure probability per Pressurizer PORV failure demand, regardless of whether the valve is passing steam, water, or a two-phase mixture. As such, it is not intended to mechanistically represent the actual valve behavior, but rather to provide a convenient threshold for exploring calculational sensitivity to valve re-closure. Refer to NUREG-1953 for a discussion of the treatment of PORV failure in MELCOR (NRC, 2011a).

In the LOCA cases studied for this analysis, the pipe break is located in the horizontal section of the cold leg in the loop containing the Break location Piping pressurizer. This location is a modeling choice, and it is not for LOCA cases expected that the location of the break will make a significant difference in the results, so long as it is in the RCS piping.

4

Table 2 (continued)

Topic Area Assumption Comments At times, MELCOR predicts significant holdup of water in the pressurizer when the hot leg and the top of the RPV are voided.

This is due to counter-current flow limitation in the pressurizer, as predicted by MELCOR. While significant holdup in the pressurizer can occur under some conditions, there is modeling uncertainty inherent in the way that codes like MELCOR capture this physics.

This modeling uncertainty is reduced by performing validation studies against relevant experiments and events (such as the Three Mile Island accident). In MELCOR, counter-current flow is affected by a phenomenological parameter called the momentum exchange length, which affects the degree of coupling between the liquid and Holdup of water vapor phases in a flow path. (Larger values result in increased Pressurizer in the coupling, while lower values result in decreased coupling between pressurizer the phases.) For these calculations, the momentum exchange length for flow paths in the surge line is set to 0.1 m. Note that sensitivity calculations in which the momentum exchange length is set to 0.01 m and 1.0 m have been performed for a loss of DC bus scenario as part of a separate study [see page A-51 of (NRC, 2014b)]. The results from these sensitivity calculations show that the momentum exchange length has a modest effect on key event timings (e.g., time to SG dryout), though it does not significantly affect the overall accident progression for the particular accident scenario in that study. Thus, the current treatment of counter-current flow in the pressurizer surge line is reasonable for the current study.

2.1 Selection of a Core Damage Surrogate To perform supporting analysis of success criteria (SC), it is necessary to define what is meant by core damage (CD) (i.e., sequence success versus failure) because no universal quantitative definition of CD exists. The American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) probabilistic risk assessment (PRA) standard RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, issued March 2009 (ASME/ANS, 2009) defines CD as uncovery and heatup of the reactor core to the point at which prolonged oxidation and severe fuel damage are anticipated and involving enough of the core, if released, to result in offsite public health effects. The standard later requires the analysis to specify the plant parameters used to determine CD in Section 2-2.3, Supporting Requirement SC-A2 (ASME/ANS, 2009). The CD surrogate provides the linkage between the qualitative definition above and the quantitative, measurable computer code outputs. The surrogate is necessary since a full Level 3 PRA is not being performed.

A number of surrogates have traditionally been used in PRAs, several of which are called out in the PRA standard (Section 2-2.3) (ASME/ANS, 2009). These include various parameters associated with collapsed reactor vessel water level, peak core-exit thermocouple temperature, and peak cladding temperature (PCT). NUREG-1953 presented a set of calculations in Section 2 that provided the basis for that reports usage of PCT of 2,200 degrees Fahrenheit (F)

(1,204 degrees Celsius (C)) as the CD surrogate.

5

Since that time, additional calculations were performed to look at other plant designs and scenarios. These analyses were published in the U.S. Nuclear Regulatory Commission (NRC) contractor report NUREG/CR-7177, entitled, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definitions and Success Criteria Modeling Issues (NRC, 2014b). That report suggests that for selection of CD surrogates for at-power accidents, a PCT of 2,200 degrees F (1,204 degrees C) is an appropriate choice for a CD surrogate for MELCOR SC applications, because it is not overly conservative or overly nonconservative. See Figure 1 for an example of a CD surrogate comparison for a specific accident sequence from (NRC, 2014b). For shutdown conditions, a single metric may not be sufficient for prescribing a realistic surrogate for CD. Rather, a combination could be used including low water level (one-third of the fuel height); PCT temperature above 2,200 degrees F (1,204 degrees C)); and a cesium class release fraction (3 percent released from fuel). If only one metric is used, the current limited pressurized-water reactor (PWR) analyses would suggest a one-third active fuel height as a precursor to fuel damage and a PCT above 2,200 degrees F (1,204 degrees C) as a precursor to significant fuel damage (NRC, 2014b).

4 PCT > 1922K Max. oxidized depth > 17% of clad thickness PCT > U.H. transition (1853K)

PCT > 1644K PCT > 1478K Hydrogen production > 1%

Cesium release > 3% of initial inventory Time to Core Damage [hr]

Xenon release > 0 kg 3 CET > 922K PCT > 922K Core level < 1/3 AF Core level < 2/3 AF Core level < TAF 2

1 4 3 5 1 6 7 8 9 2 Case Number Figure 1 Example of variation in core damage timing from (NRC, 2014b) 6

A PCT of 2,200 degrees F (1,204 degrees C) as a reactor, at power, CD surrogate achieves all of the following characteristics:

• It always precedes the fuel cladding run away oxidation transition.

• It is not overly conservative.

• It is equally applicable for both PWRs and boiling-water reactors.

• The timing between 2,200 degrees F (1,204 degrees C) and oxidation transition is relatively similar among the different sequences analyzed.

• It is consistent with the criteria contained in Title 10 of the Code of Federal Regulations (10 CFR) 50.46, Acceptance criteria for emergency core cooling systems for light-water nuclear power reactors (10 CFR, 2007).

With regard to the final bullet, the conservatism (i.e., safety margin) in 10 CFR 50.46 is because of uncertainty in large-break loss-of-coolant accident thermal-hydraulic analysis. For PRA usage, the margin has, in part, a different reason: the desire to have a specific criterion that can be used for all sequences combined with overall analysis uncertainty.

For the reasons stated above, a PCT of 2,200 degrees F (1,204 degrees C) is the surrogate used to define CD for the MELCOR analyses in this report. This decision is intrinsically tied to the aforementioned supporting analyses. Other computer codes would be expected to behave differently, depending on considerations such as the nodalization scheme and two-phase flow modeling. As a point of comparison, a PCT of 1,800 degrees F (982 degrees C) is the recommended CD surrogate for use in Modular Accident Analysis Program version 4 (MAAP4)

SC analyses (EPRI, 2010).

7

3. RELATIONSHIP TO THE AMERICAN SOCIETY OF MECHANICAL ENGINEERS/AMERICAN NUCLEAR SOCIETY PROBABILISTIC RISK ASSESSMENT STANDARD Core damage (CD) specification is one of several aspects of success criteria (SC) analysis covered by the American Society of Mechanical Engineers/American Nuclear Society (ASME/ANS) probabilistic risk assessment (PRA) standard (ASME/ANS, 2009) 2. Although the present project is confirmatory in nature, it is still prudent to cross-check the effort against the PRA standard requirements (see Table 3). Capability Category II is used for comparison, since this is the category identified in Regulatory Guide 1.200, Revision 2, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, issued March 2009, as current industry good practice (NRC, 2009).

Because the current report focuses primarily on the actual thermal-hydraulic and accident progression analysis and defers the actual PRA model changes for a subsequent report, there are some cases where the comparison to the standard has limited applicability. Table 3 notes these instances as appropriate.

2 There is a more recent version of this Standard; however, it has not yet been endorsed in a revision of Regulatory Guide 1.200.

9

Table 3 Comparison of this Project to the ASME/ANS PRA Standard PRA Standard Supporting Requirement for Capability Category II This Project SC-A1: Use provided CD The standard provides a qualitative CD definition. The definition used definition or justify the here is believed to be consistent with the definition, but is necessarily definition used.

quantitative. The basis for the definition (in terms of quantitative SC-A2: Specify the accident analysis and comparison of alternatives) is provided in quantitative surrogate used Section 2.

for CD and provide basis.

SC-A3: Specify SC for The existing SPAR model essentially satisfies the requirement. Any each safety function for changes proposed to the SC should not inappropriately remove criteria each accident sequence. for important safety functions.

SC-A4: Identify systems In the context of this project, this requirement applies only to changes in shared by units and how which the SC is modified to include systems that are shared by multiple they perform during units that were not previously in the SC. This is not believed to be the initiating events affecting case for any of the changes proposed.

both units.

SC-A5: Specify the These calculations generally use a mission time of 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. In several mission times being used cases, calculations are run further than 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> to establish whether (and use appropriate conditions are safe and stable.

mission times).

The MELCOR input model was developed, and the calculation boundary conditions were selected, after a detailed review of the plants design (e.g., Final Safety Analysis Report), operating envelope (e.g., Technical Specifications, Emergency Operating Procedures), and analytical basis SC-A6: Confirm that the (e.g., PRA systems notebooks). In cases where assumptions are made bases for the SC are that deviate from the operating philosophy of the plant (either due to consistent with the limitations in available information, limitations in the capability of the operating philosophy of the MELCOR model, or limitations in the scope of this project), these plant.

assumptions are documented. In addition, the site has had involvement with particular aspects of the project in order to further promote realism in this regard, including commenting on the factual basis of both this report and the underlying MELCOR calculation notebook.

For this project, the use of realistic plant-specific analyses means that SC-B1: Use realistic Capability Category III is being met, though the last clause in Category III generic analyses about using no assumptions that could yield conservative criteria is evaluations.

debatable.

SC-B2: Do not use expert Other than cases in which MELCOR models are based on expert judgment except when judgment, or judgment is used for selecting operator timings, these sufficient analyses do not use expert judgment. Some judgment will be inevitable information/analytical when the analyses are translated to specific changes in the SC for other methods are unavailable. similar plants.

SC-B3: Use analysis that is appropriate to the This requirement is clearly met by the use of MELCOR on a scenario and contains the scenario-specific basis for the sequences being studied.

necessary level of detail.

10

Table 3 Comparison of this Project to the ASME/ANS PRA Standard (continued)

PRA Standard Supporting Requirement for Capability Category II This Project MELCOR is not formally assessed in the same manner as a design-basis analysis code, but it does undergo some of the same steps (e.g., comparison of results against relevant experimental results). The SC-B4: Use appropriate documentation for this project provides some high-level information models and codes, and about this assessment but does not attempt to make a comprehensive use them within their limits argument for MELCORs applicability. In general, MELCOR is of applicability.

considered an appropriate tool for this application, and areas where it is known to have higher uncertainty (namely large-break LOCAs) are not studied.

SC-B5: Confirm that the All analyses have been reviewed by multiple experienced engineers to analyses results are confirm that the results are reasonable and acceptable. In addition, the reasonable and results for many analyses have been compared to similar previous acceptable. analyses performed by either the NRC or the nuclear industry.

SC-C1: Document the The analyses are being comprehensively documented. The judgment analyses to support PRA used in applying the analyses as the basis for making specific SPAR applications, upgrades, model changes will be documented separately.

and peer review.

SC-C2: Document the overall analysis comprehensively, including In general, the level of documentation being provided with these consideration of a provided analyses is consistent with this Supporting Requirement.

list of documentation areas.

SC-C3: Document the Numerous sensitivity studies have been performed and documented to sources of model capture relevant model uncertainties. Assumptions are documented uncertainty and related throughout, and major assumptions are captured in Section 2.

assumptions.

11

4. MAJOR PLANT AND MELCOR MODEL CHARACTERISTICS The following subsections describe aspects of the analyzed plant and the associated MELCOR model that are germane to the analysis performed in this report.

4.1 Byron Station Unit 1 Byron Station Unit 1 is a four-loop Westinghouse plant with a large dry containment. It has two high-head centrifugal charging pumps (CCPs), two intermediate-head safety injection (SI) pumps, two low-head SI (a.k.a., residual heat removal (RHR)) pumps, 3 and four cold-leg accumulators (ACCs) (one per loop). RHR pumps are required for high-pressure recirculation (HPR) (in order to provide sufficient net positive suction head to the high-head pumps when using the containment sump as a water source). The minimum technical specification refueling water storage tank (RWST) volume is 1,495 cubic meters (m3) (395,000 gallons (gal)).

Operators initiate the transfer of the water source for the emergency core cooling system (ECCS) pumps from the RWST to the containment sump when the RWST water level drops below 46-percent level, which is the RWST Lo-2 setpoint. It has been assumed that this transfer operation takes 10 minutes to account for the time required to perform the relevant procedural steps.

The containment spray (CS) system in injection mode relies on two pumps rated at 12.93 and 14.86 cubic meters per minute (m3/min) (3,415 and 3,925 gallons per minute (gpm)) for the A and B trains, respectively. Containment spray automatically actuates at 0.248 megapascal (MPa) (35.9 pounds per square inch absolute (psia)) containment pressure. Table 4 summarizes major plant characteristics.

Byron Unit 2 and Braidwood Units 1 and 2 are substantively similar to Byron Unit 1.

Table 4 Major Plant Characteristics for Byron Unit 1 Characteristic Value Design Type 4-loop Westinghouse Containment Type Large Dry Power Level 3,586.6 MWt (see text below)

Number of CCPs / SI Pumps 2/2 Number of RHR / CS Pumps 2/2 Shutoff Head for Charging/SI 17.9/10.7 MPa (2,600/1,550 psid)

Shutoff Head for RHR 1.31 MPa (190 psid)

Lowest PORV Opening/Closing Setpoint 16.2/16.067 MPa (2,350/2,330 psia)

Number of Cold-Leg Accumulators 1 per loop (4 total)

Nominal Operating Pressure 15.5 MPa (2,250 psia)

RWST Minimum Volume Technical Specification 1,495 m3 (395,000 gal)

The power level used in this report is the power level before a 1.63-percent power uprate approved in February 2014 (NRC, 2014a), since the majority of work was completed prior to that date. However, as later sensitivities will show, there is a compensating effect between the lower power level used versus the somewhat conservative decay heat curve used.

3 The low-head safety injection pumps are also used for residual heat removal (RHR). Byron documentation frequently refers to these pumps as RHR pumps. This convention is adopted in this report.

13

4.2 Byron MELCOR Model The Byron model used for this analysis is based on the as-built, as-operated plant, as understood from information compiled from discussions with plant operation and engineering staff, site visits, and review of plant documentation and operating procedures. Where information about Byron Unit 1 was unavailable, the model uses applicable data from a Seabrook TRACE model or from a Surry MELCOR model. 4 The input model was developed using MELCOR 1.8.6 and then converted to MELCOR 2.1 input format. All calculations were performed using MELCOR 2.1.

Appendix A of this report outlines the basic features of the Byron model. Included are the reactor trip signals modeled; the ECCS injection setpoints; the charging, SI, and residual heat removal (RHR) pump curves; details of the switchover of ECCS suction from the RWST to the containment sump; accumulator characteristics; CS system characteristics; containment fan cooler characteristics; and relief valve setpoints.

Figure 2 shows a plan view of the MELCOR model for the Byron reactor coolant system (RCS).

All four RCS loops are modeled individually. The detailed nodalization of the RCS loop piping as well as the reactor core and vessel upper plenum allows modeling of the in-vessel and hot-leg counter-current natural circulation during core heatup. This feature has been shown to be relevant even within the temperature ranges of interest in the analysis (i.e., those preceding core damage). The reactor coolant pumps (RCPs) are tripped on power failure, containment pressure greater than 1.36 bar (20 pounds per square inch gage (psig)), simultaneous RCS pressure less than 9.93 MPa (1,425 psig) and SI injection flow greater than 0.38 m3/min (100 gpm), or voiding in the coolant loop. 5 The core region is nodalized into 10 axial thermal response nodes (the MELCOR core package (COR)) mapped to 5 axial hydrodynamic volumes (the MELCOR control volume hydrodynamics package (CVH)), and comprises 5 radial rings.

Safety systems are modeled using injection points, and the relevant portions of the reactor protection system and control systems are modeled using MELCOR control functions. For the secondary side, both motor-driven auxiliary feedwater and diesel-driven auxiliary feedwater are modeled (including provisions for water level control). The containment is modeled as a single control volume. Containment sprays and fan coolers are also modeled.

The core decay power is based on the decay heat curve in the Byron Final Safety Analysis Report (FSAR). Note that the decay power from the Byron FSAR is noticeably higher than the default decay heat curve in MELCOR based on the 1979 American Nuclear Society (ANS) standard. The decay heat curve in the Byron FSAR is also based on the 1979 ANS Standard; however, the Byron FSAR curve incorporates a number of assumptions that result in a higher decay power relative to the curve in MELCOR that is based on the same ANS standard.

4 This is the same Surry model used in NUREG-1953.

5 Since the present analyses do not credit operator actions to trip the RCPs for some cases (which are identified in the associated sections), a global void fraction in the vicinity of the pumps of 10 percent is selected to represent a condition in which pump cavitation would prompt shutdown of these pumps. A system-level code such as MELCOR does not have the capability to directly model actual pump performance under degraded conditions.

14

Figure 2 Schematic of the Byron MELCOR RCS model To investigate the sensitivity of calculation results to the potential failure of pressurizer power-operated relief valves (PORVs) due to repeated cycling, some calculations assume that the valve fails open, partially open, or closed after 251 cycles. This value is derived from the median cumulative failure probability (using a per-demand failure probability obtained from (NRC, 2011b) and the number of demands). This simplified approach assumes that the per-demand failure rate of the valve is constant (i.e., no degradation in valve performance following repeated lifts) and the valve failure rate is insensitive to either steam, water, or a two-phase mixture passing through the valve. Generally speaking, the standardized plant analysis risk models treat the situation in a binary fashionthe valve is either stuck open after the first demand or it operates normally.

4.3 MELCOR Validation The MELCOR code is designed to run best-estimate accident simulations (NRC, 2005). The code has been assessed against a number of experiments and plant calculations. The current test suite for MELCOR contains over 170 separate input decks. MELCOR has been used for FSAR audit calculations (related to engineered safety feature design and performance, containment design and performance, design-basis accident analysis, and severe accident analysis); the post-September 11, 2001, security assessments; and the State-of-the-Art Reactor Consequence Analyses project. It has also been used to assess significance determination process issues. For these reasons, it is an ideal tool to use in this project.

15

Specific experiments and plant calculations relevant to this project for which MELCOR has been assessed include the following:

• Quench experiment 11, simulating a small-break loss-of-coolant accident with late vessel depressurization to investigate response of overheated rods under flooding conditions (Hering, 2007)

• the Three Mile Island Unit 2 accident (NRC, 1980)

• loss-of-fluid test (LOFT) LP-FP-2, simulating a large-break loss-of-coolant accident (Adams, 1985)

• Russian Academy of Sciences MEI experiments involving a spectrum of loss-of-coolant accident sizes to study critical flow and vessel response (e.g., Dementiev, 1977)

• NEPTUN experiments to test pool boiling models and void fraction treatment (NRC, 1992)

• General Electric level swell and vessel blowdown experiments characterizing single- and two-phase blowdown, liquid carryover, and water level swell (e.g., Appendix A to NRC, 1981)

• General Electric Mark III tests with steam blowdown into the suppression pool investigating vent clearing and heat transfer models

• containment thermal-hydraulic phenomena studied in various experimental facilities, including Nuclear Power Engineering Corporation for mixing and stratification (e.g., NUPEC, 1993), Heissdampfreaktor for blowdown into containment, and Carolinas Virginia Tube Reactor for steam condensation in the presence of noncondensables (SNL, 2008)

• small-scale experiments to test condensation models, including Wisconsin flat plate experiments (e.g., Huhtiniemi, 1993) and Dehbi tests 16

5. MELCOR RESULTS The detailed results for Byron are provided in Appendices B-F. 6 The following subsections summarize these results in a standard format: (1) a description of the scenario and calculation results, (2) a table of key assumptions and operator actions, (3) a table of results, (4) table(s) of the timing to key events and figures of merit, and (5) the results of sensitivity studies 7.

The following scenarios were analyzed for Byron:

• Small-break loss-of-coolant accident (SLOCA) to investigate the sequence timing for alignment of sump recirculation (Section 5.1)

• SLOCA to investigate the success criteria for steam generator (SG) depressurization and condensate feed (Section 5.2)

• SLOCA to investigate the sequence timing and minimal success criteria (SC) for feed and bleed (Section 5.3)

• The loss of DC bus 111 (LoDCB-111) with no diesel-driven auxiliary feedwater (DD-AFW) to investigate the sequence timing and minimal SC for feed and bleed (Section 5.4)

• Steam generator tube rupture (SGTR) events to investigate the sequence timing in the absence of successful operator actions (Section 5.5)

• Medium-break loss-of-coolant accident (MLOCA) to look at the minimal injection SC (Section 5.6)

• MLOCA to investigate the timing for low-pressure recirculation (LPR) (Section 5.7)

• Loss of shutdown cooling to investigate timing for recovery actions (Section 5.8)

In many cases, the analyzed sequence progressions make assumptions about the unavailability of systems and about operator actions that are not taken. These assumptions often stem from the particular sequence in the event tree that is being studied, which may not be the most probable sequence. In other cases, these characteristics are not included because of resource constraints. In all cases, the relevant subsections note these assumptions.

Note that after much of the analyses described in this report had been completed, a concern was raised regarding MELCORs treatment of liquid water in any air space (referred to as fog 6 Plots of reactor vessel water level in Appendices B-F show the actual water level rather than collapsed liquid level (i.e., they include two-phase effects where appropriate).

7 In describing the results of the sensitivity studies, the term negligible is intended to denote trivial changes in the timing figures of merit, relative to the precision of the simulation (e.g., ones of minutes). Meanwhile, terms such as little impact denote situations where there is generally no change in the sequence of events, the change in figures of merit would have no effect on PRA applications of the results, and the changes are the same order of magnitude as would be expected for many other unstudied uncertainties.

17

in MELCOR), when the hygroscopic model is activated in conjunction with the flashing model. 8 The MELCOR code developers are aware of the issue and are working to address this concern.

To determine the impact of the concern on the results presented in this report, several calculations have been rerun with the hygroscopic model turned off. There are no significant differences in the results, though changes on the order of minutes are seen in some key event timings (e.g., time of refueling water storage tank (RWST) depletion, time at which reactor coolant system (RCS) pressure falls below the residual heat removal (RHR) pump shutoff head) prior to core damage (CD) (or its avoidance). In rare cases, there are more noticeable effects (e.g., key event timing changes by an hour) later in the accident sequences when RCS conditions stabilize near the RHR pump shutoff head. However, these differences do not significantly affect the key conclusions made in this report.

5.1 Small-Break Loss-of-Coolant Accident-Sequence Timing for Alignment of Sump Recirculation This series of cases investigates the timing to RWST depletion (and thus switchover to sump recirculation) for SLOCAs in which safety injection (SI) and auxiliary feedwater (AFW) are available and high-pressure recirculation (HPR) is assumed to be unavailable. For these cases, plant operators are assumed to initiate SG cooldown to depressurize the primary system to allow for low-pressure sump recirculation. Other than actions taken to depressurize the SGs, very few operator actions are modeled. In reality, operators would enter Byron Emergency Procedure (BEP)-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment and start equipment as needed); transition to BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip reactor coolant pumps (RCPs), reduce RCS injection flow); and later transition to BEP ES-1.2, Post-LOCA Cooldown and Depressurization (e.g., dump steam to the condenser, fill the pressurizer).

The varied parameters are equivalent diameter break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), the available injection systems (one charging pump or one SI pump), and the SG cooldown initiation time and target depressurization rate. The cooldown initiation times are selected to envelope the time used in the licensee probabilistic risk assessment (PRA). In all cases, the break is located in the horizontal section of the cold leg in the loop containing the pressurizer. This location is a modeling choice, and it is not expected that the location of the break should make a significant difference in the results. Also, the SG power-operated relief valves (SG PORVs, a.k.a, atmospheric relief valves - the former is the term used in the Byron emergency procedures) are opened to commence secondary-side cooldown (in reality, either the SG PORVs or the condenser steam dump valves could be used to perform the cooldown). 9 Additional sensitivity cases (1a and 7a) were performed to study the consequences of the operators failing to initiate SG cooldown.

8 The concern with this situation is that MELCOR may not be correctly conserving mass during conditions where both the hygroscopic model and flashing model are active.

9 The SC for secondary-side cooldown in the Byron SPAR model is 3/4 SG PORVs or 1/12 turbine bypass valves (TBVs). For this analysis, 4/4 SG PORVs are used, due in part to the simplified approach taken for the secondary side of the Byron MELCOR model. For instance, the steam dump model has been tuned to avoid an early safety injection signal in normal transients, and so use of the TBVs for secondary-side cooldown may be unrealistic.

(Also, steam dumps would be unavailable following MSIV closure, at which point the SG PORVs would be used for the cooldown.) Using 3/4 SG PORVs challenges the steam header/MSIV/turbine control valve behavior, which is not a focus of the Byron model development. Thus, the Byron model is not well-suited to test the required valve lineup for secondary-side cooldown. Furthermore, results of sensitivity case 11j show that there is little difference between 3/4 SG PORVs and 4/4 SG PORVs for this scenario, as predicted by the MELCOR analysis.

18

The modeling uses a simplified approach and does not necessarily reflect actual plant operating procedures in some cases. 10 For this reason, the results should be used with caution.

Boundary conditions for this scenario are listed in Table 5 and Table 6. Results are provided in Table 6 through Table 9. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.1. Additional sensitivity studies and their results are listed in Table 10. Finally, in order to assist with extrapolation of these results to other situations, Figure 3 shows a plot of the time to sump switchover as a function of RWST delivered flow while Figure 4 shows a plot of peak containment pressure as a function of the number of fan coolers available and the containment free volume. In Figure 4, the situation with zero fan coolers triggers containment sprays (CSs), which is why the containment pressure is capped at 21 pounds per square inch gauge (psig) (which is the CS setpoint).

Table 5 SLOCA-Sump Recirculation Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable) 11 Primary side

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm

• 1 of 1 motor-driven auxiliary feedwater (MD-AFW) trains; 0 of 1 diesel-driven auxiliary feedwater (DD-AFW) trains Secondary side

• Condenser steam dumps available until main steam isolation valve (MSIV) closure due to high containment pressure

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps

• 2 of 2 containment spray (CS) trains ECCS/ESF

• 1 of 4 reactor containment fan cooler (RCFC) units

• 1 of 2 low-pressure recirculation (LPR) trains

• No high-pressure recirculation (HPR) pumps available

• RHR pumps are secured during dead-head phase, available upon demand

• No RWST/CST refill

• Actions to open pressurizer PORV for additional RCS depressurization are Operator actions not modeled (see text)

• Switchover of the ECCS injection source from the RWST to the containment sump is assumed to begin when the RWST level is at 46% (the procedural trigger for switchover) and to take 10 minutes to complete

• CCW to residual heat removal heat exchanger (RHR HX) is available (except Other as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

10 For instance, no effort is made to throttle charging pump or SI flow to control pressurizer level. As a result, the reactor coolant system (RCS) becomes water-solid for the 0.83-in. (2.11-cm) break cases. In the plant operating procedures, the operators are instructed to terminate safety injection if plant conditions (subcooling margin, secondary-side heat removal, RCS pressure, pressurizer level) are acceptable to prevent pressurizer overfill.

11 The choice of 50% open was simply a decision to explore an intermediate state that could be more limiting, wherein the valve is not fully open or fully closed. In the case of the valve failing closed, pressure would increase to the setpoint of the 2nd PORV, causing it to cycle.

19

Table 6 SLOCA-Sump Recirculation Results Equivalent Number of Diameter Target SG Cooldown Core Uncovery Core Damage b Case Charging/

Break Size Rate a (hh:mm) (hh:mm)

SI Pumps (in.)

100 °F/hr (55.6 °C/hr) 1 1/0 No No starting at 1.75 hr 1a 1/0 No Cooldown 10:41 12:15 100 °F/hr (55.6 °C/hr) 2 0/1 No No 0.83 starting at 1.75 hr 3 1/0 75 °F/hr (41.7 °C/hr) No No 4 0/1 starting at 2.25 hr No No 5 1/0 100 °F/hr (55.6 °C/hr) No No 6 0/1 starting at 2.75 hr No No 100 °F/hr (55.6 °C/hr) 7 1/0 00:33 No starting at 1.75 hr 7a 1/0 No Cooldown 00:33 06:41 100 °F/hr (55.6 °C/hr) 8 0/1 00:32 No 1.66 starting at 1.75 hr 9 1/0 75 °F/hr (41.7 °C/hr) 00:33 No 10 0/1 starting at 2.25 hr 00:32 No 11 1/0 100 °F/hr (55.6 °C/hr) 00:33 No 12 0/1 starting at 2.75 hr 00:32 No a Times for SG depressurization are from time = 00:00 b Defined as peak cladding temperature (PCT) = 2,200 °F (1,204 °C)

For the 1.66-in. (4.22-cm) break cases, the RCS depressurizes because of the break. The system depressurizes further as a result of the operator-initiated SG cooldown, until the RCS pressure drops below the RHR dead-head pressure. After the RWST level decreases to 46 percent (RWST Lo-2), the RHR system is realigned to sump recirculation. The LPR flow is sufficient to refill the pressurizer and keep the core cool. The results for Case 7a clearly show that RCS pressure does not fall below the RHR pump dead-head pressure unless the operators initiate SG cooldown. In Case 7a, the operators fail to initiate cooldown, and CD occurs after the loss of high-pressure injection (HPI) due to RWST depletion (HPR is not modeled for these cases).

For the 0.83-in. (2.11-cm) break case without SG cooldown, the RCS does not depressurize below the RHR dead-head pressure. Thus, CD occurs in Case 1a because the RCS remains at high pressure and HPR is assumed to be not available. For the other 0.83-in. (2.11-cm) break cases, SG cooldown allows the RHR system to operate in sump recirculation mode to prevent CD. However, the pressure does not fall below the RHR dead-head pressure until after HPI stops. The end of HPI upon RWST low level causes the reduction in pressure because the coolant lost through the cold leg break is no longer replaced by water from the RWST.

For both equivalent break sizes, there is little difference in the sequence of events when RCS injection is provided by either the charging pump or the SI pump (recall that AFW is available for removing decay heat). In general, RWST depletion occurs minutes to tens of minutes earlier for the SI pump cases. This is because the SI pump has a greater capacity at pressures below about 1,100 psi (7.6 megapascals (MPa)) and because the RCS is below 1,100 psi (7.6 MPa) for much of the accident in all cases except Case 1a (0.83-in. (2.11-cm) break without SG cooldown).

20

Table 7 SLOCA-Sump Recirculation Key Event Timings Case 1 Case 1a Case 2 Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 00:06 00:06 00:06 Charging pump 00:06 00:06 -- 00:06 -- 00:06 --

injection SI pump injection -- -- 00:07 -- 00:07 -- 00:07 RCP trip 00:39 00:39 00:08 00:39 00:08 00:39 00:08 MSIVs close 02:12 02:52 02:12 02:49 02:49 03:09 03:10 RHR injection from RWST RWST Lo-2 a 06:07 07:14 05:50 06:17 06:08 06:20 06:16 Switchover to sump recirc 06:17 07:24 06:00 06:27 06:18 06:30 06:26 completed Start of injection 06:28 -- 06:10 06:46 06:36 06:53 06:42 from the sump Core uncovery -- 10:41 -- -- -- -- --

Core damage -- 12:15 -- -- -- -- --

Case 7 Case 7a Case 8 Case 9 Case 10 Case 11 Case 12 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 Charging pump 00:01 00:01 -- 00:01 -- 00:01 --

injection SI pump injection -- -- 00:02 -- 00:02 -- 00:02 RCP trip 00:02 00:02 00:02 00:02 00:02 00:02 00:02 MSIVs close 00:22 00:22 00:21 00:22 00:21 00:22 00:21 RHR injection 03:32 -- 03:09 04:23 04:01 04:21 03:48 from RWST RWST Lo-2 a 04:21 05:45 03:50 05:28 04:30 05:02 04:26 Switchover to sump recirc 04:31 05:55 04:00 05:38 04:40 05:12 04:36 completed Start of injection 04:32 -- 04:01 06:02 04:41 05:15 04:36 from the sump Core uncovery 00:33 00:33 00:32 00:33 00:32 00:33 00:32 Core damage -- 06:41 -- -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

These SLOCA cases assume operators take action to depressurize the secondary system.

However, plant operating procedures also direct the operators to use the pressurizer PORVs to depressurize the RCS while they are using the SG PORVs to depressurize the secondary system. This action is not included in the MELCOR model for simplicity reasons and because it is not part of the minimal SC in the licensees model. The Byron SPAR model requires a pressurizer PORV for successful RCS cooldown and depressurization. MELCOR results support the licensees PRA treatment of this scenario for equivalent break sizes larger than 0.83 in. (2.11 cm). For smaller breaks, a pressurizer PORV may be needed to prevent CD.

Alternatively, throttling of SI/charging or use of auxiliary spray may be sufficient.

21

Table 8 SLOCA-Sump Recirculation Margins Case Case Case Case Case Case Case 1 1a 2 3 4 5 6 1,204 °C (2,200 °F) minus a 852 CD a 852 a 852 a 852 a 852 a 852 PCT (in °C)

Completion of sump realignment-RHR entry -00:11 c -- -00:11 -00:19 -00:17 -00:23 -00:15 time b (hh:mm)

CS setpoint-peak 94.0 50.7 96.3 87.0 92.4 83.5 90.4 containment pressure (kPa

[13.6] [7.4] [14.0] [12.6] [13.4] [12.1] [13.1]

[psi])

Case Case Case Case Case Case Case 7 7a 8 9 10 11 12 1,204 °C (2,200 °F) minus 847 CD a 852 847 a 852 847 a 852 PCT (in °C)

Completion of sump realignment-RHR entry 00:59 c -- 00:51 01:15 00:40 00:51 00:48 time b (hh:mm)

CS setpoint-peak 32.5 16.4 34.8 24.8 23.6 22.1 20.4 containment pressure (kPa

[4.7] [2.4] [5.0] [3.6] [3.4] [3.2] [3.0]

[psi])

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b This parameter measures the difference between the time at which RCS pressure drops below the RHR shutoff head (i.e., the time at which low-pressure injection (LPI) can begin) and the time at which operators realign RHR pump suction to draw from the containment sump. This is important because HPR is assumed to be not available for this accident scenario.

c The RCS pressure never drops below the RHR pump dead-head pressure.

Table 9 SLOCA-Sump Recirculation Cooldown Rates Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Target a 100 100 75 75 100 100 1 hr after start of cooldown 125 128 111 113 134 137 2 hr after start of cooldown 107 109 94 96 111 113 3 hr after start of cooldown 88 90 83 84 90 92 Case 7 Case 8 Case 9 Case 10 Case 11 Case 12 Target a 100 100 75 75 100 100 1 hr after start of cooldown 101 100 78 81 104 102 2 hr after start of cooldown 100 103 75 73 95 88 3 hr after start of cooldown 82 66 61 61 77 59 a Rates are in F/hr In these cases, the condenser steam dumps open immediately following the reactor trip, as is expected, but the steam dumps cause SG and RCS pressure to drop more severely than one would expect, for reasons that have not yet been determined. However, a subsequent calculation in which the steam dumps were disabled was performed. Results from this sensitivity study show that, while the RCS pressure behavior immediately after the trip is different, the RCS pressure quickly matches the pressure trend for the case with the steam dumps enabled. Thus, the early steam dump actuation has little impact on overall system behavior.

22

Table 10 SLOCA-Sump Recirculation Sensitivity Studies Case Sensitivity Justification Results 5a Extend to This case was run until When Case 5 is extended to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, the 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> without CST refill CST depletes at approximately 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.

to see if CST refill shortly (Note that this case assumes that the CST after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> should be level is at the minimum allowed by the plant noted as a consideration in Technical Specifications. The SGs dry out at the accident sequence 44 hours5.092593e-4 days <br />0.0122 hours <br />7.275132e-5 weeks <br />1.6742e-5 months <br />. If one assumes that the CST is full analysis (which represents a significantly larger volume over the Tech Spec minimum level), CST depletion would be further delayed by at least 32 hours3.703704e-4 days <br />0.00889 hours <br />5.291005e-5 weeks <br />1.2176e-5 months <br /> based on the average AFW flow rate at 30 hours3.472222e-4 days <br />0.00833 hours <br />4.960317e-5 weeks <br />1.1415e-5 months <br />.) After CST depletion, RCS pressure begins increasing. The RHR pump is quickly dead-headed by the rising pressure, thus ending injection to the RCS. Core water level begins falling just before the end of the calculation. CD does not occur before 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, but it is imminent.

11a 1 CCP AND This is a nonminimal In this case, the RWST level reaches Lo-2 at 1 SI pump combination, which in this 2:40, as opposed to 5:02 in Case 11. As a case may lead to earlier result, there is no ECCS injection for RWST depletion, potentially 20 minutes, between the time at which the increasing the severity of RWST depletes and the time at which RCS the accident pressure falls below the RHR pump shutoff head. There is no heatup during this period because the RCS water level is several meters above TAF.

11b 4/4 RCFC This will reduce Containment pressure and temperature are containment temperature lower with 4/4 fan coolers available compared and pressure to the case with 1/4 fan coolers. This has a minor impact on heat losses from the RCS in the first few hours of the accident, which in turn impacts RCS pressure and thus ECCS flow rates. As a result, RWST depletion occurs about 25 minutes earlier in Case 11b than in Case 11.

11c Set target SG Current logic simplistcly There is less water on the secondary side of water level in uses normal operating level the SGs due to the lower AFW target level.

AFW logic to (24.25m, which is ~60% The lesser mass of water heats up and boils 22.90 m (it is NR) as the target. more rapidly than the greater mass of water in 24.25 m Procedure BEP 0 instructs the base case, resulting in more SG relief otherwise) operators to maintain SG valve cycling before actions are taken to cool water level above 31% NR down the plant in the sensitivity case.

level for adverse Otherwise, the SG water level has little impact containment conditions on the plant thermal hydraulic response in this (containment pressure scenario.

>5 psig)b.

23

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11d Model This step is included in the The procedural conditions required to secure operator EOPs, notably in both ECCS pumps (i.e., adequate subcooling and actions to BEP-1 (Loss of Reactor or pressurizer level) are not met until after the throttle pumps Secondary Coolant) and switchover to recirculation. Normally, to prevent BEP ES-1.2 (Post LOCA operators would secure all pumps except pressurizer Cooldown and one charging pump, and use that charging from going Depressurization) pump to maintain adequate pressurizer level solid and RCS subcooling. However, this scenario assumes that HPR is unavailable, so charging pumps are unavailable for controlling level. If the RHR pumps are stopped, RCS subcooling would quickly become unacceptable, triggering the yellow indicator on the core cooling critical safety function status tree. This in turn would prompt operators to restart available ECCS pumps, per procedure 1BFR-C.3. If pumps are not restarted, the result would be CD. If the pumps are restarted, then the scenario would progress as if no action was taken to stop and restart the pump. This has been confirmed by MELCOR calculations.

11e Use the The model used for critical The HFM critical flow model yields slightly Homogenous flow can have a significant greater two-phase and single-phase steam Frozen Model impact on flow through the break flow rates compared to the HEM, though (HFM) instead cold leg break the slight increase in break flow has little of the impact on key event timings.

Homogneous Equilirbium Model (HEM) for critical flow 11f 1.63% power 1.63% MUR power uprate The higher power level results in slightly higher increase that was recently approved auxiliary feedwater and SG relief valve flow by NRC (NRC, 2014a)a rates compared to the base case, but has little impact on key event timings and calculation figures of merit.

11g Delay RCP BEP 0 directs operators to Delaying RCP trip by 10 minutes results in trip by trip RCPs if SI flow greater losses through the break. As a result, 10 minutes >100 gpm and RCS RHR injection begins 30 minutes earlier in pressure <1,425 psig; Case 11g than in Case 11. RWST depletion however, this action occurs occurs approximately 20 minutes earlier in at Step 20, so there will be Case 11g than in Case 11 due to the earlier a delay from reactor trip RHR injection.

(shortly after which the above two conditions are true) until operators take action to trip RCPs 24

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11h Use the ANS The MELCOR model The ANS standard decay heat curve decay heat currently uses a decay heat implemented in MELCOR yields lower decay standard as curve from the plants heat relative to the Byron FSAR decay heat encoded in FSAR curve. As a result, the RCS cools significantly MELCOR even before actions are taken to initiate cooldown using the SG PORVs. However, there is little impact on the time of RWST depletion.

11i Adjust core This is approximately equal Increasing the core bypass flow has little bypass flow to to the maximum bypass impact on key event timings.

6% of total flow cited in the FSAR RCS flow 11j Use 3/4 SG The SC for secondary-side This case shows that 3/4 SG PORVs is PORVs for cooldown is 3/4 SG PORVs sufficient for secondary-side cooldown for this cooldown or 1/12 TBVs particular scenario. Disabling the SG PORV instead of on one of the SGs has little effect on key event 4/4 SG timings.

PORVs 11k Use This case will show if CSs With no fan coolers available, containment 0/4 RCFC actuate in the absence of pressure reaches the CS setpoint at fan coolers, and if so, the 80 minutes. With both spray trains running, effect on the time to sump the RWST reaches Lo-2 approximately switchover 25 minutes after spray initiation, or approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> before operators begin the controlled cooldown. At this time, RCS pressure is significantly above the RHR pump shutoff head, so LPR is unavailable immediately after RWST depletion. As a result, core water level quickly drops below the TAF, and CD occurs at approximately 02:25 (i.e., 20 minutes before operators initiate the cooldown). This case shows that at least one fan cooler is required to prevent CS actuation, which results in rapid RWST depletion and CD unless operators take earlier action to initiate SG cooldown.

25

Table 10 SLOCA-Sump Recirculation Sensitivity Studies (continued)

Case Sensitivity Justification Results 11l Use 2/2 This case will show the In this case, RWST level decreases much charging effect of maximum injection more rapidly than it does in Case 11. Not all of pumps and on the time to sump the procedural requirements to reduce ECCS 2/2 SI pumps, switchover flow are met, so all high- and with control of intermediate-pressure ECCS pumps continue Pressurizer to inject to the RCS. RWST Lo-2 occurs at level 1:34 minutes, compared to 5:02 in Case 11.

Assuming that operators stop injection 10 minutes after RWST Lo-2 as part of the switchover to sump recirculation, and given that HPR is unavailable, only LPR is available from 1:44 until the end of the transient.

Operators do not begin the cooldown until 2:45, so there is a long period of time during which there is no injection to the RCS. Water level drops below TAF at 2:46 and falls to about 1/3 active fuel height by 3:22, when RCS pressure finally drops below the RHR pump shutoff head. LPR quickly refills the RCS and quenches the fuel. PCT is approximately 800 °C (1472 °F), which is below the CD surrogate temperature of 2200 °F. (Note that inadequate core cooling would also prompt a depressurization at generally the same time as is assumed here.)

a Note that most technical work for the present study preceded approval of the power uprate.

b The adjustment here includes an additional reduction of 0.33 m to account for the difference between normal operating level in the Byron reference material (24.3 m) and steady-state level calculated by MELCOR (23.97 m).

Note that in the 0.83-in. break cases, the cooldown rate in the first hour following operator action to initiate cooldown is greater than the target value. This is illustrated by Table 9, which shows the cooldown rate at 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />, 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after operator action to initiate cooldown. The first-hour cooldown rate is up to 40 degrees Fahrenheit/hour (F/hr) greater than the target rate.

However, the cooldown rate averaged over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the start of the cooldown is less than the target rate for Cases 1, 2, 5, and 6, and less than 10 degrees F/hr greater than the target in Cases 3 and 4. It is worth noting that RWST depletion occurs more than 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> after the start of cooldown, and that RCS temperature is relatively constant at the time of RWST depletion.

Furthermore, the faster cooldown would most likely have little impact on the time to RWST depletion because charging and SI pumps are operating at their maximum flow rates for much of the cooldown period (as demonstrated by the consistent time of RWST depletion for Cases 1, 3, and 5 and for Cases 2, 4, and 6). For these reasons, there would be little difference in the plant response if the cooldown rate was maintained at the target rate over 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, compared to the actual results (in which the cooldown rate was much higher than the target for the first hour and then less than the target later in the cooldown period). Thus, the 0.83-in. break cases are acceptable given that the high initial cooldown rate does not affect the takeaways from this scenario.

For the 1.66-in. break cases, cooldown rates greatly exceeded the target rates, which necessitated major modifications of the cooldown logic implemented in the MELCOR model.

26

After rerunning the cases with the improved cooldown logic (i.e., adjustments to the logic that the MELCOR model uses to emulate the operators actions to cooldown the plant), cooldown rates are approximately equal to the target rates for the 1.66-in. break cases. Results for the 1.66-in. break cases presented in this report use the improved cooldown logic.

Figure 3 Time of RWST depletion as a function of RWST volume All of the cases described above assume that the component cooling water (CCW)-to-residual heat removal heat exchanger (RHR HX) is available throughout the transient. The RHR HX provides a means of decay heat removal during the emergency core cooling system (ECCS) recirculation from the containment sump. This heat removal mechanism acts together with the AFW system and the containment fan cooler to accomplish long-term decay heat removal. The above cases have been rerun assuming the RHR HX is unavailable. These sensitivity calculations show no differences in the results up to the time of RWST depletion, and little differences during ECCS recirculation. Thus, the RHR HX is not needed to prevent CD for the SLOCA Sump Recirculation scenario. This is because AFW is assumed to be available and is removing most of the decay heat, so ECCS is needed primarily to keep the fuel covered and to remove a small fraction of the decay heat.

27

Figure 4 Peak containment pressure as a function of containment volume and the number of available fan coolers for Case 11 The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (i.e., one train of centrifugal charging pump (CCP) or SI and one train of RHR) and the unavailability of HPR.

• For the smaller breaks in the SLOCA range, SG depressurization is sufficient for achieving RHR conditions at the time of RWST switchover if SI/charging injection is manually reduced allowing the RCS pressure to decrease. Otherwise, operator action to use the PORV to further depressurize the primary side is required. Alternatively, CD is still averted if RCS pressure is allowed to naturally drop below the RHR dead-head pressure as a ramification of losing high-head injection during switchover (since HPR is failed in these cases).

• For the larger break studied in the SLOCA range, SG depressurization is sufficient to reduce the RCS pressure below the RHR shutoff head, allowing RHR injection and preventing CD.

• For all break sizes, AFW is sufficient for late decay heat removal, and the RHR HX is not required as an additional minimal SC. Condensate storage tank (CST) refill after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> would be needed, if only the Technical Specification CST volume is credited (see Sensitivity Case 5a).

28

• A sensitivity study for a 4.2-cm (1.66-in.) break considered the case of no containment fan coolers and predicted that CSs would actuate, resulting in earlier RWST depletion and CD.

• General caution: The situations with greater than minimal ECCS flow will result in earlier RWST depletion. Those in the smaller break size of the SLOCA range may also experience greater repressurization later in the transient due to the smaller break sizes inability to relieve pressure out of the break as quickly as the larger breaks.

5.2 Small-Break Loss-of-Coolant Accident-Success Criteria for Steam Generator Depressurization and Condensate Feed This series of cases investigates a scenario in which SI and condensate feed (due to an assumed lack of AFW) are used to mitigate an SLOCA. To utilize condensate feed, operators must take action early in the accident to depressurize the SGs below the shutoff head of the condensate booster pumps at 670 psig. Other than actions to depressurize the SGs and to restart the booster pumps for injection, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed); transition to BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip RCPs, reduce RCS injection flow);

and later transition to BEP ES-1.2, Post-LOCA Cooldown and Depressurization (e.g., dump steam to the condenser, fill the pressurizer). Operators would also be directed by BEP-0 to perform actions in BFR-H.1, Response to Loss of Secondary Heat Sink, due to insufficient feed flow to the SGs.

The varied parameters for this scenario are equivalent break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), available HPI (one charging pump or one SI pump), and the time at which operators begin SG cooldown (10 minutes or 20 minutes). In all cases, the break is located in the horizontal section of the cold leg in the loop containing the pressurizer. Also, the SG PORVs are opened to commence secondary-side cooldown. 12 Boundary conditions for this scenario are listed in Table 11. Results are shown in Table 12 through Table 15. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.2.

Sensitivity studies and their results are listed in Table 16.

For the 0.83-in. (2.11-cm) break cases, SG cooldown and loss of HPI (due to depletion of the RWST) together cause RCS pressure to drop below the shutoff head of the RHR pumps, thus allowing for LPR flow. In all cases, LPR quickly follows RWST depletion. Eventually, the SGs boil completely dry due to the loss of all feedwater (FW) injection following depletion of the condenser hotwell. (Refill or alignment of alternative sources of water is not considered here.)

Once the secondary heat sink is lost, RCS pressure increases quickly because the break is not large enough to accommodate the expansion of RCS coolant volume associated with the core heatup. The rise in pressure cuts off LPR, causing the level in the vessel to drop to below the top of active fuel (TAF). The pressure continues to rise until it reaches the pressurizer PORV setpoint. Valve cycling causes the PORV to fail open, thus causing pressure to decrease, but the drop in pressure occurs too lateCD occurs due to the lack of makeup to the RCS.

12 Specifically, 4/4 SG PORVs are used instead of 3/4 SG PORVs or 1/12 TBVs. See footnote 9 for more information.

29

Table 11 SLOCA-Condensate Feed Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable)

Primary side

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm

• 0 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• Condenser steam dumps available until MSIV closure Secondary side

• SG PORVs do not fail open a

• Feedwater source is assumed to be the condenser hotwell

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps

• 0 of 2 CS trains ECCS/ESF

• 1 of 4 RCFC units

• LPR

• HPR unavailable

• RHR pumps are secured during dead-head phase, available upon demand

• No RWST/CST refill Operator actions

• Switchover of the ECCS injection source from the RWST to the containment sump is assumed to begin when the RWST level is at 46% (the procedural trigger for switchover) and to take 10 minutes to complete Other

• CCW to RHR HX is available (except as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

Table 12 SLOCA-Condensate Feed Results Equivalent Number of Core Uncovery Core Damage Case Break Size Charging/ SG Cooldown a (hh:mm) (hh:mm) b (in.) SI Pumps 1 1/0 100 °F/hr (55.6 °C/hr) 11:33 12:22 c 2 0/1 starting at 10 min 11:41 12:41 c 0.83 3 1/0 100 °F/hr (55.6 °C/hr) 11:39 12:38 c 4 0/1 starting at 20 min 11:44 12:44 c 5 1/0 100 °F/hr (55.6 °C/hr) 00:37 --

6 0/1 starting at 10 min 00:36 --

1.66 7 1/0 100 °F/hr (55.6 °C/hr) 00:35 --

8 0/1 starting at 20 min 00:34 --

a Note that the licensees assumptions on the time to initiate SG cooldown were somewhat ambiguous based on the documentation available, but that the implementation time used here (either 10 or 20 minutes after reactor trip, depending on the case) is believed to be consistent with the intent of the relevant plant procedures b Defined as PCT = 2,200 °F (1,204 °C) c Early depressurization and condensate feed were successful in preventing CD early; CD occurs late due to lack of hotwell refill (or alignment of an alternate FW source) 30

Table 13 SLOCA-Condensate Feed Key Event Timings Case 1 Case 2 Case 3 Case 4 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 Charging pump injection 00:06 -- 00:06 --

SI pump injection -- 00:08 -- 00:08 RCP trip 00:19 00:08 00:28 00:08 MSIVs close 00:57 00:54 01:04 01:02 RHR injection -- -- -- --

Condenser hotwell depletion 03:00 02:57 03:08 03:05 RWST Lo-2 a 05:48 05:14 05:50 05:17 Switchover to sump recirc completed 05:58 05:24 06:00 05:27 Start of injection from the sump 05:59 05:26 06:01 05:29 Core uncovery 11:33 11:41 11:39 11:44 Core damage 12:22 12:41 12:38 12:44 Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 Charging pump injection 00:01 -- 00:01 --

SI pump injection -- 00:02 -- 00:02 RCP trip 00:03 00:02 00:03 00:02 MSIVs close 00:23 00:23 00:21 00:21 RHR injection 02:03 02:05 02:11 02:10 Condenser hotwell depletion 02:58 02:58 03:06 03:07 RWST Lo-2 a 02:58 02:54 03:06 03:05 Switchover to sump recirc completed 03:08 03:04 03:16 03:15 Start of injection from the sump 03:09 03:04 03:16 03:15 Core uncovery 00:37 00:35 00:35 00:34 Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

Table 14 SLOCA-Condensate Feed Margins Case 1 Case 2 Case 3 Case 4 1,204 °C (2,200 °F) minus PCT (in °C) CD CD CD CD Completion of sump realignment-RHR entry time

-00:01 -00:02 -00:01 -00:02 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 39.5 [5.7] 39.2 [5.7] 39.5 [5.7] 39.3 [5.7]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) a a 852 a 852 a 852 a 852 Completion of sump realignment-RHR entry time 01:05 00:59 01:05 01:05 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 61.1 [8.9] 59.6 [8.6] 57.0 [8.3] 54.3 [7.9]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

31

Table 15 SLOCA-Condensate Feed Cooldown Rates Case 1 Case 2 Case 3 Case 4 Target a 100 100 100 100 1 hr after start of cooldown 98 108 104 115 2 hr after start of cooldown 99 104 101 107 3 hr after start of cooldown 85 86 85 88 Case 5 Case 6 Case 7 Case 8 Target a 100 100 100 100 1 hr after start of cooldown 102 106 103 104 2 hr after start of cooldown 106 106 110 108 3hr after start of cooldown 89 88 87 90 a Rates are in F/hr.

The transient behavior is markedly different for the 1.66-in. (4.22-cm) break cases. Here, the pressure in the RCS drops rapidly because of loss of coolant through the break combined with secondary-side cooldown initiated early in the transient. Inventory losses through the break and flashing due to the drop in RCS pressure cause the water level in the core to drop just below the TAF within 40 minutes of the start of the accident, though charging or SI pump flow is able to maintain level near the TAF (thus preventing fuel heatup). Condensate booster pump injection to the SGs begins less than 30 minutes after water level drops below the TAF. Together, condensate booster flow to the SGs and charging or SI pump injection to the RCS provide decay heat removal. Meanwhile, the ECCS injection continues to maintain RCS level just below the TAF until RCS pressure drops below the RHR pump shutoff head. At this time, low-pressure injection (LPI) begins and quickly restores RCS level to above the TAF. The RHR pump continues to draw from the RWST until the sump switchover level is reached, at which point operators are assumed to successfully switch the injection source to the sump. After the SGs boil dry, decay heat removal and reactor vessel inventory are maintained by LPR flow, thus preventing CD.

For all cases, the time at which operators begin to depressurize the SGs has little impact on the transient progression. For the smaller break cases, SG depressurization permits early decay heat removal via condensate feed and significantly delays CD (although hotwell refill or alternate FW injection is still required). For the 1.66-in. (4.22-cm) cases, core uncovery occurs at approximately 35 minutes into the accident, and uncovery lasts for approximately the same length of time in each case. There is no fuel heatup for any of the 1.66-in. (4.22-cm) break cases.

Note that this scenario experienced issues with the plant cooldown rate similar to those described in Section 5.1: 0.83-in. cases exceeded the target cooldown rate by a relatively small margin, whereas 1.66-in. cases greatly exceeded the target cooldown rate. For this reason, the 1.66-in. cases were all run with improved cooldown logic (i.e., adjustments to the logic that the MELCOR model uses to emulate the operators actions to cooldown the plant), which yielded the improved results that are presented in this report. Cooldown rates for each case are presented in Table 15.

32

Table 16 SLOCA-Condensate Feed Sensitivity Studies Case Sensitivity Justification Results 4a Model operator This action is part Operators open the PORV for a short period of time actions to of BEP ES-1.2. starting at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> into the accident. Opening the PORV depressurize Also, the Byron does not reduce RCS pressure below the RHR pump RCS using the SPAR model shutoff head before rising pressurizer level and loss of Pressurizer requires a adequate subcooling would prompt operators to reclose PORV pressurizer PORV the PORV. CD eventually occurs after RWST depletion for successful and SG dryout because RCS pressure remains above cooldown. the RHR pump shutoff head.

(However, the licensees PRA does not.)

7a 1 CCP AND See Table 10 In this case, the RWST level reaches Lo-2 at 2:33, as 1 SI pump opposed to 3:06 in Case 7. In both cases, LPI begins OR before RWST depletion.

2 CCP 7b 4/4 RCFC This will reduce Containment pressure and temperature are lower with containment 4/4 fan coolers available compared to the case with 1/4 temperature and fan coolers, but this has little impact on the accident pressure sequence timings and no impact on PCT for this scenario.

7c Set target SG See Table 10 Modifying the target SG water level from 24.25 m to water level in 22.90 m delays hotwell depletion by approximately AFW logic to 75 minutes but has a negligible impact on other key event 22.90 m timings for this scenario.

7d Model operator See Table 10 Operators are directed in BEP ES-1.2 to secure ECCS actions to pumps if RCS subcooling is acceptable and pressurizer throttle pumps level exceeds a given setpoint. These conditions are not to prevent met until after the switchover to recirculation. See the pressurizer discussion for Case 11d in Table 10.

from going solid 7e Use the HFM The model used The HFM critical flow model yields slightly greater (instead of for critical flow can two-phase and single-phase steam break flow rates HEM) for have a significant compared to the HEM, but the differences in key event critical flow impact on flow timings and calculation figures of merit are negligible.

through the cold leg break 7f 1.63% power 1.63% MUR The higher power level results in slightly higher auxiliary increase power uprate that feedwater and SG relief valve flow rates compared to the was recently base case and slightly earlier RWST depletion, but the approved by NRC differences in key event timings and calculation figures of (NRC, 2014a) merit are negligible.

7g Delay RCP trip See Table 10 Delaying RCP trip by 10 minutes results in slight by 10 minutes differences in the plant thermal hydraulic response, but the differences in key event timings and calculation figures of merit are negligible.

33

Table 16 SLOCA-Condensate Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 7h Use the ANS The MELCOR The ANS standard decay heat curve implemented in decay heat model currently MELCOR yields lower decay heat relative to the Byron standard as uses a decay heat FSAR decay heat curve. As a result, depletion of water encoded in curve from the in the condenser hotwell is delayed by approximately MELCOR plants FSAR 1 hr. compared to Case 7. After RWST depletion, most of the heat is removed by the RHR HX, and so SG dryout occurs significantly later in the sensitivity case compared to the base case (>24 hr. vs. ~17 hr.), due to the lower decay heat load.

7i Adjust core This is approx. Increasing the core bypass flow has little impact on key bypass flow to equal to the event timings.

6% of total maximum bypass RCS flow flow cited in the FSAR 7j Use 3/4 SG The SC for This case shows that 3/4 SG PORVs is sufficient for PORVs for secondary-side secondary-side cooldown for this particular scenario.

cooldown cooldown is instead of 3/4 SG PORVs or 4/4 SG PORVs 1/12 TBVs As in the SLOCA-Sump Recirculation (Section 5.1) cases, the procedural action to depressurize the RCS using the pressurizer PORVs is not modeled in these cases. Instead, this action is included in sensitivity Case 4a. In this sensitivity case, the PORV is opened if subcooling is adequate and if pressurizer level is sufficiently low. These conditions are first met at approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> in Case 4a. The PORV is opened for a short period of time, after which pressurizer level quickly increases and subcooling quickly decreases. At this point, the procedure would prompt operators to close the PORV. Results of the sensitivity calculation show that operator action to open the PORV is not sufficient for reducing RCS pressure below the RHR shutoff head. Once the RWST depletes, RCS pressure remains above the RHR pump shutoff head, thus preventing further ECCS injection. Thus, there is little difference between the sensitivity case and Case 4.

From the figures in Appendix B, it appears that the SG PORVs are cycling a large number of times, such that one would expect the PORVs to eventually fail. While this is certainly the case in the calculations, the cycling behavior is a direct result of the modeling approach in MELCOR.

In the MELCOR input model, the fraction that the PORV is open is controlled by the SG depressurization rate. When the depressurization rate is greater than (or less than) the target rate, the PORV is partially closed (or opened). While control functions used to model SG depressurization are smoothed to limit the effects of instantaneous changes in valve open fraction, the valve response is still much more rapid than one might expect from this type of valve. There is also potential departure between the responsiveness of the mathematical representation versus that of an actual operator. Finally, it is also probable that the plant operators would adjust SG PORV position slowly to avoid valve failure due to excessive cycling.

Thus, while the calculation results show excessive valve cycling, these results should be viewed with caution.

Note that the condenser steam dumps cause a greater-than-expected drop in pressure when they open following the reactor scram. (See the discussion in Section 5.1.) To determine the effects of the steam dumps on the accident progression, Case 1 was rerun without the steam dumps. Results from this sensitivity study show that RCS pressure behavior for this case is 34

very similar to the pressure behavior in Case 1. Thus, the early steam dump actuation has little impact on the overall system behavior.

All of the cases described above assume that the CCW to RHR HX is available throughout the transient. For this scenario, the RHR HX acts together with the containment fan cooler to accomplish long-term decay heat removal (again recall that refill of alignment of alternative sources of water following hotwell depletion is not considered). The above cases have been rerun assuming the RHR HX is unavailable. For the smaller (0.83-in. (2.11-cm)) break cases, the RHR HX has little effect; these cases go to CD in the long-term whether or not the heat exchanger is available. However, the heat exchanger plays an important role in the larger (1.66-in. (4.22-cm)) break cases. When available, it is sufficient to remove decay heat by cooling the water from the sump before recirculating it through the RCS. However, when the heat exchanger is unavailable, only the containment fan cooler is available to remove decay heat. Decay heat exceeds the heat removed by the fan cooler, and so the average temperature and the pressure in the RCS increase during the ECCS recirculation phase (i.e., following hotwell depletion). Eventually, the RCS pressure exceeds the RHR dead-head pressure. With high-pressure ECCS recirculation unavailable, there is no further injection to the RCS. This situation leads to CD in all four of the 1.66-in. (4.22-cm) break cases. Thus, the RHR HX is necessary to prevent CD for the 1.66-in. (4.22-cm) break cases, if feedwater is not sustained.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (1 Charging or 1 SI pump and 1 RHR pump) and the unavailability of HPR.

• For smaller breaks in the SLOCA range, early SG depressurization and condensate feed is sufficient, but failure to refill the hotwell or align alternate SG injection will result in CD later in the event.

- The same conclusion may apply even if HPR is available.

- For some conditions, throttling of SI/charging or use of the pressurizer PORV may be needed to achieve LPR conditions prior to RWST switchover.

• For larger SLOCAs, early SG depressurization and condensate feed does not prevent core uncovery but does prevent CD; failure to refill the hotwell or align alternate SG injection does not result in CD later in the event due to effective primary-side heat removal (feed from LPR plus bleed through the break). The RHR HX is required during LPR, if feedwater is not sustained.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion. Those in the smaller equivalent break size of the SLOCA range may also experience greater repressurization later in the transient.

5.3 Small-Break Loss-of-Coolant Accident-Success Criteria for Primary Side Bleed and Feed This series of cases investigates an SLOCA scenario where no FW is available and decay heat removal is accomplished by primary-side bleed and feed (B&F) through the pressurizer PORVs.

Other than actions to initiate B&F, very few operator actions are modeled. In reality, operators 35

would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed), then transition to both BEP-1, Loss of Reactor or Secondary Coolant (e.g., trip RCPs, reduce RCS injection flow),

and BFR-H.1, Response to Loss of Secondary Heat Sink (e.g., start B&F, attempt to manually start AFW).

The varied parameters for this scenario are equivalent break size (0.83 in. (2.11 cm) or 1.66 in.

(4.22 cm)), available HPI (one charging pump or one SI pump), the time at which operators begin B&F, and the number of PORVs used for B&F. The break is located in the horizontal section of the cold leg in the loop containing the pressurizer. Boundary conditions for this scenario are listed in Table 17. Results are shown in Table 18, Table 19, and Table 20. In addition to the key timing tables, results for selected parameters of interest are shown in Appendix B, Section B.3. Sensitivity studies and their results are listed in Table 21.

It is clear from the figures in Appendix B and from Table 18 that none of the SLOCA-B&F cases examined result in CD. However, there are significant phenomenological differences between the 0.83-in. (2.11-cm) and 1.66-in. (4.22-cm) break cases.

Table 17 SLOCA-Bleed and Feed Boundary Conditions

• Break is in cold leg of the pressurizer loop, downstream of ECCS injection

• Pressurizer PORV fails 50% open at 251 cycles (if applicable)

• RCPs will be tripped if:

(i) cold leg void fraction >0.1 or Primary side (ii) containment pressure >20 psig or (iii) RCS pressure <1425 psig and SI injection >100 gpm or (iv) time to initiation of B&F is less than 2 minutes (assumed based on FR-H.1 guidance to trip RCPs prior to initiating SI)

• 0 of 1 MD-AFW trains; 0 of 1 DD-AFW trains Secondary side

• Condenser steam dumps available until MSIV closure

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps ECCS/ESF

• 0 of 2 CS trains

• 1 of 4 RCFC units

• Low- and high-pressure recirculation available

• RHR pumps are secured during dead-head phase, available upon demand Operator actions

• No RWST/CST refill Other

• CCW to RHR HX is available (except as noted otherwise) a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

36

Table 18 SLOCA-Bleed and Feed Results Equivalent Number of Time of B&F Core Uncovery Core Damage Case Break Size Charging/ Initiation/

(hh:mm) (hh:mm) b (in.) SI Pumps # of PORVs a 1 35 min / 1 02:08 --

1/0 2 55 min / 1 02:26 --

0.83 3 30 min / 2 01:27 --

0/1 4 50 min / 2 03:54 --

5 35 min / 1 00:49 --

1/0 6 55 min / 1 01:00 --

1.66 7 30 min / 2 00:42 --

0/1 8 50 min / 2 00:56 --

a Times for B&F initiation are from the time of reactor trip.

b Defined as PCT = 2,200 °F (1,204 °C)

Table 19 SLOCA-Bleed and Feed Key Event Timings Case 1 Case 2 Case 3 Case 4 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:06 00:06 00:06 00:06 Charging pump injection 00:06 00:06 -- --

SI pump injection -- -- 00:08 00:08 RCP trip 00:41 01:01 00:08 00:08 MSIVs close 01:20 01:29 00:55 01:12 RHR injection -- -- -- --

Core uncovery 02:08 02:26 01:27 03:54 RWST Lo-2 a 06:06 06:09 05:10 05:18 Switchover to sump recirc completed 06:16 06:19 05:20 05:28 Start of low-pressure injection from the sump -- -- -- --

Core damage -- -- -- --

Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 Charging pump injection 00:01 00:01 -- --

SI pump injection -- -- 00:02 00:02 RCP trip 00:03 00:03 00:02 00:02 MSIVs close 00:30 00:30 00:31 00:31 RHR injection -- -- -- --

Core uncovery 00:49 01:00 00:42 00:56 RWST Lo-2 a 05:37 05:38 04:46 04:51 Switchover to sump recirc completed 05:47 05:48 04:56 05:01 Start of low-pressure injection from the sump 14:24 14:19 09:25 08:36 Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

37

Table 20 SLOCA-Bleed and Feed Margins Case 1 Case 2 Case 3 Case 4 1,204 °C (2,200 °F) minus PCT (in °C) 833 831 a 852 a 852 Completion of sump realignment-RHR entry time b -- b -- b -- b --

(hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 31.4 [4.6] 31.4 [4.6] 14.6 [2.1] 19.9 [2.9]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) 848 a 852 a 852 a 852 Completion of sump realignment-RHR entry time

-08:21 -07:55 -03:07 -03:03 (hh:mm)

CS setpoint-peak containment pressure (kPa [psi]) 11.5 [1.7] 12.7 [1.8] 10.3 [1.5] 12.6 [1.8]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b The RCS pressure never drops below the RHR pump dead-head pressure.

For the 0.83-in. (2.11-cm) break cases, the fuel experiences only a slight heatup to around the normal operating temperature after an initial period during which the RCS cools down. This heatup occurs relatively early in the transient for Cases 3 and 4 (which have one SI pump available); falling reactor vessel water levels (resulting from break flow exceeding feed flow and reactor vessel level decrease due to RCS cooldown from injection of cold water) causes the fuel heatup for these cases. After about 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> (i.e., the time of PCT), the combined flow through the break and the PORVs decreases to below the injection flow rate from the SI pumps (either from the RWST or from the containment sump). This allows the core water level to recover, thus reducing clad temperatures. The water level rises above the TAF at approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br />, where it remains for the remainder of the simulation.

For Cases 1 and 2, the peak cladding temperature (PCT) occurs much later in the accident, though PCT is only about 20 degrees Celsius (C) higher than the PCT at the start of the transient. Core water level drops rapidly after operators initiate B&F, though the level dips only slightly below the TAF in Case 1 and remains above TAF until later in the accident in Case 2.

RCS injection flow from the charging pump recovers the water level to above the top of the active core at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> in Case 1. However, falling RCS pressure flashes water to steam and causes reactor vessel level to decrease, which exposes the top of the core at approximately 6 hours6.944444e-5 days <br />0.00167 hours <br />9.920635e-6 weeks <br />2.283e-6 months <br /> in Case 1 and 7 hours8.101852e-5 days <br />0.00194 hours <br />1.157407e-5 weeks <br />2.6635e-6 months <br /> in Case 2. This causes the cladding in the uppermost core cell to heat up, though the heatup is minor because the decay heat power at the top of the core is relatively low. The top of the fuel remains uncovered at the end of the calculation because ECCS flow rate is lower in Cases 1 and 2 than in Cases 3 and 4 due to the lower capacity of the charging pump compared to the SI pump.

The 1.66-in. (4.22-cm) break cases behave much differently because the larger equivalent break size causes a more rapid depressurization of the primary system. Initiation of B&F causes the water level to decrease further because of increased boiling of coolant due to reduced RCS pressure and due to coolant loss through the PORVs. Pressure decreases more rapidly in Cases 7 and 8 because operators open two pressurizer PORVs, whereas operators only open one PORV in Cases 5 and 6. The core water level recovers due to injection by either the charging pump in Cases 5 and 6 or the SI pump in Cases 7 and 8. Low-pressure injection begins 4-5 hours into the accident in Cases 7 and 8, while the RCS pressure in Cases 5 and 6 remains above the RHR shutoff head until late in the accident. There is a very slight cladding heatup in Case 5, and no cladding heatup in Cases 6, 7, and 8, because only the very top of the active fuel is uncovered in all of these cases.

38

Table 21 SLOCA-Bleed and Feed Sensitivity Studies Case Sensitivity Justification Results 6a Full This is a With the full complement of high-pressure pumps, complement of sensitivity to show RWST water level reaches Lo-2 at 01:32, which is more charging/SI the effect of than 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> earlier than in the base case. However, having all pumps with high- and low-pressure recirculation and the RHR available HX available, and adequate bleed paths through the break and through the open PORV, there is no core heatup after RWST depletion.

6b 4/4 RCFC This will reduce Containment pressure is lower with all four fan coolers containment available than with 1/4 available, as in the base case.

temperature and This has a negligible impact on key event timings for pressure this scenario.

6c Set initial SG This is The initial SG water level has little effect on the plant level to approximately response for this scenario, because SG dryout occurs

~22.8 m equal to the low after B&F initiation.

(target SG level alarm secondary- (23% NR level).

side inventory This is a is about reduction of 40,000 kg) approximately 25% of the initial SG inventory compared to the base case. The initial SG inventory is important because there is no AFW for this scenario.

6d Model See Table 10 For this scenario, the pressurizer drains early in the operator transient and remains empty throughout the calculation, actions to so operators would not need to take action to prevent throttle pumps pressurizer overfill.

to prevent pressurizer from going solid 6e Use the HFM See Table 10 Using HFM instead of HEM for critical flow has a (instead of the negligible effect on the results of this scenario.

HEM) for critical flow 6f 1.63% power See Table 10 The increase in power has a negligible effect on the increase results of this scenario.

6g Delay RCP trip See Table 10 Delaying RCP trip by 10 minutes has little effect on the by 10 minutes results of this scenario.

6h Use MELCOR The MELCOR RCS pressure decreases more quickly following decay heat model currently operator action to initiate B&F in this sensitivity case curve uses a decay compared to the base case due to the lower decay heat heat curve from in the sensitivity case. This allows LPR to occur a few the plants FSAR hours earlier, but otherwise, there is little difference between the sensitivity case and the base case.

39

Table 21 SLOCA-Bleed and Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 6i Adjust core This is approx. Increasing the core bypass flow has a negligible effect bypass flow to equal to the on the results of this scenario.

6% of total maximum bypass RCS flow flow cited in the FSAR 2a Extend Investigate the At 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the water level in the core is stable at simulation to stability of the approximately 2 ft below the TAF. This is sufficient to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> end-state, given maintain cladding temperatures in the uncovered the core is portion of the core near the PCT during normal uncovered at operations. Water level increases very slowly beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> because the ECCS recirculation flow rate slightly exceeds the combined losses through the break and through the open PORV. At approximately 34 hours3.935185e-4 days <br />0.00944 hours <br />5.621693e-5 weeks <br />1.2937e-5 months <br />, water level is at the TAF. Level remains above TAF through the end of the calculation. Thus, the end-state of Case 2 can be considered stable for the purposes of the PRA.

4a 1 SI and Currently this In Case 4a, only 1 PORV is available, compared to 1 PORV at report only 2 PORVs in Case 4. Because only 1 PORV is 50 minutes examines the available, RCS pressure is higher in Case 4a than in (0.83-in. case where 1 SI Case 4. The injection rate from the operating SI pump is break) and 2 PORVs are slightly lower in Case 4a, leading to later RWST successful. This depletion, but also providing less cooling. Also, the sensitivity is to RCS temperature is higher in Case 4a, as a determine consequence of the higher saturation temperature and whether 1 PORV the slightly reduced cooling provided by the lower SI is sufficient. pump injection flow. Immediately following switchover of ECCS pump suction to the sump, water level drops below the TAF in Case 4a, due to the reduced cooling provided by the hotter water from the sump (relative to the water from the RWST, as well as to the water from the sump in Case 4). Inventory losses through the break and through the open PORV are approximately equal to the SI pump injection rate, so water level remains about a foot below TAF. The SI pump finally restores water level above TAF at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br />, once injection flow exceeds inventory losses due to a gradual reduction in RCS pressure as decay heat decreases.

There is no CD in the sensitivity case because there is sufficient steam cooling at the top of the bundle. In fact, there is no difference in PCT between Case 4 and Case 4a, which suggests that operator action to initiate B&F at 50 minutes using 1 SI pump and 1 PORV is sufficient for preventing CD for a 0.83-in. cold leg break.

Note that in a similar Loss of DC Bus 111 calculation described in Section 5.4, CD occurs when 1 PORV and 1 SI pump are available for B&F. SLOCA - B&F sensitivity Case 4a avoids CD because the break provides additional depressurization capacity, thus preventing dead-heading of the SI pump and CD due to insufficient makeup.

40

Table 21 SLOCA-Bleed and Feed Sensitivity Studies (continued)

Case Sensitivity Justification Results 8a 1 SI and See above This case is analogous to Case 4a, but with a larger 1 PORV at break size. The two cases are also similar in that they 50 minutes result in slower depressurization following initiation of (1.66-in. B&F compared to their respective base cases. Like in break) Case 4a, the core water level in Case 8a remains stable below TAF for hours, though there is no difference in PCT between Cases 8 and 8a. This suggests that operator action to initiate B&F at 50 minutes using 1 SI pump and 1 PORV is sufficient for preventing CD for a 1.66-in. cold leg break.

This scenario involves operator action to initiate B&F in response to a loss of secondary heat sink. Operators would be directed to enter procedure FR-H.1 when AFW flow cannot be verified and the narrow range (NR) level in all SGs is less than 10 percent. MELCOR predicts that these conditions will occur at approximately 20 minutes in Cases 1 and 2, 19 minutes in Cases 3 and 4, and in 15 minutes in Cases 5-8. The earliest time at which operators take action to initiate B&F in the MELCOR calculations is 30 minutes (Cases 3 and 7). Given that operators must perform a few steps in FR-H.1 before initiating B&F, the timings assumed for the MELCOR calculations (which were based on the licensees sequence timing assumptions) agree well with the predicted time of FR-H.1 entry.

All of the cases described above assume that the CCW to RHR HX is available throughout the transient. For this scenario, the RHR HX acts together with the containment fan cooler and, to a limited extent, with the SGs to accomplish long-term decay heat removal. The above cases have been rerun assuming the RHR HX is unavailable. The loss of the RHR HX as a decay heat removal mechanism has no impact on the PCT. However, the unavailability of the RHR HX causes the RCS average temperature to be slightly higher later in the transient when compared to the cases where the RHR HX is available. In Cases 5 and 6, the higher temperatures cause the RCS pressure to remain above the RHR shutoff head throughout the transient, thus preventing RHR from injecting directly to the cold legs. (With the RHR HX available, LPR begins about 15 hours1.736111e-4 days <br />0.00417 hours <br />2.480159e-5 weeks <br />5.7075e-6 months <br /> into the transient.) However, HPR is available throughout the transient, and thus the inability of the RHR pumps to inject directly to the cold legs has little impact on the overall results of the calculations.

In summary, in cases both with and without the RHR HX, CD is avoided in the SLOCA-B&F cases because HPR is available and because the sump water is cooler than the fuel. HPR enables heat transfer from the fuel to the sump to continue throughout the calculation. Thus, the RHR HX has little or no effect on the outcome of the calculation 13.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection (e.g., a single charging or SI pump and a single RHR pump) and minimal pressurizer PORV availability/use (except where noted otherwise in sensitivity cases).

13 The RHR HX has no impact on peak containment pressure because peak pressure occurs before injection from the RWST is lost. Containment pressure and temperature after RWST depletion are slightly higher when the RHR HX is unavailable. Long-term heat removal is provided by one operating containment fan cooler.

41

• For all SLOCA sizes, and for the operator action timings and equipment usages studied, CD does not occur, nor is there significant core uncovery and heatup.

• For all break sizes, either one RCFC or the RHR HX is sufficient for late decay heat removal.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion. Use of more than the minimal number of PORVs could result in additional inventory loss and more core uncovery early in the transient.

5.4 Loss of DC Bus 111, Unavailable DD-AFW, and Subsequent Primary Side Bleed and Feed This series of cases investigates LoDCB-111 with the DD-AFW pump unavailable. LoDCB-111 causes the FW regulating and isolation valves to close, thus causing a loss of main feedwater (MFW). LoDCB-111 also causes a loss of one pressurizer PORV and loss of MD-AFW (Byron has one MD-AFW train per unit). The loss of all FW necessitates operator action to initiate primary-side B&F. Note that LoDCB-111 affects operator actions to trip the RCPs, as described in Appendix A and mentioned in Table 22. Other than actions to initiate B&F, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed), then transition to BFR-H.1, Response to Loss of Secondary Heat Sink (e.g., trip the RCPs, initiate B&F, attempt to manually start AFW).

The varied parameters for this scenario are the available HPI system (one charging pump or one SI pump), the time at which operators begin B&F, and whether or not a pressurizer PORV sticks open due to excessive cycling. Boundary conditions for this scenario are listed in Table

22. Results, key event timings, and margins to key figures of merit are shown in Table 23, Table 24, and Table 25, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix C, Section C.1. Sensitivity studies and their results are listed in Table 26.

Core damage is prevented in all five of the cases with one charging pump available (Cases 1-5). The charging pump is able to prevent CD because it can inject with sufficient capacity at the high pressures encountered in this accident scenario. Thus, the charging pump is able to provide cooling and maintain vessel inventory throughout the transient.

In Cases 6 and 7, CD occurs at 2:04 and 1:52 into the accident, respectively, because the SI pump is dead-headed for significant periods of time. In these cases, inventory losses through the PORV cause the vessel water level to drop. In Case 6, the SI pump begins to inject at 21 minutes, thus maintaining vessel water level above the TAF for a time. However, at 46 minutes, high RCS pressure dead-heads the pump, eventually leading to core uncovery and CD. The SI pump does not operate in Case 7 until after CD has occurred, because the operators do not open the available PORV in time to depressurize the RCS to below the SI pump shutoff head. Together, these cases show that one PORV is not sufficient to maintain reactor pressure below the SI pump shutoff head.

42

Table 22 Loss of DC Bus 111 Boundary Conditions

• RCPs are tripped as follows:

(i) one RCP trips at the time of reactor trip due to the loss of DC bus (ii) two RCPs are tripped if time to initiation of B&F is less than 2 minutes (assumed based on FR-H.1 guidance to trip RCPs prior to initiating SI)

(iii) the RCP in the pressurizer loop is tripped 10 minutes after initiating B&F; this RCP cannot be tripped from the main control room due to loss of DC bus Primary side (iv) all RCPs are tripped if (1) cold leg void fraction >0.1; (2) containment pressure >20 psig; (3) RCS pressure <1425 psig and SI injection >100 gpm

• Only 1 PORV is available (due to initiator)it is the lower setpoint PORV (FL306) based on the dependencies provided in the pressurizer PRA system notebook

• 0 of 1 MD-AFW trains (due to initiator); 0 of 1 DD-AFW trains

• All SG PORVs are available Secondary side

• Steam dumps are unavailable

• SG PORVs do not fail open a

• 0 of 4 accumulators (by PRA modeling convention)

• 1 of 2 RHR pumps ECCS/ESF

• 0 of 2 CS trains

• 1 of 4 RCFC units

• Low- and high-pressure recirculation is available

• RHR pumps are secured during dead-head phase, available upon demand Operator actions

• No RWST/CST refill Other

• No CCW to RHR HX a As discussed further in Section 5.2, the number of cycles on the SG PORVs shown in the plots in the appendices should be viewed with caution.

Table 23 Loss of DC Bus 111 Results Number of Time of B&F PORV Core Uncovery Core Damage Case Charging/ Initiation/

Treatment (hh:mm) (hh:mm)b SI Pumps # of PORVs a 1 20 min / 1 Does not stick N/A N/A 2c open N/A N/A 40 min / 1 3 1/0 Sticks 50% open 03:05 N/A 4 after 251 cycles 02:16 N/A No manual action 5c 01:45 N/A Does not stick 6 20 min / 1 01:27 02:04 0/1 open 7c 40 min / 1 01:18 01:52 a Because reactor trip occurs very early in the accident, times for B&F initiation are from time = 0.

b Defined as PCT = 2,200 °F (1,204 °C) c Caution: The PORV cycles an extraordinary number of times in these cases, but they are present to demonstrate that PORV failure is not a benevolent failure affecting the SC.

43

Table 24 Loss of DC Bus 111 Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 RCP 1A trip 00:01 00:01 00:01 00:01 00:01 00:01 00:01 RCP 1B and 1C 00:18 00:38 00:38 01:46 01:21 00:18 00:38 trip Charging pump 00:21 00:41 00:32 00:32 00:45 -- --

injection SI pump injection -- -- -- -- -- 00:21 02:15 RCP 1D (pressurizer loop) 00:30 00:50 00:50 01:46 01:21 00:30 00:50 trip SG dryout 00:54 00:43 00:48 00:48 00:43 00:47 00:43 MSIVs close 01:15 01:08 01:36 01:38 01:14 01:06 01:00 RHR injection -- -- -- -- -- -- --

PORV stuck

-- -- 00:29 00:29 -- -- --

open Core uncovery -- -- 03:05 02:16 01:45 01:27 01:18 Core damage -- -- -- -- -- 02:04 01:52 RWST Lo-2 a 07:32 07:58 11:40 11:48 13:33 -- --

Switchover to sump recirc 07:42 08:08 11:50 11:58 13:43 -- --

completed Start of RHR injection from the -- -- -- -- -- -- --

sump a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

Table 25 Loss of DC Bus 111 Margins Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 Case 7 1,204 °C (2,200 °F) minus 850 850 786 747 784 CD CD PCT (in °C)

Completion of sump realignment-RHR entry time -- -- -- -- -- -- --

(hh:mm)

CS setpoint-peak contain- 13.7 16.0 18.7 15.3 23.2 18.9 18.4 ment pressure (kPa [psi]) [2.0] [2.3] [2.7] [2.2] [3.4] [2.7] [2.7]

While the pressure drops immediately after the PORV is opened by the operators or fails open due to excessive cycling, the RCS quickly repressurizes, dead-heading the SI pump in Case 6 and causing the safety relief valves (SRVs) to cycle in Cases 2-7. (The pressure does not drop below the SI pump shutoff pressure until after CD occurs in Case 7.) In Cases 1-4, the cooling provided by the charging pump and the decay heat removal through the PORV and the SRVs eventually cause RCS pressure to decrease until it is approximately equal to the secondary-side pressure.

Cases 4 and 5 show the consequences of the operators failure to take action to initialize primary-side B&F. In Cases 3 and 4, the pressurizer PORV sticks 50 percent open due to excessive cycling at 29 minutes. However, the RCS behavior in Case 4 is significantly different from the behavior in Case 3 because the operators fail to trip the RCPs in Case 4. Tripping the RCPs reduces the heat added to the RCS, delays the time of SG dryout, and reduces RCS 44

pressure. By reducing RCS pressure, tripping the RCPs both limits inventory loss through the PORV and increases the amount of water added to the RCS by the charging pumps.

The results show that early action to trip the RCPs in Case 1, combined with removal of some decay heat through the open PORV, delays SG dryout to 54 minutes, versus 43-48 minutes for Cases 2-5. The results also show that manual RCP trip in preparation for B&F prevents core uncovery in Cases 1 and 2 and delays core uncovery in Case 3 relative to Case 4.

The core is partially uncovered for a short period of time in Cases 3-5. Core uncovery occurs in Cases 4 and 5 because the RCPs increase the RCS pressure, thus both reducing makeup from the charging pumps and increasing losses through the SRVs. Eventually, high RCS pressure causes the SRVs to open, which results in a large RCS inventory loss. Inventory loss through the PORV and SRVs and reduced makeup from the charging pumps due to high RCS pressure also cause a large drop in downcomer water level that eventually leads to partial core uncovery.

At the same time, the large RCS inventory loss quickly leads to RCP trip on high cold leg void fraction. 14 Altogether, the loss of inventory, reduced makeup, and RCP trip reduces the RCS pressure, which subsequently reduces inventory losses and increases makeup from the charging pumps. As a result, the charging pump is able to recover core water level after a brief period of partial core uncovery.

Similarly, the core uncovery in Case 3 is due to higher RCS pressure relative to Case 2. In Case 3, the PORV sticks 50% open due to excessive cycling, whereas in Case 2 operators open the PORV 100% as part of B&F actions. The reduced relief capacity through the 50%-stuck-open PORV causes higher RCS pressure, more SRV cycling, and reduced charging pump injection relative to Case 2, leading to eventual core uncovery. Eventually, as decay heat decreases, relief capacity through the PORV is sufficient to depressurize the RCS, which allows the charging pump to recover level to above the TAF.

In Cases 1-5, long-term decay heat removal is accomplished primarily by the single credited containment fan cooler operating in accident mode, though condensation on containment heat structures and heat transfer to the secondary side of the SGs also provides some cooling. By approximately 20 hours2.314815e-4 days <br />0.00556 hours <br />3.306878e-5 weeks <br />7.61e-6 months <br /> in Cases 1-5, total heat removal from the RCS and containment exceeds the decay heat rate, and thus the total energy of the system decreases from that point until the end of the calculation.

This scenario involves operator action to initiate B&F in response to a loss of secondary heat sink. Operators would be directed to enter procedure FR-H.1 when AFW flow cannot be verified and the NR level in all SGs is less than 10 percent. MELCOR predicts that these conditions will occur within 2 minutes of the loss of FW.15 The earliest time at which operators take action to initiate B&F in the MELCOR calculations is 20 minutes (Cases 1 and 6), which is in turn based on the licensees sequence timing assumption. Thus, the action cue, as predicted by MELCOR, significantly precedes the action time assumed.

14 This criterion is used as a surrogate for pump cavitation, which is not explicitly treated by the simplified RCP model implemented in the Byron input deck.

15 Note that these conditions occur much earlier in the loss of DC bus 111 scenario than in the SLOCA with bleed and feed scenario for two reasons. First, reactor trip occurs later in the loss of DC bus scenario. Second, some of the fission and decay power is removed through the break in the SLOCA scenario, whereas all of the fission and decay energy must be removed by the steam generators (SGs) in the loss of DC bus scenario.

45

Table 26 Loss of DC Bus 111 Sensitivity Studies Case Sensitivity Justification Results 4a Assume PORV Other cases assume the In Case 4a, the pressurizer PORV sticks closed sticks closed valve sticks 50% open at 29 minutes. RCS remains at high pressure after after 251 demands, but it throughout the transient because it is assumed 251 demands is also credible that the that the pressurizer SRVs will continue to cycle valve would instead stick indefinitely. Charging pump flow is lower at this closed. higher pressure than at the lower pressures predicted in Case 4, in which the PORV sticks open at 29 minutes. As a result, the TAF is uncovered for a longer period of time in Case 4a than in Case 4, but there is little impact on the calculated PCT. The PCT for Case 4a is 471 °C, which is <25 °C higher than in Case 4. (Note that this case is also documented in Appendix C.)

6a Manual trip at In this situation, Manually tripping the reactor 15 seconds after 15 s operators have the loss of DC bus increases the remaining indications that the DC secondary-side inventory at the time of trip bus is degrading, and compared to the base case, in which the reactor thus they are prepared to trips automatically on low SG water level at manually trip the reactor ~30 seconds. As a result of the greater when the bus is lost. secondary-side coolant inventory at the time of This allows for a very reactor trip, SG dryout is delayed by early manual reactor trip. approximately 30 minutes in Case 6a. In turn, CD is delayed by 50 minutes.

6b Increase The cases with one SI The greater PORV capacity is still not sufficient PORV pump go to CD because to maintain RCS pressure below the SI pump capacity by the PORV capacity is shutoff head. It also has little impact on the 20% insufficient to maintain times of core uncovery or CD.

pressure below the SI pump shutoff head. This sensitivity will look at whether or not increased PORV capacity will prevent CD.

6c Operators Plant procedures instruct Operation of the head vent valve has little impact open the head operators to open the on this scenario because the relief capacity of vent at 1 hr RPV head vent valves if the head vent valve is less than 20% of the operators cannot open capacity of one pressurizer PORV (see text for both pressurizer PORVs. more information on the head vent modeling).

This action could RCS pressure remains above the SI pump depressurize the RCS shutoff head after the head vent valve is opened, sufficiently to allow the and CD occurs as a result of inadequate core SI pump to resume cooling.

injection.

6d Operators Initiating B&F earlier As expected, initiating B&F at 10 minutes slightly initiate B&F at would allow for earlier SI delays SG dryout relative to the case in which 10 minutes pump injection and operators initiate B&F at 20 minutes.

would likely delay SG Nevertheless, CD occurs at 2:09 dryout. (i.e., approximately the same time as in Case 6) because one pressurizer PORV is insufficient for maintaining RCS pressure below the SI pump shutoff head.

46

Table 26 Loss of DC Bus 111 Sensitivity Studies (continued)

Case Sensitivity Justification Results 2a 4/4 RCFC This will reduce Containment pressure is lower with all four fan containment temperature coolers available than with 1/4 available, as in and pressure the base case. This has a negligible impact on key event timings for this scenario.

2b 1/4 RCFC The RHR HX is The RHR HX decreases the containment sump available, RHR unavailable for the base temperature and RCS temperature and pressure HX available case. Crediting the RHR late in the accident, which would allow operators HX will likely decrease to place RHR in service - and thus end HPR -

RCS pressure during the earlier. Otherwise, the availability of the RHR ECCS recirculation HX has little impact on this scenario.

phase of the accident.

2c Set initial SG See Table 21. Setting the initial SG level to 22.8 m results in level to earlier reactor trip compared to the base case

~22.8 m (16 seconds vs. 33 seconds). However, (target SG because the SG inventory at the time of reactor secondary- trip is the same in Case 2c as in Case 2, there is side inventory little impact on the time of SG dryout. Thus, the is about initial SG water level has little impact on the 40,000 kg) results of this scenario.

2d Use the HFM The model used for Using HFM instead of HEM for critical flow has a (instead of the critical flow can have a negligible effect on the results of this scenario.

HEM) for significant impact on flow critical flow through the cold leg break 2e 1.63% power 1.63% MUR power The increase in power has a negligible effect on increase uprate that was recently the results of this scenario.

approved by NRC (NRC, 2014a) 2f Use the ANS The MELCOR model In the base case, the core water level drops to decay heat currently uses a decay just above the TAF in the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the standard as heat curve from the accident. In Case 2f, core water level is much encoded in plants FSAR higher in the early phase of the accident due to MELCOR the lower decay heat given by the ANS curve with MELCOR default values relative to the decay heat curve used in the base case (based on the decay heat curve in the Byron FSAR).

Also, the lower decay heat requires less pressure relief capability, so one pressurizer PORV is sufficient for overpressure protection.

In contrast, the pressurizer SRVs open several times between 1:26 and 1:42 in the base case, and the PORV cycles approximately twice as many times in the first 40 minutes compared to the sensitivity case. There is very little difference between Case 2f and Case 2 in the later stages of the transient.

2g Adjust core This is approximately Increasing the core bypass flow to 6% has a bypass flow to equal to the maximum negligible effect on the results of this scenario.

6% of total bypass flow cited in the RCS flow FSAR 47

Table 26 Loss of DC Bus 111 Sensitivity Studies (continued)

Case Sensitivity Justification Results 2h Full This is a sensitivity to With all charging and SI pumps available, the complement of show the effect of having vessel remains full throughout the transient. This charging/SI all pumps available. provides adequate cooling water, such that the RCS pressure falls to and remains below the SI pump shutoff head after operators open the PORV to initiate B&F. In comparison, the RCS repressurizes to the pressurizer SRV setpoint after operators initiate B&F with only 1 charging pump available in the base case. With all high-pressure pumps available, the RWST level reaches Lo-2 much earlier than in the base case (3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> vs. 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />).

6e 1 SI and This is a sensitivity to In this sensitivity case, two PORVs are sufficient 2 PORVs at confirm success under for maintaining RCS pressure below the SI pump 20 minutes these conditions. shutoff head. Together, opening two PORVs (EPRI,2011) predicted and initiating one SI pump at 20 minutes is failure for roughly 20% of sufficient for preventing CD in this scenario.

these cases.

7a 1 SI and This is a sensitivity to This sensitivity case shows that opening 2 PORVs at investigate success two PORVs and initiating one SI pump at 40 minutes under these conditions. 40 minutes is not sufficient for preventing CD.

B&F actions initially decrease pressure to just below the shutoff head of the SI pump, allowing for a very brief period of injection. However, the RCS quickly repressurizes and prevents further ECCS injection for 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />. During the period with no injection, vessel water level quickly drops below the TAF, causing the fuel temperature to rapidly increase above 2,200 °F. At approximately 01:35, pressure falls below the SI pump shutoff head, allowing the pump to inject to recover water level to above the TAF by 02:05, more than 20 minutes after the onset of CD.

Finally, it is worth noting that plant procedures specify that the operators should open the reactor pressure vessel (RPV) head vent valves if they are unable to open both pressurizer PORVs. By definition, operators can only open one PORV during a loss of DC bus event, and thus one would expect the operators to attempt to open the head vent valves when they reach this point in the plant emergency operating procedures (EOPs). However, credit is not given for this action in the PRAs, and so it has not been included in the MELCOR calculations described above. The impact of opening the head vent is included as a sensitivity case, as described in Table 26. Note that based on information provided by Byron engineering after completion of the sensitivity analyses, the flow area of the head vent flow path used in sensitivity Case 6c is approximately 4 times the estimated effective flow area due to large flow losses through the head vent valve. This would further reduce the effectiveness of the head vent as an RCS vent flow path relative to the results of sensitivity Case 6c. Because Case 6c already showed that the head vent valve has little impact on the calculation, even with the larger effective flow area, the sensitivity calculation has not been repeated with a lower head vent path flow area.

48

Numerous studies focusing on B&F success for a loss of FW scenario 16 have been sponsored by both the U.S. Nuclear Regulatory Commission (NRC) and by industry. Examples include (NRC, 1988), (NRC, 2014b), (Gabor, 2005), and (EPRI, 2011). Results of the present study for Byron Unit 1 are largely consistent with results from past studies. For example, (NRC, 1988) and (Gabor, 2005) demonstrate that charging pumps actuated upon high containment pressure are sufficient for preventing CD, even in the absence of operator actions to initiate B&F (e.g. tripping RCPs, opening PORVs, and manually initiating SI). This result is demonstrated in the present study for Byron Unit 1 as well. Furthermore, (EPRI, 2011) and (NRC, 2014b) both conduct uncertainty analyses for a loss-of-MFW event at a four-loop Westinghouse plant. (Note that the study included in (NRC, 2014b) uses the Byron Unit 1 MELCOR input deck, while (EPRI, 2011) uses a MAAP4 deck for an unspecified four-loop plant.) In both studies, CD is predicted for about 60 percent of the cases with one PORV and one SI pump; almost all successful cases with this configuration had a lower initial power level. This suggests that success is unlikely for one PORV and one SI pump during full-power operation. The LoDCB-111 calculations for Byron Unit 1 presented in this report further support this conclusion.

Meanwhile, (EPRI, 2011) and (NRC, 2014b) predicted CD for about 20 percent of cases with two PORVs and one SI pump, and the results presented here show either success or failure for the two sensitivities run with this configuration, depending on the time of B&F initiation.

With that said, success of B&F for loss of MFW is influenced by a number of factors, including the initial reactor power, the timing of operator actions to initiate B&F, and the time of reactor trip relative to loss of FW. As previously mentioned, some past studies (e.g., Gabor, 2005; EPRI, 2011; and NRC, 2014b) include cases in which one PORV and one SI pump are successful in preventing CD. The conditions of these successful cases (e.g., lower initial power level, reactor trip and RCP trip concurrent with loss of MFW, very early operator action to initiate feed and bleed) have not been replicated for the present study, so it is not surprising that all of the one PORV and one SI cases in the present study go to CD. Again, MELCOR results for Byron Unit 1 LoDCB-111 are consistent with results of past studies as long as the boundary conditions are consistent.

The key observations from this analysis are:

• All of the studied cases assume minimal ECCS injection.

• In the cases studied, one charging pump and one PORV or SRV is sufficient for preventing CD.

- For the cases with one charging pump in which operator actions are taken to initiate B&F, core uncovery is also prevented.

- For the cases in which operators take no action to initiate B&F, the core is briefly uncovered, but PCTs remain well below the CD surrogate temperature of 2,200 degrees Fahrenheit (F) (1,204 degrees C).

With no operator action to open the PORV or secure charging, the PORV cycles thousands of times. If the PORV is assumed to fail closed, success is still achieved via SRV cycling.

16 Loss of DC Bus 111 is very similar to loss of main feedwater (MFW). One important distinction is that only one PORV is available for LoDCB-111 due to the initiator, whereas two PORVs may be available for loss of MFW.

49

This situation (failure to initiate B&F when one charging pump is available) is not treated as a success path in this report, owing to the extraordinary number of valve cycles and/or subsequent valve failures.

• In the cases studied, one SI pump is insufficient for preventing CD.

- One pressurizer PORV is insufficient for depressurizing the RCS below the SI pump shutoff head early in the transient. Core damage occurs when one SI pump is available and both charging pumps are unavailable. Thus, one charging pump is needed to prevent CD.

• Although not strictly relevant for this scenario, sensitivity cases were run where one SI train and two PORVs were available. Success or failure depended on the time of B&F initiation. This result is not expected to be sensitive to the availability of one versus two SI trains, since the driving factor is depressurization below SI shutoff head conditions.

The mixed results of this configuration are consistent with past studies.

• General caution: Situations with greater than minimal ECCS will result in earlier RWST depletion and could also result in greater RCS repressurization and inventory loss through the pressurizer PORV and SRVs.

5.5 Spontaneous Steam Generator Tube Rupture with No Operator Action This series of cases investigates spontaneous SGTR with all systems available (except where greater-than-minimal ECCS trains are discounted) but unsuccessful operator actions to isolate the faulted SG, refill the RWST, and execute cooldown procedures. 17 These actions are necessary to limit radiological releases and to prevent SG overfill. Steam generator overfill can significantly aggravate radiological releases through increased flow through the SG PORV or SG PORV failure, and through possible steam line leak or failure due to the increased structural loading of water in the steam lines. 18 This scenario will look at the time to SG overfill as a measure of how much time operators have to complete the required actions.

In most of the cases studied for this scenario, operators are assumed to manually trip the reactor when the pressurizer level drops below 17 percent of instrument span. However, other than the action to manually trip the reactor, very few operator actions are modeled. In reality, operators would enter procedure BEP-0, Reactor Trip or Safety Injection (e.g., verify reactor and turbine trips, verify mitigating system alignment, and start equipment as needed). High SG radiation levels would direct operators to transition to BEP-3, Steam Generator Tube Rupture, which includes instructions to identify and isolate the faulted SG, initiate cooldown, and secure the ECCS pumps. Operators would then be directed to one of three post-SGTR cooldown procedures, depending upon plant conditions.

The varied parameters for this scenario are minimal or maximal ECCS pumps (one charging pump or two charging and two SI pumps), the number of equivalent tube breaks, condenser 17 This is one of the highest contributing core damage frequency sequence in the Byron SPAR model (3 percent of CDF).

18 Note that this analysis does not include any attempt to evaluate induced steam line failure. Nevertheless, it is mentioned here as one of the reasons why operators are trained to avoid SG overfill.

50

steam dump availability, 19 and whether or not operators manually trip the reactor. A sensitivity case looks at the effects of SG PORV sticking due to two-phase flow through the valve.

Boundary conditions for this scenario are listed in Table 27. Results, key event timings, and margins to key figures of merit are shown in Table 28, Table 29, and Table 30, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix D, Section D.1. Sensitivity studies and their results are listed in Table 31.

Even with few operator actions, the availability of high-pressure ECCS pumps and AFW ensures sufficient makeup early in the accident and decay heat removal late in the accident, respectively. In all cases, the water remains above the TAF throughout the 24-hour mission time. However, operators have relatively little time to prevent SG overfill, especially for the cases with two tube ruptures. In fact, in Case 4, operators have slightly more than 10 minutes from the time of reactor trip until SG level reaches 100 percent instrument span, and 20 minutes until water floods the steam lines. As mentioned, SG overfill may increase releases to the environment and may also lead to SG PORV or main steam line leaks or failures that could both increase radiological releases and complicate safe shutdown of the plant.

The overall system behavior is similar for all cases (except Case 4a). In general, an SGTR event with an equivalent break size of either 0.5 or 2 tubes causes pressurizer level and RCS pressure to drop, triggering either a manual reactor trip on low pressurizer level or an automatic trip on overtemperature T. There is only a small increase in water level and a small decrease in FW flow to the faulted SG before the reactor trip. After the reactor trip and subsequent reduction in steam flow, and the corresponding rapid changes in SG water level caused by the collapse of voids in the SG, level in the faulted SG increases rapidly. This is especially true for the cases in which the maximum number of ECCS pumps are available. The equivalent break size has a lesser, but still noticeable, effect on the flow through the ruptured tubes. This lesser effect is due to the amount of pressure in the RCS. If the injection flow does not maintain pressure in the RCS, then the amount of water that will flow out through the break is less than if pressure were maintained, regardless of the number of tubes ruptured.

Between 20 and 90 minutes into the event (depending on the case), water begins to spill into the steam line of the faulted SG. Because operators fail to manually isolate the SG, the water flows through the steam lines and into the intact SGs.20 High water levels in the intact SGs caused by water backfeeding from the ruptured SG limit the amount of AFW injected.

Eventually, continued ECCS injection depletes the RWST. Because there is little or no water in the sump due to bypass of ECCS water through the ruptured tubes, 21 HPR is unavailable. This 19 The condenser steam dumps would most likely be available until the operators manually close the MSIVs. Thus, the cases in which the steam dumps are available are more representative of the plant response to an SGTR.

Nevertheless, the results show that the steam dumps have only a small effect on most of the event timings.

20 In the revision of the Byron MELCOR model used for these calculations, there is no elevation change in any of the steam lines, based on the information that was available at the time. It has since been determined that the orientation of the steam lines makes it impossible for water to flow from the steam header to the intact SGs until the entire steam header is flooded. However, the amount of water that flows into the secondary side through the ruptured tube(s) over several hours is sufficient to completely flood the steam header and to backfeed intact SGs, especially when all high pressure ECCS pumps are available. Note that this represents an extreme case in which operators fail to take action to isolate the SGs hours into the event.

21 As explained later in this section, during Case 3 the pressurizer PORV cycles thousands of times, causing the pressurizer relief tank rupture disc to rupture. Thus, there is some water in the sump in Case 3, though not enough to establish recirculation. Therefore, boundary conditions were imposed in the model to prevent high-pressure recirculation from being available.

51

leads to a large drop in RCS pressure-particularly for the 0.5-tube break cases, where the RCS pressure is at or near the pressurizer PORV setpoint-and in the subcooling margin. Note that the low subcooling margin immediately following the cessation of injection from the RWST may affect procedural actions to achieve a safe, stable condition in the core.

Table 27 SGTR Boundary Conditions

• If pressurizer level <17% NR prior to an automatic trip signal, it will be assumed that the reactor is manually tripped based on off-normal operating procedure Primary side BOA SEC-8, unless otherwise noted in the calculation matrix

• RCPs will be tripped if cold-leg void fraction >0.1 a

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains Secondary side

• Steam dumps assumed unavailable except as noted

• 4 of 4 accumulators b

• 0 of 2 RHR pumps

• 1 of 4 RCFC units ECCS/ESF

• ECCS will not be secured to prevent SG overfill

• CSs are irrelevant b/c no energy is going in to containment (except for Case 3)

• Recirculation is unavailable due to bypass of ECCS water through SGTR c

• Manual reactor trip if pressurizer level <17% NR prior to an automatic trip Operator actions signal, RCPs tripped if cold leg void fraction >0.1.

a Note that other scenarios credit RCP trip on (i) containment pressure >20 psig and (ii) simultaneous RCS pressure <1,425 psig and SI injection >100 gpm. These criteria are continuous action steps in the SGTR procedure for Byron. Because this analysis assumes that operators fail to perform the actions in BEP-3, these two RCP trip criteria are not credited for the SGTR calculations presented here. The RCP trip criterion on containment pressure is not relevant unless significant primary-side inventory loss through the PORVs occurs. The primary-side pressure criterion only applies if the system naturally depressurizes prior to SGTR diagnosis and implementation of proceduralized actions to perform a controlled cooldown. Inspection of the results shows that the RCS pressure and SI injection criteria would occur before the voiding criteria; however, this would occur late in the transient, so it should not significantly affect the results.

b After these calculations were completed, it was discovered that the accumulator water and gas volumes in the MELCOR model should be 935 ft3 and 415 ft3, respectively, and not 850 ft3 and 500 ft3. However, this error has very little impact on the SGTR results. In fact, the accumulators only inject in Case 4a. The accumulators are not empty at the end of Case 4a, so a greater initial water inventory would make little difference, except that it would impact the hydrostatic head of the accumulators and would thus have a minor effect on the accumulator injection rates.

c Note that in these simulations, when the RWST reaches Lo-2 (the normal trigger for switchover of ECCS pumps to the containment sump), ECCS is assumed to terminate due to the lack of water in the sump (for almost all cases). In reality, operators would determine response not obtained for a proceduralized condition in BEP ES-1.3 related to indication of water in the sump. The operators would then transition to BCA-1.1, whereby ECCS injection from the RWST would be allowed to continue until RWST level reached 9 percent, at which point it would be terminated. However, in these simulations, the continuation of ECCS injection from the RWST would not affect the conclusions regarding core uncovery occurring beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, nor would it affect the overfill timings that precede the time of switchover.

Following RWST depletion, voids begin to form in the RCS, eventually leading to RCP trip on high void fraction. RCP trip ends the forced circulation through the RCS and leads to the formation of a steam bubble at the top of the RPV. However, RCP trip also causes a slight drop in RCS pressure, thus reducing primary-to-secondary leakage.

52

Table 28 SGTR Results Number of Core Core

1. of Reactor Steam SG PORV Case Charging/ Uncovery Damage tubes Trip Dumps Treatment SI Pumps (hh:mm) (hh:mm)a 1 0.5 First Out: No b No b 1/0 2 2 RPS or No b No b Does not stick 3 0.5 manual No No b No b 4 2/2 trip on No b No b 2

4a 17% Sticks open c No b No b 5 0.5 1/0 pressur- No b No b izer level Yes 6 2 2/2 No b No b Does not stick 7 1/0 No b No b 0.5 Auto No 8 2/2 No b No b a Defined as PCT = 2,200°F (1,204°C) b The response is based on a 24-hour mission time. Also, the analyses do not consider induced steam line failure following steam line flooding.

c SG PORV sticks full-open when water first flows through the valve.

For the smaller breaks, the RCS pressure remains slightly above the secondary-side pressure, which allows primary-to-secondary leakage to continue, although at a significantly reduced rate.

There is also a small but steady increase in RCS pressure between the time at which the RCPs trip and the time at which the pressurizer completely drains. Once the pressurizer drains, pressure decreases until it once again steadies slightly above the secondary-side pressure. For the larger breaks, the RCS pressure begins to oscillate about the secondary pressure late in the transient, leading to some reverse flow through the ruptured tubes. Decay heat removal is accomplished through heat transfer from the primary side to the initially large water volume in the SGs due to overfill of the faulted generator. Once a sufficient quantity of this water boils off, AFW is available to provide long-term makeup to the intact SGs. The CST volume is not depleted within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for any of the cases studied.

Case 4a is identical to Case 4 until 10 minutes after the steam lines flood, at which point two-phase flow through the SG PORV is assumed to cause the valve to fail open. This leads to a rapid drop in pressure in the ruptured SG, which in turn causes the MSIVs to close on low steam line pressure, effectively isolating the ruptured SG from the intact generators. Failure of the SG PORV also causes the RCS pressure to fall below the SI pump shutoff head. 22 In this case, RWST depletion and RCP trip occur much earlier than in other cases. It is also worth noting that in Case 4a, the pressure of the RCS is approximately equal to the pressure of the faulted SG, which is significantly below that of the intact generators. This leads to reverse heat transfer from the intact SGs to the primary system. AFW now injects to the faulted SG at a greater rate than AFW injection to the intact SGs in the other cases. Overall, this case would be much more challenging for the plant operators, which in turn demonstrates the potential problems associated with SG overfill.

22 In all of the other cases with the SI trains available, SI did not inject because the charging pumps kept the RCS pressure above the SI pump shutoff head.

53

Table 29 SGTR Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 4a (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Auto reactor trip -- 00:02 -- 00:02 00:02 Manual reactor trip 00:09 -- 00:09 -- --

Charging pump injection 00:19 00:02 00:19 00:02 00:02 SI pump injection -- -- -- -- 00:34 MSIVs close -- -- -- -- 00:58 SG at 100% indicated level 00:53 00:23 00:44 00:13 00:13 Onset of steam line flooding 01:27 00:42 01:07 00:23 00:23 SG PORV fails -- -- -- -- 00:32 Pressurizer goes solid 10:34 -- 01:30 -- --

RWST Lo-2 a 10:36 06:47 07:16 03:48 02:34 Switchover to sump recirc completed 10:46 06:57 07:26 03:58 02:44 (i.e., end of ECCS injection)b RCP trip 17:42 08:40 14:08 06:36 03:33 Core uncovery -- -- -- -- --

Core damage -- -- -- -- --

Case 5 Case 6 Case 7 Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Auto reactor trip -- 00:02 00:12 00:12 Manual reactor trip 00:09 -- -- --

Charging pump injection 00:10 00:02 00:12 00:12 SI pump injection -- -- -- --

MSIVs close -- -- -- --

SG at 100% indicated level 00:52 00:13 00:56 00:44 Onset of steam line flooding 01:27 00:22 01:31 01:10 SG PORV fails -- -- -- --

Pressurizer goes solid 10:19 -- 10:14 01:26 RWST Lo-2 a 10:26 03:48 10:27 07:08 Switchover to sump recirc completed (i.e., end of 10:36 03:58 10:37 07:18 ECCS injection)b RCP trip 17:28 06:23 17:30 13:57 Core uncovery -- -- -- --

Core damage -- -- -- --

a This is the normal trigger for switchover of ECCS and occurs at 46-percent level.

b Note that operators would not switch to sump recirculation when there is no water in the sump (i.e., for all cases except for Case 3). See note c to Table 27 for more information.

The various parameters studied affect the event timings of the SGTR cases in the following ways. The larger breaks cause the RCS pressure to remain well below the pressurizer PORV opening pressure for the entire 24-hour mission time. In contrast, the RCS repressurizes after an initial drop in pressure for the smaller rupture cases. In Case 3, the PORV cycles thousands of times because injection from two charging pumps greatly exceeds the flow rate through the ruptured tube. The larger rupture cases also lead to more rapid SG overfill, RWST depletion, and RCP trip. In other words, the larger ruptures accelerate the event timings. Similarly, the cases with maximum ECCS flow progress more quickly than the cases with only one charging train.

54

Table 30 SGTR Margins Case 1 Case 2 Case 3 Case 4 Case 4a 1,204 °C (2,200 °F) minus PCT (in °C) a 852 a 852 a 852 a 852 a 852 Completion of sump realignment-RHR b -- b -- b -- b -- b --

entry time (hh:mm)

CS setpoint-peak containment pressure 135 135 121 135 137 (kPa [psi]) [19.6] [19.6] [17.6] [19.6] [19.9]

Case 5 Case 6 Case 7 Case 8 1,204 °C (2,200 °F) minus PCT (in °C) a 852 a 852 a 852 a 852 Completion of sump realignment-RHR entry time b -- b -- b -- b --

(hh:mm) 135 135 135 135 CS setpoint-peak containment pressure (kPa [psi])

[19.6] [19.6] [19.6] [19.6]

a This is the margin at the start of the transient (i.e., during normal operations). No heatup occurred from the initial conditions for this case.

b The RCS pressure never drops below the RHR pump dead-head pressure.

Cases 7 and 8 illustrate the consequences of the operators failure to manually trip the reactor.

For both cases, the consequences are relatively minor. In Case 7, reactor trip (on overtemperature T), SG overfill, and steam line flooding are all delayed by about 3 minutes when compared to the analogous Case 1. More importantly, the relative time between reactor trip and SG overfill is unaffected in Case 7. However, ECCS injection occurs immediately after reactor trip in Cases 7 and 8, whereas in Cases 1 and 3, the ECCS does not inject until 10 minutes after reactor trip. This is because the earlier reactor trip occurs when the reactor pressure is greater, and so the drop in pressure following the reactor trip is not large enough to trigger SI. The reactor pressure is much lower in Cases 7 and 8 at the time of reactor trip on overtemperature T, and so the pressure drops below the ECCS low pressure setpoint after the reactor trip. Earlier SI causes the RWST to deplete and RCPs to trip about 10 minutes earlier in both cases, which is a relatively minor consequence of operator failure to trip the reactor. More significant, given that the operators have a limited time in which to respond to the transient, is the fact that the time between reactor trip and SG level at 100 percent indicating range is reduced by 3 minutes in Case 8, relative to Case 3. 23 In addition, failure to manually trip the reactor is significant because it delays the appropriate operator response to the transient. In this case, the delay in reactor trip because of operator failure to manually trip the reactor is only 3 minutes, but it may be much longer for a break smaller than 0.5 tubes.

23 The time between reactor trip and SG level at 100 percent in Case 7 is not affected by the later reactor trip on overtemperature T because only one charging pump injects in this case. In the analogous Case 1, the charging pump injects to the RCS after reactor trip but before an ECCS signal is received because letdown is isolated upon reactor trip. Thus, in both Case 1 and Case 7, one charging pump injects immediately following reactor trip. In contrast, two charging pumps inject immediately after trip in Case 8, whereas only one charging pump injects in Case 3 until an ECCS signal is received, at which point both charging pumps inject.

55

Table 31 SGTR Sensitivity Studies Case Sensitivity Justification Results 3a Assume In Case 3, the PORV cycles In this sensitivity case, the PORV thousands of times without failing, pressurizer PORV cycles 251 times sticks open which is unrealistic. and sticks open 88 minutes into the after 251 accident. As a result, the small SG demands tube leak becomes a larger leak due to the stuck-open PORV. This causes RCS pressure to drop below the SI pump shutoff head, resulting in injection from both charging pumps and both SI pumps. The RWST level reaches Lo-2 at 3:07. At this time, there is sufficient water in containment to allow for HPR, due to the loss of inventory through the stuck-open PORV. If operators do not align HPRas the calculation assumes core uncovery begins at 7:01, and PCT exceeds 2,200 °F at 8:29. If operators align HPR, they could delay core uncovery as long as there is sufficient water in the sump to run the ECCS pumps. Eventually, CD will occur because water recirculated from the sump will be lost through the ruptured SG tube and will be unavailable for core cooling.

3b Operators BEP-3 instructs operators to secure Securing ECCS pumps to limit flow to secure and ECCS pumps when certain conditions the faulted SG delays steam line reinitiate SI are met, and to reinitiate SI if RCS flooding by approximately half an hour per subcooling is unacceptable or if in this case. It also significantly delays procedure pressurizer level cannot be RWST depletion to 21 hours2.430556e-4 days <br />0.00583 hours <br />3.472222e-5 weeks <br />7.9905e-6 months <br /> after the BEP-3 maintained. Securing ECCS pumps tube break.

will limit the amount of reactor coolant flowing into the faulted SG through the ruptured tube(s) and thus the time to SG overfill.

4b 1.63% 1.63% MUR power uprate that was The higher power level results in power recently approved by NRC (NRC, slightly higher auxiliary feedwater and increase 2014a) SG relief valve flow rates compared to the base case, but the differences in key event timings and calculation figures of merit are negligible.

4c Modify As part of a recently approved MUR SG PORVs uprate, Byron modified its SG PORVs.

This sensitivity calculation was not performed due to insufficient information and project resource constraints, but the entry is retained in this table to note that it could have some impact on the calculation results.

56

Table 31 SGTR Sensitivity Studies (continued)

Case Sensitivity Justification Results 4d Continue This sensitivity shows the relevance of In this case, CST depletion occurs just simulation imposing a 24-hour mission time. before 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. At the end of the to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> calculation, water level is still well above TAF, and SG level is just below the setpoint for AFW. Thus, CD is not imminent, though it is expected to occur within an additional 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if action is not taken to refill the CST or the RWST.

4e Continue This sensitivity shows the impact of If injection is continued until RWST simulation the operators not proceeding with the level reaches 9%, then CST depletion to 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br /> switchover at RWST Lo-2, given the is delayed beyond 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. Based on and allow lack of water in the containment sump the AFW flow rate at 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />, CST continued (see note c for Table 27). depletion is not expected for another injection to 10+ hours.

an RWST level of 9%

The last condition studied, the availability of the condenser steam dumps, has little impact on the event timing. 24 In Cases 5 and 6, the steam dumps slightly accelerate the event progression because they cause the RCS pressure to drop when they open, which causes the SI signal on low pressurizer pressure to occur slightly sooner than in Cases 1 and 4, respectively. This leads to earlier RWST depletion and earlier RCP trip but has almost no impact on the time to SG overfill. These effects are more noticeable in Case 5 because it would take much longer for the RCS pressure to reach the low-pressure SI setpoint because of the smaller equivalent break size. This is evident from a comparison of the time between reactor trip and charging pump injection in Cases 1 and 4 (i.e., 10 minutes versus nearly simultaneous).

It should be noted that, because of the selected user input, there can be no flow of water from the SGs to the steam lines until the uncollapsed water level in an SG reaches the bottom of the steam line. 25 In reality, there may be some carryover of water into the steam lines before the water level reaches the steam line bottom elevation. This means there could be water in the steam lines earlier than is predicted by MELCOR, which in turn means there is the potential for earlier impacts of two-phase flow through the SG PORV, earlier water intrusion past the MSIVs, and increased water flow to FW pump turbines (either the MFW pump turbines for scenarios significantly different from the one studied here or the turbine of a turbine-driven AFW pump in a four-loop Westinghouse plant that uses turbine-driven AFW, such as Vogtle Units 1 and 2).

24 The steam dumps open to maintain RCS loop average temperature (Tavg) at the no-load setpoint. Because RCS Tavg is below the no-load setpoint for significant periods of time in Cases 5 and 6, steam dump valve actuation is limited in these cases. In fact, the steam dump valves open only once in Case 5.

25 MELCOR has a simple entrainment model that uses an input parameter called the momentum exchange length.

Larger values of the momentum exchange length increase the coupling between the phases, while smaller values increase the slip between the phases. In addition, MELCOR uses junction opening heights to determine the elevations from which fluid may be drawn into the flow path. There can be no flow of a phase through a flow path unless that phase is present within either the to or from junction opening height. Thus, carryover of water in the SGs to the steam lines could be modeled by manipulating the junction opening heights and the momentum exchange length. Of course, when varying these parameters, care must be taken to prevent unphysical or unrealistic behavior (such as significant entrainment during the steady-state, normal operations portion of the calculation).

57

Finally, the reader may notice that there are significant differences between these results and the results of the margin to overfill analysis in Section 15.6.3 of the Byron Final Safety Analysis Report (FSAR). It is important to remember that the FSAR calculation is a design-basis calculation. As such, the FSAR analysis follows the normal design basis analysis rules, in which the analyst conservatively biases plant initial conditions (such as power level, pressurizer pressure, and RCS temperatures) and trip setpoints, while at the same time assuming the worst single failure, all to give a conservative answer to the analysis. Conversely, the FSAR calculation credits operator procedural actions to identify and isolate the faulted SG, initiate a plant cooldown, depressurize the primary system, and terminate SI to limit flow to the SGs to arrest the accident progression. In contrast, the calculations presented here use best-estimate initial conditions and nominal trip setpoints and assume all plant systems are available (except where greater-than-minimal ECCS trains are discounted). However, these calculations also assume that operators fail to take the appropriate procedural actions, while the FSAR analysis assumes that operators enter E-3 (which directs them to isolate the secondary side of the ruptured SG, cool down the RCS below saturation, and then depressurize the RCS to below the ruptured SG pressure to terminate break flow). The other major difference between the FSAR calculations and the calculations presented here is that the FSAR calculations involve a single double-ended guillotine tube rupture, whereas the calculations presented here have either half or two equivalent double-ended guillotine tube ruptures.

In the FSAR SGTR design-basis calculations, automatic reactor trip occurs around 4.5 minutes, which is between 2 minutes for Case 2 (with 2 tube ruptures) and 12 minutes for Case 7 (with 0.5 tube ruptures). Auxiliary feedwater injection begins almost immediately following reactor trip in both the FSAR calculation and in the calculations presented here. However, while SI occurs immediately after trip in these calculations, SI does not occur until about 5 minutes following reactor trip in the FSAR calculation. Without more information about the pressure behavior in the FSAR calculation, it is difficult to determine why SI is delayed, though it is likely that the drop in reactor pressure following reactor trip is not as large in the FSAR calculation as it is in the MELCOR calculation. Possible explanations are that the MELCOR model is overpredicting this drop in pressure or that the conservative FSAR boundary conditions (e.g., decay heat) keep pressure higher. Note that this difference will also result in less time to SG overfill in the calculations presented here because injection from the high head ECCS pumps keeps the RCS at a higher pressure, and thus leads to higher flow through the ruptured tubes. By 6.5 minutes after reactor trip in the FSAR calculation, operators isolate the faulted SG, at which point comparisons between the FSAR and these SGTR calculations are no longer valid. 26 Thus, the reader should be cautious when comparing these SGTR calculations, in which operators fail to take action to terminate the accident, and the FSAR calculations, in which operator action prevents SG overfill.

In summary, the key observations from this analysis are:

• A 24-hour mission time is assumed, the analyses do not consider induced steam line failure following steam line flooding and no operator actions are modeled (i.e., SG is not isolated).

26 Note that isolating the faulted SG will cause pressure in the faulted SG to increase more rapidly than if the faulted SG were allowed to communicate with the other SGs through the main steam lines. The increase in faulted SG pressure reduces the break flow and, hence, increases the margin to overfill.

58

• The time of reactor trip ranges between 2 and 12 minutes depending on assumed conditions, with automatic trip (in cases where automatic trip occurs before operators are assumed to manually trip the reactor) occurring due to the overtemperature delta-T reactor protection system (RPS) logic.

• The time between reactor trip and SG overfill (as measured by SG water level reaching the steam line nozzle with no operator actions) is as follows:

- ~60 to 80 minutes for 0.5-tube equivalent leaks

- ~20 to 40 minutes for 2-tube equivalent leaks

• No core uncovery (and thus no CD) occurs in the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> for the main cases.

- However, failure to control pressurizer level in cases with a smaller tube leak and maximum ECCS can lead to a large number of cycles on the pressurizer PORV and potential failure of this component. As shown in one of the sensitivity cases, CD can occur prior to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if sump switchover is not accomplished (and will occur later, otherwise, due to loss of recirculated water through the ruptured tube(s)).

5.6 Medium-Break LOCA Injection Success Criteria This series of cases investigates the minimal ECCS injection requirements for the injection phase of ECCS operation. If the initial injection is successful and if CD occurred, it would be expected to occur later for the specified conditions. 27 Other than actions to trip the RCPs, very few operator actions are modeled. In reality, operators would enter BEP-0, Reactor Trip or Safety Injection (e.g., verify alignments and component status, try to start components that should be running but are not (e.g., charging pumps), and trip the RCPs if the procedure directs). Operators would then transition to BEP-1, Loss of Reactor Coolant or Secondary Coolant (e.g., trip RCPs if the procedure directs, secure CSs if the procedure directs).

Depending on plant conditions, BEP-1 would prompt operators to enter either ES-1.2, Post-LOCA Cooldown and Depressurization, or ES-1.3, Transfer to Cold Leg Recirculation.

Note that, in this case, operators are assumed to either fail to enter or fail to complete ES-1.3, and thus they do not establish HPR. They are also assumed to fail to perform an emergency cooldown based on the inadequate core cooling functional restoration procedure. However, some of the actions in ES-1.2 are modeled in the MLOCA cooldown timing scenario described in Section 5.7.

The varied parameters for the MLOCA injection SC scenario are the equivalent break size and the available ECCS injection (one SI pump and one RHR pump, or two accumulators 28 and one RHR pump). The equivalent break size range considered is 2 to 6 in. (5.1 to 15.1 cm) equivalent break diameter. Additional sensitivity cases look at variations in the availability of containment heat removal systems.

27 Cooldown timing for low-pressure recirculation is investigated in a different set of MLOCA calculations that are documented in Section 5.7. Functional restoration (FR)-based emergency cooldown is not modeled.

28 Both available accumulators are in intact legs.

59

The boundary conditions for this scenario are listed in Table 32. Results, key event timings, and margins to key figures of merit are shown in Table 33, Table 34, and Table 35, respectively. In addition to these tables, results for selected parameters of interest are shown in Appendix E, Section E.1. Sensitivity studies and their results are listed in Table 36.

Table 32 MLOCA Injection Success Criteria Boundary Conditions

• Reactor trip based on RPS signal

• RCPs will be tripped if:

Primary side (i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1,425 psig and SI injection >100 gpm Secondary side

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• 0 of 4 RCFC units

• 2 of 2 CS trains (except for Case 4b)

ECCS/ESF

• Spray recirculation is unavailable (except for Case 4a)

• Low-pressure ECCS recirculation is available / HPR is unavailable Operator actions

• Trip RCPs; align LPR; align CS recirculation (where credited)

Other

• CCW to RHR HX is available (except for Cases 3a and 7a)

Table 33 MLOCA Injection Success Criteria Results Number of Equivalent Charging/ Core Core Diameter Containment Case SI Pumps/ RHR HX Uncovery Damage Break Size Sprays Accumulators/ (hh:mm) (hh:mm)a (in.)

RHR Pumps 1 2 00:21 02:18 2 3.33 Yes 00:08 --

3 0 of 2 / 2 / 2; no recirc 00:05 --

4.67 3a 1 of 2 / No 00:05 --

4 0 of 4 / 00:01 --

1 of 2 2 / 2; recirc 4a 6 00:01 --

available 4b 0/2 Yes 00:01 --

5 2 00:30 00:51 0 of 2 /

6 3.33 00:11 00:21 0 of 2 /

7 2 / 2; no recirc 00:06 --

4.67 2 of 4 /

7a No 00:06 --

1 of 2 8 6 Yes 00:04 --

a Defined as PCT = 2,200 °F (1,204 °C) 60

Table 34 MLOCA Injection Success Criteria Key Event Timings Case 1 Case 2 Case 3 Case 3a Case 4 Case 4a Case 4b (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 00:00 ACC injection -- -- -- -- -- -- --

SI pump injection 00:01 00:00 00:00 00:00 00:00 00:00 00:00 RCP trip 00:02 00:01 00:00 00:00 00:00 00:00 00:00 MSIVs close 00:11 00:04 00:02 00:02 00:01 00:01 00:01 RHR injection -- 00:50 00:19 00:19 00:12 00:12 00:12 Core uncovery 00:21 00:08 00:05 00:05 00:01 00:01 00:01 CS signal 01:02 00:19 00:08 00:08 00:04 00:04 --

RWST Lo-2 a 01:21 00:41 00:26 00:26 00:21 00:21 00:44 Switchover to sump recirc completed 01:31 00:51 00:36 00:36 00:31 00:31 00:54 (i.e., end of ECCS injection)b Start of RHR injection from the -- 00:52 00:37 00:37 00:32 00:32 00:54 sump RWST Lo-3 01:41 01:01 00:40 00:40 00:35 00:35 --

Core damage 02:18 -- -- -- -- -- --

Case 5 Case 6 Case 7 Case 7a Case 8 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 Accumulator injection 01:01 00:21 00:11 00:11 00:06 SI pump injection -- -- -- -- --

RCP trip 00:18 00:07 00:03 00:03 00:02 MSIVs close 00:15 00:04 00:02 00:02 00:01 RHR injection -- 00:48 00:25 00:25 00:14 Core uncovery 00:30 00:11 00:06 00:06 00:04 Containment spray signal --c 00:20 00:08 00:08 00:04 RWST Lo-2 a --c 00:45 00:31 00:31 00:24 Switchover to sump recirc completed (i.e.,

--c 00:55 00:41 00:41 00:34 end of ECCS injection)b Start of RHR injection from the sump -- 01:08 00:41 00:41 00:34 RWST Lo-3 --c 01:06 00:45 00:45 00:38 Core damage 00:51 00:21 -- -- --

a This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

b Note that operators are assumed to fail to align the SI and charging pumps for HPR.

c This calculation stopped during CD progression, before initiation of CSs on high containment pressure and before RWST depletion and switchover to low-pressure ECCS recirculation. The calculation was not restarted because CD was already in progress.

61

Table 35 MLOCA Injection Success Criteria Margins Case 1 Case 2 Case 3 Case 3a Case 4 Case 4a Case 4b 1,204 °C (2,200 °F) minus CD 575 457 457 378 378 381 PCT (in °C)

Completion of sump realignment-RHR entry --a 00:02 00:17 00:17 00:20 00:20 00:42 time (hh:mm)

CS setpoint-peak containment pressure 0b 0b 0b 0b 0b 0b 0b (kPa)

Case 5 Case 6 Case 7 Case 7a Case 8 1,204 °C (2,200 °F) minus PCT (in °C) CD CD 169 169 454 Completion of sump realignment-RHR entry

--c 00:08 00:16 00:16 00:20 time (hh:mm)

CS setpoint-peak containment pressure (kPa) --c 0b 0b 0b 0b a RHR does not inject in this case.

b Containment sprays are activated in this case (if available). If sprays are unavailable, actual values are negative.

c This calculation stopped during CD progression, before initiation of CSs on high containment pressure and before RWST depletion and switchover to low-pressure ECCS recirculation. The calculation was not restarted because CD was already in progress.

The results 29 show that for Cases 1-4 and their sensitivities, the ECCS system is successful in preventing CD during the early stages of the loss-of-coolant accident (LOCA), prior to RWST depletion which marks the end of the injection phase. In these cases, the SI (for smaller breaks) and RHR (for larger breaks) pumps are able to recover RPV water levels to above the TAF after a brief period of partial core uncovery. This arrests the fuel heatup such that PCTs during core reflood are well below the CD surrogate temperature of 2,200 degrees F (1,204 degrees C). In these cases, CSs actuate on high containment pressure. Once sprays actuate, the rate of RWST depletion increases significantly due to the approximately 7,400 gallons per minute (gpm) flow through the CS pumps (compared to the approximately 5,000-gpm flow through the SI and RHR pumps). In Case 1, depletion of the RWST and assumed unavailability to align HPR leads to CD after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> because the RCS remains above the RHR dead-head pressure. In the other SI cases, the equivalent break size is large enough to depressurize the RCS to below the RHR dead-head pressure before RWST depletion, 30 thus allowing LPR to maintain the RPV water level above the TAF. These cases (with the exception of Case 3a, about which more will be said later) reach a safe, stable state within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the accident initiation. Inventory control is provided by LPR, and long-term cooling is provided primarily by the RHR HX, with some cooling by AFW.

As mentioned, Case 3a examines the impact of the RHR HX on the accident sequence. While the RHR HX has no effect on the success of the initial injection, or on the PCT, it does affect 29 Note that the results typically show that the pressure in one of the intact loop SGs (i.e. SG-B, -C, and -D) is lower than the pressure in the other two intact loop SGs. The lower pressure is caused by loop seal clearing, which affects the thermal-hydraulic behavior in the loop and its associated SG. This behavior is common in LOCA calculations and is explained in more detail in Section 5.2.

30 In Case 2, low-pressure injection begins within the 10-minute period between RWST level Lo-2 and the time at which operators would complete alignment of cold leg recirculation. (Recall that in this case, HPR is assumed to be unavailable.) Still, the break size is large enough and containment heat removal is sufficient to maintain RCS pressure below the RHR dead-head pressure throughout the cold leg recirculation phase.

62

long-term heat removal. In Case 3a, the lack of containment heat removal causes the containment to exceed its design pressure within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> following the start of the accident.

Note that the operators will receive a cue via the critical safety function status tree for high containment pressure at approximately 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to restore CSs and align alternate heat removal capability, but these capabilities are assumed unavailable in this case. RCS pressure and temperature increase very slowly but steadily throughout the recirculation phase, though PCTs are only 437 degrees F (225 degrees C) at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Also, the increase in RCS pressure is accompanied by an increase in containment pressure, and so the containment backpressure remains relatively constant throughout cold leg recirculation. Thus, while the RCS is not in a safe, stable state at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, the rate of temperature increase is very low, and the operators could most likely achieve a safe, stable state by providing some containment heat removal (either the RHR HX or reactor containment fan cooler (RCFC) units).

On the other hand, the second set of injection criteria (two accumulators and one RHR pump) is not successful in preventing CD during the injection phase for the range of MLOCAs studied here. 31 In particular, CD occurs in Cases 5 and 6 (2-in and 3.33-in breaks, respectively) before the accumulators are able to inject. This shows that these equivalent break sizes are not sufficiently large to allow the RCS to depressurize to below the accumulator injection pressure of 585 psig (4.136 MPa). In these cases, losses through the break cause the water level in the core to quickly fall, exposing a significant portion of the fuel. The accumulators are unable to inject to recover the water level until it is too late, leading to CD.

The accumulators, as well as the RHR pump, are able to inject to recover the core water level in Cases 7 and 8. Specifically, in Case 7, accumulator and RHR injection begin 11 and 25 minutes after initial core uncovery; in Case 8, accumulator and RHR injection begin 6 and 14 minutes following uncovery. Core reflood arrests the fuel heatup and limits the PCT to 1,895 degrees F (1,035 degrees C) and 1,382 degrees F (750 degrees C) for Cases 7 and 8, respectively, which is below the surrogate for CD. Though not the focus of these calculations, modeling of an emergency cooldown upon entry in to the functional restoration procedure (FRP) for inadequate core cooling may allow recovery of the core water level (via accumulator injection) prior to core damage, though the operator time windows may be very short based on the results for Case 6 (core uncovery at 11 minutes and core damage at 21 minutes) and Case 7 (high PCT).

In all of the accumulator cases, the CS pumps actuate on high containment pressure. In Cases 5 and 6, sprays begin after CD, and so they have no effect on the figures of merit for this calculation. In Cases 7 and 8, sprays actuate early in the accident sequence, when the core is uncovered and before the RCS pressure falls below the RHR pump dead-head pressure. The sprays quickly deplete the RWST, but not before the accumulators and LPI quench the fuel.

After depletion of the RWST, the RHR pump suction aligns to the containment sump, and LPR provides adequate inventory makeup to keep the core covered. The RHR HX provides most of the decay heat removal, while the SGs also provide limited cooling to the RCS.

31 After these calculations were completed, it was discovered that the accumulator water and gas volumes in the MELCOR model should be 935 ft3 and 415 ft3, respectively, and not 850 ft3 and 500 ft3. However, this error has little impact on these calculations because the accumulators do not inject until after CD occurs for Cases 5 and 6, while CD is avoided in Cases 7 and 8 even with reduced accumulator inventory. The only impact would be to delay RWST depletion in Cases 7 and 8.

63

Table 36 MLOCA Injection Success Criteria Sensitivity Studies Case Sensitivity Justification Results 6a Trip RCPs This sensitivity is not supported Tripping the RCPs earlier allows the earlier procedurally, but it could be RCS pressure to drop below the RHR interesting, especially since RHR pump shutoff head earlier than in injection begins shortly after CD in Case 6, but accumulator injection still Case 6. begins after CD in this sensitivity case.

3b Increase In Case 3a, containment exceeds its Increasing the containment heat containment design pressure due to lack of decay structure surface area by 20% reduces heat removal heat removal. This case looks into containment pressurization, such that surface area by the effects of heat sink surface area, pressure at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> is approximately 20% (with RHR which is justified because the surface 10% lower in Case 3b than in Case 3a.

HX areas in the Byron MELCOR model However, containment pressure is still unavailable) are based on conservative estimates. above the design pressure due to the lack of containment heat removal (i.e., fan coolers or the RHR HX).

4c Use the HFM The model used for critical flow can Using HFM for critical flow results in (instead of the have a significant impact on flow minor changes in the calculated HEM) for through the cold leg break. response of the system, including a critical flow 15 °C (27 °F) increase in PCT. This is insignificant given that PCT is still more than 350 °C (630 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

4d 1.63% power Recently approved 1.63% MUR Increasing core power by 1.63%

increase power uprate (NRC, 2014a) results in minor changes in the calculated response of the system, including a 30 °C (54 °F) increase in PCT. This is insignificant given that PCT is still 349 °C (628 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

4e Delay RCP trip BEP-0 directs operators to trip RCPs Delaying RCP trip reduces PCT by by 10 minutes if SI flow >100 gpm and RCS approximately 100 °C (180 °F).

pressure <1,425 psig; however, this However, flow through the RCPs is action occurs at Step 20, so there will single-phase steam for approximately be a delay from reactor trip (shortly 6 minutes before the RCPs are after which the above two conditions tripped. Note the RCPs are modeled are true) until operators take action to simply as a constant differential trip RCPs. pressure source that has been tuned to match the desired RCS flow and pressure drop during the steady-state portion of the calculation. This differential pressure source does not account for degraded conditions during two-phase flow or single-phase steam flow. Thus, PCT results for this sensitivity case are subject to considerable uncertainty.

64

Table 36 MLOCA Injection Success Criteria Sensitivity Studies Case Sensitivity Justification Results 4f Use the ANS The MELCOR model currently uses a Using the ANS decay heat curve decay heat decay heat curve from the plants instead of the Byron FSAR curve standard as FSAR reduces PCT by 155 °C (297 °F) encoded in relative to Case 4. This is because of MELCOR the lower decay heat given by the ANS curve relative to the decay heat curve used in the base case. There is very little difference between Case 4f and Case 4 in the later stages of the transient.

4g Adjust core This is approximately equal to the Increasing core bypass flow to 6%

bypass flow to maximum bypass flow cited in the results in minor changes in the 6% of total FSAR. calculated response of the system, RCS flow including a 37 °C (67 °F) increase in PCT. This is insignificant given that PCT is still 341 °C (614 °F) less than the CD surrogate of 1,204 °C (2,200 °F).

8a Put one of the This looks at whether the injection See the text of Section 5.6 and figures ACCs in the SC should be 2/4 ACCs or 2/3 intact in Appendix E for the results of this broken leg ACCs. sensitivity calculation.

Two additional cases. Cases 4a and 4b, examine the impact of CSs on containment pressure and the time to RWST depletion. In Case 4a, sprays actuate on high containment pressure, as they did in Case 4. However, in Case 4a, operators are assumed to successfully align the CS pumps to the sump. Containment sprays are assumed to operate in recirculation mode for the remainder of the accident sequence. Containment pressure following transfer of CS pump suction to the sump is slightly higher than in Case 4, in which operators do not switch to CS recirculation, though pressure remains below containment design pressure. There is no effect on PCT or on general RCS behavior.

In Case 4b, CSs are assumed to be unavailable. In this case, RWST Lo-2 setpoint (46.7 percent) is delayed by about 20 minutes. Also, PCT is slightly lower in this case due to a very small difference in break flow caused by higher containment backpressure in Case 4b.

Peak containment pressure without sprays is 27 psig (0.19 MPa-g), which is well below the containment design pressure of 50 psig (0.34 MPa-g).

Caution must be taken when interpreting the effects of containment heat removal systems on the containment thermal-hydraulic behavior. For the current Byron model, the containment is modeled as a single node and includes only the heat transfer surfaces listed in Chapter 6 of the FSAR (which is conservative from the view of limiting containment pressure). Thus, the model does not account for natural circulation in containment, nor does it include all of the heat transfer surfaces present in containment. With that said, the single node containment model is sufficient for the purposes of this study (i.e., selected SC and accident sequence timing) because containment behavior has little impact on whether or not CD occurs in any of the scenarios described in this report.

Finally, it must be noted that for the larger breaks (4.67 in. and 6 in.), MELCOR experienced numerical problems that caused the calculations to run very slowly. In some cases, the numerical problems were so severe as to prevent the calculations from running for the 24-hour 65

problem time. The problems began well after core reflood and fuel quenching, and so the numerical issues are not related to core heat transfer behavior. Instead, the problem appears to be related to feedback between core and downcomer water level (which are in turn affected by the interplay between ECCS injection and break flow). The rapidly varying core and downcomer water levels affect the driving head for flow through the core, and thus core flow oscillates rapidly. This behavior causes rapid changes in pressure in some control volumes, which in turn limits the time step to extremely small values (as low as 1-10 microseconds). The issue is under further investigation, but for now, the affected cases will be assumed to be complete as is. Fortunately, this scenario focuses on the initial injection phase of the accident, and so the key observations for this scenario are unaffected by the numerical problems.

In summary, the key observations from this analysis are:

• One SI pump and one RHR pump are sufficient for preventing CD during the initial injection phase for the full range of MLOCA equivalent break sizes.

• On the other hand, two accumulators and one RHR pump are not sufficient for preventing CD for the smaller end of the MLOCA break spectrum. In these cases, CD occurs before the RCS pressure falls below the accumulator injection setpoint.

o Though not the focus of these calculations, modeling of an emergency cooldown upon entry in to the FRP for inadequate core cooling may allow recovery of the core water level (via accumulator injection) prior to core damage, though the operator time windows may be very short

• Assuming the initial injection is successful, CD will occur for smaller MLOCAs in the absence of either secondary-side cooldown 32 or HPR. For larger equivalent break sizes (3.33 in. and above), the break causes the RCS pressure to eventually drop below the RHR shutoff head, thus allowing for LPR to maintain the RPV water level above TAF.

- This is not surprising, in that 2 in. is the upper end of the SLOCA break range, and SLOCAs are partially defined by an inability to naturally depressurize to low RCS pressure. However, some undocumented calculations were run to scope out the tipping point for success/failure, and they suggest that, for the conditions studied, that point is around 3.33 in. (8.46 cm).

• Containment heat removal systems (e.g., CSs and the RHR HX) have a negligible impact on the initial injection phase of the accident but have a significant impact on the containment conditions later in the accident.

- The biggest impact of the CSs is that they rapidly deplete the RWST.

- The RHR HX removes decay heat late in the accident, though cladding temperatures remain well below the CD surrogate until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> even without the RHR HX in service. If the RHR HX and containment fan coolers are unavailable, the containment will exceed its design pressure due to lack of long-term heat removal.

32 Based on the results in Section 5.7, secondary-side cooldown may not be sufficient for preventing CD for 2-in.

breaks.

66

Effect of Accumulator in Broken Loop Cases 5-8 described above assume that both of the available accumulators are in intact loops.

Cases 7 and 8 have been rerun to determine the effects of placing one of the available accumulators in the broken loop. (Recall that CD occurs before accumulator injection for Cases 5 and 6, so placement of an accumulator in a broken loop would have no impact on the pre-CD phase of the accident.)

One would expect that placing one of the available accumulators in the broken loop would have a detrimental impact on the system response because water from this accumulator would spill out of the break before reaching the core. However, the opposite is true: PCTs are higher when both accumulators are in intact loops than when one accumulator is in an intact loop and the other is in the broken loop. For Case 7, PCT decreases from 1,895 degrees F (1,035 degrees C) to 1,477 degrees F (830 degrees C) when one accumulator is moved from an intact loop to the broken loop. For Case 8, PCT decreases from 1,382 degrees F (750 degrees C) to 1,162 degrees F (628 degrees C). This is because more water reaches the core when the accumulators are in intact loops. The additional water produces more steam, which keeps the pressure above the RHR pump shutoff head longer than in the cases with an accumulator in the broken loop. Thus, the top of the core is uncovered for a longer period of time in the two-intact-loop accumulator case before the RHR pump can inject to recover level, resulting in higher cladding temperatures.

With that said, it is important to emphasize that accumulator injection is still needed to provide some cooling until the RHR pumps can inject. If no accumulators are available, then CD will occur before the low pressure pumps can recover core level and quench the overheated fuel.

The higher predicted PCT for Cases 7 and 8 with two accumulators in intact loops compared to one accumulator in an intact loop and one in a broken loop is a function of the particular break sizes and other conditions chosen.

5.7 Medium-Break LOCA Cooldown Timing for Low-Pressure Recirculation This scenario investigates the time for initiating secondary-side depressurization and cooldown to preclude the need for HPR when the RWST level prompts initiation of switchover. Other than actions to trip the RCPs and to initiate secondary-side cooldown, very few operator actions are modeled. In reality, operators would enter BEP-0, Reactor Trip or Safety Injection (e.g., verify alignments and component status, try to start components that should be running but are not (e.g., charging pumps), and trip the RCPs if the procedure directs). Operators would then transition to BEP-1, Loss of Reactor Coolant or Secondary Coolant (e.g., trip RCPs if the procedure directs, secure CSs if the procedure directs). Depending on plant conditions, BEP-1 would prompt operators to enter either ES-1.2, Post-LOCA Cooldown and Depressurization, or ES-1.3, Transfer to Cold Leg Recirculation.

Minimal ECCS (one SI train and one RHR train) is assumed in all cases. The varied parameters for this scenario are equivalent break size (2 in. or 6 in. (5.1 or 15.1 cm)), the time at which operators initiate the cooldown (20 minutes or 40 minutes), and the available containment heat removal systems. For all cases except Cases 2a and 8a, CS recirculation is assumed to 67

be unavailable. For all cases except Case 8b, the RHR HX is assumed to be available. Note that the SG PORVs are opened to commence secondary-side cooldown. 33 The boundary conditions for this scenario are listed in Table 37. Results, key event timings, and margins to key figures of merit are shown in Table 38, Table 39, and Table 40, respectively.

Meanwhile Table 41 provides the actual cooldown rates achieved. In addition to these tables, results for selected parameters of interest are shown in Appendix E, Section E.2. Sensitivity studies and their results are listed in Table 42.

Table 37 MLOCA Cooldown Timing Boundary Conditions

• Reactor trip based on RPS signal

• RCPs will be tripped if:

Primary side (i) cold leg void fraction >0.1 or (ii) containment pressure >20 psig or (iii) RCS pressure <1,425 psig and SI injection >100 gpm Secondary side

• 1 of 1 MD-AFW trains; 0 of 1 DD-AFW trains

• 0 of 2 charging trains

• 1 of 2 SI trains

• 0 of 4 accumulators ECCS/ESF

• 1 of 2 RHR pumps

• LPR is available

• CS recirculation is unavailable (except for Cases 2a and 8a)

Operator actions

• SG cooldown at specified time; tripping RCPs; aligning LPR Other

• CCW to RHR HX is available (except for Case 8b)

Table 38 MLOCA Cooldown Timing Results Containment Equivalent Core Core Sprays / Reactor Case Diameter SG Cooldown Uncovery Damage Containment Fan Break Size (in.) (hh:mm) (hh:mm)a Coolers 1 2 00:21 --

2 of 2 trains /

2 00:01 --

6 0 of 4 units 2a b 00:01 --

100 °F/hr starting 3 2 0 of 2 trains / 00:21 --

at 20 min.

4 6 0 of 4 units 00:01 --

5 2 0 of 2 trains / 00:21 --

6 6 4 of 4 units 00:01 --

7 2 00:21 --

8 2 of 2 trains / 00:01 --

8a b 6 100 °F/hr starting 0 of 4 units 00:01 --

8b c at 40 min. 00:01 --

9 2 0 of 2 trains / 00:21 --

10 6 0 of 4 units 00:01 --

a Defined as PCT = 2,200 °F (1,204 °C) b Containment spray recirculation is available for Cases 2a and 8a.

c The RHR HX is unavailable for Case 8b.

33 Specifically, 4/4 SG PORVs are used instead of 3/4 SG PORVs or 1/12 TBVs. See footnote 9 on page 18 for more information.

68

Within the first minute of accident initiation all of the 2-in. break cases experience a reactor trip (due to overtemperature T) and an ECCS actuation signal on low pressurizer pressure (although the SI pumps do not begin injecting until RCS pressure falls below the pump shutoff head). Within the first 2 minutes, the SI pumps begin to inject, and RCPs are manually tripped due to low RCS pressure with adequate SI flow (see trip condition (iii) in Table 37). The MSIVs close on high containment pressure at roughly 11 minutes. Core uncovery begins at 21 minutes, regardless of whether or not the operators initiate secondary-side cooldown at 20 minutes. 34 For the cases with all RCFCs unavailable, containment pressure reaches the CS initiation setpoint approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> into the event. If sprays are available, they quickly deplete the RWST, thus ending all HPI. For these cases (1 and 7), RCS pressure is still above the RHR pump shutoff head at the time of RWST depletion, so there is no injection for approximately half an hour. During this time, water level falls below one-half active fuel height, and the fuel heats rapidly to 1,697 degrees F (925 degrees C) in Case 1 and 1,832 degrees F (1,000 degrees C) in Case 7. At the same time, RCS pressure drops below the RHR pump shutoff head, and the low-pressure pumps inject water from the sump to the RCS to quench the fuel before it exceeds the CD surrogate temperature of 2,200 degrees F (1,204 degrees C). For the cases in which CSs are unavailable, RCS pressure drops below the RHR pump shutoff head, thus allowing continuous injection by the RHR pumps during the transfer of suction from the RWST to the containment sump. There is no fuel heatup for these cases (3, 5, and 9).

For the 6-in. break cases, a number of events occur within the first minute including reactor trip on overtemperature T, initiation of SI, the satisfaction of the RCP trip condition for the combination of low RCS pressure and SI flow greater than 100 gpm, and the closure of MSIVs due to high containment pressure. For the cases where the RCFC units are unavailable, high-high containment pressure is reached at 4 minutes. If CSs are available (i.e., Cases 2 and 8 and their variants), they actuate and quickly drain the RWST, such that Lo-2 and Lo-3 occur at 21 and 35 minutes, respectively. In all cases, RHR begins to inject at 12 minutes, which also contributes to the drawdown of the RWST, such that RWST Lo-2 occurs at 44 minutes if CSs are unavailable. Core uncovery begins about 1 minute into the accident, but the injection from the RHR pumps begins to reflood the core at 12 minutes and eventually quenches the fuel.

Peak cladding temperatures reach a maximum of about 1,520 degrees F (827 degrees C))

before ECCS injection arrests fuel heatup.

34 Note that the results typically show that the pressure in one of the intact loop SGs (i.e., SG-B, -C, and -D) is lower than the pressure in the other two intact loop SGs. The lower pressure is caused by loop seal clearing, which affects the thermal-hydraulic behavior in the loop and its associated SG. This behavior is common in LOCA calculations.

69

Table 39 MLOCA Cooldown Timing Key Event Timings Case 1 Case 2 Case 2a Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 00:00 SI pump 00:01 00:00 00:00 00:01 00:00 00:01 00:00 injection RCP trip 00:02 00:00 00:00 00:02 00:00 00:02 00:00 MSIVs close 00:11 00:01 00:01 00:11 00:01 00:19 00:01 Core uncovery 00:21 00:01 00:01 00:21 00:01 00:21 00:01 CS signal 01:04 00:04 00:04 01:04 a 00:04 a -- b -- b RHR injection -- 00:12 00:12 02:09 00:12 02:09 00:12 RWST Lo-2 c 01:23 00:21 00:21 03:01 00:44 02:58 00:44 Switchover to sump recirc completed 01:33 00:31 00:31 03:11 00:54 03:08 00:54 (i.e., end of ECCS injection) d Start of RHR injection from 02:03 00:32 00:32 03:11 00:54 03:08 00:54 the sump RWST Lo-3 01:43 00:35 00:35 -- -- -- --

Core damage -- -- -- -- -- -- --

Case 7 Case 8 Case 8a Case 8b Case 9 Case 10 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Reactor trip 00:00 00:00 00:00 00:00 00:00 00:00 SI pump injection 00:01 00:00 00:00 00:00 00:01 00:00 RCP trip 00:02 00:00 00:00 00:00 00:02 00:00 MSIVs close 00:11 00:01 00:01 00:01 00:11 00:01 Core uncovery 00:21 00:01 00:01 00:01 00:21 00:01 CS signal 01:03 00:04 00:04 00:04 01:03 a 00:04 a RHR injection -- 00:12 00:12 00:12 02:09 00:12 RWST Lo-2 c 01:22 00:21 00:21 00:21 02:47 00:44 Switchover to sump recirc completed (i.e., end of 01:32 00:31 00:31 00:31 02:57 00:54 ECCS injection) d Start of RHR injection from 02:00 00:32 00:32 00:32 02:57 00:54 the sump RWST Lo-3 01:42 00:35 00:35 00:35 -- --

Core damage -- -- -- -- -- --

a Containment pressure exceeds the CS setpoint, but sprays do not initiate because they are assumed to be unavailable for this case.

b Fan coolers are able to prevent containment pressure from reaching the CS setpoint.

c This is the normal trigger for switchover of ECCS, and occurs at 46-percent level.

d Note that HPR is unavailable.

70

Table 40 MLOCA Cooldown Timing Margins Case 1 Case 2 Case 2a Case 3 Case 4 Case 5 Case 6 1,204 °C (2,200 °F) 277 378 378 852 381 852 344 minus PCT (in °C)

Completion of sump realignment-RHR -00:30 a 00:20 00:20 01:02 00:42 00:59 00:42 entry time (hh:mm)

CS setpoint-peak 78.9 containment 0b 0b 0b 0b 0b 0b

[11.4]

pressure (kPa [psi])

Case 7 Case 8 Case 8a Case 8b Case 9 Case 10 1,204 °C (2,200 °F) minus PCT 204 378 378 378 852 381 (in °C)

Completion of sump realignment-RHR entry time -00:27 a 00:20 00:20 00:20 00:48 00:42 (hh:mm)

CS setpoint-peak containment 0b 0b 0b 0b 0b 0b pressure (kPa) a RHR injects after RWST depletion and switchover to sump recirculation.

b Containment sprays are activated in this case (if available). If sprays are unavailable, actual values are negative.

Table 41 MLOCA Cooldown Timing Cooldown Rates Case 1 Case 2 Case 3 Case 4 Case 5 Target a 100 100 100 100 100 1 hr after start of cooldown 118 70 101 72 104 2 hr after start of cooldown 121 38 112 43 110 3 hr after start of cooldown 88 - 87 31 92 Case 6 Case 7 Case 8 Case 9 Case 10 Target a 100 100 100 100 100 1 hr after start of cooldown 50 99 21 101 4 2 hr after start of cooldown 34 101 17 120 8 3 hr after start of cooldown 25 77 11 77 -

a Rates are in F/hr.

71

Table 42 MLOCA Cooldown Timing Sensitivity Studies Case Sensitivity Justification Results 3b Assume The licensee PRA requires either This sensitivity case shows that 2/4 RCFCs are the RHR HX or 2/4 RCFCs for LPR 2/4 RCFCs are sufficient for available and maintaining RCS pressure below the that the RHR RHR pump shutoff head.

HX is unavailable 7b Use 3/4 SG The SC for secondary-side In this case, the SG PORV on one of PORVs for cooldown is 3/4 SG PORVs or the nonbroken loops has been cooldown 1/12 TBVs disabled. As a result of having only instead of 3/4 SG PORVs available for 4/4 SG cooldown, there are slight differences PORVs in the thermal-hydraulic response of the RCS between the sensitivity case and the base case. For example, there are slight differences in SG heat removal rates, loop flow rates, and core water level early in the transient.

In the sensitivity case, less of the core is uncovered, and the uncovery period is shorter, compared to the base case. As a result, PCT is significantly higher in the base case.

This does not imply that 3/4 SG PORVs is better than 4/4 SG PORVs; instead, it shows that there are some nonlinearities in the response (see Case 7c below) and uncertainty in the thermal-hydraulic results.

7c 2/4 SG This will further explore the impact In this case, the SG PORVs in two of PORVs that the number of available the nonbroken loops are disabled.

SG PORVs has on secondary-side However, there is little difference in cooldown the rate of heat transfer to the SGs in the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> of the transient.

Thus, two SGs are sufficient for reducing RCS pressure below the RHR shutoff head. However, there are multiple periods during which the RHR pump is dead-headed, leading to subsequent cycles of fuel heatup and fuel quenching after injection is restored. Thus, while MELCOR predicts that CD is avoided for Case 7c, there is less margin in this case than in Case 7, for which only one instance of fuel heatup is predicted.

72

Table 42 MLOCA Cooldown Timing Sensitivity Studies (continued)

Case Sensitivity Justification Results 7d Change the Typically cold leg breaks are The hot leg break is less limiting than break location analyzed because they are believed the equivalent cold leg break size for to the hot leg to be more limiting, though it is also the set of available systems in possible that a break could occur in Cases 7 and 7d. The break in the hot leg Case 7d quickly drains the hot leg, so break flow transitions to single-phase steam flow early in the accident. On the other hand, ECCS injection to the cold leg in the cold leg break case prolongs single-phase water and two-phase flow through the break, so the RCS does not depressurize as quickly in the cold leg break case.

The more rapid depressurization in the hot leg break case allows the RHR pump to inject before RWST depletion, so there is no fuel heatup, unlike in the cold leg break case.

8c Use the HFM The model used for critical flow can The PCT is approximately 30 °C (instead of the have a significant impact on flow higher in Case 8c than in Case 8 due HEM) for through the cold leg break to slight differences in break flow critical flow early in the calculation. Otherwise, the critical flow model has little impact on the results for this scenario.

8d 1.63% power Recently approved 1.63% MUR The PCT is approximately 30 °C increase power uprate (NRC, 2014a) higher in Case 8d than in Case 8 due to the slightly higher decay power.

Otherwise, the slight increase in power has little impact on the results for this scenario.

8e Delay RCP trip BEP-0 directs operators to trip Delaying RCP trip by 10 minutes by 10 minutes RCPs if SI flow >100 gpm and RCS slightly delays the time of fuel heatup, pressure <1425 psig; however, this such that PCT occurs 3 minutes later action occurs at Step 20, so there in Case 8e than in Case 8. Also, will be a delay from reactor trip PCT is 100 °C lower in Case 8e than (shortly after which the above in Case 8. This is because the longer two conditions are true) until period of forced flow provides operators take action to trip RCPs additional cooling for the fuel early in the accident and delays fuel heatup such that, when heatup occurs, decay heat is lower. Note, however, that the RCPs are modeled as constant pressure sources. The input model does not account for degraded performance during two-phase flow, nor does it adjust the differential pressure provided by the pump during single-phase steam flow.

Two-phase and single-phase steam conditions are present for much of the 10-minute RCP trip delay, so results of this sensitivity study should be used with caution.

73

Table 42 MLOCA Cooldown Timing Sensitivity Studies (continued)

Case Sensitivity Justification Results 8f Use the ANS The MELCOR model currently uses The PCT is approximately 150 °C decay heat a decay heat curve from the plants lower in Case 8f than in Case 8. This standard as FSAR is because the ANS decay heat curve encoded in from MELCOR is noticeably lower MELCOR than the decay heat curve from the Byron FSAR (as discussed in Section 4.2). Containment temperature and pressure are also lower in Case 8f than in Case 8 due to the lower decay heat, though containment pressure still exceeds the CS setpoint early in the accident sequence.

8g Adjust core This is approximately equal to the The PCT is approximately 35 °C bypass flow to maximum bypass flow cited in the higher in Case 8g than in Case 8.

6% of total FSAR This is because the increase in RCS flow bypass flow results in less coolant flow around the fuel and, thus, less heat removal from the cladding.

Otherwise, the increase in core bypass flow has little impact on the results for this scenario.

For all cases, initial flow through the break is single-phase liquid, though two-phase flow begins once the broken cold leg is nearly dry. 35 In the 2-in. break cases, the interaction between downcomer water level, core water level, and ECCS injection flow rate causes the water level in the broken leg to fluctuate, thus causing spikes in break flow during periods of single-phase liquid flow and depressions when the steam volumetric flow rate is large. Eventually, break flow reverts to single-phase liquid flow, as is shown in Cases 1, 3, 5, 7, and 9. In the 6-in. break cases, two-phase flow through the break significantly decreases the break flow rate from 3.5 minutes until about 11 minutes, at which point ECCS injection is able to reflood the broken leg such that single-phase liquid break flow resumes by 15 minutes. Single-phase break flow continues for the remainder of the calculation.

The results show that the cooldown timing has almost no effect on the key event timings for the first hour of the 6-in. break cases. This is because the break flow is sufficient to quickly depressurize the RCS so that RHR can inject before operators initiate secondary-side cooldown. 36 Late-stage effects of the cooldown timing cannot be determined at this time because of numerical problems that have prevented most of the 6-in. cases from running to completion. 37 35 The cold leg does not dry out completely as long as the ECCS pumps are injecting. The break is assumed to be in the bottom of the cold leg.

36 Note that the cooldown rates during the operator-controlled cooldown portion of the scenario for the 6-in. break cases shown in Table 41 are much less than the target rate of 100 °F/hr because the RCS quickly depressurizes and cools down due to losses from the break in the cold leg. By the time operators initiate secondary-side cooldown, RCS temperature is already more than 200 °F below the RCS and SG secondary-side operating temperatures at 100 percent-power. Thus, the cooldown rate is less than the target rate after operators open the SG PORVs.

37 See Section 5.6 for a description of these numerical problems.

74

The time of cooldown initiation does not have a significant impact on the 2-in. break cases, either. This is because the cooldown rate between 20 and 40 minutes is approximately 100 degrees F/hr regardless of whether or not operators take action to open the SG PORVs at 20 or 40 minutes. This is because there is a significant fraction of steam flow through the break beginning around 20 minutes, which depressurizes the RCS more rapidly than when break flow is single-phase liquid.

Containment cooling system availabilities do have a noticeable impact on calculation results.

For the 2-in. break cases, CSs lead to much more rapid depletion of the RWST, thus leading to significantly higher PCTs than in cases where CSs are unavailable. In comparison, the RCFC units effectively cool the containment without depleting the RWST. In fact, the peak containment pressure in Case 5 is well below the CS setpoint, which shows that all four RCFC units are very effective at cooling containment. For the 6-in. break cases, containment heat removal systems have a small impact on PCTs, such that the more effective containment heat removal system lineups result in slightly higher PCTs. This is because there is a slight increase in flow through the break at lower containment pressures. However, the difference in PCT between Case 4 (i.e., the least effective containment heat removal lineup) and Case 6 (the most effective lineup) is only 67 degrees F (37 K).

Note that lack of long-term containment heat removal capability (i.e., either the fan coolers or the RHR HX) poses challenges to containment integrity. In Case 8b, containment exceeds its design pressure of 50 psig (0.34 MPa-g) at 23 hours2.662037e-4 days <br />0.00639 hours <br />3.80291e-5 weeks <br />8.7515e-6 months <br />. Sump temperatures are 275 degrees F (135 degrees C) at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which could also challenge the containment.38 On the other hand, the sump temperature is below the RHR pump design temperature (400 degrees F). The pump would continue to inject because net positive suction head (NPSH) is adequate throughout the recirculation phase. 39 Thus, while the unavailability of the RHR HX may challenge containment integrity, the heat exchanger is not needed to prevent CD within the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> of this accident scenario.

In addition to the cases documented in the tables below, a number of sensitivity cases were run in which operators stopped secondary-side cooldown by closing the SG PORVs after the start of RHR injection. In these otherwise undocumented sensitivity cases, CD is avoided because decay heat removal by the RHR HX is sufficient for maintaining RCS pressure below the RHR pump shutoff head. This demonstrates that SG heat removal is not needed in the later stages of the accident, as long as the RHR HX is available. However, containment would exceed its design pressure before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> if fan coolers are unavailable for containment heat removal.

Finally, numerical problems have prevented some of the 6-in. cases from completing their 24-hour simulation time. These problems are discussed in Section 5.6. With that said, CD is not expected for any of the 6-in. cases because the equivalent break size is sufficient to maintain RCS pressure below the RHR pump shutoff head, thus allowing LPR to continue indefinitely. This is substantiated by the fact that, even when there is no containment heat removal in the long term, as in Case 8b, 40 LPR continues until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and PCTs 38 The short-term design temperature of the containment liner is 280 °F (138 °C) [Table 6.2-66 of the Byron FSAR].

39 The calculation of net positive suction head does not account for head losses due to possible sump screen blockage.

40 In Case 8b, the residual heat removal heat exchanger and all four of the RCFC units are assumed to be unavailable, and thus there are no active containment heat removal systems once containment spray ceases on RWST Lo-3.

75

remain well below the CD surrogate. However, the failure to run the cases to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> limits the ability to draw conclusions about the impacts of containment heat removal systems on long-term RCS and containment behavior.

In summary, the key observations from this analysis are:

• Core damage is averted in all of the 6-in. break cases because the break is large enough to maintain RCS pressure below the RHR pump shutoff head.

• Core damage is averted in all of the 2-in. breaks because the operator action to initiate secondary-side cooldown depressurizes the RCS below the RHR pump shutoff head in time to avoid or arrest core heatup.

• Containment heat removal systems have a significant impact on some of the key event timings, particularly the time of RWST depletion, but have little impact on PCTs.

- The biggest impact of the CSs is that they rapidly deplete the RWST.

- RCFC units are very effective in limiting containment pressurization and in cooling the containment atmosphere.

- The RHR HX removes decay heat late in the accident, though cladding temperatures remain well below the CD surrogate until at least 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> even without the RHR HX in service. However, containment exceeds its design pressure if the RHR HX and the RCFCs are unavailable.

5.8 Loss of Shutdown Cooling This scenario investigates a loss of RHR cooling during shutdown. The purpose of these calculations is to determine the effectiveness of various recovery actions and the time to core uncovery and CD if recovery actions are unsuccessful. This scenario is different from previous scenarios in that the loss of shutdown cooling occurs during Mode 4 (hot shutdown) or Mode 5 (cold shutdown), whereas the other events occur with the reactor at full power. Also, while previous scenarios credited few operator actions, the loss of shutdown cooling calculations attempt to represent the actions that operators may take given a loss of RHR initiating event.

Thus, the system availabilities and possible recovery actions are based heavily on information in Byron Operating Abnormal (BOA) procedure PRI-10, Loss of RH Cooling.

The loss of shutdown cooling scenario is divided into two sets based on initial operating conditions. The first set involves loss of shutdown cooling in Mode 4, with RCS pressure at 350 pounds per square inch absolute (psia) (2.41 MPa) and loop average temperature (Tavg) at 275 degrees F (135 degrees C). The second set involves loss of shutdown cooling in Mode 5, with the pressurizer PORVs opened (i.e., RCS at atmospheric pressure), RCS Tavg at 170 degrees F (77 degrees C), and the loop stop valves closed. The initial conditions, boundary conditions, and results for the Mode 4 and Mode 5 calculations are presented in Sections 5.8.2 and 5.8.3 below. In order to achieve these initial conditions and in order to be able to model the recovery actions in BOA PRI-10, some changes were made to the MELCOR input. These changes are described briefly in Section 5.8.1 and in more detail in Sections F.1 and F.2 of Appendix F.

76

5.8.1 Changes to the MELCOR Input Deck for Loss of Shutdown Cooling Calculations The following list identifies some of the changes that were made to the MELCOR input deck in order to perform shutdown calculations.

• Logic has been added to model the shutdown cooling function of the RHR system. This logic is set up such that RHR flow rate is adjusted in order to maintain a constant coolant temperature, up to the maximum flow rate of the system. The logic also includes provisions to achieve a target cooldown rate; however, this feature is not used in any of the shutdown calculations described below.

• Pressurizer level control logic has been modified to control water level during the steady-state portion of the calculation. For the Mode 5 calculations, level control is based on RPV level because the level is assumed to be at the vessel flange, which is below the bottom of the pressurizer.

• Similarly, pressurizer heater logic has been modified to achieve the desired pressure during the steady-state portion of the Mode 4 calculations. For Mode 5, heaters are disabled because the pressurizer is empty.

• Logic that makes it possible to turn off ECCS flow to prevent overfilling the pressurizer has been modified in order to simulate recovery actions in which operators inject using a charging pump when RPV level is low. This feature is exercised in Mode 4 Cases 2 and 5 and Mode 5 Cases 2, 5, and 8.

• The decay heat curves have been shifted in order to simulate the desired times after trip.

For example, the decay heat curve is shifted by 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> for Mode 4 Cases 1-5. Note that during the steady-state portion of the calculation, the decay heat is assumed to be constant and to equal the decay heat 12 hours1.388889e-4 days <br />0.00333 hours <br />1.984127e-5 weeks <br />4.566e-6 months <br /> after shutdown. The same is true for all other times since subcriticality that are analyzed below.

5.8.2 Mode 4 Calculations The Mode 4 loss of shutdown cooling calculations begin with RCS temperature and pressure at 275 degrees F (135 degrees C) and 350 psia (2.41 MPa). The RCS temperature is in the middle of the temperature range for Mode 4 (see Table 1.1 of (NRC, 2008)). The RCS pressure represents the pressure at which the RHR system can be placed into service. Pressurizer level is at no-load conditions (i.e., 25-percent level), the secondary-side temperature is equal to the RCS temperature, and the steam dumps are available and are maintaining secondary-side pressure at saturation. The list of boundary conditions is given in Table 43.

77

Table 43 Loss of Shutdown Cooling (Mode 4) Boundary Conditions

• RCS Tavg = 275 °F

• Pressurizer pressure = 337 psig

• Pressurizer water level at no-load conditions (25% level)

Primary side

• LTOP not in service a

• Pressurizer heaters and backup heaters are deenergized following loss of RHR

• SG temperature equal to RCS Tavg

• Secondary side saturated Secondary side

• Pressure controlled by condenser steam dump valves at RCS saturation pressure

• 1 train of RHR operating in shutdown cooling mode until t=0 ECCS/ESF

• Accumulators are isolated

• Operators initiate 4 of 4 RCFCs at 30 minutes (based on direction in Operator actions procedure BOA PRI-10) a Calculations show that LTOP would not cause pressurizer PORVs to actuate for this scenario.

The parameters varied for the Mode 4 calculations are the initial SG water level, the time after shutdown when RHR cooling is lost, and the recovery actions that operators perform.

The results from these calculations are presented in Table 44. Key event timings are presented in Table 45.

Table 44 Loss of Shutdown Cooling (Mode 4) Results Time Since Initial SG Core Core Case Subcriticality Water Recovery Actions a Uncovery Damage b (hr) Level (hh:mm) (hh:mm) 1 None 12:40 14:59 2 Start CCP on low RPV level d -- --

3 18% NR c Recover RHR at 2 hr -- --

4 12 Initiate AFW at 3 hr -- --

5 Initiate B&F at 4 hr -- --

6 Recover RHR at 2 hr -- --

27% WR e 7 Initiate AFW -- --

8 None 10:35 12:30 9 6 18% NR c Recover RHR at 2 hr -- --

10 Initiate AFW at 3 hr -- --

a Timings for recovery actions are from the time at which RHR cooling is lost.

b For this table, CD is defined as PCT >2,200 °F, and limited to the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

c Technical Specification surveillance requirement 3.4.6.2 requires the SG water level to be at least 18 percent for a loop to be considered available for decay heat removal during Mode 4. This suggests operators would maintain SG water level above 18 percent NR span in case the SGs are needed for cooling (such as when RHR is unavailable).

d Operators are assumed to manually initiate one charging pump when RPV level falls below 392 ft.

Operators would fill the vessel to 393.5 ft and then throttle injection flow. Rather than simulate operator actions to throttle the injection flow, Case 2 assumes operators continue to start and stop the charging pump based on RPV level. This approach is taken because the MELCOR deck already has logic built in to stop ECCS injection based on RCS water level. At the same time, this treatment maintains the intent of the procedure, which is to control water level at or above 393.5 ft.

e Per BOA PRI-10, Appendix B (recovery actions for steaming intact SGs), an SG is considered available if SG water level is greater than 27-percent wide range span.

78

Table 45 Loss of Shutdown Cooling (Mode 4) Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

SG dryout 07:08 07:08 -- -- 07:07 Core reaches saturation 08:00 08:00 -- -- 04:45 PRT disk ruptures 09:22 09:22 -- -- 07:19 Core water level at TAF 12:40 -- -- -- --

Core water level at 1/3 AF height 13:20 -- -- -- --

PCT >1200 °F 13:44 -- -- -- --

PCT >2200 °F 14:59 -- -- -- --

Core exit thermocouple T >1200 °F 14:01 -- -- -- --

Core-wide Cs release >3% 14:41 -- -- -- --

Charging pump injection -- 12:25 -- -- 08:31 Case 6 Case 7 Case 8 Case 9 Case 10 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

SG dryout -- -- 05:58 -- --

Core reaches saturation -- -- 09:43 -- --

PRT disk ruptures -- -- 07:48 -- --

Core water level at TAF -- -- 10:35 -- --

Core water level at 1/3 AF height -- -- 11:08 -- --

PCT >1200 °F -- -- 11:27 -- --

PCT >2200 °F -- -- 12:30 -- --

Core exit thermocouple T >1200 °F -- -- 11:40 -- --

Core-wide Cs release >3% -- -- 12:03 -- --

Charging pump injection -- -- -- -- --

The results show that if RHR is lost during Mode 4, the operators have several hours to perform recovery actions before the core reaches saturation. All of the recovery actions in BOA PRI-10 are successful in preventing CD before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, though B&F without further actions (such as to recover RHR, initiate AFW, align charging pump suction to the containment sump, or refill the RWST) will eventually result in CD when B&F is lost after the RWST is emptied.

In each case, RCS temperature increases immediately following loss of shutdown cooling.

The increase in temperature also causes an increase in pressurizer level. RCS temperature levels out by 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> as SG heat removal matches core decay heat via the steam dumps.

If no actions are taken (such as in Cases 1 and 8), the SGs will continue to remove heat until SG dryout. The time of dryout depends on the initial secondary-side water level and on the time since shutdown (i.e., the decay heat load). After SG dryout, RCS temperature and pressure increase until pressurizer pressure reaches the pressurizer PORV opening setpoint. (As indicated by the figures for Case 1 in Appendix F, low temperature overpressure protection (LTOP) would not cause the pressurizer PORVs to open until pressure reaches the normal at-power PORV setpoint.) The PORV continues to cycle, while the water level in the core drops, leading to core uncovery and fuel damage at 12:40 and 14:59 for Case 1 and at 10:35 and 12:30 for Case 8. (Fuel damage times presented here are the times at which PCT

>2,200 degrees F).

Case 2 is the same as Case 1 until water level nears the TAF. At that point, operators are assumed to use one charging pump to maintain level above the TAF, in accordance with BOA PRI-10. This allows operators to delay CD until after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, which gives them additional time to recover RHR or to initiate AFW to provide SG cooling. Case 5 is similar to 79

Case 2, except operators fully open one PORV at 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br />, 41 when RCS pressure is at approximately 200 psia (1.4 MPa). (In comparison, the PORV first opens around 8.5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> in Cases 1 and 2). Because the PORV is opened earlier in Case 5 than it opens in Case 2, the RCS inventory loss is greater in Case 5, and thus the required makeup flow is greater as well.

However, the pressurizer PORV cycles a large number of times in Case 2 and a failure of the valve to close due to this cycling would cause Case 2 to behave more like Case 5.

Nevertheless, assuming that operators continue to inject until RWST level reaches 9 percent (as directed in BOA PRI-10), neither Case 2 nor Case 5 experiences fuel heatup within 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Based on the average injection rate for Case 5, injection is expected to continue until approximately 33 hours3.819444e-4 days <br />0.00917 hours <br />5.456349e-5 weeks <br />1.25565e-5 months <br />. Core damage would occur shortly afterward because water level is already near the TAF, so operators would need to take additional actions (e.g., refilling the RWST) to prevent CD after 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. Core damage would occur much later for Case 2 based on the RWST level at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

The remaining cases are successful in preventing CD. Cases 3, 6, and 9 show the effects of recovering RHR at 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. In these cases, RHR steadily decreases RCS temperature and pressure until the end of the calculation at 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />. The SGs are not needed for cooling following RHR recovery, and so SG dryout does not occur in these cases. Also, because RCS pressure does not increase (and thus the pressurizer PORVs do not open) in the 2-hour period between transient initiation and RHR recovery, no RCS inventory is lost. Thus, the system is at a safe, stable state at the end of the calculation.

Cases 4, 7, and 10 show the effects of initiating AFW at 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. In each of these cases, natural circulation cooling is sufficient for removing decay heat before AFW initiation. This is true even for Case 7, which begins with reduced SG inventory. After 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />, AFW provides sufficient cooling under natural circulation conditions until RCS nears saturation at the secondary-side pressure. At this point, the falling pressure causes voids to form in the upper head, which reduces RPV water level while increasing pressurizer level. At the end of the calculation, RPV level is still falling, though it remains 4 m above TAF. If the calculation is continued beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, water level eventually falls to 3 m above TAF but then increases and stabilizes about 3.5 m above TAF. Throughout the calculation, SGs remove the full decay heat load and maintain the fuel at a safe and stable temperature.

Flashing in the upper head caused by the decrease in RCS pressure to the secondary-side pressure can be prevented by operating the pressurizer proportional heaters or backup heaters to maintain the RCS at a constant pressure. By doing so, flashing in the upper head can be prevented and natural circulation flow can be maintained throughout the 24-hour mission time.

This has been verified by an undocumented sensitivity calculation. The operators could also recover RHR (if possible) to provide adequate cooling if natural circulation cooling is insufficient.

41 The strategy used for Case 5 is Attachment C of BOA PRI-10. Attachment C directs operators to start injection at about the same time that they open a PORV. The rest of Attachment C directs operators to either start an SI pump to supplement the charging pump, or failing that, to throttle charging flow to match the boiloff rate. For simplicity, Case 5 instead uses the logic to start/stop charging to maintain RPV level above TAF that is also used for Case 2. The resulting average charging flow rate is approximately equal to the boiloff rate, so the intent of Attachment C is being met, even though there is a rather large delay between the time at which operators open the PORV and the time at which RPV level falls sufficiently low to trigger charging pump injection. Note that while the time to RWST depletion would change by about 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> if injection started immediately, the time of CD likely would not change, since the RCS level at the time of RWST depletion would be higher if charging pump injection started earlier.

80

The different initial conditions result in only minor differences in system behavior and event timings for the cases in which recovery actions are credited. Note, however, that SG dryout occurs earlier when the time since shutdown or the initial SG inventory is reduced. 42 Thus, operators have less time to perform recovery actions before the core uncovers.

In these simulations, actions to restore RHR or initiate AFW are performed before the core reaches saturation. Once the core reaches saturation, recovery actions may not be successful.

For cases in which operators initiate AFW, natural circulation may be inhibited by saturated conditions in the RCS. At the same time, RHR performance may be degraded during saturated conditions.

In summary, the key observations from this analysis are:

• Operators have several hours to take action before the core reaches saturation.

• All of the recovery actions modeled here are successful in preventing CD before 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, although recovery actions that rely on a charging pump to maintain water level above the TAF must be supplemented by actions to refill the RWST or by actions to recover RHR or AFW to prevent CD beyond 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />.

Flow Rates in Idle Loops During the comment period for this NUREG, Exelon commented that the flow rates in the idle RCS loops during the steady-state portion of the calculation are higher than expected during Mode 4. Specifically, RHR flow is approximately 90 kilograms per second (kg/s), while flow through the idle RCPs is approximately 90 kg/s per loop, or 360 kg/s for all four loops, during the steady-state portion of Cases 1-5. Exelon stated that flow through the idle loops would be much lower than these values calculated by MELCOR.

To address this issue, a sensitivity calculation (Case 4a) has been performed in which the form loss coefficient for the RCPs is set to a very high value. Otherwise, the sensitivity case is the same as Case 4. This reduces the flow through the idle RCPs to approximately 20 kg/s per loop during the steady-state portion of the calculation. The idle loop flow remains relatively constant throughout the transient portion of the calculation.

The lower loop flow results in less efficient heat transfer to the SGs, which means that the hot leg temperature is approximately 36 degrees F (20 degrees C) hotter in Case 4a than in Case 4 in order to facilitate the same decay heat removal rate. However, the hot leg temperature is still less than the saturation temperature. Furthermore, RCS pressure remains below the LTOP 42 Interestingly, core saturation occurs later in Case 8 than in Case 1. However, this is most likely caused by a small difference (2-3 cm) in pressurizer water level at the start of the transient. As the subcooling margin figures in Sections F.1.1 and F.1.8 show, subcooling margin decreases following SG dryout but then increases. The increase in subcooling margin is due to the fact that the saturation temperature increases more rapidly than the core temperature once pressurizer level exceeds a certain point. Note that RCS pressure (and thus saturation temperature) increases more rapidly as the steam bubble in the pressurizer is compressed. Thus, because the initial water level is slightly lower in Case 8, subcooling margin begins to increase before the core reaches saturation. Note that subcooling margin drops below zero and stays there much earlier in Case 8 than in Case 1.

Thus, Case 8 is actually more limiting than Case 1 in terms of time to saturation, at least based on these simulations.

81

setpoint. The SGs provide adequate heat removal, and there are no coolant leaks, so CD is avoided.

To summarize, the larger-than-expected idle loop flows during Mode 4 result in a lower hot leg-to-cold leg temperature difference, but otherwise have little effect on the results of the sensitivity case.

A related issue is whether or not the RCPs would be running at this point in the outage. The plant cooldown procedure is not available for Byron, but the cooldown procedure for a similar plant shows that RCPs would be running. However, this is only relevant for the steady-state analysis, because operators would be directed to quickly trip the RCPs following the loss of RHR. For this reason, the RCPs remain off for this analysis.

5.8.3 Mode 5 Calculations The Mode 5 loss of shutdown cooling calculations begin with the RCS at atmospheric pressure and RCS temperature at 170 degrees F (77 degrees C). The RCS temperature is in the middle of the temperature range for Mode 5 (see Table 1.1 of (NRC, 2008)). RCS level is at the vessel flange, and thus the pressurizer is empty. The pressurizer PORVs are both open and the pressurizer relief tank (PRT) is assumed to be vented to containment through a vent with flow area equivalent to the PRT rupture disk area. The loop stop valves are assumed to be closed.

The list of boundary conditions is given in Table 46.

Table 46 Loss of Shutdown Cooling (Mode 5) Boundary Conditions

• RCS Tavg = 170 °F (77 °C)

• Pressurizer pressure = atmospheric

• RCS level at top of flange Primary side

• Pressurizer PORVs open and unisolable

• PRT vented to containment

• Hot and cold leg loop stop valves closed a Secondary side

• N/A

• 1 train of RHR operating in shutdown cooling mode until t=0 ECCS/ESF

• Accumulators are isolated

• Operators initiate 4 of 4 RCFCs at 30 minutes (based on direction in Operator actions procedure BOA PRI-10)

Other

• None a The loop stop valves are valves in the hot and cold legs that can be closed to isolate the RPV from the SGs to perform maintenance on the SGs. The loop stop valves are used in place of dams in the SG nozzles, which are used in similar pressurized-water reactors. Whether a plant uses loop stop valves or nozzle dams should not greatly affect the results.

The parameters varied for the Mode 5 calculations are the time after shutdown when RHR cooling is lost and the recovery actions that operators perform. The results from these calculations are presented in Table 47. Key event timings are presented in Table 48.

The results show that if RHR is lost during Mode 5 with the SGs isolated and RCS level at the vessel flange, the operators have less than 20 minutes before the core reaches saturation.

However, recovery actions can still be successful after the core reaches saturation, as discussed below.

82

Table 47 Loss of Shutdown Cooling (Mode 5) Results Time Since Core Core Damage b Case Subcriticality Recovery Actions a Uncovery (hh:mm)

(hr) (hh:mm) 1 None 01:37 03:21 2 40 Start CCP on low RPV level c 25:32 27:30 3 Recover RHR d -- -- e 4 None 01:29 03:11 5 30 Start CCP on low RPV level c 22:58 25:00 6 Recover RHR d -- -- e 7 None 01:56 03:57 8 60 Start CCP on low RPV level c 28:44 30:29 9 Recover RHR d -- -- e a Timings for recovery actions are from the time at which RHR cooling is lost.

b For this table, CD is defined as PCT >2,200 °F.

c Operators are assumed to manually initiate one charging pump when RPV level falls below 392 ft.

Operators would fill the vessel to 393.5 ft and then throttle injection flow. Rather than simulate operator actions to throttle the injection flow, Case 2 assumes operators continue to start and stop the charging pump based on RPV level. This approach is taken because the MELCOR deck already has logic built in to stop ECCS injection based on RCS water level. At the same time, this treatment maintains the intent of the procedure, which is to control water level at or above 393.5 ft.

d Operators are assumed to recover RHR shortly after water level in the hot leg reaches the hot leg midplane.

This time corresponds to 23 minutes for Cases 3 and 6 and 27 minutes for Case 9.

e Note that these cases assume that the RHR pump has adequate net positive suction head (NPSH) as long as there is water in the hot leg. The RHR model in the MELCOR input deck is not suited for modeling degraded pump performance due to inadequate NPSH or high void fraction. Thus, these results must be used with caution.

For all cases, loss of RHR cooling at time zero causes RCS temperature to increase until the core reaches saturation. Once coolant in the core begins to boil, a gas (steam and air) bubble expands in the upper head that forces water out of the vessel and into the pressurizer.

For the cases in which no recovery actions are taken (i.e., Cases 1, 4, and 7), coolant boiloff leads to core uncovery within 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, beginning as early as 89 minutes in Case 4, which has the highest decay heat load of the three cases. Peak cladding temperatures first exceed 2,200 degrees F (1,204 degrees C) about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after water level reaches the TAF. It is worth noting that PCT exceeds 2,200 degrees F (1,204 degrees C) before water level reaches 1/3 active fuel height. This is different from the Mode 4 calculations, in which the core is almost completely uncovered when PCT first exceeds 2,200 degrees F (1,204 degrees C).

In Cases 2, 5, and 8, the operators take action to maintain RPV water level above the TAF.

This action is successful in delaying core uncovery and heatup until the RWST level falls to 9 percent, prompting operators to stop injection. This occurs at ~24, 21.5, and 27 hours3.125e-4 days <br />0.0075 hours <br />4.464286e-5 weeks <br />1.02735e-5 months <br /> for Cases 2, 5, and 8, respectively. Water level drops to the TAF about an hour and a half after RWST depletion. Peak cladding temperature first exceeds 2,200 degrees F (1,204 degrees C) about 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after water level reaches the TAF.

83

Table 48 Loss of Shutdown Cooling (Mode 5) Key Event Timings Case 1 Case 2 Case 3 Case 4 Case 5 Case 6 (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm) (hh:mm)

Core reaches saturation 00:13 00:13 00:13 00:13 00:13 00:13 Core water level at TAF 01:37 25:32 -- 01:29 22:58 --

Core water level at 1/3 AF height 04:02 27:51 -- 03:48 25:15 --

PCT >1200 °F 02:40 26:51 -- 02:15 24:17 --

PCT >2200 °F 03:21 27:30 -- 03:11 25:00 --

Core exit thermocouple T 03:03 27:11 -- 02:42 24:38 --

>1200 °F Core-wide Cs release >3% 03:07 27:17 -- 02:46 24:44 --

Charging pump injection -- 00:30 -- -- 00:30 --

RWST level at 9% a -- 24:02 -- -- 21:35 --

Case 7 Case 8 Case 9 (hh:mm) (hh:mm) (hh:mm)

Core reaches saturation 00:16 00:16 00:16 Core water level at TAF 01:56 28:44 --

Core water level at 1/3 AF height 04:28 30:52 --

PCT >1200 °F 03:20 29:55 --

PCT >2200 °F 03:57 30:29 --

Core exit thermocouple T >1200 °F 03:41 30:15 --

Core-wide Cs release >3% 03:43 30:13 --

Charging pump injection -- 00:30 --

RWST level at 9% a -- 26:49 --

a Operators are directed to stop injection from the RWST when RWST level is less than 9 percent.

In Cases 3, 6, and 9, operators recover RHR when the water level reaches the hot leg midplane (at 23 minutes in Cases 3 and 6 and at 27 minutes in Case 9). RHR cooling quickly collapses the steam bubble in the upper head, thus relieving RCS pressure and allowing coolant that was forced into the pressurizer to flow back to the RPV. RHR quickly returns the RCS to a safe, stable state.

Note that the MELCOR model assumes the RHR suction line draws from the bottom of the hot leg. This means that the RHR pump can draw water as long as there is any water in the hot leg. 43 Also note that the line is not modeled explicitly and that there is no attempt to simulate entrainment of steam in the RHR pump suction line. Finally, NPSH requirements and air entrainment in the RHR pumps due to vortexing are not considered in the simplified model of the RHR system. The results presented here could be significantly different if the suction line is assumed to draw from somewhere above the bottom of the hot leg, or if RHR pump performance is degraded due to high void fraction or insufficient NPSH. In fact, using information about the RHR pump elevation relative to the hot leg for a similar plant, there would most likely be insufficient NPSH, and so the pump would likely be cavitating. Furthermore, plant procedures direct operators to focus on aligning a charging or SI pump to increase level instead of recovering RHR. Thus, operators would most likely not take this recovery action because the procedures direct them to focus on increasing level and because RHR is unlikely to run under saturated conditions. Nevertheless, these results demonstrate that recovering RHR would be 43 Note that this is of greater concern for loss-of-decay heat removal accidents (as the one studied here), because the water level spends more time in the range of concern. For a loss-of-inventory event, the water level passes through this elevation quickly, and RHR is lost at similar times regardless of the orientation of the RHR piping (e.g., see Section A.3.2.4 of (NRC, 2014b).

84

successful in preventing CD as long as the RHR pump has adequate NPSH (i.e., before the core reaches saturation.)

In summary, the key observations from this analysis are:

• Operators have significantly less time to take action for this set of initial conditions than they do for the Mode 4 loss of shutdown cooling scenario. This is because the loop stop valves are closed, therefore the SGs are unavailable for cooling and the initial RCS water level is much lower for the Mode 5 calculations.

• Operators can prevent CD by restoring RHR cooling by the time water level reaches the hot leg midplane, but see the text earlier in this section for some significant considerations related to hot leg orientation and NPSH.

• Using a charging pump to provide makeup to the vessel is successful in delaying core uncovery and heatup, but subsequent actions must be taken to prevent CD. Such actions include refilling the RWST, aligning ECCS pumps to the sump, or restoring RHR cooling.

85

6. APPLICATION OF MELCOR RESULTS TO THE SPAR MODELS Table 49 maps the MELCOR calculations presented in Section 5 with the most closely corresponding standardized plant analysis risk (SPAR) model sequences (using the current SPAR model success criteria (SC)) and provides the relative risk contribution of these sequences. Note that at the initiator heading level (e.g., small-break loss-of-coolant accident (SLOCA)), the rightmost column gives the relative contribution of all SPAR sequences from that initiator class (e.g., SLOCA = 22 percent), while the subsequent rows give the relative contributions from the subset of sequences studied in this report (e.g., SLOCA-7 = 0.39 percent). All relevant event trees are provided in Appendix G.

Recall that the SPAR models are most commonly used for events and conditions assessment, meaning that specific portions of the model have relatively more importance in specific applications than their baseline frequencies would suggest. An example of this is primary-side bleed and feed (B&F), for which the two sequences in Table 49 have relatively small contributions. Yet, if an event or condition assessment includes the unavailability of one power-operated relief valve (PORV), successful B&F is no longer possible with the existing SC.

Table 50 below (a) summarizes the scenarios that have been investigated, (b) recaps the boundary and initial condition variations studied using MELCOR, (c) highlights the relevant parts of the existing Byron SPAR SC, and (d) discusses potential changes to the Byron model based on the MELCOR analysis. In addition, the table identifies cases in which these results can be applied to SPAR models for other similar plants. This table is the starting point for a subsequent evaluation by the SPAR model developers to (a) ensure these changes are appropriate and (b) assess whether the same changes can be made to the SPAR models for similar Westinghouse (four-loop) plants.

87

Table 49 Mapping of MELCOR Analyses to the Byron SPAR (8.27) Model Percentage as Part Percentage as SPAR of Initiator Class Part of Total Sequence CDF (Internal Internal Event (see App. B) MELCOR Calculations Events) CDF SLOCA-Sequence Timing for Alignment of Sump RecirculationSection 5.1 of this report 22 SLOCA-1 Cases 1, 2, 3, 4, 7, 8, 9, 10 N/ASuccess Path N/ASuccess Path SLOCA-7 Cases 5, 6, 11, 12 1.8 0.39 SLOCA-Success Criteria for Steam Generator (SG)

Depressurization and Condensate FeedSection 5.2 of this report 22 (Not modeled in Byron SPAR 8.27 Model) All Cases N/ANot Modeled N/ANot Modeled SLOCA-Success Criteria for Primary Side Bleed and Feed (B&F)Section 5.3 of this report 22 SLOCA-19 Cases 3, 7 N/ASuccess Path N/ASuccess Path SLOCA-21 Cases 1, 2, 4, 5, 6, 8 <0.01 <0.01 LoDCB-111-Unavailable DD-AFW, and Subsequent Primary Side B&FSection 5.4 of this report 0.94 LDCA-12 All Cases 54 0.50 SGTR-Spontaneous Steam Generator Tube Rupture with No Operator ActionSection 5.5 of this report 4.1 SGTR-12 All Cases 74 3.0 MLOCA-Injection Success Criteria (SC)Section 5.6 of this report 4.1 MLOCA-4 Cases 1, 2, 3, 4 20 0.83 MLOCA-10 Cases 5, 6, 7, 8 <0.01 <0.01 MLOCA-Cooldown Timing for Low-Pressure Recirculation (LPR)Section 5.7 of this report 4.1 MLOCA-1 Cases 1, 2, 3, 4, 5, 6 N/ASuccess Path N/ASuccess Path MLOCA-4 Cases 7, 8, 9, 10 20 0.83 LOSDC-Loss of Shutdown CoolingSection 5.8 of this report N/ANot Modeled (Not modeled in Byron SPAR 8.27 Model) All Cases N/ANot Modeled N/ANot Modeled 88

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations These calculations have generally confirmed SPAR SC and provide sequence timing information for specific applications.

Results suggest that primary-side depressurization is necessary to reach LPR conditions before the time of sump switchover, but

• Break sizes:

not to avert CD. In specific applications, the primary-side 0.83 in. (2.11 cm),

depressurization criteria could be relaxed, if contextual factors 1.66 in. (4.22 cm)

(i.e., procedural direction and specific failures) would still result SLOCA -

• Injection systems in LPR alignment once RCS pressure had dropped from the loss Sequence Timing available SLOCA sequence timing and of injection.

for Alignment of (1 charging pump mitigation SC for the alignment Sump or 1 SI pump) of the sump The SPAR SC related to containment cooling should be Recirculation b

• SG cooldown revisited, as a sensitivity study suggests that 1 containment fan (Section 5.1) initiation time cooler is necessary to prevent containment spray actuation,

• Target earlier RWST depletion, and CD (for SLOCA sequences relying depressurization on operator cooldown to substitute for HPR).

89 rate Results show that success is not very sensitive to the timing of the start of the operator-induced cooldown or to the availability of the CCW to RHR HX in LPR (due to the availability of AFW).

• Break sizes:

SLOCA - 0.83 in. (2.11 cm), Action to depressurize the SGs early and align condensate feed Sequence Timing 1.66 in. (4.22 cm) is a candidate for inclusion in the SPAR model. If this is done, for SG

• Injection systems hotwell refill or alignment of alternate feedwater later in the Not modeled in the SPAR Depressurization available scenario would also need to be modeled. Early model and Condensate (1 charging pump depressurization to achieve condensate feed was not found to Feed b or 1 SI pump) require primary-side depressurization actions (e.g., opening a (Section 5.2)

• SG cooldown PORV).

initiation time

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations These calculations have demonstrated a potential improvement that can be implemented in the SPAR model. It is proposed that the SC for SLOCA B&F be changed from (1 SI or charging

• Break sizes: pump and 2 PORVs) to (1 SI pump and 2 PORVs) or (1 CCP 0.83 in. (2.11 cm), and 1 PORV).

1.66 in. (4.22 cm)

SLOCA - Success

• Injection systems Sensitivity cases indicate that (1 SI and 1 PORV) may also be SLOCA sequence timing and Criteria for Primary available appropriate, and this should be considered on an mitigation SC for primary-side Side B&F b (1 charging pump application-specific basis.

B&F (Section 5.3) or 1SI pump)

• Bleed-and-feed Results indicate that either 1/4 RCFC or the CCW to RHR HX is initiation time capable of late decay heat removal.

• # PORVs used These calculations can also provide more information on human failure event timings to initiate B&F on an application-specific basis.

These calculations are generally representative of non-LOCA 90 B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is

• Injection systems Loss of DC bus 111 sequence proposed that the SC for non-LOCA B&F be changed from (1 SI available timing and SC with AFW or CCP and 2 PORVs) to (1 CCP and 1 PORV).

(1 charging pump unavailable LoDCB-111 -

or 1 SI pump) [this initiator was chosen Note that the applicability of the loss of DC bus SC may vary, Unavailable because it was qualitatively felt (e.g., due to the unique RCP trip situation that this initiator DD-AFW, and

• Bleed-and-feed to be more restirctive than creates), and should be evaluated on a case-by-case basis Subsequent initiation time those scenarios categorized before implementation for other plants. Meanwhile, for initiators Primary Side B&F

• PORV treatment:

as general transients in the where both PORVs are available, sensitivity calculations (Section 5.4) sticks 50% open PRA, and thus the conclusions suggest that 1 SI and 2 PORVs is successful for some timeing at 251 lifts, does are believed to be applicable assumptions but not others, and this could be considered on an not stick open to those initiators as well] application-specific basis.

These calculations can also provide more information on HEP determinations to initiate B&F on an application-specific basis.

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations For the SPAR SGTR sequence studied (SGTR-12), the results suggest that this sequence could lead to a success end-state for a 24-hour mission time if ECCS injection is controlled in order to

• Injection systems prevent excessive PORV cycling. Termination or control of available safety injection is not currently queried for this sequence, likely (1 charging pump due to the upstream failure of steam generator isolation (which SGTR - or is assumed to result in a kickout to the ECA procedures).

Spontaneous 2 charging pumps Whether additional credit is possible could be reviewed within Steam Generator and 2 SI pumps) SGTR event tree strcutre and the context of the accident sequence and human reliability Tube Rupture with

• # tubes ruptured timing modeling assumptions. Alternatively, the human error No Operator (0.5, 2) probabilities for the existing downstream success paths Action (Section 5.5)

• Condenser steam (SGTR-10 and SGTR-11) could also be reviewed, in light of the dumps available long sequence times.

• Manual reactor trip No other changes to the baseline model are currently being proposed based on these calculations. These calculations, however, can provide more information on HEP determinations 91 on an application-specific basis.

For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functaional Restoration Proceudre (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The

• Break sizes:

time available to implement these actions following the FRP range from 2 to entry criterion being met could be short. The accident sequence 6 in. (5.1 to modeling and human reliability analysis associated with 15.1 cm)

MLOCA - secondary-side cooldown for these situations (MLOCA with HPI

• Injection systems SC for the injection phase for Injection SC c failed) should be reviewed.

available (1 SI the MLOCA event tree (Section 5.6) pump and 1 RHR When HPI is successful, (non-FRP-based) secondary-side pump, or cooldown or HPR was found to be necessary near the transition 2 accumulators between SLOCA and MLOCA, encompassing as much as 33%

and 1 RHR pump) of the 2-in. (5.1-cm) to 6-in. (15.2-cm) break range.

Containment fan coolers or the RHR HX is needed in the long term to prevent containment overpressure.

Table 50 Potential Success Criteria Updates Based on Byron Unit 1 Results (continued)

Initiator/Aspect of MELCOR Variations Affected Portion of Existing Proposed SPAR Changes or Application-Specific Interest for Baseline Cases a SPAR Model Considerations

• Break sizes:

range from 2 to 6 in. (5.1 to 15.1 cm)

• SG cooldown MLOCA - initiation time No changes to the SPAR model are proposed based on these Cooldown Timing

• Available MLOCA sequence timing for calculations. However, these calculations may be useful for for LPR c containment heat cooldown for LPR informing specific applications.

(Section 5.7) removal systems

• Operator action to terminate cooldown if cold leg temperatures are increasing

• Loss of SD cooling in Mode 4:

92 initial SG water level, time RHR cooling is lost, No changes to the SPAR model are being proposed based on LOSDC - Loss of recovery actions Not modeled in the SPAR these calculations. These results will be instead used for Shutdown Cooling

• Loss of SD model application-specific information as well as to aid in (Section 5.8) cooling in Mode 5:

benchmarking a separate NRC shutdown Excel calculator.

time after shutdown when RHR cooling is lost and recovery actions a This table focuses on the baseline results, not the sensitivity analyses.

b Historically, SLOCAs have been 0.5-in (1.3-cm) to 2-in. (5.1-cm) equivalent diameter (NRC, 1990) and (NRC, 1999) Appendix J.

c Historically, MLOCAs have been 2-in. (5.1-cm) to 6-in. (15.2-cm) equivalent diameter or larger (NRC, 1990) and (NRC, 1999) Appendix J.

7. CONCLUSIONS This project used a realistic core damage (CD) definition surrogate based on accident simulations. The project performed MELCOR analyses for the Byron Unit 1 nuclear power plant, looking at various initiating events and sequences of interest. These results have either confirmed existing standardized plant analysis risk (SPAR) assumptions, or provide a technical basis for a few specific model changes.

The study results provide additional timing information for several probabilistic risk assessment sequences, confirm many of the existing SPAR model modeling assumptions, and provide a technical basis for a few specific SPAR modeling changes. Potential SPAR model changes supported by this study include:

• Small-Break Loss-of-Coolant Accident (SLOCA) Sequence Timing for Alignment of Sump RecirculationFor sequences where operator cooldown is credited as an alternative to high-pressure recirculation (HPR), the SPAR success criteria related to containment cooling could be enhanced by requiring one containment fan cooler to prevent containment spray actuation. Avoiding spray actuation extends the time available prior to refueling water storage tank depletion and allows the operators to successfully depressurize the plant using the post-LOCA procedures for cases when HPR is not available.

• SLOCA Success Criteria for Steam Generator (SG) Depressurization and Condensate FeedAction to depressurize the SGs early and align condensate feed is a candidate for inclusion in the SPAR model. This would provide an additional success path for a loss of auxiliary feedwater event. If this is done, hotwell refill or alignment of alternate feedwater later in the scenario would also need to be modeled. Early depressurization to achieve condensate feed was not found to require primary-side depressurization actions (e.g., opening a power-operated relief valve (PORV)).

• SLOCA Success Criteria for Primary Side Bleed and Feed (B&F)These calculations have demonstrated a potential conservatism that can be removed from the applicable SPAR models. It is proposed that the SC for SLOCA B&F be changed from (one safety injection (SI) or centrifugal charging pump (CCP) and two PORVs) to (one SI pump and two PORVs) or (one CCP and one PORV). In other words, for SLOCAs the requirement for availability of a second PORV can be removed when a CCP is available.

• Loss of DC Bus-111 - Unavailable Diesel-Driven Auxiliary Feedwater, and Subsequent Primary Side B&FThese calculations are generally representative of non-loss-of-coolant accident (non-LOCA) B&F situations and have demonstrated a potential improvement that can be implemented in the Byron SPAR model. It is proposed that the SC for non-LOCA B&F be changed from (one SI or CCP and two PORVs) to (one CCP and one PORV). In other words, the same one CCP and one PORV enhancement as above is credited, but credit is eliminated for cases with no CCP available. This initiator was chosen because it was qualitatively felt to be more restrictive than those scenarios categorized as general transients in the PRA, and thus the conclusions are believed to be applicable to those initiators as well. Note that the applicability of the loss of DC bus SC may vary, (e.g., due to the unique reactor coolant pump trip situation that this initiator 93

creates) and should be evaluated on a case-by-case basis before implementation for other plant models.

• SGTR - Spontaneous Steam Generator Tube Rupture with No Operator ActionFor sequences with successful high-pressure injection (HPI) and auxiliary feedwater, but with steam generator isolation having failed, an additional success path or additional recovery credit may be justifiable pending additional consideration of closely-related accident sequence and human reliability modeling assumptions.

• Medium-Break Loss-of-Coolant Accident (MLOCA) - Injection SC For breaks in the lower half of the MLOCA range, it was found that an early operator-induced depressurization based on the Functional Restoration Procedure (FRP) for inadequate core cooling would be needed to avoid core damage if HPI fails. The time available to implement these actions following the FRP entry criterion being met could be short. The accident sequence modeling and human reliability analysis associated with secondary-side cooldown for these situations (MLOCA with HPI failed) should be reviewed.

94

8. REFERENCES (10 CFR, 2007) U.S. Code of Federal Regulations, Domestic Licensing of Production and Utilization Facilities, Part 50, Chapter I, Title 10, Energy.

(Adams, 1985) Adams J.P., et al., Quick Look Report on OECD LOFT Experiment LP-FP-2, OECD LOFT-T-3804, EG&G Idaho, Inc., Idaho Falls, ID, September 1985, Agencywide Documents Access and Management System (ADAMS) Accession No. ML071940358.

(ASME/ANS, 2009) American Society of Mechanical Engineers/American Nuclear Society, ASME/ANS RA-Sa-2009, Standard for Level 1/Large Early Release Frequency Probabilistic Risk Assessment for Nuclear Power Plant Applications, ANS, LaGrange Park, IL, March 2009.

(Dementiev, 1977) Dementiev, B.A., Studying Hydrodynamics of Steam-water Media in Steady-state and Non steady-state Conditions for Nuclear Power Installations, Doctor-of-Science thesis, Moscow Power Engineering Institute, Moscow, 1977 (in Russian).

(EPRI, 2010) Electric Power Research Institute, MAAP4 Applications Guidance, EPRI TR-1020236, July 2010.

(EPRI, 2011) Electric Power Research Institute, Technical Framework for Management of Safety Margins - Loss of Main Feedwater Pilot Application, EPRI TR-1023032, November 2011.

(Gabor, 2005) Gabor, J.R., and D.E. True, Byron and Braidwood Feed and Bleed Analysis Using MAAP4, International Topical Meeting on Probabilistic Safety Assessment and Analysis, PSA 05, September 11-15, 2005, American Nuclear Society, San Francisco, CA.

(Hering, 2007) Hering W., et al., Results of Boil-off Experiment QUENCH-11, FZKA 7247, SAM-LACOMERA-D18, Forschungszentrum Karlsruhe, Karlsruhe, Germany, June 2007.

(Huhtiniemi, 1993) Huhtiniemi, I.K., and M.L. Corradini, Condensation in the Presence of Noncondensable Gases, Nuclear Engineering and Design, 141:429-446.

(NRC, 1980) U.S. Nuclear Regulatory Commission, Three Mile Island: A Report to the Commissioners and to the Public, NUREG/CR-1250, January 1980.

(NRC, 1981) U.S. Nuclear Regulatory Commission, BWR Refill-Reflood Program Task 4.8Model Qualification Task Plan, NUREG/CR-1899/EPRI NP-1527/GEAP-24898, August 1981.

(NRC, 1988) U.S. Nuclear Regulatory Commission, Decay Heat Removal Using Feed-and-Bleed for U.S. Pressurized Water Reactors, NUREG/CR-5072, June 1988.

95

(NRC, 1990) U.S. Nuclear Regulatory Commission, Severe Accident Risks: An Assessment for Five U.S. Nuclear Power Plants, NUREG-1150, December 1990.

(NRC, 1992) U.S. Nuclear Regulatory Commission, Boil-Off Experiments with the EIR-NEPTUN Facility: Analysis and Code Assessment Overview Report, NUREG/IA-0040, March 1992, ADAMS Accession No. ML062560458.

(NRC, 1999) U.S. Nuclear Regulatory Commission, Rates of Initiating Events at U.S. Nuclear Power Plants: 1987-1995, NUREG/CR-5750, February 1999.

(NRC, 2005) U.S. Nuclear Regulatory Commission, MELCOR Computer Code Manuals, Vol. 1: Primer and Users Guide, Version 1.8.6.2005, NUREG/CR-6119, Rev. 3, 2005.

(NRC, 2008) U.S. Nuclear Regulatory Commission, Exelon Generation Company, LLC Docket No. STN 50-454 Byron Station, Unit No. 1 Facility Operating License, Appendix A, Technical Specifications, February 2008.

(ADAMS Accession No. ML052910365).

(NRC, 2009) Regulatory Guide 1.200, An Approach for Determining the Technical Adequacy of Probabilistic Risk Assessment Results for Risk-Informed Activities, Revision 2, March 2009.

(NRC, 2011a) U.S. Nuclear Regulatory Commission, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, NUREG-1953, September 2011.

(NRC, 2011b) U.S. Nuclear Regulatory Commission, Industry Performance of Relief Valves at U.S. Commercial Nuclear Power Plants through 2007, NUREG/CR-7037, March 2011.

(NRC, 2014a) Wiebe, Joel S., U.S. Nuclear Regulatory Commission, letter to Michael J.

Pacilio, Exelon Generation Company, LLC, February 7, 2014, ADAMS Accession No. ML13281A000.

(NRC, 2014b) U.S. Nuclear Regulatory Commission, Compendium of Analyses to Investigate Select Level 1 Probabilistic Risk Assessment End-State Definition and Success Criteria Modeling Issues, NUREG/CR-7177, ERI/NRC 13-210, May 2014, ADAMS Accession No. ML14148A126.

(NRC, 2014c) U.S. Nuclear Regulatory Commission, MELCOR Best Practices as Applied in the State-of-the-Art Reactor Consequence Analyses (SOARCA) Project, NUREG/CR-7008, August 2014, ADAMS Accession No. ML14234A136.

96

(NUPEC, 1993) Nuclear Power Engineering Corporation, Specification of ISP-35 NUPECs Hydrogen Mixing and Distribution Test M-5-5, ISP35-027, Revision 1, November 1993.

(SNL, 2008) Sandia National Laboratories, An Assessment of MELCOR 1.8.6:

Design Basis Accident Tests of the Carolinas Virginia Tube Reactor (CVTR) Containment (Including Selected Separate Effects Tests),

SAND2008-1224, February 2008, ADAMS Accession No. ML080840322.

97

APPENDIX A DETAILED INFORMATION ON BASE MELCOR MODEL

A.1 Byron MELCOR Input Model Description The main body of this NUREG contains descriptions of the Byron input model. This section of the appendix includes descriptions of, and data pertaining to, the following features: the reactor trip signals modeled; the emergency core cooling system (ECCS) injection setpoints; the charging, safety injection (SI), and residual heat removal (RHR) pump curves; details of the switchover of ECCS suction from the refueling water storage tank (RWST) to the containment sump; accumulator characteristics; containment spray system characteristics; containment fan cooler characteristics; modeling of the reactor coolant pumps (RCPs); and relief valve setpoints.

Note that throughout this report (unless otherwise stated), MELCOR elevations are referenced to the elevation of the inside of the reactor pressure vessel lower head.

Reactor Trip Signals Table A-1 indicates the conditions for reactor trip (i.e., if any condition becomes true, then the reactor is tripped).

Table A-1 Reactor Trip Signals Condition Comment 1 Manual Time-based High-temperature difference of coolant across the core (with 2 Overtemperature T pressure dependence)

High-temperature difference of coolant across the core (with 3 Overpower T rate-of-change dependence) 4 Low pressurizer pressure Pressure below 1,885 psig (13.03 MPa abs) 5 High pressurizer pressure Pressure above 2,393 psig (16.60 MPa abs) 6 High pressurizer level Level above 93.5% of instrument span Minimum loop flow (across 4 loops) less than 89.3% steady-state 7 Low RCP flow value 8 Low SG level Level less than 16.1% of instrument span 9 Loss of power 10 Turbine trip Assume MSIV closure trips the reactor 11 ECCS signal See Section A.1.2 of this appendix ECCS Injection Setpoints The SI, RHR, and charging 1 pumps all take suction from the RWST until the RWST level reaches Lo-2, at which point the ECCS pumps take suction from the containment sump. (See Section A.1.4 of this appendix for details of ECCS suction switchover.) The ECCS actuation signals for charging, SI, and RHR are as follows:

• Pressurizer pressure below 1,817 pounds per square inch gage (psig)

(12.632megapascals absolute (MPa abs))

• Containment pressure greater than 4.6 psig (1.334 bar abs) 1 Before receiving an ECCS signal, the charging pumps draw from the VCT.

A-1

• Steamline pressure below 614 psig (4.336 MPa abs)

• Manual operator action In addition, power must be available.

ECCS Pump Curves Flow from the ECCS pumps (charging, SI, and RHR) is directed to the cold legs of the Byron model (control volumes 348 / 448 / 548 / 648). There are two ECCS trains, each with one charging, one SI, and one RHR pump. One train injects into cold legs A and B, while the other train injects to cold legs C and D. Flow from each pump in each train is equally divided between the two respective cold legs. Charging, SI, and RHR pump performance are given in Table A-2, Table A-3, and Table A-4, respectively, as flow per pump (gallons per minute (gpm)).

The pressure used to evaluate pump performance is the average cold leg pressure minus the sum of the source pressure (i.e., the pressure of the RWST or the containment sump) and the hydraulic head.

Table A-2 Charging Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 630 (4.34) 580 (2.20) Runout 700 (4.83) 550 (2.08) 950 (6.55) 520 (1.97) 1,180 (8.14) 490 (1.85) 1,380 (9.51) 460 (1.74) 1,720 (11.9) 400 (1.51) 1,920 (13.2) 355 (1.34) 2,150 (14.8) 300 (1.14) 2,350 (16.2) 240 (0.908) 2,480 (17.1) 190 (0.719) 2,570 (17.7) 100 (0.379) 2,600 (17.9) 0 (0) Shutoff Table A-3 SI Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 740 (5.10) 700 (2.65) Runout 900 (6.21) 620 (2.35) 980 (6.76) 580 (2.20) 1,060 (7.31) 537 (2.03) 1,150 (7.93) 480 (1.82) 1,240 (8.55) 440 (1.67) 1,330 (9.17) 375 (1.42) 1,400 (9.65) 290 (1.10) 1,460 (10.1) 230 (0.871) 1,470 (10.1) 205 (0.776) 1,490 (10.3) 150 (0.568) 1,510 (10.4) 100 (0.379) 1,550 (10.7) 0 (0) Shutoff A-2

Table A-4 RHR Pump Performance Pressure Flow Comment psi (MPa) gpm (m3/min) 110 (0.758) 5,000 (18.9) Runout 124 (0.855) 4,520 (17.1) 136 (0.938) 3,980 (15.1) 147 (1.01) 3,420 (12.9) 153 (1.05) 2,930 (11.1) 159 (1.10) 2,260 (8.56) 164 (1.13) 1,810 (6.85) 171 (1.18) 1,350 (5.11) 176 (1.21) 988 (3.74) 181 (1.25) 494 (1.87) 185 (1.28) 0 (0) Shutoff Switchover of ECCS Suction from the RWST to the Containment Sump ECCS pumps take suction from the RWST until tank level reaches Lo-2, or 46.7 percent of instrument span. At this point, operators take action to switch suction from the RWST to the containment sump. Based on the number of steps involved in the relevant procedure, it is assumed that it will take operators 10 minutes to switch the suction source. In the Byron model, a timer is started when the RWST level reaches Lo-2. When the timer reaches 10 minutes, injection from the RWST ends and injection from the containment sump (control volume 800) begins. Note that injection from the RWST continues during the switchover.

The above treatment is a simplification of the actual response to low RWST level. At Byron, when RWST level reaches Lo-2, the sump to RHR pump suction valves automatically open.

However, operator action is needed to isolate the RHR pump suction from the RWST. Thus, immediately following RWST Lo-2, the RHR pumps draw from both the sump and the RWST; the fraction that the pumps pull from each source depends on source pressure and line losses.

Because the MELCOR input deck for Byron does not explicitly model ECCS piping (as is typical for other MELCOR plant models (NRC, 2011)), it would be difficult to model the actual plant situation in which the RHR pumps draw from both the sump and the RWST. Thus, the input has been simplified so that the RHR pumps continue to draw from the RWST until operators take action to isolate the pumps from the RWST. This simplification is not expected to impact whether or not core damage occurs for any case studied in this report, though it could have a small impact on event timings following RWST Lo-2.

Accumulator Characteristics The four accumulators (one per loop) are modeled as mass and enthalpy sources to cold leg control volumes 348, 448, 548, and 648. Each accumulator contains an initial water volume of 850 cubic feet (ft3) (24.07 cubic meters (m3)) and an initial nitrogen cover gas volume of 500 ft3 (14 16 m3). 2 The actuation pressure is 585 psig (4.136 MPa); the accumulator water 2 There was initially some confusion about the water and gas volumes of the accumulators due to seemingly inconsistent information in the Byron FSAR (actual estimates versus analytical assumptions). Subsequent information suggests that accumulators contain 935 ft3 of water and 415 ft3 of nitrogen. However, this discrepancy does not affect any of the calculations in which accumulators inject, and so the corrected water and gas volumes have not been added to the model. Refer to Section 5.6 for more information.

A-3

temperature is assumed to be 125 degrees Fahrenheit (F) (51.7 degrees Celsius (C)). Control functions are used to calculate accumulator pressure assuming adiabatic expansion of the nitrogen gas. The injection rate is the difference between the calculated accumulator pressure and the cold leg pressure.

Containment Spray System Characteristics The A and B trains of containment sprays contain pumps with nominal flow rates of 3,415 gpm (12.93 cubic meters per minute (m3/min)) and 3,925 gpm (14.86 m3/min), respectively.

Four MELCOR spray modeling components are defined: SPR24 and SPR25 represent trains A and B during normal injection from the RWST, and SPR26 and SPR27 represent trains A and B during sump recirculation mode. Note that the pumps are assumed to run at a constant flow rate. In reality, the pump flow rate would depend on the developed head, and so the spray flow would vary with containment pressure; however, the containment spray pump curves are not available for this study. The parameter that would be most affected by this assumption would be the time to RWST depletion for those cases in which the containment sprays actuate. With that said, the flow variation is not expected to be very large for containment pressures expected in this study (between atmospheric pressure and spray actuation pressure), and so the assumption of constant flow should not have a large effect on the calculations.

The pumps actuate when the containment pressure exceeds 21.2 psig (2.48 bar). The sprays initially take suction from the RWST. When RWST level reaches Lo-3 (12 percent of instrument span), the sprays are switched to recirculation mode. During recirculation mode, containment spray pumps draw suction from the containment sump.

Containment Fan Cooler Characteristics Byron has four containment fan coolers, which operate in both normal (high blower speed) and accident (low blower speed) modes of operation. The four coolers are assumed to be identical for the purpose of this model. The fan coolers switch to accident mode upon receiving an ECCS actuation signal. Before the ECCS signal, they operate in normal mode. Fan coolers have rated flows of 106,700 standard cubic feet per minute (scfm) (50.35 cubic meters per second (m3/s)) and 73,700 scfm (34.78 m3/s), and rated heat removal capacities of 0.5774 megawatts (MW) and 38.685 MW, during normal operations and during accident mode, based on expected containment conditions.

Four fan cooler modeling components are defined in the MELCOR model. The FCL1 and FCL3 represent the coolers during normal operations. FCL1 consists of three lumped coolers, while FCL3 represents the fourth cooler. Coolers are defined using the flow rate and inlet temperature of water to the cooling coils, the flow rate and inlet temperature of the containment gas, the water vapor content of the gas, and the heat extraction rate (all at rated conditions during normal operations). Similarly, FCL2 and FCL4 represent the three lumped coolers and the fourth cooler, respectively, in the accident mode of operation. FCL2 and FCL4 are defined in terms of the rated conditions during the accident mode of operation.

Reactor Coolant Pumps The Byron reactor coolant pumps have a rated head of 293 ft (89.3 m), which corresponds to differential pressure of 89.91 pounds per square inch differential (psid) (619.9 kilopascals (kPa))

assuming cold leg conditions of 588 degrees F (582 degrees Kelvin) and 2,248 pounds per square inch absolute (15.5 MPa). However, the pump head has been adjusted to 104.1 psid A-4

(717.6 kPa) in the MELCOR model 3 to achieve the desired coolant flow (141.8x106 pounds mass per hour (17,866 kilograms per second) from four pumps).

The pump provides a steady head until pump trip. A 60-second coastdown is assumed after pump trip. The RCPs trip when any of the following conditions are met:

• For SLOCA/MLOCA, RCPs trip if containment pressure >20 psig, or [RCS pressure

<1425 psig AND SI injection >100 gpm].

• For SGTR, RCPs do not trip.

• In any scenario, RCPs trip if the void in the inlet of the RCPs reaches 0.1 prior to any of the conditions listed above.

The situation for the Loss of DC Bus 111 scenario is complicated by the initiating event. The at-power configuration of the RCPs is as follows:

Table A-5 Reactor Coolant Pump Motive and Control Power Configuration RCP Motive Power Control Power A Main Generator DC Bus 111 B Main Generator DC Bus 112 C Grid DC Bus 112 Da Grid DC Bus 111 a In this table, RCP D refers to the RCP in the pressurizer loop.

When the reactor trips, RCP A trips because it loses power from the main generator. RCPs B and C can be tripped from the main control room as required by the bleed and feed procedure because they have control power from DC Bus 112. However, the loss of DC Bus 111 prevents operators from tripping the RCP in the pressurizer loop from the main control room. Instead, this RCP must be tripped locally. For the Loss of DC Bus 111 calculations, it is assumed that the operators trip the pressurizer loop RCP 10 minutes after bleed and feed is initiated.

Relief Valve Setpoints The opening and closing pressures for the pressurizer power-operated relief valves and safety relief valves are shown in Table A-5.

Table A-6 Opening and Closing Pressures for Pressurizer PORVs and SRVs Opening Pressure Closing Pressure psig (MPa) psig (MPa)

PORV-1 (FL306) 2,335 (16.2) 2,315 (16.067)

PORV-2 (FL307) 2,349 (16.3) 2,315 (16.067)

SRV-1 (FL308) 2,460.7 (17.067) 2,360.7 (16.378)

SRV-1 (FL309) 2,460.8 (17.068) 2,360.9 (16.379)

SRV-1 (FL312) 2,460.9 (17.069) 2,361.0 (16.380) 3 This pump head applies to Revision 5 of the model. The pump head is adjusted in each subsequent revision to achieve the desired coolant flow, though the head is generally around 715 kPa for all model revisions used for this study.

A-5

A.2 Input Deck Revisions and MELCOR Code Versions MELCOR is a code that is under active development, so it is important to mention the code version used for this analysis, if only to allow users to reproduce the results discussed in this NUREG. All calculations were performed using MELCOR 2.1.3649, which was the latest available code version when the work documented in this NUREG began.

Similarly, the MELCOR input deck used for the calculations described in this report was under active development throughout the project. Numerous corrections were made to correct input errors, to improve the performance of system logic (e.g., cooldown logic), or to reflect feedback received from internal and external stakeholders regarding plant design and operations (e.g., the unique RCP response to loss of DC bus 111). The following table lists the major input deck revisions used for the various calculations documented in this report, as well as any modifications that may have been made to the base input model to address specific scenarios.

Note that sensitivity studies use the same input model as their base cases, with some minor modifications that are described in the various tables documenting the sensitivity analyses.

Table A-7 Input Models Used for Documented Calculations Input Model Scenario Cases Comments Revision #

1-6 Rev. 8 SBLOCA - Sump Includes improved cooldown logic, as discussed Recirculation 7-12 Rev. 8 in Section 5.1 1-4 Rev. 8 SBLOCA -

Includes improved cooldown logic, as discussed Condensate Feed 5-8 Rev. 8 in Section 5.1 SBLOCA - Bleed All Rev. 8 and Feed Loss of DC Includes modified RCP trip logic for LoDCB111, All Rev. 8 Bus 111 as described in Section A.1.8 SGTR All Rev. 7 MLOCA Injection All Rev. 8 Success Criteria Includes improved cooldown logic, as discussed MLOCA 1, 3, 5, 7, 9 Rev. 8 in Section 5.1 Cooldown Timing 2, 4, 6, 8, 10 Rev. 8 Mode 4-specific Loss of Shutdown All input model based Cooling - Mode 4 on Rev. 8 Mode 5-specific Loss of Shutdown All input model based Cooling - Mode 5 on Rev. 8 A.3 Additional Notes on MELCOR This section provides further explanation of behavior predicted by MELCOR that is applicable to many, if not all, scenarios described in this report. This section also provides more information about discontinuities in plotted temperatures.

A-6

Temperature Discontinuities In some cases, plots of temperatures show large discontinuities due to the way MELCOR handles certain plot parameters. For example, the plot of cross-over leg temperatures in Section E.2.1 shows large changes in the loop C liquid temperature. This is because MELCOR uses the vapor temperature for parameter CVH-TLIQ when there is no liquid water present in the control volume. Thus, the loop C liquid temperature jumps to the vapor temperature at about 2.25 hours2.893519e-4 days <br />0.00694 hours <br />4.133598e-5 weeks <br />9.5125e-6 months <br />, while the liquid temperature is actually the vapor temperature for much of the time after 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. A similar situation occurs for the vapor plot parameter, CVH-TVAP.

On the other hand, COR package component temperatures are set to zero if a component is not present in a cell. This also means that after a component fails, its temperature is zero. Thus, the maximum cladding temperature plotted in Section E.1.5 drops to zero when the last of the cladding has failed due to the collapse of the support plate just after 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />. (It must also be noted that the smaller discontinuities earlier in the calculation are caused by failure of the cladding in the cell that previously had the maximum cladding temperature. The maximum cladding temperature then occurs in a different cell, where the temperature is, by definition, lower than the previous maximum.)

A.4 References (NRC, 2011) U.S. Nuclear Regulatory Commission, NUREG-1953, Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria in the Standardized Plant Analysis Risk ModelsSurry and Peach Bottom, September 2011.

A-7

APPENDIX B DETAILED SMALL-BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS RESULTS

B.1 Small-Break Loss-of-Coolant Accident - Sequence Timing for Alignment of Sump Recirculation Case 1: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 1.75 hr B-1

B-2 B-3 B-4 B-5 B-6 B.1.1.1 Case 1a: 0.83-in. Break LOCA with Chg Pump and No SG Cooldown B-7

B-8 B-9 B-10 B-11 B-12 Case 2: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 1.75 hr B-13

B-14 B-15 B-16 B-17 B-18 Case 3: 0.83-in. Break LOCA with Chg Pump and 75 °F/hr Cooldown at 2.25 hr B-19

B-20 B-21 B-22 B-23 B-24 Case 4: 0.83-in. Break LOCA with SI Pump and 75 °F/hr Cooldown at 2.25 hr B-25

B-26 B-27 B-28 B-29 B-30 Case 5: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 2.75 hr B-31

B-32 B-33 B-34 B-35 B-36 Case 6: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 2.75 hr B-37

B-38 B-39 B-40 B-41 B-42 Case 7: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 1.75 hr B-43

B-44 B-45 B-46 B-47 B-48 B.1.7.1 Case 7a: 1.66-in. Break LOCA with Chg Pump and No SG Cooldown B-49

B-50 B-51 B-52 B-53 B-54 Case 8: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 1.75 hr B-55

B-56 B-57 B-58 B-59 B-60 Case 9: 1.66-in. Break LOCA with Chg Pump and 75 °F/hr Cooldown at 2.25 hr B-61

B-62 B-63 B-64 B-65 B-66 Case 10: 1.66-in. Break LOCA with SI Pump and 75 °F/hr Cooldown at 2.25 hr B-67

B-68 B-69 B-70 B-71 B-72 Case 11: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 2.75 hr B-73

B-74 B-75 B-76 B-77 B-78 Case 12: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 2.75 hr B-79

B-80 B-81 B-82 B-83 B-84 B.2 Small-Break Loss-of-Coolant Accident - Success Criteria for Steam Generator Depressurization and Condensate Feed Case 1: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 10 min B-85

B-86 B-87 B-88 B-89 B-90 Case 2: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 10 min B-91

B-92 B-93 B-94 B-95 B-96 Case 3: 0.83-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 20 min B-97

B-98 B-99 B-100 B-101 B-102 Case 4: 0.83-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 20 min B-103

B-104 B-105 B-106 B-107 B-108 Case 5: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 10 min B-109

B-110 B-111 B-112 B-113 B-114 Case 6: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 10 min B-115

B-116 B-117 B-118 B-119 B-120 Case 7: 1.66-in. Break LOCA with Chg Pump and 100 °F/hr Cooldown at 20 min B-121

B-122 B-123 B-124 B-125 B-126 Case 8: 1.66-in. Break LOCA with SI Pump and 100 °F/hr Cooldown at 20 min B-127

B-128 B-129 B-130 B-131 B-132 B.3 Small-Break Loss-of-Coolant Accident - Success Criteria for Primary Side Bleed and Feed Case 1: 0.83-in. Break LOCA with Chg Pump and 1 PORV Opened at 35 min B-133

B-134 B-135 B-136 B-137 Case 2: 0.83-in. Break LOCA with Chg Pump and 1 PORV Opened at 55 min B-138

B-139 B-140 B-141 B-142 Case 3: 0.83-in. Break LOCA with SI Pump and 2 PORVs Opened at 30 min B-143

B-144 B-145 B-146 B-147 Case 4: 0.83-in. Break LOCA with SI Pump and 2 PORVs Opened at 50 min B-148

B-149 B-150 B-151 B-152 Case 5: 1.66-in. Break LOCA with Chg Pump and 1 PORV Opened at 35 min B-153

B-154 B-155 B-156 B-157 Case 6: 1.66-in. Break LOCA with Chg Pump and 1 PORV Opened at 55 min B-158

B-159 B-160 B-161 B-162 Case 7: 1.66-in. Break LOCA with SI Pump and 2 PORVs Opened at 30 min B-163

B-164 B-165 B-166 B-167 Case 8: 1.66-i.n Break LOCA with SI Pump and 2 PORVs Opened at 50 min B-168

B-169 B-170 B-171 B-172 APPENDIX C DETAILED LOSS OF DC BUS 111 ANALYSIS RESULTS

C.1 Loss of DC Bus 111 and Unavailable DD-AFW, Leading to Primary Side Bleed and Feed Case 1: 1 Chg Pump, 1 PORV Opened at 20 min, PORV Does Not Stick Open C-1

C-2 C-3 C-4 C-5 C-6 C-7 Case 2: 1 Chg Pump, 1 PORV Opened at 40 min, PORV Does Not Stick Open C-8

C-9 C-10 C-11 C-12 C-13 C-14 Case 3: 1 Chg Pump, 1 PORV Opened at 40 min, PORV Sticks after 251 Cycles C-15

C-16 C-17 C-18 C-19 C-20 C-21 Case 4: 1 Chg Pump, No Manual Action, PORV Sticks after 251 Cycles C-22

C-23 C-24 C-25 C-26 C-27 C-28 C.1.4.1 Case 4a: 1 Chg Pump, No Manual Action, PORV Fails Closed after 251 Cycles C-29

C-30 C-31 C-32 C-33 C-34 C-35 Case 5: 1 Chg Pump, No Manual Action, PORV Does Not Stick Open C-36

C-37 C-38 C-39 C-40 C-41 C-42 Case 6: 1 SI Pump, 1 PORV Opened at 20 min, PORV Does Not Stick Open C-43

C-44 C-45 C-46 C-47 C-48 Case 7: 1 SI Pump, 1 PORV Opened at 40 min, PORV Does Not Stick Open C-49

C-50 C-51 C-52 C-53 C-54

NUREG-2187, Vol. 1 Confirmatory Thermal-Hydraulic Analysis to Support Specific Success Criteria January 2016 in the Standardized Plant Analysis Risk ModelsByron Unit 1