ML16180A182

Revision 26 to the Updated Final Safety Analysis Report, Chapter 15, Accident Analyses, Sections 15.1 Through 15.8

ML16180A182
Person / Time
Site:	Ginna
Issue date:	05/05/2016
From:	Exelon Generation Co
To:	Office of Nuclear Reactor Regulation
Shared Package
ML16180A174	List: ML16180A127 ML16180A128 ML16180A130 ML16180A131 ML16180A132 ML16180A134 ML16180A136 ML16180A137 ML16180A138 ML16180A139 ML16180A140 ML16180A141 ML16180A142 ML16180A143 ML16180A144 ML16180A145 ML16180A146 ML16180A147 ML16180A148 ML16180A149 ML16180A150 ML16180A156 ML16180A157 ML16180A158 ML16180A159 ML16180A160 ML16180A161 ML16180A162 ML16180A163 ML16180A164 ML16180A165 ML16180A166 ML16180A167 ML16180A168 ML16180A169 ML16180A170 ML16180A171 ML16180A172 ML16180A173 ML16180A180 ML16180A181 ML16180A182 ML16180A183 ML16180A184 ML16180A185 ML16180A186 ML16180A214 ML16180A215 ML16180A216
References
Download: ML16180A182 (275)

Text

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15 ACCIDENT ANALYSES Page 1 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.0 GENERAL In support of the Extended Power Uprate (EPU) all Chapter 15 accident analyses were reana-lyzed or evaluated. Significant assumptions for the EPU analysis include:

• FH = 1.72 for 422V+ 1.60 for OFA

• FQ = 2.60 (limited by LBLOCA)

• BWI steam generators

• Tavg window of 576.0F to 564.6F (see Table 15.0-1)

• The core thermal limits used in the analyses are valid to a core power of 1775 MWt, exclud-ing calormetric uncertainty.

Utilization of the TAVG window entails selecting a nominal full power TAVG anywhere between 564.6F and 576F prior to operation of a given cycle. The nominal full power TAVG then remains at that value for the remainder of the cycle unless changed by an addi-tional evaluation. Safety analyses were performed to bound operation within the TAVG win-dow and appropriately considered uncertainties on TAVG. The events that were potentially impacted by operation at the lower initial vessel average temperature were analyzed with the lower TAVG explicitly modeled. All other events were analyzed at the high end of the win-dow (576F) which had not changed from the previous licensing basis analyses. Thus, the impact of the TAVG window was explicitly accounted for in the analyses.

Changing TAVG can impact other parameters (e.g., steam pressure). Table 15.0-1 gives a comparison of the important primary and secondary parameters at both ends of the TAVG win-dow. The evaluations that follow address the impact of these changes on the licensing basis analyses.

Some assumptions were made in order to perform the evaluations that follow. First, it was assumed that the reference average temperatures used in the overtemperature T and over-power T setpoint equations (T" and T"", respectively) were rescaled to the nominal full power TAVG. It was also assumed that the NIS excore detectors were recalibrated to compen-sate for the increase in downcomer coolant density at a lower temperature. The TAVG pro-gram and the pressurizer level program were assumed to remain applicable with the full power TAVG in the programs set to full power TAVG for the cycle. These items are assumed to be addressed each time the nominal full power operating TAVG is changed.

15.0.1 INITIAL CONDITIONS 15.0.1.1 Assumed Values of Initial Conditions Table 15.0-3 lists the non-LOCA initial condition assumptions used. Other major assump-tions considered in the non-LOCA transient analyses are discussed below:

Page 2 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

• At least 1.4% setpoint tolerance was considered in modeling of the main steam safety valves (MSSVs). Staggered lift setpoints were modeled for the MSSVs using plant-specific Technical Specification setpoints, as shown in Table 15.0-4.

• The pressurizer safety valves (PSVs) were modeled assuming a setpoint tolerance range of at least +2.3% to -3.0%. Additionally, when it was conservative to do so (that is , for peak RCS pressure concerns), the effects of the PSV loop seals were explicitly modeled, as dis-cussed in Reference 10. See Table 15.0-4 for more information.

• Consistent with the Ginna Technical Specifications (COLR), for minimum reactivity feed-back a maximum moderator temperature coefficient (MTC) of +5 pcm/F was applicable for power levels less than 70%. For maximum reactivity feedback, a maximum moderator density coefficient (MDC) of at least 0.45 k/g/cc was assumed.

• The fission product contribution to deacy heat assumed in the non-LOCA analyses was consistent with the standard ANSI/ANS-5.1-1979 for decay heat power in light water reac-tors (Reference 11), including two standard deviations of uncertainty.

• The assumed core bypass flow percentages were 5.6% for RTDP analyses, and 6.5% for STDP analyses.

15.0.2 POWER DISTRIBUTION The transient response of the reactor system is dependent on the initial power distribution.

The nuclear design of the reactor core minimizes adverse power distribution through the placement of control rods and operating instructions. The Relaxed Axial Offset Control (RAOC) strategy (Reference 7) is used for Ginna Station.

Power distribution may be characterized by the radial factor (FH) and the total peaking fac-tor (FQ). The peaking factor limits are given in the COLR and are discussed in Section 4.2.

For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15.0-1. All transients that may be DNB limited are assumed to begin with an FH consistent with the initial power level defined in the Technical Specifications.

The axial power shape used in the DNB calculations is discussed in Section 4.3. The radial and axial power distributions described above are input to the VIPRE code.

For transients which may be overpower limited, the total peaking factor (FQ) is of impor-tance. All transients that may be overpower limited are assumed to begin with plant condi-tions, including power distributions which are consistent with reactor operation as defined in the Technical Specifications.

For overpower transients which are slow with respect to the fuel rod thermal time constant (e.g., the chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant incident which lasts many minutes and the exces-sive increase in secondary steam flow incident which may reach equilibrium without causing a reactor trip), the fuel rod thermal evaluations are performed as discussed in Section 4.4. For Page 3 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES overpower transients which are fast with respect to the fuel rod thermal time constant (e.g.,

the uncontrolled rod cluster control assembly bank withdrawal from subcritical and rod clus-ter control assembly ejection incidents which result in a large power rise over a few seconds),

a detailed fuel heat transfer calculation must be performed. Although the fuel rod thermal time constant is a function of system conditions, fuel burnup, and rod power, a typical value at beginning-of-life for high-power rods is approximately 5 sec.

15.0.3 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the doppler power coefficient. These reactivity coefficients and their values are discussed in detail in Section 4.3 and illustrated on Table 15.0-5.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events, conservatism requires the use of small reactiv-ity coefficient values. Some analyses, such as loss of coolant from cracks or ruptures in the reactor coolant system, do not depend on reactivity feedback effects. The justification for use of conservatively large versus small reactivity coefficient values is treated on an event-by-event basis. In some cases conservative combinations of parameters are used to bound the effects of core life, although these combinations may not represent possible realistic situa-tions. The limiting values of the moderator density and doppler power coefficients used in the safety analyses are shown in Figure 15.0-2.

15.0.4 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS The negative reactivity insertion following a reactor trip is a function of the position versus time of the rod cluster control assemblies (also commonly referred to as control rods) and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry.

The normal reactivity insertion versus time assumed in accident analyses is shown in Figure 15.0-3. The control rod insertion time to dashpot entry is normalized to 1.8 sec. A total neg-ative reactivity insertion following a trip of 3.5% delta k is assumed in the transient analyses except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available.

15.0.5 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN THE ACCIDENT ANALYSES A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mecha-nisms to release the control rods, which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actua-tion, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Limiting trip setpoints assumed in the accident analy-ses and the time delay assumed for each trip function are given in Table 15.0-4.

Page 4 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The overtemperature and overpower delta T trips assumed in the analysis are presented on Table 15.0-7, and illustrated on Figure 15.0-1. This figure presents the allowable reactor coolant loop average temperature and delta T for the design flow and power distribution, as described in Chapter 4, as a function of primary coolant pressure. The boundaries of opera-tion defined by the overpower delta T trip and the overtemperature delta T trip are repre-sented as protection lines on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the loci of conditions for which the DNBR equals the limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that the DNBR acceptance criteria is met for all cases if the area enclosed by the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure, and temperature) is bounded by the com-bination of reactor trips: high neutron flux (fixed setpoint), high pressure (fixed setpoint),

low pressure (fixed setpoint), and overpower and overtemperature delta T (variable set-points).

The limit value, which was used as the DNBR limit for all accidents analyzed with the Revised Thermal Design Procedure (see Table 15.0-2), is conservative compared to the actual design DNBR value required to meet the DNB design basis as discussed in Chapter 4.

The difference between the limiting trip point assumed for the analysis and the normal trip point represents an allowance for instrumentation channel error and setpoint error. Nominal trip setpoints are specified in the Technical Specifications.

15.0.6 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS - POWER RANGE NEUTRON FLUX The instrumentation drift and calorimetric errors used in establishing the power range high-neutron-flux setpoint are presented in Table 15.0-8. The calorimetric error is the error assumed in the determination of core thermal power as obtained from secondary plant mea-surements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

The secondary power is obtained from measurement of feedwater flow, feedwater inlet tem-perature to the steam generators, and steam pressure. High-accuracy instrumentation is pro-vided for these measurements with accuracy tolerances much tighter than those which would be required to control feedwater flow.

15.0.7 COMPUTER CODES Summaries of the principal computer codes used in the non-loss-of-coolant accident (non-LOCA) and steam generator tube rupture transient analyses are given below. The codes used in the non-LOCA analyses are listed in Table 15.0-9.

Page 5 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.0.7.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross section of the metal clad UO2 fuel rod and the transient heat flux at the surface of the clad, using as input the nuclear power and time-dependent coolant parameters (pressure, flow, temperature, and den-sity). The code uses a fuel model that exhibits the following features simultaneously:

A. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

B. Material properties that are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.

C. The necessary calculations to handle post-DNB transients: film boiling heat transfer cor-relations, zircaloy-water reaction, and partial melting of the materials.

FACTRAN is further discussed in Reference 2.

15.0.7.2 RETRAN RETRAN is used for studies of transient response of a pressurized water reactor (PWR) sys-tem to specified perturbations in process parameters. This code simulates a multi-loop sys-tem by a lumped parameter model containing the reactor vessel, hot- and cold-leg piping, RCPs, system generators (tube and shell sides), main steam lines, and the pressurizer. The pressurizer heaters, spray, relief valves, and safety valves can also be modeled. RETRAN includes a point neutron kinetics model and reactivity effects of the moderator, fuel, boron, and control rods. The secondary side of the steam generator uses a detailed nodalization for the thermal transients.

The RPS simulated in the code includes reactor trips on high neutron flux, high neutron flux rate, OTT and OPP, low RCS flow, high- and low-pressurizer pressure, high pressurizer level, and low-low steam generator water level.

Control systems are also simulated including rod control and pressurizer pressure control.

Parts of the safety injection system (SIS), including the accumulators, can also be modeled.

RETRAN conservatively approximates the transient value of DNBR based on input from the core thermal limits illustrated in Figure 15.0-1. The core thermal limits represent the mini-mum value of DNBR as calculated for typical or thimble cells.

RETRAN is a versatile program that is suited to accident evaluation and control studies as well a parameter sizing. RETRAN is further discussed in Reference 4.

15.0.7.3 TWINKLE The TWINKLE program is a multi-dimensional spatial neutron kinetics code. The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equa-tions in one, two, and three dimensions. The code uses six delayed neutron groups and con-tains a detailed multi-region fuel-clad-coolant heat transfer model for calculating pointwise doppler and moderator feedback effects. The code handles up to 2000 spatial points and per-Page 6 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES forms its own steady-state initialization. Aside from basic cross-section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet tempera-ture, pressure, flow, boron concentration, control rod motion, and others. Various parameter edits are provided, e.g., channelwise power, axial offset, enthalpy, volumetric surge, pointwise power, and fuel temperatures.

The TWINKLE code is used to predict the kinetic behavior of a reactor for transients that cause a major perturbation in the spatial neutron flux distribution (e.g., control rod ejection accident).

TWINKLE is further discussed in Reference 4.

15.0.7.4 VIPRE The VIPRE computer program performs thermal-hydraulic calculations. This code calculates coolant density mass velocity, enthalpy, void fractions, static pressure, and DNBR distribu-tions along flow channels within a reactor core. VIPRE is discussed further in Reference 5.

15.0.7.5 ADVANCED NODAL CODE (ANC)

ANC is an advanced nodal code capable of two-dimensional (2-D) and three-dimensional (3-D) neutronics calculations. ANC is the reference model for certain safety analysis calcula-tions, power distributions, peaking factors, critical boron concentrations, control rod worths, reactivity coefficients, etc. In addition, 3-D ANC validates 1-D and 2-D results and provides information about radial (x-y) peaking factors as a function of axial position. It can calculate discrete pin powers from nodal information as well. ANC is discussed in more detail in Ref-erence 6.

15.0.8 CLASSIFICATION OF PLANT CONDITIONS Since 1970, the classification of plant conditions in American Nuclear Society Standard ANSI N18.2-1973, "Nuclear Safety Criteria for the Design of Stationary PWRs" (Reference 8), has often been used to facilitate the evaluation of nuclear plant safety and the functional requirements for structures, systems, and components. The plant conditions are divided into four categories in accordance with the anticipated frequencies of occurrence and potential radiological consequences. The four categories (or conditions) are:

Condition I - Normal Operation Condition II - Faults of Moderate Frequency Condition III - Infrequent Faults Condition IV - Limiting Faults The basic principle applied in relating requirements to each of the conditions is that the more probable occurrences must result in little or no risk to the public, and those extreme situations having the potential for greater risk shall be those situations least likely to occur. Where applicable, reactor trip system and engineered safety features functioning is assumed in ful-filling this principle. The following sections describe each condition in more detail.

Page 7 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.0.8.1 Condition I - Normal Operation Condition I occurrences are those which are expected frequently or regularly during power operation, refueling, maintenance or maneuvering of the plant. Condition I occurrences are accommodated with margin between any plant parameter and the value of the parameter which would require either automatic or manual protective action. In this regard, analysis of the fault condition is typically based on a conservative set of initial conditions corresponding to the most adverse set of conditions occurring during Condition I operation.

15.0.8.2 Condition II - Faults of Moderate Frequency These faults occur with moderate frequency during the life of the plant, any one of which may occur during a calendar year (i.e., between 1/year and 1 x 10-1/year). These faults, at worst, result in a reactor trip with the plant being capable of returning to operation after corrective action. Any release of radioactive materials in effluents to unrestricted areas should be in conformance with 10 CFR 20, Standards for Protection Against Radiation. A Condition II fault (or event), by itself, does not propagate to a more serious incident of the Condition III or Condition IV type without the occurrence of other independent incidents. A single Condition II incident should not cause the loss of any barrier to the escape of radioactive products.

15.0.8.3 Condition III - Infrequent Faults Condition III faults occur very infrequently during the life of the plant, any one of which may occur during the plant's lifetime (i.e., between 1 x 10-1/year and 1 x 10-2/year). Condition III faults can be accommodated with the failure of only a small fraction of the fuel rods, although sufficient fuel damage might occur to preclude resumption of operation for a considerable outage time. The release of radioactivity due to Condition III faults may exceed the guide-lines of 10 CFR 20, but is not sufficient to interrupt or restrict public use of those areas beyond the exclusion area boundary (EAB). A Condition III fault does not, by itself, generate a Condition IV fault or result in a consequential loss of function of the reactor coolant system or containment barriers.

15.0.8.4 Condition IV - Limiting Faults Condition IV occurrences are faults that are not expected to occur, but are postulated because their consequences have the potential for the release of significant amounts of radioactive material (i.e., < 1 x 10-2/year). Condition IV faults are the most drastic occurrences which must be designed against, and represent the limiting design cases.

Condition IV faults should not cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of the guideline values in 10 CFR 100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault including those of the reactor coolant system and the reactor containment.

Page 8 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.0.9 UFSAR RE-WRITE In 2001, the UFSAR accident analysis sections were completely rewritten to facilitate 10 CFR 50.59 reviews.

15.0.9.1 General Layout The general layout of the rewritten accident analysis sections is as follows:

Description of Event Frequency of Event Event Analysis Single Failures Assumed Operator Actions Assumed Chronological Description of Event Impact on Fission Product Barriers Reactor Core and Plant System Evaluation Input Parameters and Initial Conditions Method of Analysis Acceptance Criteria Results Radiological Consequences Conclusions Supplemental Evaluations 15.0.9.2 Interpretation of Operator Action Times An operator action time applies to its associated design basis event analysis as presented in the UFSAR, including all the limitations and conservatisms assumed in the analysis. In some cases, a plant simulator may be able to reproduce the analyzed event closely enough that applicable operator action time(s) can be verified. In other cases, such as Section 15.2.7, Feedwater System Pipe Breaks, where the cooldown portion of the accident is considered bounded by the steam line rupture accident and only the heatup portion is presented, simula-tor modeling is impractical. Procedure A-601.10, "Time Critical Action Management Pro-gram"(Reference 9) summarizes operator action times assumed in Chapter 15 of the UFSAR.

Page 9 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.0

1. A.J. Friedland, and S. Ray, Revised Thermal Design Procedure, WCAP 11397-P-A (Pro-prietary) and WCAP 11397-A (Non-Proprietary), April 1989.

2. H. G. Hargrove, FACTRAN - A Fortran-IV Code for Thermal Transients in a Uranium-Dioxide Fuel Rod, WCAP 7908, June 1972.

3. D. H. Risher, Jr., and R. F. Barry, TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code, WCAP 7979-P-A (Proprietary), WCAP 8028-A (Non-Proprietary), Jan-uary 1975.

4. D. S. Huegel, et. al., RETRAN-02 Modeling and Qualification for Westinghouse Pres-surized Water Reactor Non-LOCA Safety Analyses. WCAP-14882-P-A (Proprietary),

April 1999.

5. Y. X. Sung, et. al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A (Propietary), Octo-ber 1999.

6. Y. S. Liu, et. al., ANC: A Westinghouse Advanced Nodal Computer Code, WCAP-10965-P-A (Propietary), September 1986.

7. S. L. Davidson, et. al., Relaxation of Constant Axial Offset Control FQ Surveillance Technical Specifications, WCAP-10216-P-A-R1A (Proprietary), February 1994.

8. ANS-51.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants

9. Procedure A-601.10, "Time Critical Action Management Program"

10. WCAP-12910 Rev 1-A, Pressurizer Safety Valves Set Pressure Shift, G. O. Barrett, et.

al., May 1993

11. ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, August 29, 1979.

12. WCAP-7588, Rev 1-A, An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors using Special Kinetics Methods, January 1975.

13. Letter from M. G. Korsnick, Constellation Energy, to NRC, Document Control Desk,

Subject:

License Amendment Request Regarding Extended Power Uprate, dated July 7, 2005.

Page 10 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-1 NSSS PCWG Parameters for Ginna Station Uprate Program Thermal Design Parameters Low TAVG High TAVG NSSS Power MWt 1817 1817 1817 1817 106 Btu/hr 6,200 6,200 6,200 6,200 Reactor Power MWt 1811 1811 1811 1811 106 6,179 6,179 6,179 6,179 Thermal Design Flow, loop gpm 85,100 85,100 85,100 85,100 Reactor 106lb/hr 65.8 65.8 64.8 64.8 Reactor Coolant Pressure, psia 2250 2250 2250 2250 Core Bypass, % 6.5a 6.5a 6.5a 6.5a Reactor Coolant Temperature, F Core Outlet Vessel Outlet 605.5 605.5 616.2 616.2 Core Average 601.0 601.0 611.8 611.8 Vessel Average 568.8 568.8 580.3 580.3 Vessel/Core Inlet 564.6 564.6 576.0 576.0 Steam Generator Outlet 528.3 528.3 540.2 540.2 528.0 528.0 539.9 539.9 Steam Generator Steam Outlet 506.5 503.1 518.8b 515.4 Temperatue, F Steam Outlet Pressure, 722 700 804b 781 psia Steam Outlet Flow, 106lb/ 7.42/7.88 7.417/7.87 7.44/7.9b 7.43/7.89 hr total 390/435 390/435 390/435 390/435 Feed Temperature, F Steam Outlet Moisture, % 0.10 0.10 0.10 0.10 max.

Design FF, hr.sq.ft F/Btu 0.00015 0.00015 0.00015 0.00015 Tube Plugging Level (%)

0 10 0 10 Zero Load Temperature, F 547 547 547 547

a. Core bypass flow includes 2.0% due to thimble plugs removed (TPR).

b. If a high steam pressure is more limiting for analysis purposes, a greater steam pressure of 855 psia, steam temperature of 525.9F, and steam flow of 7.92 x 106 lb/hr total should be assumed. This enve-lopes the possibility that the steam generator could perform better than expected.

Page 11 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-1 NSSS PCWG Parameters for Ginna Station Uprate Program Hydraulic Design Parameters Pump Design POint, Flow (gpm)/Head (ft.) 90,000/252 Mechanical Design Flow, loop gpm 101,200 Minimum Measured Flow, loop gpm 88,650 Page 12 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-2 Non-LOCA Analysis Limits and Analysis Results Analysis Result UFSAR Section Event Description Result Parameter Analysis Limit Limiting Case 15.1.1 Decrease in Feedwater Temperature (a) N/A N/A 15.1.2 Increase in Feedwater Flow Minimum DNBR (RTDP), WRB-1) (HFP) 1.38 (HFP) 1.60 (HFP)

Minimum DNBR (STDP, W-3) (HZP) 1.613 (HZP) b (HZP) 15.1.3 Excesive Load Increase Minimum DNBR (RTDP, WRB-1) 1.38 >1.38 15.1.4 Inadvertent Opening of a Steam Generator Bounded by Steam Line Break (UFSAR, section N/A N/A Relief/Safety Valve 15.1.5) 15.1.5 Steam System Piping Failure - Zero Power Minimum DNBR (non-RTDP, W-3) 1.566 2.58 (Core response only)

Steam System Piping Failure - Full Power Minimum DNBR (RTDP, WRB-1 correlation) 1.38/1.38 1.392/1.395 (Core response only) (typical thimble)

Peak Linear Heat Generation (kW/ft) 22.7c 22.67 15.1.6 Combined Steam Generator ARV and Feedwater Minimum DNBR (RTDP, WRB-1) 1.38 1.52 Control Valve Failures 15.2.1 Steam Pressure Regulator Malfunction or Fail- Bounded by Loss-of-External-Electrical Load N/A N/A ure that Results in Decreasing Steam Flow (UFSAR, section 15.2.2) 15.2.2 Loss-of-External-Electrical-Load Minimum DNBR (RTDP, WRB-1) 1.38 1.61 Peak RCS Pressure, psia 2748.5 2746.8 Peak MSS Pressure, psia 1208.5 1208.0 15.2.3 Turbine Trip Bounded by Loss-of-External-Electrical Load N/A N/A (UFSAR, section 15.2.2) 15.2.4 Loss-of-Condenser Vacuum Bounded by Loss-of-External-Electrical Load N/A N/A (UFSAR, section 15.2.2) 15.2.5 Loss-of-Offsite-Power to the Station Auxiliaries Maximum pressurizer mixture volume, ftc 800 635 Page 13 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Analysis Result UFSAR Section Event Description Result Parameter Analysis Limit Limiting Case 15.2.6 Loss-of-Normal-Feedwater Maximum pressurizer mixture volume, ftc 800 537 15.2.7 Feedwater System Pipe Breaks Margin to Hot Leg Saturation, F 0.0 2 15.3.1 Flow Coastdown Accident - PLOFd Minimum DNBR (RTDP, WRB-1) (typical/ 1.38/1.38 (422V+) 1.601/1.597 (422V+)

thimble)

Flow Coastdown Accident - CLOFe Minimum DNBR (RTDP, WRB-1) (typical/ 1.38/1.38 (422V+) 1.489/1.491 (422V+)

thimble)

Flow Coastdown Accident - UFf Minimum DNBR (RTDP, WRB-1) (typical/ 1.38/1.38 (422V+) 1.385/1.392 (422V+)

thimble) 15.3.2 Locked Rotor Accident Peak RCS Pressure, psia 2997 2782 Peak Cladding Temperature, F 2700 1924.6 (422V+)

Maximum Zirc-Water Reaction, % 16 0.53 (422V+)

15.4.1 Uncontrolled RCCA Withdrawal from a Subcrit- Minimum DNBR Below First Mixing Vane Grid 1.447/1.447 (422V+) 1.987/2.238 (422V+)

ical Condition (non-RTDP, W-3 corelation)(typical/thimble)

Minimum DNBR Above First Mixing Vane Grid 1.302/1.302 (422V+) 1.957/1.951 (422V+)

(non-RTDP, WRB-1 correlation) (typical/thim-ble)

Maximum Fuel Centerline Temperature, F 4800g 2108 (422V+)

15.4.2 Uncontrolled RCCA Withdrawal at Power Minimum DNBR (RTDP, WRB-1) 1.38 1.384 Peak RCS Pressure, psia 2748.5 2748.1 Peak MSS Pressure, psia 1208.5 1207.7 15.4.3 Startup of an Inactive Reactor Coolant Loop. No Analysis Performed (See Reference 13)h N/A N/A (RCL) 15.4.4 Chemical and Volume Control System (CVCS) Minimum Time to Loss of Shutdown Margin, 15 30.3 (Mode 1 manual)

Malfunction (Boron Dilution) Minutes 15 33.3 (Mode 1 auto) 15 25.1 (Mode 2)

Page 14 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Analysis Result UFSAR Section Event Description Result Parameter Analysis Limit Limiting Case 30 32.0 (Mode 6) 15.4.5 Rupture of a COntrol Rod Drive Mechanism Maximum Fuel Pellet Average Enthalpy, cal/g 200 151.8 (BOC-HZP)

(CRDM) Housing (RCCA Ejection) 177.9 (BOC-HFP) 155.1 (EOC-HZP) 177.2 (EOC-HFP)

Maximum Fuel Melt, % 10 0.0 (BOC-HZP)i 6.62 (BOC-HFP)i 0.00 (EOC-HZP)j 9.00 (EOC-HFP)j Peak RCS Pressure, psia Generically addressed in Reference 12 15.4.6 RCCA Drop Minimum DNBR (RTDP, WRB-1) 1.38 > 1.38 Peak Linear Heat Generation (kW/ft) 22.7(3) < 22.7 Peak Uniform Cladding Strain (%) 1.0 < 1.0 15.6.1 Inadvertent Opening of a Pressurizer Safety or Minimum DNBR (WRB-1) 1.38 1.49 Relief Valve 15.8 ATWS Peak RCS Pressure, psig 3200 3,193

a. Event bounded by the steam system piping failure at full power event. See UFSAR, section 15.1.5.7.

b. Bounded by zero power steam line break.

c. Corresponds to a UO2 fuel melting temperature of 4700F.

d. PLOF = partial loss of flow (one-loop flow coastdown).

e. CLOF = complete loss of flow (two-loop flow coastdown)

f. UF = underfrequency (frequency decay of RCP power supply)

g. UO2 fuel melting temperature corresponding to a burnup of ~48,276 MWd/MTU.

h. Technical Specifications preclude operation with a RCS loop out of service above 8.5% power, as such, this event is not creditable for Ginna at power levels > 8.5% RTP. For power levels 8.5% RTP this event is not limiting and was not analyzed for EPU conditions.

i. Fuel melting temperature = 4900F

j. Fuel melting temperature = 4800F Page 15 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-3 Non-LOCA Plant Initial Condition Assumptions Parameter RTDP Non-RTDP Notes NSSS Power (MWt) 1817.0 1817.0 a Nominal Total Net RCP Heat 6.0 6.0 a, b, c (MWt)

Maximum Full-Power Vessel 576.0 576.0 4.0 a, d TAVG (F)

Mimimum Full-Power Vessel 564.0 564.0 4.0 a, d TAVG (F)

No-Load RCS Temperature (F) 547.0 547.0 a, d Pressurizer Pressure (psia) 2250 2250 60 a Steam Flow (lbm/hr) see Note e see Note e e Steam Pressure (psia) see Note e see Note e Feedwater Temperature (F) 390 to 435 390 to 435 a Pressurizer Water Level (% span) see Note f see Note f f Steam Generator Water Level (% see Note g see Note g g NRS)

a. See Table 15.0-1

b. Total RCP heat input minus RCS Thermal losses.

c. A maximum net RCP heat of 10 MWt was conservatively assumed in some non-RTDP analyses, e.g.,

loss-of-normal feedwater.

d. All analyses assumed a programmed no-load TAVG of 547F. For the events initiated from a no-load condition (rod withdrawal from subcritical, steam line break, rod ejection, boron dilution), the use of the no-load temperature as the initial temperature bounded the case of startup operations at Ginna with a temperature less than 547F.

e. The nominal steam flow rate and steam pressure depended on other nominal conditions. See Table 15.0-1.

f. The nominal/programmed pressurizer water level varied linearly from 20% of span at the no-load TAVG of 547F to either 44.3% of span at the minimum full-power TAVG of 564.6F or 60% of span at the maximum full power TAVG of 576F. The programmed level remained constant at the full-power TAVG level for TAVG values greather then the full-power TAVG. An uncertainty of 5% of span was applied when conservative.

g. The programmed steam generator water level modeled in the analyses was a constant 52% narrow range span (NRS) for all power levels. An uncertainty of 4% NRS/+8% was applied when conservative.

Page 16 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-4 Pressurizer and Main Steam System (MSS) Pressure Relief Assumptions Pressure Relief Modela UFSAR Event Description Pressurizer MSS 15.1.1 Decrease in Feedwater Tempera- 5 5 ture 15.1.2 Increase in Feedwater Flow 1 3A 15.1.3 Excessive Load Increase 5 5 15.1.4 Inadvertant Opening of a Steam b Generator Relief/Safety Valve 15.1.5 Steam System Piping Failure - 4 4 Zero Power (Core Response only)

Steam System Piping Failure - 4 4 Full Power (Core Response Only) 15.1.6< Combined Steam Generator ARV 1 3A and Feedwater Control Valve Failures 15.2.1 Steam Pressure Regulator Mal- c function or Failure that Results in Decreasing Steam Flow 15.2.2 Loss-of-External-Electrical Load 1 3B

- DNB Case Loss-of-External-Electrical Load 2B 3B

- Peak RCS Pressure Case Loss-of-External-Electrical Load 1 3B

- Peak MSS Pressure Case 15.2.3 Turbine Trip c 15.2.4 Loss-of-Condenser Vacuum c 15.2.5 Loss-of-Offsite-AC-Power to the 1 3A Station Auxiliaries 15.2.6 Loss-of-Normal Feedwater 1 3A (LONF) 15.2.7 Feedwater System Pipe Breaks 1 3A 15.3.1 Flow Coastdown Accidents 2A 7 15.3.2 Locked Rotor Accident 2B 3A Page 17 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Pressure Relief Modela UFSAR Event Description Pressurizer MSS 15.4.1 Uncontrolled RCCA Withdrawal 5 5 from a Subcritical Condition 15.4.2 Uncontrolled RCCA Withdrawal 1 3B at Power - DNB Case Uncontrolled RCCA Withdrawal 2B 3B at Power - Peak RCS Pressure Case 15.4.3 Startup of an Inactive RCL Analysis not required 15.4.4 CVCS Malfuntion (Boron 5 5 Dilute) 15.4.5 RCCA Ejection 5 5 15.4.6 RCCA Drop 6 6 15.6.1 Inadvertent Opening of a Pres- d surizer Safety or Relief Valve

a. The pressure relief models are decribed below.

b. Transient bounded by steam system piping failure (UFSAR, Section 15.1.5).

c. Transient bounded by loss-of-external-electrical load (UFSAR, Section 15.2.2).

d. Generic (see Reference 12)

Model 1 (Maximum Pressurizer Pressure Relief)

The setpoint for each of the two pressurizer power-operated relief valves (PORVS) was either 100 psi above the initial pressure or 2350 psia, whichever was lower. Each PORV had a relief rate of 179,000 lbm/hr. The pressurizer spray system was actuated when the idicated pressur-izer pressure exceeded the initial value by 25 psi. The presurizer spray valves were full-open when the indicated pressurizer pressure exceeded the initial value by 75 psi. A linear increase in the pressurizer spray valve flow area was assumed between these points. The full-open spray valve flow area was 0.0376 ft2.

The PSV set point was 3% below the nominal setpoint of 2485 psig. Once the PSV's came open, they did not reseat until the pressure dropped 5% below the openig setpoint. No time delay penalty was applied to account for purging the water in the PSV loop seals. The PSV design relief rate was 288,000 lbm/hr per valve (2 valves total). Note that for the PONF, loss-of-offsite-ac power to the station auxiliaries, and feedwater system pipe break transients, the PSV model was irrelevant because the PORVs and sprays were sufficient to control pressure.

Model 2A (Minimum Pressurizer Pressure Relief)

The pressurizer PORVs and pressurizer sprays were assumed to be unavailable. Although the PSVs were modeled, they do not actuate during the transient.

Page 18 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Model 2B (Minimum Pressurizer Pressure Relief)

The pressurizer PORVs and pressurizer sprays were assumed to be unavailable. The PSVs set-point was increased at least 2.3% above the nominal set pressure of 2485 psig to account for set pressure tolerance, plus an additional 1% to address the set pressure shift phenomenon associ-ated with PSVs that had water-filled loop seals (see WCAP-12910[Reference2]). A maximum time delay of 0.8 seconds was applied to account for purging the water in the PSV loop seals.

The PSV design relief rate was 288,000 lbm/he per valve (2 valves total).

Model 3A (Staggered MSSV Setpoints)

There were 4 MSSVs on each loop with a total relief capacity of ~1861 lbm/sec (total of 8 valves). The assumed setpoints are listed below:

Valve Bank Nominal Setpoint Initial Open Pressure of the MSSVsa 1 1085 psig 1134.20 psia 2 1140 psig 1190.00 psia 3 1140 psig >1190.00 psia 4 1140 psia 1190.00 psia

a. Pressure includes +1.5% for the setpoint tolerance, +18.2 psi for the pressure drop from the inlet con-nection of the 30-inch main steamline pipe to the MSSV, and +14.7 psi to convert to atmospheric pres-sure. The full-open pressure for each MSSV was 5 psi above the inital open pressure.

Model 3B (Staggered MSSV Setpoints)

Same as Model 3A, except that a less conservative setpoint tolerance of +1.4% (instead of

+1.5%) and/or slightly less conservative pressure drop from the inlet of the 30-inch main steam-line pipe to the MSSVs of 18.07 psid (instead of 18.2 psid) were/was assumed.

Model 4 No specific pressurizer pressure or MSS relief input were modeled. The pressurizer pressure and steam pressure both decrease during this event. Thus, the pressurizer spray, relief valves, and safety valves, and the MSSVs were irrelevant.

Model 5 Pressurizer and MSS relief was not modeled because either the computer code(s) used for this analysis did not include pressurizer or steam generator models, or the analysis was a hand calcu-lation that did not involve these plant components. Refer to the accident-specific analyses for additional information.

Page 19 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Model 6 The generic (that is, not plant specific) analysis performed to address this event assumed that the pressurizer PORVs actuated at 2350 psia with a total maximum relief capacity of 16.65 ft3/sec.

The pressurizer spray valve setpoints assumed were the same as those specified for Model 1, but the total spray capacity was 52.2 lbm/sec. The PSVs and MSSVs were modeled and assumed to be available, but did not actuate.

Model 7 No specific MSS relief inputs were modeled because the secondary side pressure transient during the event was non-limiting.

Page 20 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-5 Core Kinetics Parameters and Reactivity Feedback Coefficients Parameter Beginning of Cycle End of Cycle (Minimum Feedback) (Maximum Feedback)

MTC, pcm/F 5.0 (> 70% RTP)a N/A 0.0 (70% RTP)

Moderator Density Coefficient, N/A 0.45 k/(g/cc)

Doppler Temperature Coeffi- -0.91 -2.90 cient, pcm/F Doppler-Only Power Coefficient, -12.0 + 0/045Q -24.0 + 0.100Q pcm/%power (Q=power in %

Delayed Neutron Fraction 0.0072(maximum) 0.0043 (minimum)

Minimum Doppler Power Defect, Pcm

- RCCA Ejection 1000 950

-RCCA Withdrawal from Sub- 1100 N/A Critical

a. RTP=Rated Thermal Power Page 21 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-6 Summary of RPS and ESFAS Functions Actuated UFSAR Section Event Description RPS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (sec) 15.1.1 Decrease in Feedwater Temperature N/A N/A N/A 15.1.2 Increase in Feedwater Flow High-High Steam Generator Water Level 100% NRS 22.0 Feedwater Regulator Valve Closure 15.1.3 Excessive Load Increase N/A N/A >N/A 15.1.4 Inadvertent Opening of a Steam Generator a Relief/Safety Valve 15.1.5 Steam System Piping Failure - Zero Power High-High Steam Flow Setpoint 155% of nominal >2.0 (Core response only)

High Steam Flow Setpoin -155% of nominal 2.0 High Steam Flow Setpoint 1.5E6 lbm.hr 2.0 Low Steam Pressure Safety Injection (SI)Set- 327.7 psia (lead/lag=12/ 2.0 point 2)

Steam Line Isolation Delay from SI Coinci- N/A 7.0 dent with High-High Steam Flow Feedwater Isolation Delay from SI N/A 32.0 SI Pumps at Full Flow Following SI Signal N/A 12.0/22.75 (with/without offsite power)

Steam System Piping Failure-Full Power OPT reactor trip Table 15.0.7 10.0b (Core response only) 15.1.6 Combined Steam Generator ARV and Feed- High-High Steam Generator Water Level 100% NRS 22.0 water Control Valve Failures Feedwater Regulator Valve Closure OPT Reactor Trip Table 15.0.7 10.0b Low-Pressurizer Pressure Safety Injection 1715.0 psia 32.0 15.2.1 Steam Pressure Regulator Malfunction or Fail- c ure That Results in Decreasing Steam Flow 15.2.2 Loss-of-External-Electrical Load High-Pressurizer Pressure Reactor Trip 425 psia 2.0 Page 22 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES UFSAR Section Event Description RPS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (sec)

OTT Reactor Trip Table 2.8.5.0-4 7.0b 15.2.3 Turbine Trip c 15.2.4 Loss-of-Condenser Vacuum c 15.2.5 Loss-of-Offsite-AC Power to the Station Aux- Low-Low Steam Generator Water Level Reac- 0% NRS 2.0 iliaries tor Trip Low-Low Steam Generator Water Level Aux- 0% NRS 60.0 iliary Feedwater (AFW) Pump Start 15.2.6 LONF Low-Low Steam Generator Water Level Reac- 0% NRS 2.0 tor Trip Low-Low Steam Generator Water Level AFW 0% NRS 60.0 Pump Start 15.2.7 Feedwater System Pipe Breaks Low-Low Steam Generator Water Level Reac- 0% NRS 2.0 tor Trip Low-Low Steam Generator Water Level AFW 0% NRS 60 & 870 Pump Start 15.3.1 Flow Coastdown Accidents Low RCL Flow Reactor Trip 87% 1.0 RCP Undervoltage Reactor Trip N/A 1.5 RCP Underfrequency Reactor Trip 57 Hz 1.4 15.3.2 Locked Rotor Accident Low RCL Flow Reactor Trip 87% 1.0 15.4.1 Uncontrolled RCCA Withdrawal from a Sub- Power-Range High Neutron Flux Reactor Trip 35% 0.5 critical Condition (Low Setting) 15.4.2 Uncontrolled RCCA Withdrawal at Power Power-Range High Neutron Flux Reactor Trip 115% 0.5 (High Setting)

OTT Reactor Trip Table 15.0-7 7.0b High Pressurizer Pressure Reactor Trip 2425 psia 2.0 15.4.3 Startup of an Inactive RCL N/A N/A N/A 15.4.4 Chemical and Volume Control System Mal- OTT Reactor Trip Table 15.0-7 7.0b function (Boron Dilution)

Page 23 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES UFSAR Section Event Description RPS or ESFAS Signal(s) Actuated Analysis Setpoint Delay (sec) 15.4.5 RCCA Ejection Power-Range High Neutron Flux Reactor Trip 35% (low setting) 0.5 (Low and High Settings) 118% (high setting) 0.5 15.4.6 RCCA Drop Low-Pressurizer Pressure reactor Trip d 2.0 15.6.1 Inadvertent Opening of a Pressurizer Safety or OTT Reactor Trip Table 15.0-7 0.0b Relief Valve 15.8 ATWS ATWS Mitigation System Actuation Circuitry N/A 30(TT)

(AMSAC) - Turbine Trip (TT), AFW Pump 60(AFW)

Start (AFW)

a. Transient bounded by steam system piping failure (UFSAR, Section 15.1.5

b. Modeling the OTT and OPT reactor trips including a time constant (first order lag) of 2.0 seconds for the RTDs and a filter (lag) of 3.5 (or 6.0) seconds on the hot-leg temperature measurement. The RTD lag accounted for the response of the RTDs and the RTD electronic filter (if any). In addition, after the overtemperature or overpower setpoint was reached, a delay of 1.5 (or 2.0) seconds was assumed to account for electronic delays, reator trip breakers opening, and RCCA gripper release.

c. Transient bounded by loss-of-external-electrical load (UFSAR, Section 15.2.2

d. The generic two-loop dropped RCCA analysis, applicable to Ginna, modeled the low-pressurizer pressure reactor trip setpoint as a "convenience trip". The cases that actauted this function assumed dropped rod and control bank worth combinations that were non-limiting with respect to DNB. The fact that the plant-specific low-pressurizer pressure setpoint (1775 psia) was lower than the value assumed in the generic analysis (1860 psia) did not invalidate the applicability of the generic two-loop statepoints to Ginna. Therefore, the low-pressurizer pressure reactor trip setpoint value that was used in the generic two-loop dropped RCCA analysis (1860 psia) did not represent an analytical limit for this function for Ginna.

Page 24 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-7 Overtemperature and Overpower T Setpoints Allowable Full-Power TAVG Range 564.6to 576.0F K1 (safety analysis value) 1.30 K2 0.00093/psi K3 0.0185/F K4 (safety analysis value) 1.15 K5 0.0014/Fa K6 0.00/F T' 564.6to 576.0Fb P' 2250 psia f(I) Deadbandc -14% Id to +6% I f(I) Negative Gainc -3.08%/%Id f(I) Positive Gainc +2.27%/%I High-Presurizer Pressure Reactor Trip Setpoint (safety analysis value) 2425 psia Low-Pressurizer Pressure Reactor Trip Setpoint (safety analysis value) 1775 psia

a. K5=0.0014/F is valid for increasing TAVG. For decreasing TAVG, K5=0.0/F

b. Value to be set equal to or less than the full power operating TAVG chosen.

c. The f(I) penalty is implicitly assumed in the non-LOCA safety analysis.

d. Value supported by non-LOCA transient analysis. Value will change based on fuel rod design analysis.

Page 25 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-8 DETERMINATION OF MAXIMUM OVERPOWER TRIP POINT - POWER RANGE NEUTRON FLUX CHANNEL - BASED ON NOMINAL SETPOINT CONSIDERING INHERENT INSTRUMENT ERRORS Nominal setpoint 108% of Rated Power Maximum overpower trip point per uncertainty analysis. 115% of Rated Power Variable Accuracy of Effect of Thermal Power Measurement Determination (percent error) of Variable (Percent error) Estimated Assumed Calorimetric errors in the measure-ment of secondary system thermal Power Feedwater temperature 0.5 Feedwater pressure (small cor- 0.5 0.3 rection on enthalpy)

Steam pressure (small correction 2 on enthalpy)

Feedwater flow 1.25 1.25 Assumed calorimetric error (% of 2 (a) rated power)

Axial power distribution effects on total ion chamber current Estimated error (% of rated 3 power)

Assumed error (% of rated 5 (b) power)

Instrumentation channel drift and setpoint reproducibility Estimated error (% of rated 1 power)

Assumed error (% of rated 2 (c) power)

Total assumed error in setpoint (a) + (b) + (c) 9 Page 26 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.0-9 Summary of Initial Conditions and Computer Codes Used Accident Computer Codes DNB Correlation RTDP Initial NSS Power RCS Flow (gpm) RCS Temp (F) RCS Pressure Used (psia)

Decrease in Feedwater Event bounded by the excessive-load-increase event Temperature Increase in Feedwater RETRAN WRB-1 yes(HFP) 1817 MWt 177,300 676.0 (HFP) 2250 Flow VIPRE (HFP) No(HZP) 0 MWt (HFP) 547.0 (HZP)

W-3 (HZP) 170,200 (HZP)

Excessive Load Increase N/A WRB-1 Yes 1817 MWt 177,300 576.0 2250 Inadvertent Opening of a Event bounded by the steam system piping failure event.

Steam Generator Relief/

Safety Valve Rupture of Steam Pipe- RETRAN W-3 No 0 MWt 170,200 547.0 2250 Zero Power Core VIPRE

Response

Rupture of Steam Pipe- RETRAN WRB-1 Yes 1817 MWt 177,300 576.0 2250 Full Power Core VIPRE

Response

Combined Steam Genera- RETRAN WRB-1 Yes 1817 MWt 177,300 576.0 2250 tor ARV and Feedwater Control Valve Failures Steam Pressure Regula- Event bounded by the loss-of-external-electrical-load-event.

tor Malfunction or Failure That Results in Decreas-ing Steam Flow Loss-of-External-Electri- RETRAN WRB-1 N/A 1817 MWt 170,200 580.0 2190 cal Load (pressure) (pressure) (pressure) (pressure) (pressure)

Yes 1817 Mwt (DNB) 177,300 576.0 (DNB) 2250 (DNB)

(DNB) (DNB)

Turbine Trip Event bounded by the loss-of-external-electrical-load-event.

Page 27 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Accident Computer Codes DNB Correlation RTDP Initial NSS Power RCS Flow (gpm) RCS Temp (F) RCS Pressure Used (psia)

Loss-of-Condenser Vac- Event bounded by the loss-of-external-electrical-load-event.

uum

>Loss-of-Offsite-ac- RETRAN N/A N/A 1817 MWt 170,200 572.0 231.0 Power to the Station Aux-iliaries Feedwater System Pipe RETRAN N/A N/A 1817 MWt> 170,200 580.0> 2190 Breaks Flow Coastdown Acci- >RETRAN WRB-1 Yes 1817 MWt 177,300 576.0 2250 dent VIPRE Locked Rotor Accident RETRAN N/A N/A 1817 MWt> 170,200> 580.0 2310 VIPRE Uncontrolled RCCA TWINKLE w-3a No 0 MWt (core 76,420c 547 2190 Withdrawal from a Sub- FACTRAN power) critical Condition VIPRE WRB-1b Uncontrolled RCCA RETRAN WRB-1 Yes 1817 MWt (100%) 177,300 576.0 (100%) 2250 Withdrawal at Power (DNB) (DNB/MSS (DNB/MSS) 564.4 (60%) (DNB/MSS)

Press.) 549.9 (10%)

N/A 1090.2 MWt 170,200 553.9 (8%) 2190 (Pressure) (60%) (RCS Press.) (RCS Press.)

(DNB/MSS Press.)

181.7 MWt (10%)

(DNB/MSS Press.)

145.4 MWt (8%)

(RCS Press.)

CVCS System Malfunc- N/A N/A N/A 1817 MWt (100%) N/A 580 (Mode 1) 2.250 tion (mode 1) 547 (Mode 2) (modes 1 90.9 MWt (5%) 140 (mode 6) and 2)

(mode 2) 14.7 (mode 6) 0 MWt (0%)

(mode 6)

Page 28 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Accident Computer Codes DNB Correlation RTDP Initial NSS Power RCS Flow (gpm) RCS Temp (F) RCS Pressure Used (psia)

RCCA Ejection TWINKLE N/A N/A 1811 MWt (core 170,200 580.0 (HFP) 2190 FACTRAN power)(HFP) (HFP) 547.0 (HZP) 0 MWt (core 76,420c power) (HZP)

(HZP)

RCCA Drop LOFTRANd WRB-1 Yes 1817 MWt 177,300 576.0 >2250 ANC VIPRE Inadvertent Opening of a RETRAN WRB-1 Yes 1817 MWt 177,300 576.0 2250 Pressureizer Safety or Relief Valve ATWS LOFTRAN N/A N/A 1817 MWt 170,200 574.5 2250

a. Below the first mixing vane grid.

b. Above the first mixing vane grid.

c. Single loop flow=0.449

• TDF.

d. The LOFTRAN portion of the analysis was generic; the DNB evaluation performed with VIPRE utilized the plant-specific values presented.

Page 29 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Excessive heat removal (i.e., a heat removal rate in excess of the heat generation rate in the core) from the reactor coolant to the steam generator feedwater is caused by one of the fol-lowing events:

A. Feedwater system malfunction that results in a decrease in feedwater temperature.

B. Feedwater system malfunction that results in an increase in feedwater flow.

C. Excessive load increase that results in an increase in feedwater flow.

D. Steam system piping failures that result in an increase in feedwater flow.

E. Combined steam generator atmospheric relief valve (ARV) and main feedwater regulating valve (MFRV) failures that result in an increase in feedwater flow.

In 1991, the advanced digital feedwater control system (ADFCS) was installed at Ginna Sta-tion (see Section 7.7.1.5). Prior to installation of the advanced digital feedwater control sys-tem, the feedwater bypass valves were closed when operating with the main feedwater regulating valves (MFRV). When operating with the advanced digital feedwater control sys-tem, the main feedwater bypass valves can be partially open at the same time that the main feedwater regulating valves are open. Thus, it is postulated for the increase in feedwater flow events that it is possible for a regulating valve to open fully when its bypass valve is open (References 1 and 2). As part of the 18 Month Fuel Cycle Program, the increase in feedwater flow events (Section 15.1.2) and the combined steam generator atmospheric relief valve (ARV) and feedwater control valve failure events (Section 15.1.6) were analyzed with suffi-cient flow to bound the effects of regulating valves fully opening with their associated bypass valve open.

15.1.1 DECREASE IN FEEDWATER TEMPERATURE 15.1.1.1 Description of Event The reduction in feedwater temperature or enthalpy is one means of increasing core power above full power. Such increases are attenuated by the thermal capacity in the secondary plant and in the reactor coolant system. The overpower-overtemperature protection (nuclear overpower and overtemperature delta T trips) prevents any power increase which could lead to a departure from nucleate boiling ratio (DNBR) less than the safety analysis limit.

An extreme example of excess heat removal by the feedwater system is the transient associ-ated with the accidental opening of the condensate bypass valve which diverts flow around the low-pressure feedwater heaters (see Section 10.4.4.4). In the event of an accidental open-ing, there is a sudden reduction in inlet feedwater temperature to the steam generators. The increased subcooling will create a greater load demand on the primary system which can potentially lead to a reactor trip. The net anticipated effect on the reactor coolant system is similar to the effect of increasing secondary steam flow, i.e., the reactor will reach a new equi-librium condition at a power level corresponding to the new steam generator delta T.

Page 30 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1.1.2 Frequency of Event The decrease in feedwater temperature is classified as an ANS Condition II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.1.1.3 Event Analysis The analysis procedure for the feedwater temperature reduction event from full power con-sists of comparing the decreased enthalpy caused by the feedwater temperature reduction with an equivalent enthalpy reduction that occurs from a steam line rupture initiated at full power (Section 15.1.5.7).

The zero power case analysis was removed when ADFCS was installed. The analysis for a zero power case with a feedwater flow increase is analyzed with ADFCS and appears in Sec-tion 15.1.2.2.

15.1.1.3.1 Protective Features The following reactor trip system (RTS) features provide protection against DNB for this event:

A. Reactor trip is actuated by an overpower delta T signal if any two-of-four delta T channels exceed a variable setpoint during the transient. The setpoint is automatically varied with axial power imbalance and coolant temperature conditions.

B. Reactor trip is actuated by an overtemperature delta T signal if any two-out-of-four delta T channels exceed a variable setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure conditions.

None of the automatic reactor trips is credited in this evaluation.

15.1.1.3.2 Single Failures Assumed No single failure in an instrumentation channel, or actuation train, will prevent the reactor trip system from performing its protective function.

15.1.1.3.3 Operator Actions Assumed No operator actions are credited in the evaluation of this event.

15.1.1.3.4 Chronological Description of Event The event starts with a sudden decrease in feedwater temperature.

15.1.1.3.5 Impact on Fission Product Barriers The DNBR is expected to remain greater than the safety analysis limit for this event. No fuel cladding failures are anticipated. The reactor coolant system pressure is expected to decrease.

Therefore, the fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

Page 31 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1.1.4 Reactor Core and Plant System Evaluation 15.1.1.4.1 Input Parameters and Initial Conditions The event is bounded by the steam line rupture event analyzed at hot full power conditions (Section 15.1.5.7). The input parameters and initial conditions assumed in the steam line rup-ture analysis are:

A. The initial reactor power, reactor coolant average temperatures, and reactor coolant pres-sure are assumed to be at their nominal values consistent with high TAVG (576.0F). See Table 15.0-3.

B. Maximum moderator reactivity feedback is assumed.

In the evaluation of the feedwater temperature reduction event, the nominal feedwater enthalpy is reduced by an amount greater than the loss of one feedwater heater.

15.1.1.4.2 Methodology The opening of a low pressure heater bypass valve causes a reduction in feedwater tempera-ture which increases the thermal load on the primary system. The increased thermal load, due to the opening of the condensate bypass valve, results in a transient similar, but of a greatly reduced magnitude, to the steam system piping failure initiated from full power conditions described in Section 15.1.5.7. Thus, the feedwater temperature reduction transient is bounded by a steam system piping failure initiated from full power. No transient results are presented, as no explicit analysis is performed.

15.1.1.4.3 Acceptance Criteria The specific acceptance criterion used for this analysis is that the DNBR remains greater than the safety analysis limit. The safety analysis DNBR limit is discussed in Section 4.4.

15.1.1.4.4 Results No explicit results are presented for this event as it is bounded by the steam line rupture ana-lyzed at hot full power conditions (Section 15.1.5.7).

The feedwater enthalpy decrease incident is similar to an excessive load increase and is an overpower transient for which the fuel temperatures rise. When a reactor trip does not occur, the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

15.1.1.5 Radiological Consequences An evaluation of radiological consequences is not performed since fuel failures are not caused by this event.

15.1.1.6 Conclusions The minimum DNBR remains above the safety analysis DNBR limit for feedwater enthalpy decreases at full power.

Page 32 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1.2 INCREASE IN FEEDWATER FLOW The two cases analyzed are an increase in feedwater flow at full power (Section 15.1.2.1) and at hot zero power (Section 15.1.2.2).

15.1.2.1 Increase in Feedwater Flow at Full Power 15.1.2.1.1 Description of Event The addition of large amounts of feedwater to the steam generators results in excessive heat removal from the primary coolant system. The resultant decrease in the average temperature of the core causes an increase in core power (nuclear flux) due to moderator and control sys-tem feedback.

The reduced coolant temperature also reduces the pressurizer water volume and pressurizer pressure. The water volume decreases due to the increase in coolant density. Since the pres-surizer must remain at saturated conditions (it contains both water and steam), the pressure decreases to the saturation pressure corresponding to the reduced water temperature.

The possible consequence of this accident (assuming no protective functions) is departure from nucleate boiling (DNB) with subsequent fuel damage. With the addition of excess feed-water into one or both steam generators, there is also the possibility of steam generator over-fill and damage to the turbine and steam piping. Protection is provided by isolating feedwater flow at the high steam generator level setpoint.

Flow control failures causing the main feedwater regulating valves (MFRV) to fully open are considered an initiating event. With an increase in feedwater flow at power, the high steam generator water level setpoint is approached in the faulted loop(s). The high steam generator water level will close the main feedwater regulating valve (MFRV) and the feedwater bypass valve (if open) in the associated loop; the signal does not result in a turbine trip or a reactor trip. This temporarily terminates the addition of feedwater to the faulted steam generator(s) and the water level begins to drop. When the water level drops below the high steam genera-tor water level setpoint, the closure signal clears and the valves will reopen, potentially caus-ing the steam generator water level to increase. The control can oscillate between full closed and open until a reactor trip signal or a safety injection signal is generated. If no protection setpoint is approached, the main feedwater regulating valves (MFRV) will continue to cycle until the operator has had time to identify the problem and take the appropriate action, which could be to manually trip the reactor and isolate feedwater.

15.1.2.1.2 Frequency of Event The increase in feedwater flow incident is classified as an ANS Condition II event of moder-ate frequency. Section 15.0.8 discusses Condition II events.

15.1.2.1.3 Event Analysis This transient is analyzed by increasing the feedwater flow in the faulted loop(s). The increased flow is sufficient to cover the simultaneous opening of the main feedwater regulat-Page 33 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ing valve (MFRV) with an open bypass valve. Four cases were analyzed to demonstrate the plant behavior in the event of a sudden increase in feedwater flow at full power:

A. A step increase in feedwater flow to one steam generator to 200% of the nominal full power flow rate initiated at full power with the reactor control in manual.

B. A step increase in feedwater flow to one steam generator to 200% of the nominal full power flow rate initiated at full power with the reactor control in automatic.

C. Step increases in feedwater flow to both steam generators to 170% of the nominal full power flow rate initiated at full power with the reactor control in manual.

D. Step increases in feedwater flow to both steam generators to 170% of the nominal full power flow rate initiated at full power with the reactor control in automatic.

15.1.2.1.3.1 Protective Features The following features provide protection for this event:

1. Reactor trip is actuated by an overpower delta T signal if any two-of-four delta T channels exceed a variable setpoint during the transient. The setpoint is automatically varied with axial power imbalance and coolant temperature conditions.

2. Reactor trip is actuated by an overtemperature delta T signal if any two-out-of-four delta T channels exceed a variable setpoint during the transient. This setpoint is automatically var-ied with axial power imbalance, coolant temperature, and pressurizer pressure conditions to protect against DNB.

3. Reactor trip is actuated by a power range neutron flux high trip signal if any two-out-of-four channels exceed neutron flux setpoints.

4. The main feedwater regulating and bypass valves close on high steam generator water level or a safety injection (SI) signal on low pressurizer pressure. The high steam generator water level signal is generated from two of three high level channels per steam generator. The control valves are assumed to reopen once the high steam generator water level signal clears. The low pressurizer pressure SI signal is generated from two of three pressurizer low-pressure channels.

This analysis credits engineered safety features feedwater isolation signals for closing the main feedwater regulating and bypass valves on a high steam generator water level.

None of the automatic reactor trips is credited in this analysis.

15.1.2.1.3.2 Single Failures Assumed A single failure in one train of the reactor protection system is considered the limiting failure.

No single failure in the reactor trip system will prevent it from performing a protective trip of the reactor. For operator-initiated trips, no single failure in one of the reactor trip system trip actuation trains will prevent a manual trip of the reactor.

No single failure of one of three level instrumentation channels will prevent the closure of the valves to the faulted steam generator.

Page 34 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES No single failure of one of three pressurizer low-pressure channels will prevent the closure of the valves to the steam generators.

15.1.2.1.3.3 Operator Actions Assumed No operator actions are credited in the analysis of this event up to the time when it is demon-strated that the acceptance criteria are met. The operator is then expected to establish stable plant conditions (which could include tripping the reactor or actuating an engineered safety feature, if necessary).

15.1.2.1.3.4 Chronological Description of Event Tables 15.1-1 to 15.1-4 give the time sequence for the four increased feedwater flow cases at hot full power.

15.1.2.1.3.5 Impact on Fission Product Barriers The DNBR is maintained greater than the safety analysis limit for this event. No fuel clad-ding failures are expected. The reactor coolant system pressure does not increase signifi-cantly. The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.1.2.1.4 Reactor Core and Plant System Evaluation 15.1.2.1.4.1 Input Parameters and Initial Conditions A. Initial values of reactor power, pressure, and average temperature assumed are consistent with the Revised Thermal Design Procedure. The vessel average temperature is at the max-imum TAVG (576.0F) value. Initial conditions are shown in Table 15.0-3.

B. The feedwater temperature at the inlet of the steam generators is at its high value of 435F.

C. The steam generator water level corresponds to 48% on the narrow range level. This value represents the nominal steam generator water level at nominal initial power with a negative 4% narrow range level uncertainty applied.

D. The feedwater malfunction causes an initial step increase to 200% of nominal full power feedwater flow to the faulted steam generator. Feedwater malfunctions affecting both steam generators cause 170% of nominal full power flow to both steam generators.

E. The main feedwater regulating and bypass valves close on high steam generator water level after a 22 second delay. The high level setpoint is conservatively 100% of the narrow range level which bounds the maximum value allowed by the Technical Specifications. The delay conservatively accommodates electronic delay and valve closure times. The control valves are assumed to reopen once the high steam generator water level signal clears.

F. Maximum moderator feedback is assumed to maximize the reactivity insertion. The mini-mum doppler power defect is used to minimize the negative reactivity insertion with increasing power in the fuel. No decay heat is assumed, but maximum values for prompt neutron lifetime and minimum values for delayed neutron fraction are assumed.

Page 35 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES G. The pressurizer spray system and pressurizer power operated relief valves (PORV) are assumed operational since they reduce primary system pressure and thereby minimize the calculated values of DNBR.

H. Cases are analyzed with and without automatic rod control. Control systems are assumed to function only if their operation results in more severe accident results.

15.1.2.1.4.2 Method of Analysis The plant responses for malfunctions resulting in increased feedwater flow were analyzed using the RETRAN code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, main steam safety valves (MSSV), and feedwater system. Section 15.0.7 provides an additional description of RETRAN and its capabilities.

This accident is analyzed with the Revised Thermal Design Procedure described in Reference

3. Uncertainties in initial conditions are included in the DNBR limit using this procedure.

The increase in feedwater flow significantly increases the heat removal by the faulted steam generator(s). Feedwater flow rate to the faulted steam generator is increased instantaneously to the maximum postulated value. The main feedwater regulating and bypass valves are assumed to start to close once the steam generator high level setpoint is reached. The subse-quent re-opening and re-closing of the valves is modeled by maintaining (analytically) the level in the faulted steam generator at the level reached 22 seconds after the high steam gener-ator water level signal is generated. This high level is maintained until the reactor is manually tripped and the event is terminated.

15.1.2.1.4.3 Acceptance Criteria The applicable acceptance criteria for this Condition II feedwater malfunction incident are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The primary acceptance criterion used in this analysis is that the minimum DNBR remains greater than the safety analysis limit in Section 4.4. The event does not challenge the primary and secondary side pressure limits since the increased heat removal tends to cool the reactor coolant system.

15.1.2.1.4.4 Results The event sequences for the four full power cases are given in Tables 15.1-1 through 15.1-4.

Each case reaches an equilibrium condition in the first 10 minutes of the transient. The results show that the DNBR remains above the safety analysis limit during the excessive feedwater flow event.

Page 36 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Of these four full power cases, the most limiting is the multi-loop feedwater malfunction with manual rod controla. Plots of nuclear power, maximum reactor coolant system pressure, loop average temperature, and steam generator pressure and mass versus time are given in Figures 15.1-1 through 15.1-3. As shown in Figure 15.1-1, the temperature reduction that results from the increased feedwater flow is less than 5F.

15.1.2.1.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event.

15.1.2.1.6 Conclusion The DNBRs for the excessive feedwater addition at power are above the safety analysis limit.

The analysis shows that reactor core is capable of reaching a stable condition if the event is not terminated by the reactor trip system (RTS) or by the operator.

15.1.2.2 Increase in Feedwater Flow at Zero Power 15.1.2.2.1 Description of Event The addition of large amounts of feedwater to the steam generators results in excessive heat removal from the primary coolant system. When initiated at hot zero power, the resultant decrease in the average temperature of the core can cause a return to criticality due to moder-ator feedback.

The possible consequence of this accident (assuming no protective actions) is DNB with sub-sequent fuel damage. Like the full power cases, the addition of excess feedwater can lead to water carryover and damage to the plant if the feedwater isolation valves are not automati-cally closed on high steam generator water level or the feedwater system is not tripped.

15.1.2.2.2 Frequency of Event The increase in feedwater flow incident is classified as an ANS Condition II event of moder-ate frequency. Section 15.0.8 discusses Condition II events.

15.1.2.2.3 Event Analysis The transient is analyzed by a step increase in feedwater flow to both steam generators to 110% of the nominal full power flow rate initiated at zero power with the reactor in manual.

15.1.2.2.3.1 Protective Features The main feedwater regulating and bypass valves close on high steam generator water level or a safety injection (SI) signal on low pressurizer pressure. The high steam generator water level signal is generated from two of three high level channels per steam generator. The con-

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 37 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES trol valves are assumed to reopen once the high steam generator water level signal clears.

The low pressurizer pressure SI signal is generated from two of three pressurizer low-pres-sure channels.

15.1.2.2.3.2 Single Failures Assumed A single failure in one train of the reactor protection system is considered the limiting failure.

No single failure of one of three level instrumentation channels will prevent the closure of the valves to the faulted steam generator.

No single failure of one of three pressurizer low-pressure channels will prevent the closure of the valves to the steam generators.

15.1.2.2.3.3 Operator Actions Assumed No operator actions are assumed in the transient analysis.

15.1.2.2.3.4 Chronological Description of Event The event begins with the failing open of feedwater regulating and bypass valves to both steam generators. The analysis is terminated at a point where there has been sufficient time to show that the system reaches an equilibrium condition.

15.1.2.2.3.5 Impact on Fission Product Barriers The DNBR is maintained greater than the safety analysis limit for this event. No fuel cladding failures are expected. The reactor coolant system pressure does not increase significantly. The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.1.2.2.4 Reactor Core and Plant System Evaluation 15.1.2.2.4.1 Input Parameters and Initial Conditions A. Initial values of reactor power, pressure, and nominal no load TAVG (547F) for the hot zero power case are given in Table 15.0-3 .

B. Reactivity feedback conditions are assumed to be at their maximum values except for the doppler defect, which is minimized. No decay heat is assumed, but minimum values for prompt neutron lifetime and delayed neutron fraction are assumed.

C. The event is analyzed with the reactor in manual control.

D. The feedwater control malfunction causes a step increase in feedwater flow to both steam generators from zero to 110% of the nominal full power flow rate.

E. Feedwater temperature is at an assumed value of 100F. (A minimum temperature of 30F was evaluated in Reference 6.)

F. A steam generator water level of 48% on the narrow range level is evaluated. This value represents the nominal steam generator water level at zero power with a negative 4% nar-row range level uncertainty applied.

Page 38 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES G. The main feedwater regulating and bypass valves close on high steam generator water level after a 22 second delay. The high level setpoint is conservatively 100% of the narrow range level which bounds the maximum value allowed by the Technical Specifications. The delay conservatively accommodates electronic delay and valve closure times. The control valves are assumed to reopen once the high steam generator water level signal clears. The main feedwater regulating and bypass valves can also close on a low pressurizer pressure safety injection (SI) signal after a 32 second delay. The SI low pressurizer pressure set point is conservatively set at 1715 psia.

H. The pressurizer spray system and pressurizer power operated relief valves (PORVs) are assumed operational since they reduce primary system pressure and thereby minimize the calculated valves of DNBR.

15.1.2.2.4.2 Methodology The increase in feedwater flow at hot zero power is also analyzed using RETRAN. The meth-odology for this case is essentially the same as described for the full power cases in Section 15.1.2.1.4.2 except that once the SG level reaches the Hi SG level setpoint, it does not decrease below the Hi SG level setpoint before a feedwater isolation on low pressurizer pres-sure SI occurs. Thus, the reopening behavior of the main feedwater regulating and bypass valves does not need to be addressed as described for the full power cases. In addition, since the event is analyzed at zero power, the Revised Thermal Design Procedure is not employed, but conditions corresponding to zero power are assumed.

15.1.2.2.4.3 Acceptance Criteria The general acceptance criteria applicable to the feedwater malfunction event at hot zero power are the same as the full power case. The minimum DNBR from the case initiated at hot zero power conditions with manual rod control and a failure of the MFRVs in both loops is greater than the safety analysis limit.

15.1.2.2.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event.

15.1.2.2.6 Conclusion The DNBR for the excessive feedwater addition at zero power is above the safety analysis limit. The analysis shows that reactor core is capable of reaching a stable condition if the event is not terminated by the protection system or by the operator.

15.1.3 EXCESSIVE LOAD INCREASE INCIDENT 15.1.3.1 Description of Event An excessive load increase incident is defined as a rapid increase in steam generator steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. The reactor control system is designed to accommodate a 10% step load increase and/or a 5%/min. ramp load increase (without a reactor trip) in the range of 15% to Page 39 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 100% full power. Any loading rate in excess of these values may cause a reactor trip actuated by the reactor trip system (RTS).

An excessive load increase incident could result from either an administrative violation such as an excessive loading by the operator or an equipment malfunction in the steam dump con-trol or turbine speed control systems. For excessive loading by the operator or by system demand, the turbine load limiter keeps maximum turbine load below approximately 100%

rated load.

During power operation, steam dump to the condenser is controlled by reactor coolant condi-tion signals, i.e., abnormally high reactor coolant temperature indicates a need for steam dump. A single controller malfunction does not cause steam dump; an interlock is provided that blocks the control signal to the valves unless a large turbine load decrease or a turbine trip has occurred.

If the load increase exceeds the capability of the reactor control system, the transient is termi-nated in time to prevent a DNBR less than the safety analysis limit by a combination of the nuclear overpower trip, low pressurizer pressure trip, and the overpower-overtemperature delta T trips.

15.1.3.2 Frequency of Event The excessive load increase incident is classified as an ANS Condition II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.1.3.3 Event Analysis Four cases were evaluated to determine the plant behavior following a 10% step load increase from rated load. These cases are as follows:

1. Reactor control in manual with beginning-of-life, minimum moderator reactivity feedback.

2. Reactor control in manual with end-of-life, maximum moderator reactivity feedback.

3. Reactor control in automatic with beginning-of-life, minimum moderator reactivity feed-back.

4. Reactor control in automatic with end-of-life, maximum moderator reactivity feedback.

15.1.3.3.1 Protective Features The following features provide protection for this event:

1. Reactor trip is actuated by an overpower delta T signal if any two-of-four delta T channels exceed a variable setpoint during the transient. The setpoint is automatically varied with axial power imbalance and coolant temperature conditions.

2. Reactor trip is actuated by an overtemperature delta T signal if any two-out-of-four delta T channels exceed a variable setpoint during the transient. This setpoint is automatically var-ied with axial power imbalance, coolant temperature, and pressurizer pressure conditions to protect against DNB.

Page 40 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

3. Reactor trip is actuated by a power range neutron flux high trip signal if any two-out-of-four channels exceed neutron flux setpoints.

4. Reactor trip is actuated on two-out-of-four low pressurizer pressure (RTS) signals.

None of the automatic reactor trips are credited in the evaluation.

15.1.3.3.2 Single Failures Assumed A single failure was assumed in one train of the reactor trip system (RTS); however, no trip was credited for this event.

15.1.3.3.3 Operator Actions Assumed No operator actions are credited in the evaluation. The operator is expected to be able to reduce power to normal levels following the transient.

15.1.3.3.4 Chronological Description of Event The events start with a 10% step load increase. Reactor power increases with the plant reach-ing a stabilized condition at the higher power level.

15.1.3.3.5 Impact on Fission Product Barriers The DNBR is expected to be greater than the safety analysis limit for this event. No fuel clad-ding failures are expected. Reactor coolant and steam pressures are expected to decrease.

The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.1.3.4 Reactor Core and Plant System Evaluation 15.1.3.4.1 Input Parameters and Initial Conditions A. Initial values of reactor power, pressure, and average temperature assumed are consistent with the Revised Thermal Design Procedure. The vessel average temperature is at the max-imum TAVG (576.0F ) value. Plant characteristics and initial conditions are described in Section 15.0.1.

B. For the beginning of life minimum moderator feedback cases, the core has the least positive moderator density coefficient and the least negative doppler-only power coefficient curve.

Therefore, the core has the least inherent transient response capability.

C. For the end of life maximum moderator feedback cases, the moderator density coefficient of reactivity has its most positive value and the most negative doppler-only power coeffi-cient curve. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

D. Automatic pressure control using the pressurizer sprays is assumed. Operation of the sprays would decrease primary system pressure and minimize calculated DNBRs.

E. No credit is taken for the pressurizer heaters when the reactor coolant system pressure decreases. Operation of the heaters would tend to increase the DNBR, which is non-con-servative for this analysis.

Page 41 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES F. The reactor is assumed to be in automatic control.

G. A 10% step increase in steam demand is assumed.

H. Zero percent steam generator tube plugging is assumed. Sensitivity results showed that this case is slightly more limiting than when plugging is assumed.

15.1.3.4.2 Methodology Given the non-limiting nature of this event with respect to the DNBGR safety analysis crite-rion, an explicit analysis was not performed as part of the Extended Power Uprate Program.

Instead, a detailed evaluation of this event was performed. The evaluation model consists of the generation of statepoints based on generic conservative data. The statepoints are in the form of changes in temperature, pressure, power, and flow that are applied to the plant's initial conditions. These conditions are then compared to the core thermal limits to ensure that the DNBR limit is not violated. Statepoints for the following cases were evaluated:

• Reactor in manual rod control with BOL (minimum moderator) reactivity feedback

• Reactor in manual rod control with BOL (maximum moderator) reactivity feedback

• Reactor in automatic rod control with BOL (minimum moderator) reactivity feedback

• Reactor in automatic rod control with BOL (minimum moderator) reactivity feedback 15.1.3.4.3 Acceptance Criteria The general acceptance criteria for a Condition II event are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Primary and secondary side pressures tend to decrease due to increased heat removal from both systems. Therefore, the specific criterion used for this incident is that the DNBR must remain greater than the safety analysis limit described in Section 4.4.

15.1.3.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failure occurs.

15.1.3.6 Conclusions It has been demonstrated that, for an excessive load increase, the DNBR remains above the safety analysis DNBR limit. Following the load increase, the plant rapidly reaches a stable condition at the higher power level.

Page 42 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF/SAFETY VALVE The effects of a relief/safety valve inadvertent opening are bounded by the rupture of a steam pipe in Section 15.1.5.

15.1.5 SPECTRUM OF STEAM SYSTEM PIPING FAILURES INSIDE AND OUTSIDE OF CONTAINMENT 15.1.5.1 Description of Event A rupture of a steam pipe is assumed to include any accident that results in an uncontrolled steam release from a steam generator. The release can occur due to a break in a steam line, or the inadvertent opening of a main steam safety, atmospheric relief or steam dump valve.

The steam release results in an initial increase in steam flow, which decreases during the acci-dent as the steam pressure falls. The energy removal from the reactor coolant system causes a reduction of coolant temperature and pressure. With a negative moderator temperature coef-ficient, the cooldown results in a reduction of core shutdown margin. If the most reactive control rod is assumed to be stuck in its fully withdrawn position, there is a possibility that the core will become critical and return to power even with the remaining control rods inserted.

A return to power following a steam pipe rupture is a potential problem because of the high hot-channel factors that may exist when the most reactive rod is assumed stuck in its fully withdrawn position. Assuming the most pessimistic combination of circumstances that could lead to power generation following a steam line break, the core is ultimately shut down by the boric acid in the safety injection system.

Analysis of a steam pipe rupture is performed to demonstrate that with a stuck rod and mini-mal engineered safety features, the core remains in place and essentially intact so as not to impair effective cooling of the core. For major steam line ruptures, DNB and possible clad perforation are not unacceptable consequences. The analysis performed here, in fact, shows that the DNBR design basis is not violated for any pipe break.

In addition to the spectrum of steam line breaks discussed in this UFSAR section, the conse-quences of a steam line break in the Turbine Building with subsequent resulting steam breaks in the 30" main steam headers in the Intermediate Building has been analyzed as part of the Ginna licensing basis. The basis for this steam line break scenario and its consequences on the RCS response is discussed in UFSAR Section 3.6.2.5.2.2.

15.1.5.2 Frequency of Event A major steam pipe rupture is classified as a Condition III or Condition IV event depending on the size of the break. The licensing basis double ended steam line break considered here is classified as a Condition IV limiting fault. See Section 15.0.8 for a discussion of the ANS fault condition categories.

Page 43 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1.5.3 Event Analysis The following combinations of break sizes and initial plant conditions are considered in determining the core power and reactor coolant system transient.

Case (1) Complete severance of a steam line at initial no-load conditions with outside power available and two loops in service. The equivalent break area is 1.4 ft2.

Case (2) Case (1) above with loss of outside power simultaneous with the steam line break.

Case (3) Case (1) above with only one loop in service.

In order to evaluate auxiliary feedwater temperatures as low as 35F on core response, Cases 1, 2 and 3 were analyzed assuming an auxiliary feedwater enthalpy of 3.05 Btu/lbm. Note that the 35 degrees is based on a RETRAN limitation, and although this is an analysis limita-tion, SW temperature has been analyzed for acceptability to 30oF (Reference 15).

15.1.5.3.1 Protective Features The primary design features which provide protection for steam ruptures are:

A. Safety injection system actuation from any of the following:

1. Two-out-of-three pressurizer low-pressure signals.

2. Two-out-of-three low-pressure signals in any steam line.

3. Two-out-of-three high containment pressure signals.

B. If the reactor trip breakers are closed, reactor trip may be actuated from overpower neutron flux, overpower delta T, or upon actuation of the safety injection system.

C. Redundant isolation of the main feedwater lines - a safety injection signal will result in actuation of feedwater isolation causing all main feedwater isolation, main feedwater regu-lating, and bypass valves to rapidly close, tripping of the main feedwater pumps, and clos-ing the main feedwater pump discharge valves and closing of the feedwater isolation valves.

An engineered safety feature sequence will result in all main feedwater regulating and bypass valves to rapidly close.

D. Trip of the fast-acting steam line isolation valves (designed to close in less than 5 seconds with no flow) on the following:

1. Two-out-of-three high containment pressure signals.

2. One out of the two high-high steam flow signals in a steam line in coincidence with any safety injection signal.

3. The high-high steam flow setpoint is applicable to those steam line breaks occurring from full power steam conditions which result in a greater than or equal to 155%ther-mal power steam flow.

Page 44 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

4. One out of the two high steam flow signals in a steam line in coincidence with two-out-of-four indications of low reactor coolant average temperature and any safety injection signal.

The high steam flow setpoint is applicable to steam line breaks which result in a greater than 10% thermal power step change, including those from no load conditions.

Each steam line has a fast-closing main steam isolation valve (MSIV) and a non-return check valve. These four valves prevent blowdown of more than one steam generator for any break location, even if one valve fails to close.

The analyses for main steam pipe rupture is performed with hot shutdown (MODE 3) initial conditions. Therefore, the control rods are assumed to be already inserted. Since the control rods are inserted, credit is taken for the steam line isolation and feedwater isolation.

15.1.5.3.2 Single Failures Assumed The worst single active failure is the failure of a safety injection pump with the remaining pumps each delivering minimum flow to a cold leg. The minimum flow assumptions maxi-mize the time required to sweep the unborated water from the lines, and thereby minimize the mitigating capabilities of safety injection for this transient. All other failures that could increase the cooldown or steam release were investigated generically by Westinghouse and found to be less limiting than a failure in the safety injection system.

No single failure in the engineered safety features actuation system (ESFAS) will prevent the protective actions credited in this analysis. A single active failure of a main feedwater regu-lating or bypass valve to close is mitigated by the trip of both feedwater pumps and closure of the main feedwater pump discharge valves. The effects of a single active failure of a main steam isolation valve are mitigated by the operation of the main steam isolation valve on the other loop and the non-return check valves.

15.1.5.3.3 Operator Actions Assumed No operator actions are assumed for the cases analyzed.

15.1.5.3.4 Chronological Description of Event All events start with a break upstream of the main steam line isolation valves. The reactor coolant system pressure and temperature rapidly decrease due to the increased heat transfer through the faulted steam generator. Safety injection, main steam line isolation and feedwater isolation are actuated. The safety injection pumps start-up and begin to deliver borated water to the core. A return to power may occur before boron concentrations are sufficient to make the core subcritical. Table 15.1-6 gives the time sequence for the three cases analyzed.

15.1.5.3.5 Impact on Fission Product Barriers DNBRs greater than the safety analysis limit are expected. The fuel cladding maintains its integrity as a fission product barrier. Reactor coolant pressure decreases during this transient.

Therefore, the reactor coolant pressure boundary is expected to maintain its integrity as a gross fission product boundary.

Page 45 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Although no additional cladding failures occur, the coolant activity can increase due to iodine spiking caused by the rapid reduction in primary system pressure. Normal primary to second-ary side leakage rates in the steam generators could provide pathways for the release of reac-tor coolant activity to the secondary side. Secondary side activity pathways include steaming down of the intact steam generator to remove heat from the primary side and through the main steam piping for breaks located outside containment.

The containment is designed to maintain its integrity after the instantaneous rupture of the largest primary or secondary system piping within the structure. Main steam line breaks inside containment do not exceed the containment design limits in the containment integrity evaluations in Section 6.2.1.2. Therefore, the containment remains available as an additional fission product barrier for breaks inside containment.

The largest potential release of activity to the environment is for steam line breaks occurring outside containment. The radiological consequences for this release path are evaluated in Section 15.1.5.5.

15.1.5.4 Reactor Core and Plant System Evaluation The analyses for main steam pipe rupture events are performed with hot shutdown (MODE 3) initial conditions. Should the reactor be in MODE 1 or MODE 2 at the time of a steam line break, the reactor will be tripped by the normal overpower protection system when the power level reaches the trip setpoint. Following a trip at power, the reactor coolant system contains more stored energy than at no load, the average coolant temperature is higher than at no load, and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steam line break before the no-load conditions of reactor coolant system temperature and shutdown margin assumed in the analyses, are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analyses, which assume no-load conditions at time zero.

15.1.5.4.1 Input Parameters and Initial Conditions A. Initial values of pressure, average temperature and reactor coolant flow are at the no load TAVG (547F) conditions given in Table 15.0-5.

B. The analyses assume initial hot shutdown conditions with the rods inserted (except for one stuck rod) at time zero. The core has no decay heat.

C. The shutdown reactivity is 1.3% delta k at no load, equilibrium xenon conditions with two loops in operation. This is the end of life design value including design margins with the most reactive rod cluster control assembly stuck in its fully withdrawn position. A shut-down reactivity of 1.8% delta k is used for one loop in service. Both values are consistent with the Technical Specifications. Operation of rod cluster control assembly banks during core burnup is restricted in such a way that addition of positive reactivity in a secondary system steam release accident will not lead to a more adverse condition than the case ana-lyzed.

D. A negative moderator temperature coefficient corresponding to the end-of-life rodded core with the most reactive rod cluster control assembly fully withdrawn is assumed. The varia-Page 46 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES tion of the coefficient with temperature and pressure is included. The multiplication factor k versus temperature at 1050 psia based on the moderator temperature coefficient is shown in Figure 15.1-4.

E. In computing the power generation following a steam line break, the local reactivity feed-back from the high neutron flux in the region of the core near the stuck control assembly has been included in the overall reactivity balance. The local reactivity feedback is com-posed of doppler reactivity from the high fuel temperatures near the stuck control rod and moderator feedback from the high water enthalpy near the stuck rod. For the cases ana-lyzed where steam generation occurs in the high flux regions of the core, the effect of void formation on the reactivity has been included. The effect of power generation in the core on overall reactivity is presented in Figure 15.1-5. The curve assumes end-of-life core con-ditions with all rods in except the most reactive rod which is assumed stuck in its fully with-drawn position.

F. Minimum safety injection consists of two-out-of-three safety injection pumps in operation with each pump delivering flow to a cold leg.

G. The boron concentration in the accumulators is 2100 ppm and in the RWST is 2300 ppm, which is less than the Technical Specification limit. The time to sweep the unborated water from the safety injection piping is included.

H. Power peaking factors corresponding to one stuck control rod assembly and non-uniform core inlet coolant temperatures are determined at the end-of-core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control rod assem-bly during the return to power phase following the steam line break. This void in conjunc-tion with the large negative moderator coefficient partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and thus are different for each case studied.

I. A steam line rupture break area of 1.4 ft2 is assumed upstream of the main steam isolation valves. The rupture size is limited to the 1.4 ft2 throat area of the steam generators. The steam flows out of the breaks assume no friction losses.

J. Operation of the main and auxiliary feedwater control systems are postulated to maximize heat extraction and make the accident more severe. For the main steam line rupture, full main feedwater flow is assumed until automatic isolation occurs.

K. An auxiliary feedwater enthalpy of 3.05 Btu/lbm is used in Cases 1, 2 and 3 to evaluate core response to auxiliary feedwater temperatures as low as approximately 35F.

L. Zero percent steam generator plugging is assumed since it results in more severe cooldown of the reactor coolant system due to enhanced primary to secondary heat transfer.

15.1.5.4.2 Methodology RETRAN is used to determine transient values for the core heat flux, pressure, core inlet tem-perature, reactor coolant flow rate, and boron concentrations for use in the DNBR evalua-tions. Next, the reactivity and radial power distributions are calculated using the RETRAN-generated parameters. Finally, a detailed DNBR evaluation is performed based on results Page 47 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES from the VIPRE-W code. VIPRE-W performs DNBR analyses using detailed thermal-hydraulic models using core transient parameters determined by RETRAN. Additional descriptions of the RETRAN and VIPRE-W codes are provided in Sections 15.0.7 and 4.4.2.3.

The DNBRs at low pressures are determined using the W-3 correlation. Test data used to develop the W-3 correlation were taken at pressures ranging from 1000 to 2300 psia; how-ever, evaluations using the same data source show that the W-3 correlation holds for pressures less than 1000 psia. The NRC has agreed with the use of the W-3 correlation for pressures ranging from 500 to 1000 psia provided the correlation limit is increased from 1.30 to 1.45 (see Section 4.4.3.1). This increase accommodates uncertainties associated with the use of the W-3 correlation at low pressures (Reference 4).

DNBR is not calculated if the core remains subcritical. With no return to power, the actual heat flux is negligible. The resultant DNBR is essentially infinite and automatically satisfies the DNBR criteria.

15.1.5.4.3 Acceptance Criteria The general acceptance criteria for ANS Condition II events are used for the range of steam line breaks and valve malfunctions analyzed here. The ability to meet Condition II criteria for major steam line ruptures shows that applicable Condition III and IV acceptance criteria can be met. Condition II acceptance criteria are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The specific acceptance criterion used for this analysis is that the DNBR remains greater than the correlation limit. The event will not challenge the primary and secondary side pressure limits since the increased heat removal tends to cool the reactor coolant system.

15.1.5.4.4 Results Figures 15.1-6 through 15.1-10 show the reactor coolant system transient and core heat flux for Case (1) following a steam line rupture (complete severance of a line) at initial no-load conditions with two loops in operation. Offsite power is assumed available such that full reactor coolant flow exists. The transient shown assumes the rods inserted at time zero (with one rod stuck in its fully withdrawn position) and steam flow from both steam generators.

Should the core be critical at near zero power when the rupture occurs, the initiation of safety injection by low steam line pressure will trip the reactor. Steam release from at least one steam generator will be prevented by either the non-return check valve or by automatic trip of the fast-acting main steam isolation valve (MSIV) in the steam line by the high-high steam flow signal in coincidence with the safety injection signal. Even with the failure of one valve, release is limited to no more than 8.4 seconds for one steam generator while the second gen-Page 48 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES erator blows down. (The steam line isolation valves are designed to be fully closed in less than 5 seconds with no flow through them. With the high flow existing during a steam line rupture, the valves will close considerably faster.)

The core becomes critical with the rods inserted (with the design shutdown assuming one stuck rod) at 22.7 seconds. Boron solution at 2300 ppm enters the reactor coolant system from the safety injection system (initiated automatically by the low steam line pressure) at 24.8 seconds, which includes the delay required to clear the safety injection system lines of low concentration boric acid. The peak core heat flux is 13.3% of 1811 MWt, and the mini-mum DNBR remains greater than the safety analysis limit.

Figures 15.1-11 through 15.1-15 show the responses for Case (2), which assumes a loss of offsite power at time zero followed by coastdown of the reactor coolant pumps. The safety injection system delay time includes the time required to start two safety injection pumps on one diesel after the assumed failure of one safety injection pump. Credit is taken for only the safety injection flow entering the cold-leg lines since the flow to the hot-leg flow paths are valved shut. The peak heat flux power is 6.0% of nominal. Again, the DNBR is greater than the safety analysis limit.

Figures 15.1-16 through 15.1-20 show the transient for a double-ended rupture assuming one loop in service for Case (3). The loop having the faulted steam generator is assumed to be in operation. The sequence of events is similar to the case with both loops in operation. The core becomes critical at 41.4 seconds. Boron solution enters the core at 28 seconds. The peak core heat flux neglecting the initial release of stored energy is 6.2% of 1811 MWt. The DNBR remains above the correlation limit.

The sequence of events for each case is presented in Table 15.1-6.

15.1.5.5 Radiological Consequences The radiological consequences from a main steamline rupture at power were calculated in Reference 11. Doses were calculated for offsite and their control room using the alternate source term methodology assuming an accident initiated iodine spike or a pre-accident iodine spike. The inputs to the calculation were updated for a core power of 1811 MWt.

The results of the calculations are presented on Table 15.1-9. All doses are less than the acceptance criteria of 2.5 rem for accident initiated spike, 5.0 rem for pre-accident spike, and 5.0 rem for control room.

Reference 11 is now considered to be the analysis of record. As part of the Control Room Emergency Air Treatment (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistency, new x/Q values and off-site doses were also analyzed. The analysis was performed using the alternate source term (AST) per 10CFR 50.67 and Reference 12. The two cases evaluated were with a pre-accident iodine spike to the Tech Spec Limit, and an accident initiated iodine spike of a factor of 500. The new methodology and analysis was approved by the NRC in Reference 13 as supplemented by Reference 14. The assumptions used in the analysis are summarized in Table 15.1-8 and the results are contained in Table 15.1-9.

Page 49 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.1.5.6 Conclusions Steam line breaks were analyzed for the double-ended rupture of a main steam line and the failing open of a main steam safety valve. A DNB analysis was performed for each case. In all cases, the DNBRs are greater than the correlation limit.

Radiological consequences of a main steam line pipe rupture are well within the limits of 10 CFR 50.67.

15.1.5.7 Supplemental Evaluations 15.1.5.7.1 SEV-1073 SEV-1073 (Reference 10) addresses issues regarding the ability of the motor driven auxiliary feedwater trains(s) to initially deliver adequate flow. This evaluation is not valid at EPU con-ditions. The flow requirements for the motor driven auxiliary feedwater train(s) are presented in Section 15.2.7, Feedwater System Pipe Breaks, and Section 6.2.1.2.3, Secondary System Pipe Break Analysis.

15.1.5.7.2 HZP 6 Inch Steamline Break This analysis was done to show the core response to a break of a branch steamline off the main steamline upstream of the main steam isolation valve in the intermediate building (the largest line is 6 inches). The purpose was to show feedwater isolation was not required for this break. Therefore, feedwater isolation valves located in the intermediate building are not required to be environmentally qualified.

The analysis described in Section 15.1.5.3 for Case (1) was redone for a 6 inch break assum-ing no feedwater isolation. Upon reaching a safety injection signal, the main feedwater pumps were tripped and the feedwater regulating valve was assumed to fail open. Since there was no feedwater isolation when steam generator pressure dropped below 350 psia, feedwater was supplied by the condensate pumps.

A DNBR evaluation was performed. The 6 inch HZP steamline break was less limiting than the 1.4ft2 break.

15.1.5.7.3 High Steam Flow Setpoint Increase Evaluation This analysis was done to support an increase in the high steam flow setpoint from 0.66x106 lbm/hr to 1.5x106 lbm/hr.

The analysis described in Section 15.1.5.3 for Case (1) was redone using a high steam flow setpoint of 1.5x106 lbm/hr and a break size just large enough to generate a high steam flow signal in both loops without resetting before a safety injection and low Tavg signal was gener-ated. Therefore, any larger break would reach the high steam flow setpoint and not reset before the steamline isolation logic was satisfied (high steam flow/safety injection/low Tavg).

The Case (1) DNBR with the assumed break size was evaluated and found to be less limiting than for the 1.4ft2 break. Therefore, for a high steam flow setpoint of 1.5x106 lbm/hr, any Page 50 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES break smaller than the assumed break size with no steamline isolation is bounded by the HZP 1.4ft2 break Any break larger than the assumed break size will cause a steamline isolation.

15.1.5.7.4 Steamline Rupture a Full Power To ensure safe shutdown during Mode 1 operation, the steam line rupture event was analyzed at hot full power conditions. For this analysis, initial conditions of core power, RCS coolant temperature and pressurizer pressure were assumed to be at their normal values consistent with steady-state full power operation. Uncertainties in the initial conditions of these param-eters were not considered, consistent with the application of the Revised Thermal Design Pro-cedure (RTDP) methodology. Steam generator water level was assumed to be at its normal value. Minimum measured flow was modeled according to the RTDP methodology. To max-imize primary-to-secondary heat transfer and result in a more severe RCS cooldown transient, 0% steam generator tube plugging (SGTP) level was assumed. The most limiting overpower case is typically the largest break to produce a reactor rip on OPT. Since Ginna has steam exit nozzle flow restrictors which limit the flow area to 1.396 ft2, the analysis modeled a spec-trum of cases with break sizes up to 1.4ft2. The analysis demonstrates that the most limiting break size is 1.4ft2 which trips on OPT (not that the high-high steam flow setpoint was set arbitrarily high). The DNB ratio does not exceed the safety analysis limit value. In addition, the break liner heat generation rate (expressed in kW/ft) does not exceed their fuel centerline melt limit. This event resulted in a decrease in both the primary and secondary side pressures, therefore the maximum RCS and Main Steam System pressure criteria are not challenged by the hot full power steam line rupture.

15.1.5.8 Potential for Containment Overpressurization The potential for containment overpressurization resulting from a main steam line break with continued feedwater addition has been considered at Ginna Station. The analysis presented in Section 6.2 accounts for auxiliary feedwater addition from the motor driven auxiliary feedwa-ter (MDAFW) pump and turbine driven auxiliary feedwater (TDAFW) pump, as appropriate, for the duration of the event. Manual isolation is assumed after 10 minutes.

15.1.6 COMBINED STEAM GENERATOR ATMOSPHERIC RELIEF VALVE (ARV) AND MAIN FEEDWATER REGULATING VALVE (MFRV) FAILURES 15.1.6.1 Description of Event Failure of a processing controller with the advanced digital feedwater control system (ADFCS) is postulated to result in the simultaneous failure (spurious opening) of the atmo-spheric relief valves (ARVs) and the main feedwater regulating valves (MFRVs) and main feedwater bypass valves (MFBPVs). Therefore, combined ARV and MFRV/MFBPV failures are considered.

The spurious opening of a steam generator atmospheric relief valve (ARV) is a credible steam line break. A credible steam line break results in a cooldown of the reactor coolant system due to the excessive heat removal caused by the increase in steam flow. Steam line break analyses assume maximum reactivity feedback, which result in addition of positive reactivity.

This addition of positive reactivity can cause an increase in core power beyond 100% when Page 51 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES initiated from full-power conditions or a return to criticality (return to power) when initiated from zero-power conditions. The possible consequence of this accident is a DNB with subse-quent fuel damage.

Malfunction of a feedwater controller can result in full opening of a main feedwater regulat-ing valve and its bypass valve as described in Section 15.1.2. A spurious opening of a main feedwater regulating valve (MFRV) or main feedwater bypass valve (MFBPV) to one or both steam generators affects the primary system in the same way as a credible steam line break, i.e., a primary system cooldown can occur. Thus, assuming a feedwater malfunction coinci-dent with a failure of an ARV could result in a more severe cooldown than the steam line break analysis presented in Cases (3), (4) and (6) in Section 15.1.5, or the feedwater system malfunctions presented in Section 15.1.2.

15.1.6.2 Frequency of Event The spurious opening of a steam generator ARV or a feedwater system malfunction is each classified as a Condition II event of moderate frequency. A postulated electronic failure in ADFCS that can potentially result in the combined full opening of an ARV and main feedwa-ter regulating/bypass valve is classified and analyzed as a Condition II event. Section 15.0.8 discusses Condition II events.

15.1.6.3 Event Analysis Analyses are performed for possible combinations of atmospheric relief valve (ARV) and main feedwater regulating valve (MFRV)/main feedwater bypass valve (MFBPV) failures.

Six cases are analyzed based on five different scenarios (see Table 15.1-7s). The five scenar-ios are:

A. A stuck open atmospheric relief valve (ARV) in one loop.

B. Stuck open atmospheric relief valves (ARVs) in both loops.

C. A stuck open atmospheric relief valve (ARV) and a failed open main feedwater regulating valve (MFRV) and main feedwater bypass valve (MFBPV) in the same loop.

D. A stuck open atmospheric relief valve (ARV) and a failed open main feedwater regulating valve (MFRV) and main feedwater bypass valve (MFBPV) in opposite loops.

E. Stuck open atmospheric relief valves (ARVs) and main feedwater regulating valves (MFRVs) and main feedwater bypass valves (MFBPVs) in both loops.

The six cases model the scenarios resulting in the most severe cooldown at hot full and hot zero power with automatic rod control (hot full power cases) and manual rod control (hot full and hot zero power cases) that have not already been bounded by the cases considered in Sec-tion 15.1.5.

Transient analyses are performed for the full power cases until the events are terminated by the reactor trip system (RTS) or by the operator. The zero power cases which are analyzed to determine the margin to the DNBR limit, are terminated after the system reaches a new equi-librium condition. The feedwater flow used in full and zero power cases is great enough to Page 52 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES exceed the flow from the simultaneous opening of a main feedwater regulating valve and its associated bypass valve.

15.1.6.3.1 Protective Features The following features provide protection for this event:

1. Reactor trip is actuated by an overpower delta T signal if any two-of-four delta T channels exceed a variable setpoint during the transient. The setpoint is automatically varied with axial power imbalance and coolant temperature conditions.

2. Reactor trip is actuated by an overtemperature delta T signal if any two-out-of-four delta T channels exceed a variable setpoint during the transient. This setpoint is automatically var-ied with axial power imbalance, coolant temperature, and pressurizer pressure conditions to protect against DNB.

3. Reactor trip is actuated by a power range neutron flux high trip signal if any two-out-of-four channels exceed neutron flux setpoints.

4. The main feedwater regulating and bypass valves close on high steam generator water level or a safety injection (SI) signal on low pressurizer pressure. The high steam generator water level signal is generated from two of three high level channels per steam generator. The control valves are assumed to reopen once the high steam generator water level signal clears. The low pressurizer pressure SI signal is generated from two of three pressurizer low-pressure channels.

This analysis credits engineered safety features feedwater isolation signals for closing the main feedwater regulating and bypass valves on a high steam generator water level or on safety injection from a low pressurizer pressure signal.

Overpower delta T is the only automatic reactor trip credited in this analysis and is credited in only 2 (Cases 5-C and 5-D) of the 6 cases analyzed (see Table 15.1-7). No automatic reactor trip is credited in the remaining 4 cases.

15.1.6.3.2 Single Failures Assumed A single failure in one train of the reactor protection system is considered the limiting failure.

No single failure in the reactor trip system will prevent it from performing a protective trip of the reactor. For operator-initiated trips, no single failure in one of the reactor trip system trip actuation trains will prevent a manual trip of the reactor.

No single failure of one of three level instrumentation channels will prevent the closure of the valves to the faulted steam generator.

No single failure of one of three pressurizer low-pressure channels will prevent the closure of the valves to the steam generators.

15.1.6.3.3 Operator Actions Assumed No operator actions are credited in the analysis of this event up to the time when it is demon-strated that the acceptance criteria are met. The operator is then expected to establish stable Page 53 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES plant conditions (which could include tripping the reactor or actuating an engineered safety feature, if necessary).

15.1.6.3.4 Chronological Description of Event All events start with the sudden opening of a main feedwater regulating and bypass valve (MFRV/MFBPV) or atmospheric relief valve (ARV) due to control failures. The valves may open for one or both steam generators depending on the case analyzed. For the full power cases, the transient is analyzed until an automatic reactor trip occurs or until the operator ter-minates the event at 600 seconds. Hot zero power cases are analyzed long enough for the sys-tem to reach a new equilibrium condition.

15.1.6.3.5 Impact on Fission Product Barriers The DNBR is maintained greater than the safety analysis limit for this event. No fuel clad-ding failures are expected. The reactor coolant system pressure does not increase signifi-cantly. The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.1.6.4 Reactor Core and Plant System Evaluation 15.1.6.4.1 Input Parameters and Initial Conditions For the full power cases:

A. Initial values of reactor power, pressure, and average temperature assumed are consistent with the Revised Thermal Design Procedure. The vessel average temperature is at the max-imum TAVG (576F) value.

B. The feedwater temperature at the inlet of the steam generators is at its high value of 435F.

C. The steam generator water level corresponds to 48% on the narrow range level. This value represents the nominal steam generator water level at nominal initial power with a negative 4% narrow range level uncertainty applied.

D. The feedwater malfunction causes an initial step increase to 200% of nominal full power feedwater flow to the faulted steam generator. Feedwater malfunctions affecting both steam generators cause 170% of nominal full power flow to both steam generators.

E. The main feedwater regulating and bypass valves close on high steam generator water level after a 22 second delay. The high level setpoint is conservatively 100% of the narrow range level which bounds the maximum value allowed by the Technical Specifications. The delay conservatively accommodates electronic delay and valve closure times. The control valves are assumed to reopen once the high steam generator water level signal clears.

The main feedwater regulating and bypass valves can also close on a low pressurizer pres-sure safety injection (SI) signal after a 32 second delay. The SI low pressurizer pressure setpoint is conservatively set at 1715 psia.

F. Maximum moderator feedback is assumed to maximize the reactivity insertion. The mini¬mum doppler power defect is used to minimize the negative reactivity insertion with increasing power in the fuel. No decay heat is assumed, but maximum values for prompt neutron lifetime and minimum values for delayed neutron fraction are assumed.

Page 54 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES G. The pressurizer spray system and pressurizer power operated relief valves (PORV) are assumed operational since they reduce primary system pressure and thereby minimize the calculated values of DNBR.

H. A conservative flow with respect to the 6-inch ARV is assumed.

I. Cases are analyzed with and without automatic rod control. Control systems are assumed to function only if their operation results in more severe accident results.

For the zero power cases:

A. Initial values of reactor power, pressure and nominal no load Tavg (547F) are consistent with the zero power conditions.

B. Reactivity feedback conditions are assumed to be at their maximum values except for the doppler defect, which is minimized. No decay heat is assumed, but minimum values for prompt neutron lifetime and delayed neutron fraction are assumed.

C. The event is analyzed with the reactor in manual control.

D. The feedwater control malfunction causes a step increase in feedwater flow to one or both of the steam generators from essentially zero to 110% of the nominal full power flow rate.

E. Feedwater temperature is at an assumed value of 100F.

F. A steam generator water level of 48% on the narrow range level is evaluated. This value represents the nominal steam generator water level at zero power with a negative 4% nar-row range level uncertainty applied.

G. The main feedwater regulating and bypass valves close on high steam generator water level after a 22 second delay. The high level setpoint is conservatively 100% of the narrow range level which bounds the maximum value allowed by the Technical Specifications. The delay conservatively accommodates electronic delay and valve closure times. The control valves can reopen once the high steam generator water level signal clears.

The main feedwater regulating and bypass valves can also close on a low pressurizer pres-sure safety injection (SI) signal after a 32 second delay. The SI low pressurizer pressure setpoint is conservatively set at 1715 psia.

H. A conservative flow with respect to the 6-inch ARV is assumed.

I. The pressurizer spray system and pressurizer power operated relief valves (PORVs) are assumed operational since they reduce primary system pressure and thereby minimize the calculated values of DNBR.

15.1.6.4.2 Methodology These transients are analyzed using the RETRAN code. Section 15.0.7 provides an additional description of RETRAN and its capabilities.

The full power cases are analyzed with the Revised Thermal Design Procedure described in Reference 3. Uncertainties in initial conditions are included in the DNBR limits using this procedure. DNBRs are not explicitly determined for the hot zero power cases. Instead, the conditions for the limiting case (Case 5-F) are evaluated with respect to similar conditions associated with a calculated DNBR that was above the safety analysis limit.

Page 55 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The step increase in flow feedwater flow to the faulted steam generator causes the level to increase until the main feedwater regulating and bypass valves close after the high level set-point is reached. The analytical method used to account for cycling about the setpoint level in the full power cases that do not trip on Overpower delta T (Cases 5-A, 5 B) is the same as Section 15.1.2.1.4.2 used for the increase in feedwater flow event. In Cases 5-C and 5-D, the step increase in feedwater flow to the faulted steam generators continues past the time the high level setpoint is reached until the main feedwater regulating and bypass valves close on a safety injection signal on low pressurizer pressure.

15.1.6.4.3 Acceptance Criteria The applicable acceptance criteria for this Condition II combined atmospheric and feedwater control valve failures are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the most limiting rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The primary acceptance criterion used in this analysis is that the minimum DNBR remains greater than the safety analysis DNBR limit defined in Section 4.4. The event does not chal-lenge the primary and secondary side pressure limits since the increased heat removal tends to cool the reactor coolant system.

15.1.6.4.4 Results The six cases summarized in Table 15.1-7 were analyzed. The analyses show that all of the full power cases have DNBRs greater than the safety analysis DNBR limit. The most severe transient resulting from the full power cases is Case 5-C with both ARVs and both MFRVs/

MFBPVs failed open with the reactor in manual controla. Case 5-C and Case 5-D are termi-nated by an overpower delta T trip; all other full power cases reach a quasi-equilibrium condi-tion in the first 10 minutes of the transient. The event sequence for Case 5-C is given in Table 15.1-10. Plots for Case 5-C are given as Figures 15.1-21 through 15.1-24.

The most limiting zero power case, in terms of the resulting core heat flux, is Case 5-F in Table 15.1-7. The DNBR from the limiting zero power case (Case 5-F) is similar to a DNBR calculated above the safety analysis limit for a case with similar transient conditions.

15.1.6.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event. Secondary coolant steam activities discharged from the atmospheric relief

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 56 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES valves to areas outside the exclusion area boundary (EAB) are expected to be minor and a small fraction of 10 CFR 50.67.

15.1.6.6 Conclusions All full and zero power cases meet the safety analysis DNBR limit.

Page 57 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.1

1. Letter from J. F. Hofscher, Westinghouse Electric Corporation, to R. Baker, RG&E, Sub-ject: Non-LOCA Safety Evaluation for Operation with the Advanced Digital Feedwater Control System for Ginna, dated January 30, 1990.

2. Letter from J. F. Hofscher, Westinghouse Electric Corporation, to R. Baker, RG&E, Sub-ject: Final (Supplemental) non-LOCA Safety Evaluation for Operation with the Advanced Digital Feedwater Control System for Ginna, dated January 9, 1991.

3. A. J. Friedland, and S. Ray, Revised Thermal Design Procedure, WCAP 11397-P-A (Proprietary) and WCAP 11397-A (Non-Proprietary), April 1989.

4. Letter from A. C. Thadani, NRC, to W. J. Johnson, Westinghouse,

Subject:

Acceptance for Referencing of Licensing Topical Report, WCAP-9226-P/9227-NP, 'Reactor Core Response to Excessive Secondary Steam Releases', dated January 31, 1989.

5. H. Chelemer, et al., Improved Thermal Design Procedure, WCAP 8567-P-A (Propri-etary), February 1989.

6. SEV-1090, Technical Specification Bases Change for Screen house Bay Lower Tempera-ture Limit, 10 CFR 50.59 Safety Evaluation Report, dated January 8, 1999.

7. SEV-1172, MOV 871 A/B Stroke Time, 10 CFR 50.59 Safety Evaluation Report, dated February 13, 2001.

8. DELETED

9. DELETED

10. SEV-1073, Revision 1, MDAFW Discharge Valves, 10 CFR 50.59 Safety Evaluation Report, dated September 6, 1996.

11. DA-NS-2002-007, Main Steam Line Break Offsite and Control Room Doses, Revision 4, dated January 24, 2005.

12. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

13. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

Ginna Nuclear Power Plant - Amendment RE: Modification of the Control Room Emergency Air Treatment System (CREATS) and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123), dated February 25, 2005.

14. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant Correction to Amendment No. 87 - Modification of the Control Room Emergency Air Treatment System (CREATS) (TAC No. MB9123), dated May 18, 2005.

15. Approval of Westinghouse calculation CN-TA-04-63, R.E. Ginna (RGE) IGOR/

RETRAN Base Deck for the Extended Power Upreate Program, Rev. 1.

Page 58 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-1 TIME SEQUENCE OF EVENTS FOR FEEDWATER MALFUNCTION TRANSIENTS HOT FULL POWER - SINGLE LOOP - WITH ROD CONTROLa Event Time (sec)

Main Feedwater Regulating Valve (MFRV) in loop 1 fails full open 0 High steam generator water level setpoint reached in loop 1 (100% narrow 33.4 range)

Feedwater flow in loop 1 throttled back to conservatively maintain the 55.4 water level in loop 1 at a constant level Minimum DNBR is reached 65.7 Manual feedwater isolation and reactor trip occur 600.0

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 59 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-2 TIME SEQUENCE OF EVENTS FOR FEEDWATER MALFUNCTION TRANSIENTS HOT FULL POWER - SINGLE LOOP - WITHOUT ROD CONTROL Event Time (sec)

Main Feedwater Regulating Valve (MFRV) in loop 1 fails full open 0 High steam generator water level setpoint reached in loop 1 (100% narrow 33.3 range)

Feedwater flow in loop 1 throttled back to conservatively maintain the 55.3 water level in loop 1 at a constant level Minimum DNBR is reached 64.2 Manual feedwater isolation and reactor trip occur 600.0 Page 60 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-3 TIME SEQUENCE OF EVENTS FOR FEEDWATER MALFUNCTION TRANSIENTS HOT FULL POWER - MULTI LOOP - WITH ROD CONTROLa Event Time (sec)

Main Feedwater Regulating Valves (MFRV's) in both loops fail open 0 High steam generator water level setpoint reached in loop 1 45.7 High steam generator water level setpoint reached in loop 2 45.8 Feedwater flow throttled back to conservatively maintain the water level in 67.7 loop 1 at a constant level Feedwater flow throttled back to conservatively maintain the water level in 67.8 loop 2 at a constant level Minimum DNBR is reached 77.0 Manual feedwater isolation and reactor trip occur 600.0

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 61 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-4 TIME SEQUENCE OF EVENTS FOR FEEDWATER MALFUNCTION TRANSIENTS HOT FULL POWER - MULTI LOOP - WITHOUT ROD CONTROL Event Time (sec)

Main Feedwater Regulating Valves (MFRVs ) in both loops fail full open 0 High steam generator water level setpoint reached in both loops 45.7 Feedwater flow in both loops throttled back to conservatively maintain the 67.7 water level in both steam generators at a constant level Minimum DNBR is reached 76.5 Manual feedwater isolation and reactor trip occur 600.0 Page 62 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-5 Table DELETED Table DELETED Page 63 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.1-6 TIME SEQUENCE OF EVENTS FOR STEAM LINE RUPTURE Case Event Time of Event (sec)

CASE (1) Steamline ruptures on Loop 1 0 1.4 ft2 DER Low compensated steamline pressure setpoint reached 1.4 Offsite power available Both loops in service High-high steam line flow coincidence with SI is sat- 1.4 isfied Safety injection pumps start 3.4 Steamline isolation occurs in Loop 2 8.4 Feedwater isolation occurs in Loops 1 and 2 33.4 Safety injection pumps reach full flow 15.4 Peak return to power and minimum DNBR occur 54.2 CASE (2) Steamline ruptures on Loop 1 0 2

1.4 ft DER Low compensated steamline pressure setpoint reached 1.4 No offsite power available Both loops in service High-high steam line flow coincidence with SI is sat- 1.4 isfied Steamline isolation occurs in Loop 2 8.3 Feedwater isolation occurs in Loops 1 and 2 33.3 Safety injection pumps start 14.2 Safety injection pumps reach full flow 26.2 Reactor coolant pumps begin coasting down 3 Peak return to power and minimum DNBR occur 60.5 CASE (3 ) Steamline ruptures on Loop 1 0 1.4 ft2 DER Low compensated steamline pressure setpoint reached 1.4 Offsite power available One loop in service High-high steam line flow coincidence with SI is sat- 1.4 isfied Safety injection pumps start 3.4 Steamline isolation occurs in Loop 2 8.4 Feedwater isolation occurs in Loops 1 and 2 33.4 Safety injection pumps reach full flow 15.4 Peak return to power and minimum DNBR occur 68.2 Page 64 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.1-7

SUMMARY

OF MAIN FEEDWATER REGULATING VALVES (MFRV)/STEAM GENERATOR ATMOSPHERIC RELIEF VALVE (ARV) COMBINATION FAILURE CASES EVALUATED Case Affected Valve(s) Power Level Rod Controla 5-A Loop A Atmospheric Relief Valve (ARV) and loop A HFPb Manual Main Feedwater Regulating Valve (MFRV) 5-B Loop A Atmospheric Relief Valve (ARV) and loop A HFP Auto Main Feedwater Regulating Valve (MFRV) 5-C Both Atmospheric Relief Valves (ARV) and both HFP Manual Main Feedwater Regulating Valves (MFRV) 5-D Both Atmospheric Relief Valves (ARV) and both HFP Auto Main Feedwater Regulating Valves (MFRV) 5-E Loop A Atmospheric Relief Valve (ARV) and loop A HZPc Manual Main Feedwater Regulating Valve (MFRV) 5-F Both Atmospheric Relief Valves (ARV) and both HZP Manual Main Feedwater Regulating Valves (MFRV)

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

b. Hot full power

c. Hot zero power Page 65 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.1-8 MSLB DOSE ANALYSIS ASSUMPTIONS Parameter Value Reactor power, Mwt (including 2% uncer- 1550 tainty)

Initial reactor coolant activity, pre-accident iodine spike iodine Ci/gm of D.E 1-131 60 noble gas fuel defect level, % 1.0 Accident-initiated iodine spike factor 500 Duration of accident-initiated iodine spike, 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Initial secondary coolant iodine activity Ci/gm of D.E 1-131 0.1 Concentration, Ci 1-131 4.57 E+0 I-132 2.64 E-2 I-133 1.12 E+0 I-134 9.04 E-4 I-135 1.03 E-1 Primary-to-secondary leakage (post accident) to SGs 1 gpm per SG (cold conditions) 8 Duration of leakage, hours Mass of primary coolant, gm 1.247 E+8 Initial mass of secondary coolant, gm faulted SG 5.817 E+7 intact SG 5.817 E+7 Steam Releases faulted SG 0-610 sec 128,237 lb 610 sec - 8 hr 0 lb intact SG 0-610 sec 37,780 lb 610 sec-8 hr 755,097 lb Steam generator iodine partition coefficients (mass-based)

Activity release from faulted SG elemental 1 organic 1 Activity release from intact SG elemental 100 organic 1 Noble gas, all SG 1 Page 66 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Parameter Value Iodine fractions assumed in the reactor coolant and SG water elemental iodine 0.97 organic iodide 0.0 Atmospheric dispersion X/Q sec/m3 EAB 0-2 hr 2.17E-4 LPZ o-8 hr 2.51E-5 8-24 1.78E-5 24-96 8.50E-6 96-720 2.93E-6 Breathing rate m3/sec EAB & LPZ 0-8 hr 3.47E-4 8-24 1.75E-4 24-720 2.32E-4 Page 67 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.1-9 RESULTS FOR MAIN STEAM LINE BREAK, REM TEDE EAB MAX - 2 HR LPZ, 8 hr Accident Initiated Iodine Spike 4.76E-1 1.27E-1 Acceptance Criteria 2.5 2.5 Pre-Accident Iodine Spike 6.96E-2 2.80E-2 Acceptance Criteria 25 25 Page 68 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.1-10 TIME SEQUENCE OF EVENTS FOR THE COMBINED FAILURE OF TWO MFRV's AND TWO ARV's AT HOT FULL POWER Event Time (sec)

Two MFRVs fail full open Two ARV's fail full open 0 OPT setpoint reached 45.5 Rod motion begins 47.5 Minimum DNBR occurs 47.7 Low pressurizer pressure SI setpoint reached 98.4 Loops 1 and 2 MFRV closure on low pressur- 130.4 izer pressure SI Page 69 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM 15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW The effects of this event are bounded by the loss of external load event discussed in Section 15.2.2.

15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD 15.2.2.1 Description of Event The plant is designed to accept a 50% loss of electrical load while operating at full power or a complete loss of load while operating below 50% power without actuating a reactor trip. A 50% loss of electrical load is handled by the steam dump system (which accommodates 40%

of the load rejection by dumping steam directly to the condenser), the rod control system (which accommodates 10% of the load rejection by driving in to reduce coolant average tem-perature), and the pressurizer (which absorbs the change in coolant volume due to the heat addition resulting from the load rejection). Should the reactor suffer a complete loss of load from full power, the reactor trip system (RTS) would automatically actuate a reactor trip.

The most likely source of a complete loss of load on the nuclear steam supply system is a trip of the turbine generator. In this case, there is a direct reactor trip signal derived from either the turbine auto-stop oil pressure or a closure of the turbine stop valves, provided the reactor is operating above 50% power. Reactor temperature and pressure do not increase signifi-cantly if the steam dump system and pressurizer pressure control system are functioning properly. However, the reactor coolant system (RCS) and main steam system (MSS) pres-sure-relieving capacities are designed to ensure the safety of the plant without requiring the use of automatic rod control, pressurizer pressure control, and/or steam dump control sys-tems. In this analysis, the behavior of the plant is evaluated for a complete loss of steam load from full power without direct reactor trip in order to demonstrate the adequacy of the pres-sure-relieving devices and core protection margins.

15.2.2.2 Frequency of Event A complete, 100% loss of external electrical load is classified as an ANS Condition II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.2.2.3 Event Analysis The loss of electrical load is analyzed as a complete loss of steam load. A complete loss of steam load can be more severe since a loss of electrical load can occur gradually subject to grid conditions. The event is analyzed with three cases which bound expected operating con-ditions over the entire fuel cycle:

Case 1 - Beginning of life minimum reactivity feedback with automatic pressurizer pressure control (DNBR Case).

Case 2 - Beginning of life minimum reactivity feedback without automatic pressurizer pressure Page 70 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES control (peak RCS pressure case).

Case 3 - Beginning of life minimum reactivity feedback, 0% steam generator tube plugging, and zero SG tube fouling (peak MSS pressure case).

Case 1, in which automatic pressure control is modeled, minimizes the reactor coolant system pressure, which results in a more limiting departure from nucleate boiling ratio (DNBR). Case 2, in which automatic pressure control is not modeled, results in a more limiting primary side maximum pressure. Case 3 models 0% steam generator (SG) tube plugging, zero SG tube fouling, and automatic pressure control (which delays reactor trip) to exacerbate the secondary side pressure transient.

The cases with automatic pressure control minimize the reactor coolant system pressures which result in more limiting departure from nucleate boiling ratios (DNBRs). The cases without automatic pressure control result in more limiting primary and secondary maximum pressures.

15.2.2.3.1 Protective Features The following protective features are available for this event:

A. Reactor trip is actuated if any two-out-of-four delta T channels exceed an overtemperature delta T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

B. Reactor trip is actuated on pressurizer high pressure signal if any two-of-three instrument channels exceed a fixed setpoint.

C. Reactor trip is actuated by an overpower T signal if any two-of-four T channels exceed a variable setpoint during the transient. The setpoint is automatically varied with reactor coolant temperature conditions.

D. Main steam safety valves may open to provide an additional heat sink and protection against secondary side overpressure.

E. Pressurizer safety valves may open to provide protection against overpressurization of the reactor coolant system.

All of the reactor trips identified above are credited in the analysis.

15.2.2.3.2 Single Failures Assumed The limiting single failure is failure of one train of the reactor trip system (RTS). The remain-ing train trips the reactor. The main steam safety valves (MSSVs) and pressurizer safety valves are considered passive components and are assumed not to fail to open on demand.

15.2.2.3.3 Operator Actions Assumed No operator actions are assumed in the analysis of this event.

Page 71 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.2.3.4 Chronological Description of Event The event is analyzed as a complete loss of steam load from 100% power without a direct reactor trip. The analyses are terminated shortly after the reactor trip and pressures reach maximum values. Table 15.2-1 gives the time sequence for the three cases analyzed.

15.2.2.3.5 Impact on Fission Product Barriers The DNBR is maintained greater than the safety analysis limit for this event. No fuel clad-ding failures are expected, and the cladding maintains its integrity as a fission product barrier.

The peak reactor coolant pressure remains less than 110% of the design pressure as allowed by the ASME Boiler and Pressure Vessel Code,Section III. The reactor coolant system pres-sure boundary maintains its integrity as a fission product barrier.

15.2.2.4 Reactor Core and Plant System Evaluation The initial parameters and conditions differ depending on whether DNBR or reactor coolant system/main steam system peak pressure cases are analyzed. For both types of cases, the reactor is tripped by the first reactor trip system setpoint reached, with no credit taken for the direct reactor trip on turbine trip. Reactor trip setpoints used in safety analyses are shown in Table 15.0-6.

15.2.2.4.1 Input Parameters and Initial Conditions A. For the DNBR case>, the initial reactor power, flow, pressure and temperature are assumed at their nominal values. The reactor coolant average temperature is at the maximum nomi-nal TAVG (576.0F). These assumptions are consistent with the Revised Thermal Design Procedure.

For the peak RCS and MSS pressure cases, the initial condition assumptions include addi-tional allowances for uncertainties. Table 15.0-9 summarizes the initial conditions used in the DNBR and the pressure evaluations.

B. DNBR case and peak MSS pressure case, full credit is taken for the effect of pressurizer spray and pressurizer power operated relief valves (PORVs) in reducing or limiting RCS pressure.

For the peak RCS pressure case, no credit is taken for the effect of pressurizer spray or pressurizer power operated relief valves (PORVs) in reducing or limiting the reactor cool-ant pressure. Pressurizer safety valves are assumed operable.

C. Beginning of life minimum reactivity feedback conditions are modeled, which is conserva-tive for transients resulting in a primary side heatup. Conditions are modeled which is con-servative for transients resulting in a primary side heatup.

D. The reactor is assumed to be in manual control. In automatic control, the rod banks would move prior to reactor trip and reduce the severity of the transient.

E. No credit is taken for the operation of the steam dump system or atmospheric relief valves (ARVs). The steam generator pressure rises to the main steam safety valve (MSSV) set-Page 72 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES point where the steam release through the main steam safety valves (MSSVs) limits the sec-ondary steam pressure. By maximizing the secondary side pressure and saturation temperature, more limiting reactor coolant temperatures and pressures are obtained.

F. Main feedwater flow to the steam generators is assumed to be lost at the time of the loss of steam load. This condition causes a reduction in heat transfer from the primary to second-ary side, thereby maximizing the pressures and temperatures in the reactor coolant system.

Likewise, no credit is taken for auxiliary feedwater (AFW) flow in this short-term analysis since the assumption leads to similar reductions in heat transfer and more limiting primary side conditions.

G. A uniform steam generator plugging level of 10% is assumed for the DNBR and peak RCS pressure cases to exacerbate the primary side heatup. Zero plugging is modeled for the peak MSS pressure case to exacerbate the MSS pressure transient.

H. For the peak RCS pressure case, the pressurizer safety valve opening pressure of 2587 psia includes a positive 2.3% tolerance and a 1% setpoint drift due to the loop seal. A 0.8 sec-ond time delay in opening after reaching the setpoint accounts for the time required to purge the water from the loop seal. These conditions delay the onset of primary side pressure relief, which conservatively maximizes the peak primary system pressure.

For the DNBR and peak MSS pressure cases, the pressurizer safety valve opening setpoint is set to -3% tolerance and no setpoint shift or loop seal purge delay time is assumed. This minimizes the primary side pressure transient, which is conservative with respect to the cal-culated minimum DNBR (DNBR case) and peak MSS pressure case. This is conservative for the peak MSS pressure case because it prevents the high pressurizer pressure reactor trip setpoint from being reached, thus delaying reactor trip until the overtemperature T set-point is reached.

I. The MSSV model for all cases includes an allowance of +1.4% for safety valve setpoint tol-erance and an accumulation model that assumes the safety valves are wide open once the pressure exceeds the setpoint (plus tolerance) by 5 psi.

J. Modeling the OTT and OPT reactor trip included a time constant of 2.0 sec for the RTDs and a filter with a lag of 3.5 sec on the hot-leg temperature measurement. In addition, after the overtemperature or overpower setpoint is reached, a delay of 1.5 sec is assumed to account for electronic delays, reactor trip breakers opening, and RCCA gripper release.

15.2.2.4.2 Method of Analysis Loss of load transients are analyzed using RETRAN (Reference 2). The program simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer power operated relief valves (PORV), pressurizer safety valves, pressurizer spray, steam generator, and main steam safety valves (MSSVs). Section 15.0.7 provides an additional description of RETRAN and its capabilities.

The DNBR case is analyzed with the Revised Thermal Design Procedure (RTDP) described in Reference 1. Uncertainties in initial conditions are included in the DNBR limit using this procedure. The peak RCS and MSS pressure cases do not use the Revised Thermal Design Page 73 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Procedure (RTDP). These cases are analyzed with uncertainties applied in conservative directions to the initial conditions.

The event is analyzed as a complete loss of turbine steam load without a direct reactor trip by the turbine trip signal. This additional delay in reactor trip is conservative and bounds the analyses of other events in Section 15.2.

15.2.2.4.3 Acceptance Criteria Applicable acceptance criteria for this Condition II event are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The primary acceptance criteria used in these analyses are that the minimum DNBR remains greater than the safety analysis DNBR limit defined in Section 4.4 and that the primary and secondary side pressures are maintained below the acceptance limit. In addition, the pressur-izer should not become water solid due to a coolant insurge following the loss of load. Water discharge from the pressurizer could exceed the capacity of the pressurizer relief tank and cause the rupture disk to fail. The resulting loss of coolant and spill can cause a more serious plant condition than the initiating Condition II event.

15.2.2.4.4 Results The transient responses for a total loss of load from full power operation are shown for three cases: a DNBR case, peak RCS pressure case, and peak MSS pressure case as illustrated in Figures 15.2-1 through 15.2-9.

Figures 15.2-1 through 15.2-3 show the transient responses for the total loss-of-steam load, assuming full credit for the pressurizer spray and pressurizer power operated relief valves (PORVs) (Case 1). No credit is taken for the steam dump. The reactor is tripped by the over-temperature delta T signal. The minimum DNBR is well above the safety analysis limit. The pressurizer does not become water solid.

The total loss-of-load accident was also studied with no credit taken for the pressurizer spray, pressurizer power operated relief valves (PORVs), or steam dump (Case 2). The reactor is tripped on the pressurizer high-pressure signal. Figures 15.2-4 through 15.2-6 show the response to the loss of load transient for peak RCS pressure concerns. The nuclear power increases slightly until the reactor is tripped and the pressurizer safety valves are actuated.

The peak RCS pressure does not exceed 110% of the design pressure.

Figures 15.2-7 through 15.2-9 illustrate the transient response for the peak MSS pressure case. This case is analyzed with 0% steam generator tube plugging and zero SG tube fouling, along with automatic primary side pressure control, to exacerbate the MSS pressure transient.

Page 74 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Since automatic pressure control limits the primary side pressure increase, the high pressur-izer pressure trip setpoint is not reached. Rather, the reactor is tripped by the overtemperature T signal. The peak MSS pressure remains below 110% of the design pressure.

The calculated sequence of events for these three cases is shown in Table 15.2-1.

15.2.2.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event. Releases from the pressurizer power operated relief valves (PORVs) and pres-surizer safety valves are to the pressurizer relief tank inside containment. Since this does not result in an uncontrolled release to the environment, normal plant operations can be used for the clean up or discharge of radioactive contaminants under controlled conditions. Secondary coolant steam activities discharged from the main steam safety valves to unrestricted areas are expected to be minor and the doses are a small fraction of 10 CFR 50.67 guidelines.

15.2.2.6 Conclusions Results of the analyses show that the plant design is such that a total loss of external electrical load without a direct or immediate reactor trip presents no hazard to the integrity of the reac-tor coolant system or the main steam system. The pressure-relieving devices of the two sys-tems are adequate to limit the maximum pressures within the design limits.

The integrity of the core is maintained by operation of the reactor trip system (RTS); i.e., the DNBR is maintained above the safety analysis limit.

15.2.2.7 Supplemental Evaluations The analysis presented in Section 15.2.2 assumed a hot-leg RTD time constant of 2 sec and a THot filter lag time constant of 3.5 sec. The control system evaluation done to support Section 7.7.2 assumed a hot-leg RTD time constant of 1.0 sec and a THot filter lag time constant of 4.5 sec. An evaluation was done (Reference 7) that showed the time response of the 1.0/4.5 sec combination was faster than the 2.0/3.5 sec combination. Therefore, the 1.0 sec RTD and 4.5 sec THot filter combination is acceptable.

15.2.3 TURBINE TRIP The analysis of the consequences of an instantaneous turbine trip by closure of the turbine stop valves is bounded by the analyses performed for the loss of external electrical load event in Section 15.2.2.

15.2.4 LOSS OF CONDENSER VACUUM Loss of condenser vacuum can occur from failure of the circulating water system or excessive air leakage through turbine gland packing. In the event of loss of condenser vacuum, the tur-bine will be tripped and, therefore, the event is bounded by the turbine trip event. See Sec-tions 15.2.2 and 15.2.3.

Page 75 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.5 LOSS OF ALL ALTERNATING CURRENT POWER TO THE STATION AUXILIARIES 15.2.5.1 Description of Event A complete loss of all ac power to the station auxiliaries will result in a loss of all power to the reactor coolant pumps, main feedwater pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite ac distribution system. Onsite and offsite power sys-tems are described in Section 8.1.1.

This transient is more severe than the loss of external load or turbine trip event because the decrease in heat removal by the secondary system is accompanied by a flow coastdown, which further reduces the capacity of the primary coolant to remove heat from the core.

Following a loss of ac power to the station auxiliaries with turbine and reactor trips, the sequence described below will occur:

1. Plant vital instruments are supplied from emergency dc power sources.

2. As the steam system pressure rises following the trip, the atmospheric relief valves (ARVs) may be automatically opened to the atmosphere. The condenser is assumed unavailable for steam dump. If the relief capacity of the atmospheric relief valves (ARVs) is inadequate, the main steam safety valves (MSSVs) may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

3. As the no load temperature is approached, the atmospheric relief valves (ARVs) (or main steam safety valves (MSSVs), if the atmospheric relief valves (ARVs) are unavailable) are used to dissipate the residual decay heat and to maintain the plant at the MODE 3 (Hot Shutdown) condition.

4. If offsite power is also lost, the emergency diesel generators start on loss of voltage to the engineered safety features buses and begin to supply safeguards loads.

The preferred auxiliary feedwater (AFW) pumps are automatically started as discussed in Section 15.2.5.3.1. Power is supplied to the motor driven auxiliary feedwater (MDAFW) pumps by the engineered safety features buses. The turbine driven auxiliary feedwater (TDAFW) pump utilizes steam from the secondary system and exhausts to the atmosphere.

The preferred auxiliary feedwater (AFW) pumps take suction directly from the condensate storage tank for delivery to the steam generators.

Following the loss of power and coastdown of the reactor coolant pumps, natural circulation in the reactor coolant system will remove decay heat from the core, aided by auxiliary feed-water in the secondary system. Failure to remove heat could result in the rise of reactor cool-ant temperatures and pressures that could result in a departure from nucleate boiling (DNB),

filling of the pressurizer, or a challenge to the reactor coolant system pressure boundary.

15.2.5.2 Frequency of Event The loss of power to the station auxiliaries is classified as an ANS Condition II event of mod-erate frequency. Section 15.0.8 discusses Condition II events.

Page 76 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.5.3 Event Analysis The event assumes an initial 20-second period of steady-state power operation. (The 20-sec-ond period is chosen to ensure that the model has converged to a steady-state condition.) At 20 seconds, a loss of normal feedwater occurs. The loss of feedwater causes the steam gener-ator water level to decrease and the reactor coolant system to heat up. The reactor is finally tripped on a low-low steam generator level signal. The control rods start to drop followed two seconds later by the loss of power to the station auxiliary buses and the coastdown of the reactor coolant pumps. The loss of offsite power is assumed to be with respect to buses 12A and 12B since buses 11A and 11B will attempt to fast bus transfer to these buses following the turbine generator trip. This effectively results in the total loss of ac power to the plant.

An actual loss of power to the station auxiliaries would cause a loss of all feedwater, a loss of reactor coolant flow (flow coastdown), the control rods to drop into the core, and a reactor trip from any of the reactor coolant system flow trips. The analyzed event is conservative since it does not assume these conditions occur simultaneously. Instead, it requires that the reactor power be maintained until the reactor trip system trips the reactor on a steam genera-tor low-low level signal. The additional time at power reduces the available secondary side heat sink capability through depletion of steam generator inventory and increases the amount of stored energy in the reactor coolant system prior to the loss of forced coolant flow.

15.2.5.3.1 Protective Features The following design features provide protection for this event:

1. The reactor may be tripped on one or more of the following reactor trip signals:

a. Pressurizer high pressure trip signal if any two-of-three pressure channels exceed a fixed setpoint.

b. Pressurizer high water level trip signal if any two-of-three level channels exceed a fixed setpoint.

c. Overtemperature delta T trip signal if any two-out-of-four delta T channels exceed an overtemperature delta T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

d. Low-low steam generator water level trip signal if any two-out-of-three level channels in either steam generator is below a fixed setpoint

2. Two motor driven auxiliary feedwater (MDAFW) pumps are started on:

a. Low-low water level in two-out-of-three level channels in any steam generator

b. Trip of both main feedwater pumps (i.e., opening of both main feedwater pump break-ers)

c. Safety injection

d. Manual actuation

3. One turbine driven auxiliary feedwater (TDAFW) pump is started on any of the following:

Page 77 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

a. Low-low water level in two-out-of-three channels in both steam generators

b. Loss of 4 kV voltage on both buses 11A and 11B

c. Manual actuation

4. The main steam safety valves (MSSVs) open to provide an additional heat sink and protec-tion against secondary side overpressure.

5. The pressurizer safety valves may open to provide protection against overpressure of the reactor coolant system.

Low-low steam generator water level is the only automatic reactor trip credited in this analy-sis.

15.2.5.3.2 Single Failures Assumed The worst-case failure assumed in the analysis is the failure to start of the turbine driven aux-iliary feedwater (TDAFW) pump since it has the greatest flow capacity.

No single failure in the reactor trip system (RTS) or the engineered safety features actuation system (ESFAS) prevents a reactor trip or the startup of the auxiliary feedwater (AFW) sys-tem, respectively. The main steam safety valves and pressurizer safety valves are considered passive components and are assumed not to fail to open on demand.

15.2.5.3.3 Operator Actions Assumed No explicit operator actions are assumed in the analysis of this event. However, operator actions are required to control the secondary side water inventories in both steam generators (see Section 15.2.5.7).

15.2.5.3.4 Chronological Description of Event The analyzed event starts with a loss of feedwater as described in Section 15.2.5.3. The reac-tor is eventually tripped by the reactor trip system on a low-low steam generator level. The rod cluster control assemblies start to drop, and two seconds later after a loss of power to the station auxiliary buses, reactor coolant flow coastdown begins. The time sequence including initiation of pressure relief and auxiliary feedwater functions is shown in Table 15.2-2.

15.2.5.3.5 Impact on Fission Product Barriers No fuel cladding failures are anticipated. The peak reactor coolant system pressure remains less than 110% of the design pressure as allowed by the ASME Boiler and Pressure Vessel Code,Section III. The cladding and reactor coolant system pressure boundary maintain their integrity as fission product barriers.

No discharge of water from the pressurizer is expected. The capacity of the pressurizer relief tank is not exceeded, and the discharged activity in the steam relief is contained ensuring con-trol of radioactive materials.

Page 78 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.5.4 Reactor Core and Plant System Evaluation 15.2.5.4.1 Input Parameters and Initial Conditions A. The plant was initially operating at a NSSS power of 1817 MWt. Since power to the RCPs was lost, a nominal RCP heat of 6.0 MWt and core power of 1811 MWt were assumed.

Assuming a nominal RCP heat was conservative since the RCPs coasted down and ceased to add heat to the primary coolant, while the core decay heat was based on a slightly higher initial core power.

B. The most limiting loss-of-non-emergency AC power case with respect to overfill for EPU was with a conservative temperature uncertainty subtracted from the high nominal (win-dow) 572.0F Tavg (i.e., 576-4F), conservative pressure uncertainty added to the nominal value 2310 psia (i.e., 2250 psia + 60 psi), while modeling low (390F) main feedwater tem-perature conditions.

C. A zero moderator temperature coefficient (+0 pcm/F) at full power conditions is assumed.

Maximum doppler-only coefficients and minimum trip reactivity are assumed. These assumptions are used to maximize the energy input to the reactor coolant.

D. Core residual heat generation is based on ANSI/ANS-5.1-1979 (Reference 3) which gives conservative decay energy release rates.

E. As part of the initiating event, main feedwater flow to both steam generators is stopped during operation at full power (see Section 15.2.5.3). The anticipatory start of the motor-driven auxilary feedwater (MDAFW) pumps on opening of both main feed pump breakers is not assumed.

F. The shell side water inventory in both steam generators is assumed to be high. The inven-tory is based on steam generator normal full power level plus level uncertainties. A high, initial inventory delays the onset of reactor trip and increases the pre-trip heatup of the reac-tor coolant.

G. Reactor trip occurs following the receipt of a low-low steam generator water level signal conservatively assumed as 0% of the narrow range span in any steam generator.

H. Loss of power occurs two seconds after the reactor trip. The reactor coolant pumps are assumed to start their coastdown after the loss of power.

I. The preferred auxiliary feedwater (AFW) pumps start when the water level in the steam generators drops to the low-low steam generator water level setpoint with an additional delay of 60 seconds. Afterwards, a conservatively low auxiliary feedwater flow rate of 170 gpm per steam generator is assumed.

J. The pressurizer power operated relief valves (PORV) and spray are assumed to operate nor-mally. Normal pressure control increases the severity of the transient by maximizing pres-surizer insurge and minimizing reactor coolant system subcooling margin. Pressurizer safety valves are available if pressure control fails.

K. Secondary system steam relief is achieved through the main steam safety valves (MSSV).

No credit is taken for the atmospheric relief valves.

L. A minimum (0%) and a maximum uniform steam generator plugging level of 10% are both considered in establishing the most limiting conditions..

Page 79 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The initial conditions used in this analysis are intended to minimize the energy removal capa-bility of the reactor coolant and main steam systems and maximize the possibility of water relief from the reactor coolant system.

15.2.5.4.2 Method of Analysis The RETRAN Code (Reference 2) is used to analyze the plant response to this transient. The program computes pertinent variables including the steam generator pressure and mass, pres-surizer water volume and pressure, reactor coolant pump flow, and hot and cold leg tempera-tures. Section 15.0.7 provides an additional description of RETRAN and its capabilities.

The DNB is not analyzed since the result is bounded by the complete loss of forced reactor coolant system (RCS) flow event in Section 15.3.1. The reactor coolant pump coastdown in the analysis here does not occur until after reactor trip, which is less limiting than the com-plete loss of flow event. As such, the Revised Thermal Design Procedure is not used, and the uncertainties associated with the initial conditions are applied in conservative directions (see Section 15.0.1).

The RCS flow coastdown was based on a momentum balance around each reactor coolant loop and across the core. This momentum balance was combined with the continuity equa-tion, a pump momentum balance, the as-built pump characteristics, and conservative esti-mates of system pressure losses. The post-trip heat removal from the core relied upon natural circulation flow in the RCS loop. The RETRAN code results showed that the natural circula-tion and AFW flow available was sufficient to provide adequate core decay heat removal fol-lowing reactor trip and RCP coastdown.

The natural circulation capability of the unit was demonstrated during the natural circulation test described in Section 14.6.1.5.6. In addition, the methods used for cooldown with natural circulation at Ginna are adequate to prevent voiding in the reactor vessel head (Reference 4).

15.2.5.4.3 Acceptance Criteria General acceptance criteria for this Condition II event are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The specific acceptance criteria used for this analysis are:

A. The long-term heat removal capability must be achieved with auxiliary feedwater and natu-ral circulation.

B. The primary and secondary side pressures must be maintained less than acceptance limit.

Page 80 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES C. The pressurizer must not fill to the point that it becomes water solid. Water discharges from the pressurizer could exceed the capacity of the pressurizer relief tank and cause a more severe plant condition than the initiating Condition II event.

DNBR is not analyzed since the DNB results are bounded by the complete loss of flow event in Section 15.3.1.

15.2.5.4.4 Results The transient response of the reactor coolant system following a loss of ac power is shown in Figures 15.2-13 through 15.2-16. The calculated sequence of events is shown in Table 15.2-2.

The first few seconds after the loss of power to the reactor coolant pumps closely resemble the complete loss of flow incident (see Section 15.3.1), in which possible core damage due to rapidly increasing core temperatures is prevented by the reactor trip. The results show that the natural circulation flow in the reactor coolant loops is sufficient to provide adequate core decay heat removal following reactor trip and reactor coolant pump coastdown.

One minute after reaching the low-low steam generator water level setpoint, the preferred auxiliary feedwater (AFW) pumps automatically start and reduce the rate of water level decrease. Steam generator level remains high enough with auxiliary feedwater flow to ensure adequate heat transfer area is available to dissipate the core residual heat without water relief from the pressurizer power operated relief valves (PORVs) or pressurizer safety valves. The maximum pressurizer water volume is less than the accident limit value of 800.0 ft3. The pressurizer power operated relief valves (PORVs) and the main steam safety valves (MSSVs) prevent overpressurization in the primary and secondary systems, respectively.

The plant will eventually stabilize at hot standby after the heat removal capability of the aux-iliary feedwater system and the two steam generators exceeds the core's decay heat addition to the reactor coolant system.

15.2.5.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event. Releases from the pressurizer power operated relief valves (PORVs) are to the pressurizer relief tank inside containment. Since this does not result in an uncontrolled release to the environment, normal plant operations can be used for the clean up or discharge under controlled conditions. Secondary coolant steam activities discharged from the main steam safety valves to unrestricted areas are expected to be minor and within a small fraction of 10 CFR 100 guidelines.

15.2.5.6 Conclusions Analysis of the natural circulation capability of the reactor coolant system demonstrates that sufficient heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage. Primary and secondary side maximum pressures are within design limits ensuring the integrity of both systems. Overfill of the pressurizer does not occur.

Page 81 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.5.7 Supplemental Evaluations The limiting loss-of-AC-power case presented in this section was redone modeling a reduced (total) minimum AFW flow of 300 gpm split evenly to both steam generators. The accident criteria was satisfied for this flow. Even though this analysis will support a total AFW flow of 300 gpm split evenly to both steam generators, the Feedline Break analysis can only support a reduction to 195 gpm to the intact steam generator. Therefore, minimum AFW flow is 195 gpm to the intact steam generator. Basis: pp 5 of CN-TA-04-63, Rev. 1.

Reference 8 documented a concern that modeling PORV actuation during a Loss of all Alter-nating Current transient may not be conservative. Reference 9 evaluated this transient with-out PORV actuation and determined that the maximum pressurizer water volume would increase by approximately 7ft3, but still remain below the accident limit value of 800 ft3.

15.2.6 LOSS OF NORMAL FEEDWATER FLOW 15.2.6.1 Description of Event A loss of normal feedwater (from pipe breaks, pump failures, valve malfunctions, or a com-plete loss of all ac power to the station auxiliaries) results in a reduction in the capability of the secondary system to remove the heat generated in the reactor core. If an alternate supply of feedwater were not supplied, core residual heat following reactor trip would heat the pri-mary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the reactor coolant system. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables do not approach a condition that causes a DNBR limit violation.

The following occur after a loss of normal feedwater (assuming main feedwater pump fail-ures or valve malfunctions):

1. The atmospheric relief valves (ARVs) are automatically opened to the atmosphere as the steam system pressure rises following the loss of feedwater. The condenser is assumed unavailable for steam dump. If the relief capacity of the atmospheric relief valves (ARVs) is inadequate, the main steam safety valves (MSSVs) may lift to dissipate the sensible heat of the fuel and coolant plus the residual decay heat produced in the reactor.

2. As the no load temperature is approached, the atmospheric relief valves (ARVs) (or main steam safety valves (MSSVs) if the atmospheric relief valves (ARVs) are unavailable), are used to dissipate the residual decay heat and to maintain the plant at the MODE 3 (Hot Shutdown) condition.

The reactor is tripped and the preferred auxiliary feedwater (AFW) pumps are automatically started as discussed in Section 15.2.6.3.1. Power is supplied to the motor driven auxiliary feedwater (MDAFW) pumps by the engineered safety features buses. The turbine driven auxiliary feedwater (TDAFW) pump utilizes steam from the secondary system and exhausts to the atmosphere.

The preferred auxiliary feedwater (AFW) pumps take suction directly from the condensate storage tank (CST) for delivery to the steam generators. The ability to supply auxiliary feed-Page 82 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES water (AFW) to the steam generators ensures the secondary system removes sufficient decay heat to prevent excessive heat up of the reactor coolant system without overpressurization or excessive discharge of reactor coolant.

15.2.6.2 Frequency of Event The loss of normal feedwater flow is classified as an ANS Condition II event of moderate fre-quency. Section 15.0.8 discusses Condition II events.

15.2.6.3 Event Analysis This event assumes an initial, 20-second period of steady-state power operation. (The 20-sec-ond period is chosen to ensure that the model has converged to a steady-state condition.) At 20 seconds, a loss of normal feedwater occurs. The loss of feedwater causes the steam gener-ator water level to decrease and the reactor coolant system to heat up. The reactor is finally tripped on a low-low steam generator level signal followed by initiation of auxiliary feedwa-ter (AFW) to both steam generators. Unlike the loss of ac power event analyzed in Section 15.2.5, the reactor coolant pumps remain powered and continue to run.

15.2.6.3.1 Protective Features The following design features provide protection for this event:

1. The reactor may be tripped on one or more of the following reactor trip system signals:

a. Pressurizer high-pressure trip signal if any two-of-three pressure channels exceed a fixed setpoint.

b. Pressurizer high water level trip signal if any two-of-three level channels exceed a fixed setpoint.

c. Overtemperature delta T trip signal if any two-out-of-four delta T channels exceed an overtemperature delta T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

d. Low-low steam generator water level trip signal if any two-out-of-three level channels in either steam generator is below a fixed setpoint.

2. Two motor driven auxiliary feedwater (MDAFW) pumps are started on:

a. Low-low water level in two-out-of-three level channels in any steam generator

b. Trip of both main feedwater pumps (i.e., opening of both main feedwater pump break-ers)

c. Safety injection

d. Manual actuation

3. One turbine driven auxiliary feedwater (TDAFW) pump is started on any of the following:

a. Low-low water level in two-out-of-three channels in both steam generators

b. Loss of 4 kV voltage on both buses 11A and 11B Page 83 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

c. Manual actuation

4. The main steam safety valves (MSSVs) may open to provide an additional heat sink and protection against secondary side overpressure.

5. The pressurizer safety valves may open to provide protection against overpressure of the reactor coolant system.

Low-low steam generator water level is the only automatic reactor trip credited in this analy-sis.

15.2.6.3.2 Single Failures Assumed The worst-case failure assumed in the analysis is the failure to start of the turbine driven aux-iliary feedwater (TDAFW) pump since it has the greatest flow capacity.

No single failure in the reactor trip system (RTS) or the engineered safety features actuation system (ESFAS) will prevent trip of the reactor or startup of auxiliary feedwater (AFW) pumps, respectively. The main steam safety valves (MSSVs) and pressurizer safety valves are considered passive components and are assumed not to fail to open on demand.

15.2.6.3.3 Operator Actions Assumed No explicit operator actions are assumed in the analysis of this event. However, operator actions are required to control the secondary side water inventories in both steam generators (see Section 15.2.6.7).

15.2.6.3.4 Chronological Description of Event The analyzed event starts with a loss of feedwater as described in Section 15.2.6.3. The time sequence including reactor trip and initiation of pressure relief and auxiliary feedwater func-tions is shown in Table 15.2-4.

15.2.6.3.5 Impact on Fission Product Barriers No fuel cladding failures are anticipated. The peak reactor coolant system pressure remains less than 110% of the design pressure as allowed by the ASME Boiler and Pressure Vessel Code,Section III. The cladding and reactor coolant system pressure boundary maintain their integrity as fission product barriers.

No discharge of water from the pressurizer is expected. The capacity of the pressurizer relief tank is not exceeded, and the discharged activity in the steam relief is contained ensuring con-trol of radioactive materials.

15.2.6.4 Reactor Core and Plant System Evaluation 15.2.6.4.1 Input Parameters and Initial Conditions A. The plant is initially operating at a NSSS power of 1817 MWt. A maximum RCP heat of 10.0 MWt was included in the analysis. The RCPs were assumed to continuously operate throughout the transient providing a constant reactor coolant volumetric flow equal to the Page 84 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES thermal design flow value. Although not assumed in the analysis, the RCPs could be man-ually tripped at some later time in the transient to reduce the heat addition to the RCS caused by the operation of the pumps.

B. Main feedwater temperature conditions at 390and 435F were analyzed.

C. The direction of conservatism for both initial reactor vessel average coolant temperature and pressurizer pressure can vary. As such, cases were considered with the initial tempera-ture and pressure uncertainties applied in each direction. The initial average temperature uncertainty was conservatively assumed to be 4.0F. The initial pressurizer pressure uncertainty was conservatively assumed to be 60 psi. The most limiting LONF case with respect to pressurizer filling was with the temperature uncertainty subtracted from the low nominal (window) Tavg value (i.e., 564.6F-4F), pressure uncertainty added to the nominal value (i.e., 2250 psia + 60 psi), while modeling high (435F) main feedwater temperature conditions. Note that there are two peaks in the pressurizer water level for a loss of normal feedwater event. The first peak is a function of the initial conditions, and the second peak is an indication of the capability of the AFW system to perform long-term heat removal.

Thus, the magnitude of the second peak is used to determine the limiting case.

D. A zero moderator temperature coefficient (+0 pcm/F) at full power conditions is assumed.

Maximum doppler-only coefficients and minimum trip reactivity are assumed. These assumptions are used to maximize the energy input to the reactor coolant.

E. Core residual heat generation is based on ANSI/ANS-5.1-1979 (Reference 3) which gives conservative decay energy release rates.

F. As part of the initiating event, main feedwater flow to both steam generators is stopped during operation at full power (see Section 15.2.6.3).

G. The shell side water inventory in both steam generators is assumed to be high. The inven-tory is based on steam generator normal full power level plus level uncertainties. The ini-tial high inventory delays the onset of reactor trip and increases the pre-trip heatup of the reactor coolant.

H. Reactor trip occurs following the receipt of a low-low steam generator water level signal conservatively assumed as 0% of the narrow range span in any steam generator.

I. Preferred auxiliary feedwater (AFW) pumps start 60 seconds after the water level in the steam generators drops to the low-low steam generator water level setpoint. Afterwards, a conservatively low auxiliary feedwater flow rate of 170 gpm per steam generator is assumed.

J. The pressurizer power operated relief valves (PORVs) and spray are assumed to operate normally. Normal pressure control increases the severity of the transient by maximizing pressurizer insurge and minimizing the reactor coolant subcooling margin. Pressurizer safety valves are available if pressure control fails.

K. The MSSVs were modeled assuming a 1.5% tolerance and an accumulation model that assumes that the valves were wide open once the pressure exceeded the setpoint (plus toler-ance) by 5 psi (accumulation).

L. The reactor coolant pumps are not tripped and their volumetric flow remains at its normal value during the transient.

Page 85 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES M. A minimum (0%) and a maximum uniform steam generator plugging level of 10% are both considered in establishing the most limiting conditions.

The initial conditions used in this analysis are intended to minimize the energy removal capa-bility of the reactor coolant and main steam systems and maximize the possibility of water relief from the reactor coolant system.

15.2.6.4.2 Method of Analysis The DNB is not analyzed since the result is bounded by the loss of external load event in Sec-tion 15.2.2. The loss of load event assumes a complete loss of steam load with turbine trip prior to the reactor trip. In the loss of feedwater analysis here, the turbine trip does not occur until after the reactor trip. The continued heat removal due to steam flow is beneficial until rod motion begins. The Revised Thermal Design Procedure is not required, and the uncer-tainties associated with the initial conditions are applied in conservative directions (see Sec-tion 15.0.1).

The plant transient following a loss of normal feedwater is analyzed using RETRAN (Refer-ence 6). The program computes pertinent variables including the steam generator pressure and mass, pressurizer water volume and pressure, reactor coolant pump flow, and hot and cold leg temperatures. Section 15.0.7 provides an additional description of RETRAN and its capabilities.

15.2.6.4.3 Acceptance Criteria Applicable acceptance criteria for this Condition II event are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The specific criteria used for this analysis are that the primary and secondary side pressures must be maintained less than the acceptance limit and that the pressurizer must not fill to the point that it becomes water solid. Water discharges from the pressurizer could exceed the capacity of the pressurizer relief tank and cause a more severe plant condition than the initiat-ing Condition II event. The DNBR is not analyzed since the results are bounded by the loss of load event.

15.2.6.4.4 Results Figures 15.2-17 through 15.2-20 show the significant plant parameters following a loss of normal feedwater. The calculated sequence of events for this transient is shown in Table 15.2-4.

Following the reactor and turbine trip from full load, the water level in the steam generators will fall due to the reduction of steam generator void fraction and because the steam flow Page 86 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES through the main steam safety valves (MSSVs) continues to dissipate the stored and gener-ated heat. One minute after reaching the low-low steam generator water level setpoint, the preferred auxiliary feedwater (AFW) pumps are automatically started, reducing the rate of water level decrease. The steam generator levels are maintained high enough to provide suf-ficient heat transfer area for dissipation of core residual heat. Because heat removal remains adequate, there is no water relief from the pressurizer power operated relief valves (PORVs) or pressurizer safety valves.

As shown in Figures 15.2-17 through 15.2-20, the plant approaches a stabilized condition fol-lowing reactor trip and initiation of preferred auxiliary feedwater (AFW). Plant procedures may be followed to further cool down the plant.

15.2.6.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the event. Steam releases from the pressurizer power operated relief valves (PORVs) are to the pressurizer relief tank inside containment. Since this does not result in an uncontrolled release to the environment, normal plant operations can be used for the clean up or discharge under controlled conditions. Secondary coolant steam activities discharged from the main steam safety valves (MSSVs) to unrestricted areas are expected to be minor and within a small fraction of 10 CFR 50.67.

15.2.6.6 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the reactor coolant system, or the steam system. The preferred auxiliary feedwater (AFW) system capacity is sufficient to ensure the dissipation of core decay heat without reac-tor coolant relief from the pressurizer power operated relief valves (PORVs) or pressurizer safety valves.

15.2.6.7 Supplemental Evaluations The limiting Loss of Normal Feedwater Flow case presented in this section was redone mod-eling a reduced (total) minimum AFW flow of 300 gpm split evenly to both steam generators.

The accident criteria were satisfied for this flow. Even though this analysis will support a total AFW flow of 300 gpm split evenly to both steam generators, the Feedline Break analysis can only support a reduction to 195 gpm to the intact steam generator. Therefore, minimum AFW flow is 195 gpm to the intact steam generator. Basis: pp 5 of CN-TA-04-63, Rev. 1.

Reference 8 documented a concern that modeling PORV actuation during a Loss of all Alter-nating Current transient may not be conservative. Reference 9 evaluated this transient with-out PORV actuation and determined that the maximum pressurizer water volume would increase by approximately 7ft3, but still remain below the accident limit value of 800 ft3.

Page 87 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.2.7 FEEDWATER SYSTEM PIPE BREAKS 15.2.7.1 Description of Event A feedwater line rupture during plant operation could result in a disruption of secondary sys-tem energy removal capability. A major feedwater line break is defined as a break large enough to prevent the addition of sufficient feedwater to maintain shell side fluid inventories in the steam generators. The break results in the loss of all main feedwater flow to the steam generators and, depending on location (for example, downstream of the feedwater line check valve), the blowdown of a steam generator through the feedwater inlet nozzle. Thus, the event can cause either a cooldown or heatup of the reactor coolant system.

Auxiliary feedwater (AFW) is provided to ensure continued heat removal from the core. If adequate heat removal is not provided, the core decay heat could raise the reactor coolant temperatures high enough to cause fuel damage and compromise the maintenance of a coolable core geometry. Depending on the break location, a feedwater line break at full power could also increase the pressure in the reactor coolant and main steam systems, chal-lenging the pressure boundary integrity of both systems.

The potential cooldown of the reactor coolant system from a secondary system pipe break is bounded by the analysis of the steam line break event in Section 15.1.5. Therefore, the anal-ysis of feedwater line breaks performed here is based on initial conditions and assumptions that result in the most severe heatup of the reactor coolant system.

15.2.7.2 Frequency of Event A major feedwater line break is unlikely to occur over the life of the plant. The event is pos-tulated since the potential consequences can be severe. Thus, this event is classified as an ANS Condition IV, limiting event. Condition IV events are described in Section 15.0.8.

15.2.7.3 Event Analysis The analysis is performed for a double-ended rupture of the feedline between the feedwater check valve and steam generator. A break in this location results in discharge of fluid from the faulted steam generator and can preclude the addition of auxiliary feedwater (AFW) to the faulted steam generator. The effect on the reactor coolant system of a break upstream of the feedwater check valve is similar to a loss of normal feedwater (a Condition II event).

Cases with and without offsite power available are analyzed. The analysis considers a dou-ble-ended rupture of the feedwater pipe of 1.418 ft2 area. For breaks below this size, the main feedwater flow degrades less rapidly, which can cause a less severe increase in the reactor coolant temperature prior to reactor trip. For very small breaks, the main feedwater system is capable of making up the inventory lost through the break and preserves the heat removal capability of the steam generators.

15.2.7.3.1 Protective Features The following design features provide protection for the feedwater line break:

Page 88 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

1. The reactor may be tripped on one or more of the following signals:

a. Pressurizer high pressure trip signal if any two-of-three pressure channels exceed a fixed setpoint.

b. Pressurizer high water level trip signal if any two-of-three level channels exceed a fixed setpoint.

c. Overtemperature delta T trip signal if any two-out-of-four delta T channels exceed an overtemperature delta T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

d. Low-low steam generator water level trip signal if any two-out-of-three level channels in either steam generator is below a fixed setpoint.

2. Two motor driven auxiliary feedwater (MDAFW) pumps are started on:

a. Low-low water level in two-out-of-three level channels in any steam generator

b. Trip of both main feedwater pumps (i.e., opening of both main feedwater pump break-ers)

c. Safety injection

d. Manual actuation

3. One turbine driven auxiliary feedwater (TDAFW) pump is started on any of the following:

a. Low-low water level in two-out-of-three channels in both steam generators

b. Loss of 4 kV voltage on both buses 11A and 11B

c. Manual actuation

4. The main steam safety valves (MSSVs) open to provide an additional heat sink and protec-tion against secondary side overpressure.

5. The pressurizer safety valves open to provide protection against overpressurization of the reactor coolant system.

Low-low steam generator water level is the only automatic reactor trip credited in this analy-sis.

15.2.7.3.2 Single Failures Assumed Auxiliary feedwater (AFW) is the only engineered safety feature system assumed to function in this analysis. The flow from the motor driven auxiliary feedwater (MDAFW) pump aligned to the faulted steam generator and the flow from the turbine driven auxiliary feedwa-ter (TDAFW) pump are assumed to be directed out the feedline break. Therefore, the worst-case failure is the failure of the motor driven auxiliary feedwater pump aligned to the intact steam generator. The analysis allows for the realignment of this system or the startup of the standby auxiliary feedwater (SAFW) system to provide flow to the intact steam generator.

No single failure in the reactor trip system (RTS) or engineered safety features actuation sys-tem (ESFAS) will prevent trip of the reactor or startup of auxiliary feedwater (AFW) pumps, Page 89 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES respectively. The main steam safety valves (MSSVs) and pressurizer safety valves are con-sidered passive components and are assumed not to fail to open on demand.

15.2.7.3.3 Operator Actions Assumed For the assumed failure of a motor driven auxiliary feedwater (MDAFW) pump to provide auxiliary feedwater to the intact steam generator, the operator is required to realign the system or to put the standby auxiliary feedwater (SAFW) system into operation and trip the reactor coolant pumps. The operator must perform these actions within 14.5 minutes after the reactor trip on low-low steam generator level (see Section 15.2.7.4.1, item J). (Note the interpreta-tion of the operator action time in Section 15.0.9.2.) No other operator actions are credited in the analysis.

15.2.7.3.4 Chronological Description of Event The analyzed event starts with a feedwater line break. The reactor is eventually tripped on low-low steam generator water level. The time sequence including startup of auxiliary feed-water (AFW) is shown in Table 15.2-5 for the limiting break area determined in this analysis.

15.2.7.3.5 Impact on Fission Product Barriers The reactor coolant system pressure remains less than 110% of the design pressure as allowed by the ASME Boiler and Pressure Code,Section III. The reactor coolant pressure boundary maintains its integrity as a fission product barrier.

The pressurizer could overfill (become water-solid) and discharge reactor coolant to the pres-surizer relief tank. Radioactive coolant could be discharged inside containment if the capac-ity of the pressurizer relief tank is exceeded or the rupture disc fails. The containment is designed to maintain its integrity after the instantaneous rupture of the largest primary or sec-ondary system piping within the structure. Feedwater line breaks inside containment are not expected to exceed the design limits analyzed in the containment integrity evaluations in Sec-tion 6.2.1.2. Therefore, the containment and containment isolation system serve as a final barrier against the dispersion of radionuclides from the plant.

15.2.7.4 Reactor Core and Plant System Evaluation 15.2.7.4.1 Input Parameters and Initial Conditions A. NSSS power up to 1817 MWt is assumed.

B. The initial reactor coolant average temperature is 580F (576F + 4F uncertainty). The initial pressurizer pressure is 2190 psia (2250 psia - 60 psi uncertainty). Uncertainties are applied per Section 15.2.7.4.2.

C. The following key physics parameters are consistent with minimum reactivity feedback conditions:

1. Moderator density coefficients - 1 value of 0.0 K/g/cc

2. Doppler power-only coefficients - least (absolute value) negative values

3. Doppler temperature coefficients - least (absolute value) negative values Page 90 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

4. Delayed neutron fraction - minimum value D. The reactivity feedback parameters are chosen to minimize the ensuing power reduction during the transient, which results in greater heat addition to the reactor coolant system.

E. Conservative core residual heat generation rates assume long-term operation at the initial power level preceding the reactor trip.

F. The initial pressurizer water level is maximized in order to maximize the pressurizer water volume during the transient.

G. Initial water level (mass) in the faulted steam generator is at the maximum value and the initial water level (mass) in the intact steam generator is at the minimum value. The maxi-mum level in the faulted steam generator increases the time to reactor trip and heat addition to the reactor coolant system. The minimum level in the intact steam generator reduces the initial available heat sink.

H. Main feedwater flow to both steam generators is lost at the time the break occurs. Essen-tially, all main feedwater is assumed to spill out through the break.

I. Reactor trip is initiated when the low-low water level trip setpoint is reached in the faulted steam generator. The setpoint is conservatively assumed to be at 0% narrow range. The method described in Reference 7 was used to calculate steam generator masses up to the time of reactor trip. No credit is taken for protection logic signals on pressurizer high-pres-sure, overtemperature delta T, pressurizer high-level, or containment high-pressure to miti-gate the consequences of the accident.

J. The following AFW assumptions were made: for a feedline break outside the intermediate building, 195 gpm of AFW went to the intact steam generator and was initiated 60 sec after the steam generator low-low level signal. For a feedline break inside the intermediate building, 215 gpm of SAFW went to the intact steam generator and was initiated 870 sec after the steam generator low-low level signal. In all cases, no AFW went to the faulted steam generator.

K. The pressurizer power operated relief valves (PORVs) are assumed to operate in order to minimize the reactor coolant system pressure and corresponding saturation temperature.

L. Conservative feedwater line break discharge quality was assumed. This minimized the heat transfer capability of the faulted steam generator.

M. Credit was taken for heat energy deposited in portions of the RCS metal during the RCS heatup, as described in the approved method presented in Reference 7.

N. No credit is taken for charging or letdown.

O. Steam generator heat transfer correlation for the SG tubes was automatically adjusted as the shell-side liquid inventory decresed.

P. The reactor coolant pump heat addition to the reactor coolant is assumed to be the maxi-mum value of 5 MWt/pump for the offsite power available cases and 3 MWt/pump for the loss of offsite power cases.

Q. For the loss of offsite power case, loss of power and start of the reactor coolant pump coast-down is assumed to occur coincident with reactor trip. This condition increases the initial heatup of the reactor coolant following reactor trip.

Page 91 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES R. Uniform steam generator plugging level of 10% is assumed.

15.2.7.4.2 Method of Analysis The feedline break transient is analyzed using the RETRAN computer code described in WCAP-14882-P-A (Reference 2). The RETRAN model simulates the reactor coolant system, neutron kinetics, pressurizer, pressurizer relief and safety valves, pressurizer heaters, pressur-izer spray, steam generators, feedwater system, and main steam safety valves. The code com-putes pertinent plant variables including steam generator mass, pressurizer water volume, reactor coolant average temperature, reactor coolant system pressure, and steam generator pressure.

The feedline break methodology requires that bulk boiling does not occur in the reactor fol-lowing the accident. This condition is met if the reactor coolant temperature is less than the saturation temperature during the accident. This requirement is invoked until the heat removal capability of the intact steam generator exceeds the heat generation in the nuclear steam supply system. The total heat addition includes decay plus reactor coolant pump heat-ing for the case where offsite power is available; for the case where offsite power is unavail-able, pump heating decreases rapidly during coastdown after the loss of offsite power. A double-ended rupture of the feedwater pipe of 1.418 ft2 area is analyzed, because this break size results in the most severe increase in the reactor coolant temperature prior to reactor trip and leads to the closest approach (minimum margin) to the hot-leg saturation temperature.

The minimum margin to saturation occurs after reactor trip but prior to turnaround of the tran-sient.

DNBR is not analyzed, and therefore, the Revised Thermal Design Procedure is not used.

Instead, the steady state uncertainties are added to the plant's nominal conditions to develop conservative initial conditions for the analysis as discussed in Section 15.2.7.4.1).

15.2.7.4.3 Acceptance Criteria The general acceptance criteria used for the Condition IV feedwater line break event are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Any fuel damage that may occur must be sufficiently limited so that the core remains in place and intact with no loss of core cooling capability.

C. Any activity release must result in calculated doses at the exclusion area boundary (EAB) within the guidelines of 10 CFR 50.67 .

This analysis uses the more restrictive requirement that no bulk boiling occurs in the reactor coolant system following a feedline break, prior to the time that the heat removal capability of the steam generator, being fed auxiliary feedwater, exceeds the NSSS residual heat genera-tion. This requirement ensures that the core geometry remains intact without loss of core cooling capability. The ability to also limit reactor coolant and main steam pressures to 110%

of design ensures that any radioactivity release is small, thereby satisfying the dose guidelines in 10 CFR 50.67 .

Page 92 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Overfill and water relief from the pressurizer are permissible during a Condition IV feedline break event. The possible discharge from the pressurizer relief tank into the containment is considered a Condition III event. The consequential occurrence of the less severe Condition III event does not change the general acceptance criteria for the feedline break event.

15.2.7.4.4 Results The transient results for the most limiting feedline break with offsite power available are shown in Figures 15.2-21 through 15.2-25. Figures 15.2-26 through 15.2-30 show the same parameters for the feedline break case without offsite power available (i.e., the loss of offsite power is assumed coincident with reactor trip). The calculated sequences of events for the cases with and without offsite power are shown in Table 15.2-5.

For the feedline break with offsite power available, the pressurizer pressure decreases after reactor trip on low-low steam generator water level due to the reduction in heat input. Fol-lowing this initial decrease, pressurizer pressure increases. This increase is the result of reac-tor coolant expansion caused by the reduction in heat transfer capability in the steam generators. The pressurizer water volume increases in response to the heatup. Pressurizer filling is predicted in this case; therefore, fluid flow through the pressurizer power operated relief valves (PORVs). Flow through the pressurizer safety valves is not anticipated, as the pressure remains below the safety valves setpoint. The results show that the core remains covered at all times and that no boiling occurs in the reactor coolant loops prior to turnaround of the event. The feedwater pipe break transient is considered terminated when the heat removal capability of the intact steam generator exceeds the nuclear steam supply system heat generation. This occurs at approximately 2600 seconds for this case. The coolant in the hot leg never reaches the saturation temperature. The closest approach to saturation before the transient has turned around is approximately 2F.

The system response following a feedwater line rupture without offsite power available is similar to the case with offsite power available. The reactor coolant pumps start to coast down due to the loss of offsite power (assumed to occur at the time of reactor trip). The total reactor coolant system heat generated is reduced by the amount produced by operation of both pumps. Therefore, this case is less limiting than the case with offsite power available.

Note that, at Ginna, the reactor coolant pumps would not coast down for 60 seconds after the assumed loss of power instead of the almost immediate coastdown that was assumed in the analysis. If coastdown is delayed, the difference between the two cases is reduced. However, the case with offsite power available would still be more limiting than the case without offsite power.

Pressurizer pressure decreases after reactor trip on low-low steam generator water level due to the reduction of heat input. Following this initial decrease, pressurizer pressure increases until the pressurizer power operated relief valve (PORV) setpoint is reached. This pressure increase is the result of coolant expansion caused by reduction in heat transfer capability of the steam generators. The primary pressure remains at the pressurizer power operated relief valve (PORV) setpoint until the auxiliary feedwater (AFW) system starts reducing primary temperatures. Steam release through the pressurizer power operated relief valves (PORVs) is Page 93 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES minimal and the pressurizer is not predicted to go water solid. The analysis also demon-strated that ample margin to hot leg saturation is present.

15.2.7.5 Radiological Consequences The possible discharge of reactor coolant from the pressurizer relief tank could result in the release of radioactive fission and corrosion products inside containment. The containment is a barrier, preventing the direct release of radioactivity to unrestricted areas. The dose contri-bution from this path is expected to be small compared to the steam generator releases.

Steam generator releases arise from the blowdown of the faulted steam generator and the steaming down of the intact steam generator to remove heat from the reactor coolant system.

The primary to secondary side leakage in the steam generators provides a path for the trans-port of reactor coolant activity to the secondary side and release to the environment. The leakage paths and mechanisms are analogous to the main steam line break. Unlike the main steam line break, the feedwater line break does not cause a severe, rapid depressurization of the reactor coolant system; hence, iodine spiking is not expected to be as significant a contrib-utor to the post-event activity release. Because the feedline break is characterized by a dis-charge of water from the secondary side instead of an initial steam release, less of the faulted steam generator's pre-accident iodine activity is flashed to the environment. Thus, the activ-ity releases from the feedline break are less than those associated with the main steam line break accident. Therefore, the radiological consequences are bounded by the steam line break consequences in Section 15.1.5 and are well within the limits of 10 CFR 50.67 .

15.2.7.6 Conclusions The auxiliary feedwater (AFW) system capacity is adequate for limiting the heatup and removing decay heat from the reactor coolant system following a feedline break. Under extremely conservative assumptions, the energy removal capability of the secondary system exceeds the residual energy generation in the primary system within approximately 45 min-utes after the feedline rupture. No bulk boiling occurs in the reactor hot leg prior to turn-around of the events, and the core remains covered at all times. The allowable overpressure limits for the reactor coolant and main steam systems are not exceeded. Radiological conse-quences are well within the limits of 10 CFR 50.67.

Page 94 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.2

1. A. J. Friedland and S. Ray, Revised Thermal Design Procedure, WCAP 11397-P-A (Pro-prietary), WCAP 11397-A (Non-Proprietary), April 1989.

2. D. S. Huegel, et al., "RETRAN-02 Modeling and Qualification for Westinghouse Pres-surized Water Reactor Non-LOCA Safety Analysis," WCAP-14882-P-A, April 1999.

3. ANSI/ANS-5.1-1979, American National Standard for Decay Heat Power in Light Water Reactors, August 1979.

4. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Natural Circulation Cooldown, Generic Letter 81-21, dated November 22, 1983.

5. SEV-1073, MDAFW Discharge Valves, 10 CFR 50.59 Safety Evaluation Report, dated September 6, 1996.

6. WCAP-14882-S1-P, "RETRAN-02 Modeling and Quantification for Westinghouse Pres-surized Water Reactor Non-LOCA Safety Analyses Supplement 1 - Thick Metal Mass Heat Transfer Model and NOTRUMP-Based Steam Generator Mass Calculation Method," December 2002.

7. Westinghouse Calc. Note CN-SCS-05-1, Rev 2 RE Ginna 19.5% Uprate Program Plant Operability and Margin to Trip ANalysis.

8. NSAL-07-10, Loss-of-Normal Feedwater/Loss-of-Offsite AC Power Analysis PORV Modeling Assumptions.

9. Westinghouse Calc. Note, CN-TA-07-43, Rev. 1, Response to CAPS 1R 06-184-M0004.03 - Examination of PORV Operability for LONF-LOAC.

Page 95 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.2-1 TIME SEQUENCE OF EVENTS FOR LOSS OF EXTERNAL ELECTRICAL LOAD Case Event Time of Each Event (sec)

1. With pressurizer control Loss of electrical load 0 (DNBR Case )

Overtemperature T reactor trip set- 11.6 point reached Rod begins to drop 13.1 Minimum DNBR occurs 14.6 Peak RCS pressure occurs a

2. Without pressurizer control Loss of electrical load 0 (peak RCS pressure case)

High pressurizer pressure reactor trip 5.4 setpoint reached Rods begin to drop 7.4 Initiation of steam release from pres- 7.4 surizer safety valves Peak RCS pressure occurs 8.5 Initiation of release from main steam 9.4 safety valves (MSSVs)

Minimum DNBR occurs b

3. With pressurizer control Loss of electrical load 0 (peak MSS pressure case)

Overtemperature T reactor trip set- 10.9 point reached Rods begin to drop 12.4 Initiation of release from main steam 7.0 safety valves (MSSVs)

Peak MSS pressure occurs 15.9 Minimum DNBR occurs c

a. Peak RCS pressure is not reported for this case since analysis assumptions conservatively minimize it.

b. DNBR is not reported for this case since analysis assumptions are made to maximize the peak RCS pressure.

c. DNBR is not reported for this case since analysis assumptions are made to maximize the peak MSS pressure.

Page 96 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.2-2 TIME SEQUENCE OF EVENTS FOR LOSS OF OFFSITE ALTERNATING CURRENT POWER TO THE STATION AUXILIARIES Event Time (sec)

Main feedwater flow stops 20 Pressurizer power operated relief valve (PORV) initially 35 opens Low-low steam generator water level trip setpoint reached 61 Rod motion begins and turbine tripped 63 Reactor coolant pumps trip and flow coastdown begins 65 Pressurizer power operated relief valve (PORV) initial clo- 68 sure.

Peak steam generator pressure occurs 72 Peak pressurizer water level occurs (first peak) 86 Two motor driven auxiliary feedwater (MDAFW) pumps 121 start to pump 170 gpm to each steam generator Long-term peak pressurizer water level occurs (second peak) 266 Page 97 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.2-3 Table DELETED Table DELETED Page 98 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.2-4 TIME SEQUENCE OF EVENTS FOR LOSS OF NORMAL FEEDWATER FLOW Event Time (sec)

Main feedwater flow stops 20 Low-low steam generator water level trip setpoint reached 55 Rod motion begins and turbine tripped 57 Pressurizer power operated relief valve (PORV) initially opens 60 Pressurizer power operated relief valve (PORV) initial closure 62 Peak steam generator pressure occurs 79 Peak pressurizer water level occurs (first peak) 85 Two motor driven auxiliary feedwater (MDAFW) pumps start to pump 170 gpm 115 to each steam generator Long-term peak pressurizer water level occurs (second peak) 896 Page 99 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.2-5 TIME SEQUENCE OF EVENTS FOR THE FEEDWATER LINE PIPE BREAK (0.3 FT2 BREAK AREA)

Case Event Time (sec)

With offsite power Feedwater pipe rupture occurs 20.0 Reactor trip setpoint reached for low-low steam 21.8 generator water level Rod motion begins 23.8 Peak pressurizer pressure occurs 772.0 Auxiliary feedwater flow to intact steam generator 891.8 is initiated Core decay heat decreases to auxiliary feedwater ~2600 heat removal capacity Minimum margin to hot leg saturation occurs ~2600 Without offsite power Feedwater pipe rupture occurs 20.0 Reactor trip setpoint reached for low-low steam 21.8 generator water level Rod motion and reactor coolant pump coastdown 23.8 begins Auxiliary feedwater flow to intact steam generator 891.8 is initiated Peak pressurizer pressure occurs 1020.0 Core decay heat decreases to auxiliary feedwater ~1500 heat removal capacity Minimum margin to hot leg saturation occurs ~1500 Page 100 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE 15.3.1 FLOW COASTDOWN ACCIDENTS 15.3.1.1 Description of Event A loss-of-coolant-flow incident can result from a mechanical or electrical failure in one or both reactor coolant pumps or from a fault in the power supply to these pumps. If the reactor is at power at the time of the incident, the immediate effect of loss of coolant flow is a rapid increase in coolant temperature. This increase could result in departure from nucleate boiling (DNB) with subsequent fuel damage if the reactor is not tripped promptly.

Simultaneous loss of electrical power to both reactor coolant pumps at full power is the most severe credible loss-of-coolant-flow condition. For this condition, reactor trip together with flow sustained by the inertia of the coolant and rotating pump parts will be sufficient to pre-vent fuel failure, reactor coolant system overpressure, and the DNB ratio (DNBR) from decreasing to less than the safety limit value.

The simultaneous loss of power to both reactor coolant pumps is a highly unlikely event. The normal power supplies for the pumps are the two non-Class 1E buses 11A and 11B fed from the generator via unit auxiliary transformer 11. Each bus supplies power to one pump. Since the pumps are on separate buses, a single bus fault would not result in the loss of both pumps.

When a generator trip occurs, the feeds to buses 11A and 11B are automatically transferred to buses supplied from either of two independent offsite power sources. Following any turbine trip, with no generator electrical faults requiring tripping of the generator, the reactor coolant pumps remain powered from buses 11A and 11B for approximately one minute before the automatic bus 11A and 11B transfers are made. However, this delay is not required for any safety-related function.

15.3.1.2 Frequency of Event Reactor coolant pump coastdown events may involve one or two loops. A loss of flow in one loop, or partial loss of flow, is classified as an ANS Condition II event of moderate frequency.

A loss of flow in both loops is termed a complete loss of flow event. A complete loss of flow is classified as an ANS Condition III infrequent incident. Section 15.0.8 discusses the ANS classifications.

15.3.1.3 Event Analysis The following loss-of-coolant-flow cases are analyzed:

Case A - Loss of voltage to two reactor coolant pumps with two loops operating.

Case B - Loss of voltage to one reactor coolant pump with two loops operating.

Case C - Frequency decay of power to two reactor coolant pumps with two loops operating.

The first case is a total loss of flow and represents the worst credible coolant flow loss. The second case is a partial loss of flow and is less severe. The third case is not believed to be credible because the offsite power system is not highly capacitive, which is typical of systems using large amounts of buried transmission cables (Reference 4); however, this case is consid-Page 101 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ered because of the potential to yield more severe analysis results than the loss of voltage case.

15.3.1.3.1 Protective Features For the failure of two reactor coolant pumps with two loops in operation (Cases A and C), the following trip circuits provide protection for a complete loss of forced reactor coolant flow:

A. Reactor trip is actuated on undervoltage occurring concurrently on buses 11A and 11B.

The undervoltage input is derived from one out of two undervoltage channels (relays) on each bus.

B. Reactor trip is actuated on underfrequency occurring concurrently on buses 11A and 11B.

The signal input is derived from one out of two underfrequency channels (relays) on each bus.

C. Reactor trip is actuated on low flow in two out of three channels in both loops when the reactor is above a preset level. The low flow trip in both loops occurs when the power level (P-7 permissive) is above approximately 8%.

D. An anticipatory trip based on pump breaker position also provides a trip input to the reactor trip system. Opening of both pump breakers generates an anticipatory trip when power is greater than the preset level (P-7 permissive).

The undervoltage trip is the only automatic reactor trip credited in Case A; the underfre-quency trip is the only trip credited in Case C.

For the failure of one reactor coolant pump with two loops in operation (Case B), the follow-ing trip circuits provide protection for a partial loss of flow:

A. Reactor trip is actuated on low flow in two out of three channels in either loop when the reactor power is above a preset level. The power level (P-8 permissive) is approximately 25% power.

B. A backup to the low flow trip is provided by an anticipatory trip based on breaker position.

Opening of either reactor coolant pump breaker generates an anticipatory trip when power is greater than the preset level (P-8 permissive).

The low flow reactor coolant trip is the only automatic reactor trip credited in Case B.

These trip circuits and their redundancy are further described in Section 7.2.

For partial and complete loss of flow events (Cases A, B, and C), the following equipment is available:

A. The pressurizer safety valves may open to provide protection against overpressurization of the reactor coolant system.

B. The main steam safety valves may open to provide an additional heat sink for and overpres-sure protection for the secondary side.

Page 102 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.3.1.3.2 Single Failures Assumed For the failure of two reactor coolant pumps with two loops in operation (Cases A and C) and for the failure of one reactor coolant pump with two loops in operation (Case B), the limiting single failure is one train of the reactor protection system. The other, operable train trips the reactor in all cases.

For partial or complete loss of flow events (Cases A, B, and C), the main steam and pressur-izer safety valves are considered passive components and do not fail to open on demand.

15.3.1.3.3 Operator Actions Assumed No operator actions are assumed in the analysis of Cases A, B or C.

The P-8 evaluation described in Section 15.3.1.7 assumed the transient was terminated in 4000 sec. This implies the operators have over an hour to terminate the transient by either tripping the reactor or restarting the reactor coolant pump.

15.3.1.3.4 Chronological Description of Event The complete loss of flow cases start with a loss of power (Case A) or frequency degradation (Case C) on both buses 11A and 11B. The partial loss of flow case (Case B) begins with one pump coasting down. The event sequences for these three cases are shown in Table 15.3-1.

15.3.1.3.5 Impact on Fission Product Barriers No fuel cladding failures are anticipated. The peak reactor coolant system pressure remains less than 110% of the design pressure as allowed by the ASME Boiler and Pressure Vessel Code,Section III. The cladding and reactor coolant pressure boundary maintain their integ-rity as fission product barriers.

15.3.1.4 Reactor Core and Plant System Evaluation 15.3.1.4.1 Input Parameters and Initial Conditions A. The initial reactor power and pressurizer pressure are at their nominal values. The reactor coolant average temperature is at the maximum end of the TAVG window (576.0F). The initial reactor coolant flow rate is at the minimum measured flow. Table 15.0-5 summarizes these initial conditions.

B. The contribution to reactor coolant pump heating is 3 MWt per pump. Pump heat is decreased as the pump (or pumps) coasts down.

C. A moderator temperature coefficient of 0 pcm/F at hot full power is assumed in the analy-ses. The Technical Specifications allow for a positive moderator of +5 pcm/F for power levels up to 70% RTP. However, sensitivity studies have shown that 100% power with a zero moderator temperature coefficient bounds all credible moderator temperature coeffi-cient and power level combinations.

D. A conservatively large absolute value of the doppler-only power coefficient is used. This assumption maximizes the power level while it is decreasing after a reactor trip.

Page 103 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES E. The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance and the pump characteristics, and is based on high estimates of system pressure losses.

F. The automatic reactor trip system setpoints and delay times used in the accident analyses are shown in Table 15.0-5. For the underfrequency case (Case C), buses degrade at 5 Hz/

second and the underfrequency setpoint is assumed to be 57 Hz.

G. A conservative trip reactivity of 3.5% delta k is used. This value allows for the highest rod cluster control assembly stuck in a fully withdrawn position. A conservative trip reactivity worth versus rod position curve is also used.

H. A uniform steam generator plugging level of 10% is assumed.

15.3.1.4.2 Method of Analysis The transients are analyzed with two computer codes. First, the RETRAN computer code (Reference 2) is used to calculate the loop and core flow during the transient, the time of reac-tor trip based on the calculated flows, the nuclear power transient, and the primary-system pressure and temperature transients. The VIPRE computer code (Reference 1) is then used to calculate the heat flux and DNBR transients based on the nuclear power and RCS temperature (enthalpy), pressure, and flow from RETRAN. General descriptions of RETRAN and VIPRE are given in Section 15.0.7.

This accident is analyzed with the Revised Thermal Design Procedure (Reference 1). Uncer-tainties in the initial conditions are included the DNBR safety analysis limit when using this procedure.

15.3.1.4.3 Acceptance Criteria The general acceptance criteria for Condition II events are used for all reactor coolant flow coastdown events. This approach is conservative since the more severe total loss of flow cases are classified as Condition III events. The acceptance criteria are:

A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

The primary acceptance criteria used in these analyses are that the minimum DNBR remains greater than the safety analysis limit value (see Section 4.4) and that the primary and second-ary side pressures are maintained below their respective acceptance limits.

15.3.1.4.4 Results Figures 15.3-1 to 15.3-3 show the transient responses for the complete loss of flow event caused by bus undervoltage (Case A). Figure 15.3-1 shows the nuclear power and the reactor Page 104 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES coolant mass flow. Figure15.3-2 shows the average channel heat flux and the hot-channel heat flux responses. Figure 15.3-3 shows the DNBR as a function of time for this case. The minimum DNBR is reached 2.9 seconds after initiation of the incident.

Figures 15.3-1a to 15.3-3a show the transient responses for the complete loss of flow event due to bus underfrequency (Case C). These figures display the same parameters as the under-voltage event. Figure 15.3-3a shows the DNBR as a function of time for this case. The min-imum DNBR is reached 3.4 seconds after the frequency starts to degrade.

Figures 15.3-4 through 15.3-6 show the transients for the partial loss of flow event when one pump fails with both loops operating (Case B). The core mass flow and individual loop mass flows are shown on Figures 15.3-4 and 15.3-5, respectively. Figure 15.3-7 shows the DNBR as a function of time. The minimum DNBR occurs 3.6 seconds after initiation of the tran-sient.

The complete loss of flow due to bus underfrequency is the most limiting event of the three cases analyzed. Table 15.3-1 shows the time sequence of events for the loss of reactor flow events.

15.3.1.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failures are caused by the loss of flow events. Steam releases from the pressurizer power operated relief valves (PORV) and pressurizer safety valves are to the pressurizer relief tank inside containment.

Since this does not result in an uncontrolled release to the environment, normal plant opera-tions can be used for the clean up or discharge of the radioactive contaminants under con-trolled conditions.

15.3.1.6 Conclusions Since the DNBR safety analysis limit is not violated in any loss-of-coolant-flow incident, there is no cladding damage or release of fission products into the reactor coolant. The reac-tor coolant system pressure remains well below the allowable pressure limits. Therefore, once the fault is corrected, the plant can be returned to service in the normal manner for par-tial and complete loss of coolant flow events.

A P-8 permissive setpoint evaluation was performed at EPU conditions. The P-8 permissive setpoint defines the highest steady state power level at which the reactor can operate with one RCS loop inactive without violating the N-1 core thermal limits. The P-8 evaluation was per-formed with RETRAN by analyzing one loop in operation at a part power steady state condi-tion and demonstrating that the DNBR design basis is satisfied. The RETRAN analysis was performed at 35% power and determined state points that were evaluated and found to satisfy the DNB limit. Therefore, the DNB design basis is satisfied for partial loss of flow at 35%

power, demonstrating the acceptability of 35% as the P-8 permissive setpoint for EPU.

Page 105 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.3.2 LOCKED ROTOR ACCIDENT 15.3.2.1 Description of Event A transient analysis is performed for the postulated instantaneous seizure of a reactor coolant pump rotor. Flow through the reactor coolant system is rapidly reduced, leading to a reactor trip on a low-flow signal. Following the trip, heat stored in the fuel rods is transferred to the coolant, causing the coolant to heat up and expand. At the same time, heat transfer to the shell side of the steam generator is reduced: first, because the reduced RCS flow results in a decreased tube-side film coefficient; second, because the reactor coolant in the tubes cools down while the shell-side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with the reduced heat transfer in the steam generator, causes an insurge into the pressurizer and a pressure increase throughout the reactor coolant system. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the pressurizer power operated relief valves (PORV), and opens the pressurizer safety valves, in that sequence. The two pressurizer power operated relief valves (PORV) are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, the pressure-reducing effect of the non-safety pressurizer power operated relief valves (PORV) and non-safety pressurizer spray are not included.

15.3.2.2 Frequency of Event The occurrence of a locked rotor accident is extremely unlikely over the life of the plant. The event can have potentially severe consequences, which includes the possible release of signif-icant amounts of radioactive material. Consequently, this event is classified as an ANS Con-dition IV limiting fault (see Section 15.0.8).

15.3.2.3 Event Analysis Two loops are operating when one of the reactor coolant pump rotors is postulated to seize. If a consequential loss of offsite power would occur, the feeder breakers from unit auxiliary transformer 11 would not open until approximately 1 minute after the turbine trip, assuming no electrical fault conditions exist. Therefore, power to the intact reactor coolant pump would be maintained during the limiting portion of the transient when the peak clad tempera-ture occurs. RETRAN analysis of this event does assume a consequential loss of offsite power with the intact reactor coolant pump being tripped at the time of rod motion (1.0096 seconds into the transient) to provide the most conservative scenario with regards to peak clad temperature.

15.3.2.3.1 Protective Features The following protection features are available:

A. Reactor trip is actuated on low flow in two out of three channels in either loop when the reactor power is above a preset level. The power level (P-8 permissive) is approximately 25% power.

Page 106 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES B. A backup to the low flow trip is provided by an anticipatory trip based on breaker position.

Opening of either reactor coolant pump breaker generates an anticipatory trip when power is greater than the preset level (P-8 permissive).

C. The pressurizer safety valves open to provide protection against overpressurization of the reactor coolant system.

D. The main steam safety valves open to provide an additional heat sink and overpressure pro-tection for the secondary side.

The low flow reactor coolant trip is the only automatic reactor trip credited.

15.3.2.3.2 Single Failures Assumed The limiting single failure is one train of the reactor protection system. The other, operable train trips the reactor. The main steam and pressurizer safety valves are considered passive components and do not fail to open on demand.

15.3.2.3.3 Operator Actions Assumed No operator actions are assumed in the analysis of this event.

15.3.2.3.4 Chronological Description of Event The event starts with the sudden seizing (locking) of one reactor coolant pump rotor followed by the immediate reduction in loop flow and reactor trip. The reactor coolant system pressure and clad temperature increase rapidly reaching maximum values within seconds of the start of the transient. The transient is analyzed to determine that the peak pressure and clad tempera-ture are less than the acceptance criteria limits. The sequence of events is given in Table 15.3-3.

15.3.2.3.5 Impact on Fission Product Barriers Some fuel is postulated to go into DNB for this event. Therefore, clad perforations are expected with the consequential increase in the release of fission products to the reactor cool-ant. Although coolant radioactivity concentrations can significantly increase, the analyses performed here show that gross fuel clad integrity is maintained.

Maximum reactor coolant system pressures are expected to remain less than 120% of the design pressure allowed by the ASME Boiler and Pressure Vessel Code,Section III. This limit is applicable to emergency conditions for low probability events. (The locked rotor accident is classified as an ANS Condition IV limiting fault. Limiting faults in the ASME Boiler and Pressure Vessel Code have extremely low probabilities with higher allowable overpressure stresses.) The ability to meet the more conservative 120% limit ensures that the pressure boundary integrity is maintained for this accident.

No discharge of water from the pressurizer is expected. The capacity of the pressurizer relief tank is not exceeded, and the pressurizer relief tank maintains its function as a barrier against the release of fission products from the reactor coolant system.

Page 107 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.3.2.4 Reactor Core and Plant System Evaluation 15.3.2.4.1 Input Parameters and Initial Conditions A. The plant is initially operating at 1817 MWt. Nominal reactor coolant pump heating (3 MWt/pump) is assumed prior to the event.

B. The initial reactor coolant average temperature (500F) is 4F higher than the high end of the TAVG window. The reactor coolant flow is assumed to be 170200 gpm. The initial pressurizer pressure (2310 psia) is 60 psi higher than nominal, which increases the resulting pressure rise during the transient. Table 15.0-5 summarizes these initial conditions.

C. A moderator temperature coefficient of zero is assumed consistent with the allowable value allowed at full power by the Technical Specifications. This results in the minimum reduc-tion in core power as the moderator temperature rises in the early part of the transient.

D. The reactor trip occurs due to a reactor coolant low flow setpoint at 87% of nominal flow.

A delay time of one second is assumed.

E. A trip reactivity insertion of 3.5% delta k is used to allow for the highest worth rod cluster control assembly (RCCA) stuck in its fully withdrawn position. In addition, a conservative rod worth versus position characteristic and rod drop time are used to minimize the nega-tive reactivity insertion following reactor trip.

F. The pressurizer safety valve opening pressure of 2599.4 psia includes a positive 3% toler-ance and a 1% setpoint drift due to the loop seal. A 0.8 second time delay in opening after reaching the setpoint accounts for the time required to purge the water from the loop seal.

The total capacity of the pressurizer safety valves is 19.4ft3/sec.

G. No credit is taken for the pressure-reducing effect of the pressurizer power operated relief valves (PORV), pressurizer spray, steam dump, or controlled feedwater flow after the plant trip. Operation of these features would result in a lower predicted peak system pressure.

H. Steam generator plugging level of 10% is assumed, although not a significant contributor to the results.

15.3.2.4.2 Method of Analysis For this accident analysis, DNB is assumed to occur in the core. The consequences of fuel rod thermal transients are analyzed to determine upper limits on cladding temperature and zir-conium-water reaction at the hot spot location. The rod power at the hot spot is taken as 2.6 times the average rod power (FQ = 2.6) at the initial core power level. A transient analysis is also performed to determine the peak pressure in the reactor coolant system during the acci-dent.

Two computer codes are used. RETRAN is used to calculate the reactor coolant loop and core flow transients following the pump seizure, the time of reactor trip based on loop flow transients, the nuclear power, and the peak pressure. The thermal behavior of the fuel at the core hot spot is investigated using is VIPRE, which uses the core flow and nuclear power cal-culated by RETRAN. RETRAN and VIPRE are described in Section 15.0.7. Specific meth-ods used to analyze fuel cladding behavior are described below.

Page 108 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Film-Boiling Coefficient The film-boiling coefficient is calculated by VIPRE using the Bishop-Sandberg-Tong film-boiling correlation. The fluid properties are evaluated at the film temperature, which is the average of the wall and bulk coolant temperatures. The program calculates the film coeffi-cient at every time step, based on the actual heat transfer conditions at the time. The neutron flux, system pressure, bulk density, and mass flow rate used as inputs are based on the RETRAN results.

The initial values of the pressure and the bulk density are used throughout the transient since they are conservative for evaluating the cladding temperature response. For conservatism, DNB is assumed to start at the beginning of the accident.

Fuel Clad Gap Coefficient The magnitude and the time dependence of the heat transfer coefficient between fuel and clad (gap coefficient) have an important influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between the pellet and the clad. Based on investigations of the effect of the gap coefficient on the maximum clad temperature during the transient, the gap coefficient is assumed to increase from a steady-state value consistent with the initial fuel temperature to 10,000 Btu/hr-ft2-F at the initiation of the transient. Thus, the large amount of energy stored in the fuel because of the small initial gap coefficient is released to the clad at the beginning of the transient.

Zirconium-Steam Reaction The zirconium-steam reaction can be significant above a clad temperature of 1800F. The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium-steam reaction:

d(w2)/dt = 33.3 x 106 exp (-45500/1.986T) where: = w amount reacted (mg/cm2) t= time (seconds)

T= temperature (Kelvin)

The heat of reaction is 1510 cal/g , and is included in the calculation of the hot spot tempera-ture transient.

15.3.2.4.3 Acceptance Criteria The guidelines set down in the ANS safety criteria in Section 15.0.8 are general due to the inherent severity of Condition IV events. The specific licensing basis acceptance criteria used to meet these guidelines for the reactor coolant pump locked rotor accident are:

A. The primary system pressure must remain below 120% of the primary design pressure.

B. The fuel cladding temperature must remain below 2700F.

C. The local zirconium-water reaction must remain below 16% by weight.

Page 109 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.3.2.4.4 Results The sequence of events is shown in Table 15.3-3. Rod motion is assumed to begin 1 second after the flow in the affected loop decreases to 87% of nominal flow. The flux is rapidly reduced by the control rod insertion effect. Peak reactor coolant system pressure and clad-ding temperature occur within the first 10 seconds of the accident.

Figure 15.3-8 shows the loop flow and reactor coolant system pressure transients. The pres-surizer pressure response is shown in Figure 15.3-8. The maximum pressure in the reactor coolant system is at the discharge of the reactor coolant pump, which is also shown in Figure 15.3-8. The peak pressure can be considered an upper limit since the assumptions used in the analysis are conservative. Figure 15.3-9 shows the nuclear power and core flow transients.

The heat flux and clad temperature transients are given in Figure 15.3-10. The results of these calculations are summarized in Table 15.3-2.

15.3.2.5 Radiological Consequences As part of the Control Room Emergency Air Treatment System (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistency, new x/Q values and off-site doses were also analyzed. Reference 5 is now considered to be the Locked Rotor (LR) dose analysis of record. The analysis was performed using the alter-nate source term (AST) per 10 CFR 50.67 and Refernece 6. The new methodology and anal-ysis was approved by the NRC in Reference 7 as supplemented by Reference 8. The assumptions used in the analysis are summarized in Table 15.3-4 and the results are contained in Table 15.3-5.

15.3.2.6 Conclusions There is no loss of reactor coolant system integrity since the peak reactor coolant system pres-sure is less than 120% of the design pressure.

The peak clad surface temperature calculated for the hot spot during the transient remains considerably less than 2700F, and the degradation due to the zirconium-water reaction is small. There is no consequential loss of core cooling capability, and the core remains in place and intact.

Page 110 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.3

1. A. J. Friedland and S. Ray, Revised Thermal Design Procedure, WCAP 11397-P-A (Pro-prietary), WCAP 11397-A (Non-Proprietary), April 1989.

2. Letter from J. E. Maier, RG&E, to H. R. Denton, NRC,

Subject:

SEP Topic XV-7, Locked Rotor Transient, dated June 30, 1981.

3. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics -

Design-Basis Events, Accidents, and Transients, dated September 4, 1981.

4. Letter from D. M. Crutchfield, NRC, to J.E. Maier, RG&E,

Subject:

SEP Topics VI-7.F VII-3 VII-6 & VIII-2 Based on Contractor Documents Facility Meets Current Licensing, dated June 24, 1981.

5. DA-NS-2002-054, Locked Rotor Offsite and Control Room Doses, Revision 1.

6. Regulatory Guide 1.183, Alternative Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

7. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant - Amendment re: Modification of the Control Room Emergency Air Treat-ment System (CREATS) and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123), dated February 25, 2005.

8. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant - Correction to Amendment No. 87 re: Modification of the Control Room Emergency Air Treatment System (CREATS) (TAC No. MB9123), dated May 18, 2005.

Page 111 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.3-1 TIME SEQUENCE OF EVENTS FOR LOSS OF REACTOR COOLANT FLOW Case Event Time of Each Event (sec)

A. Complete loss of forced reactor Both operating pumps lose power 0 coolant flow (undervoltage) and begin coasting down Reactor coolant pump undervolt- 0 age trip point reached Rods begin to drop 1.5 Minimum DNBR occurs 2.9 Maximum Primary Pressure occurs 3.4 B. Partial loss of reactor coolant flow Coastdown begins 0 (two loops operating, one pump coasting down) Low flow reactor trip 1.6 Rods begin to drop 2.6 Minimum DNBR occurs 3.6 C. Complete loss of forced reactor Frequency decay begins (5 Hz/ 0 coolant flow (underfrequency) sec.)

Underfrequency reactor trip set- 0.6 point reached Rods begin to drop 2.0 Minimum DNBR occurs 3.4 Maximum Primary Pressure occurs 4.6 Page 112 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.3-2

SUMMARY

OF LIMITING RESULTS FOR LOCKED ROTOR ACCIDENT Maximum reactor coolant system pressure (psia) 2782 Maximum cladding temperature at core hot spot (F) 1925 Zirconium-water reaction at core hot spot (% by weight) 0.53 Page 113 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.3-3 TIME SEQUENCE OF EVENTS FOR LOCKED ROTOR INCIDENT Event Time (sec)

Rotor on One Pump Locked or the Shaft Breaks 0.0 Low Flow Reactor Trip Setpoint Reached 0.096 Rods begin to drop 1.096 Remaining Pump Loses Power and Begins to Coastdown 1.096 Maximum clad average temperature occurs 3.08 Maximum RCS Pressure Occurs 3.95 Time of Maximum Clad Oxidation 10.0 Page 114 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.3-4 LR Dose Analysis Assumptions Parameter Value Reactor power, MWt 1811 Failed Fuel, % 50 Initial reactor coolant activity, pre-accident iodine spike iodine Ci/gm of D.E. I-131 60 noble gas fuel defect level, % 1.0 Initial secondary coolant iodine activity, Ci/ 0.1 gm of D.E. I-131 Primary-to-secondary leakage (post accident) to SGs Leak rate (cold conditions) per SG, gpd 500 Duration of leakage, hours 8 Mass of primary coolant, gm 1.28 x 108 Initial mass of secondary coolant in 2 SGs, gm 7.72 x 107 Steam Releases (2 SGs), lb 0-2 hr. 210,300 2-8 hr. 484,500 Steam generator iodine partition coefficients (mass-based)

Elemental 100 Organic 1 Iodine fractions in the reactor coolant and SG Water elemental iodine 0.97 organic iodide< 0.03 Atmospheric dispersion X/Q sec/m3 EAB 0-2 hr 2.17E-4 LPZ 0-8 hr 2.51E-5 Breathing rate m3/sec EAB & LPZ 0-8 hr 3.47E-4 8-24 1.75E-4 Page 115 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.13-5 RESULTS FOR LOCKED ROTOR EAB MAX - 2 HR LPZ, 8 hr rem TEDE rem TEDE Elemental Iodide 4.76E-1 1.33E-1 Organic Iodide 4.30E-1 1.61E-1 Noble gas 2.51E-1 5.87E-2 Total 1.16 3.53E-1 Acceptance Criteria 2.5 2.5 Page 116 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES 15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL FROM A SUBCRITICAL CONDITION 15.4.1.1 Description of Event A rod cluster control assembly (RCCA) withdrawal incident is defined as an uncontrolled addition of reactivity to the reactor core by withdrawal of RCCAs resulting in a power excur-sion. While the probability of a transient of this type is low, such a transient could be caused by a malfunction of the reactor control or RCCA drive systems. This could occur with the reactor subcritical or at power. The "at power" case is discussed in Section 15.4.2.

RCCA withdrawal is used to bring the reactor from a shutdown condition to a low power level during startup. Although the initial startup procedures with a clean core use the method of boron dilution, normal startup is by withdrawal of RCCAs. RCCA motion can cause much faster changes in reactivity than can be made by changing boron concentration.

The RCCA drive mechanisms are wired into pre-selected groups which are not altered during core life. These circuits prevent the RCCAs from being withdrawn in other than their respec-tive groups. Power supplied to the rod groups is controlled such that no more than two groups can be withdrawn at the same time. The RCCA drive mechanism is of the magnetic latch type, and the coil actuation is sequenced to provide variable speed rod travel. The maximum reactivity insertion rate analyzed assumes the simultaneous withdrawal of the combination of the two RCCA groups having the maximum combined worth at maximum speed.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the negative reactivity feedback of the doppler effect. This self-limiting effect is important since it limits the power to a tolerable level during the delay before protec-tive actions are performed.

15.4.1.2 Frequency of Event The uncontrolled RCCA withdrawal from subcritical condition is classified as an ANS Con-dition II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.4.1.3 Event Analysis The effects of an uncontrolled reactivity insertion from a subcritical condition are analyzed with an extremely low core power at hot zero power temperature conditions. The reactivity insertion rate used is greater than that for the simultaneous withdrawal of two control banks.

The insertion rate and initial conditions bound other zero power Condition II events consid-ered in Chapter 15.

15.4.1.3.1 Protective Features The following reactor trip system (RTS) design features provide protection for this event:

A. Reactor trip is actuated by the source range neutron flux trip signal when either of two inde-pendent source range channels indicates a flux level above a pre-selected, manually adjust-Page 117 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES able setpoint. This trip function may be manually bypassed when either of the intermediate range neutron flux channels indicates a flux (P-6 permissive) above the source range cutoff power level. It is automatically reinstated when both intermediate range channels indicate a flux level below the source range cutoff power level.

B. Reactor trip is actuated by the intermediate range neutron flux trip signal when either of two independent intermediate range channels indicates a flux above a pre-selected, manu-ally adjustable setpoint. This trip function may be manually bypassed when two of the four power range channels are reading above approximately 8% power (P-10 permissive). The trip function is automatically reinstated when three of the four channels indicate a power level below this value.

C. Reactor trip is actuated by the power range neutron flux (low setting) trip signal when two out of the four power range channels indicate a power level above approximately 25%.

This trip function may be manually bypassed when two of the four power range channels indicate a power level above approximately 8% power (P-10 permissive). The trip function is automatically reinstated when three of the four channels indicate a power level below this value.

D. Reactor trip is actuated by the power range neutron flux (high setting) trip signal when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

This analysis credits the power range flux trip (low setting) for initiating the reactor trip.

15.4.1.3.2 Single Failures Assumed No single failure in the power range flux instrumentation channels or the trip actuation logic trains prevent the reactor trip system (RTS) from performing its protective function.

15.4.1.3.3 Operator Actions Assumed No operator actions are credited in the analysis.

15.4.1.3.4 Chronological Description of Event The event starts with the RCCA withdrawal insertion rate of 75 pcm/sec. The sequence of events including times for peak neutron and heat fluxes, reactor trip, minimum departure from nucleate boiling ratio (DNBR), and peak fuel temperatures are tabulated in Table 15.4-1.

15.4.1.3.5 Impact on Fission Product Barriers The DNBR remains greater than the safety analysis limit, and the cladding maintains its integrity as a fission product barrier. No additional fuel cladding failures to those assumed during normal operation are expected.

15.4.1.4 Reactor Core and Plant System Evaluation 15.4.1.4.1 Input Parameters and Initial Conditions A. The reactor is at hot zero power with the reactor coolant system at the no load TAVG (547ºF) temperature.

Page 118 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES This condition is more conservative than a lower initial system temperature. The higher initial system temperature yields a larger fuel-water heat transfer coefficient, larger specific heats, and a less negative (smaller absolute magnitude) doppler coefficient, all of which tend to reduce the doppler feedback effect and increase the resultant peak neutron flux.

B. The initial effective multiplication factor (KEFF) is 1.0. This condition maximizes neutron flux peaking and results in the most severe nuclear power transient.

C. The initial power level (10-9 of nominal power) is below the power level expected for any shutdown condition.

D. The maximum positive reactivity insertion rate is (75 pcm/sec) which is greater than that for the simultaneous withdrawal of the combination of the two control banks having the greatest combined worth at maximum speed. The combination of highest reactivity inser-tion rate and lowest initial power produces the highest peak heat flux.

E. The power peak is strongly dependent on the doppler coefficient for any given reactivity insertion rate. Therefore, conservative (low absolute) values of the doppler coefficient as a function of temperature are used to maximize the nuclear power peak in the early part of the transient.

F. A positive moderator temperature coefficient of +5.0 pcm/ºF at zero power is used to maxi-mize the peak heat flux.

The contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the nuclear flux response time. After the initial nuclear flux peak, however, the succeeding rate of power increase is affected by the moderator reactivity coefficient.

G. The reactor trip occurs due to the power range neutron flux (low setting) trip with an assumed setpoint of 35% of nominal. A delay time of 0.5 seconds is assumed.

The setpoint and delay conservatively account for setpoint errors, and actuation and RCCA release delays. Previous results, however, show that the rise in the neutron flux is so rapid that the effects of setpoint errors on the time the RCCAs are released are negligible.

H. The reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.

I. The most limiting axial and radial power shapes, associated with having the two highest combined worth sequential banks in their highest worth position are assumed.

J. One reactor coolant pump is assumed to be in operation. The low initial flow minimizes the DNBR during the transient.

K. Cases were analyzed for both the 422V+ and the OFA Westinghouse fuel products. The results of the 422V+ fuel case are presented herein since the results of both cases are simi-lar. Further, neither case threatens to challenge the minimum DNBR limit and peak fuel centerline temperature limit.

L. The Standard Thermal Design Procedure (STDP) is used in the analysis to determine the minimum DNBR. Since the event is analyzed from hot zero power conditions, the steady state non-RTDP uncertainties are not applied to the analysis initial conditions.

Page 119 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.1.4.2 Methodology The analysis is performed in three stages: first, an average core nuclear power transient cal-culation; second, an average core heat transfer calculation; third, a DNBR calculation. The average nuclear power calculation is performed using a spatial neutron kinetics code, TWIN-KLE (Reference 5), to determine the average power generation with time including the vari-ous total core feedback effects, i.e., doppler and moderator reactivity. In the second stage, FACTRAN (Reference 7) is used to calculate the thermal heat flux transient based on the nuclear power transient calculated by TWINKLE. FACTRAN also calculates the fuel and clad temperatures. In the final stage, the average heat flux is next used in VIPRE-01 (Refer-ence 1) for calculation of the transient DNBR. The computer codes are described in Section 15.0.7.

15.4.1.4.3 Acceptance Criteria General acceptance criteria appropriate for this are:

A. An incident of moderate frequency (a Condition II event) should not generate a more seri-ous plant condition without other incidents occurring independently.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. Fuel integrity should be maintained by ensuring that the centerline fuel temperature is less than its melting temperature.

The peak RCS pressure must remain less than 110% of the design pressure throughout the transient.

Criteria A and B are explicitly evaluated in the analysis. The primary acceptance criterion is that the minimum DNBR remains greater than the safety analysis DNBR limit defined in Sec-tion 4.4. With respect to criterion C, overpressurization of the RCS is not the main concern in this analysis. This is based on the fact that the total amount of excess energy deposited in the reactor coolant is relatively small. It can be shown that the pressure transient is much less severe than the limiting ANS Condition II overpressurization event, a loss of external electri-cal load/turbine trip. Thus, the pressure transient is not explicitly analyzed for this event.

15.4.1.4.4 Results The calculated sequence of events is shown in Table 15.4-1. Figures 15.4-1 and 15.4-2 show the transient behavior for the indicated reactivity insertion rate with the accident terminated by reactor trip at 35% nominal power. This insertion rate is greater than that for the two high-est worth control banks, both assumed to be in their highest incremental worth region. Figure 15.4-1 shows the neutron power transient.

The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is also shown in Figure 15.4-1. The beneficial effect on the inherent thermal lag in the fuel is evidenced by a peak heat flux less than the full-power nominal value. There is a large margin to DNB during the transient since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at Page 120 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES all times in the core. Figure 15.4-2 shows the response of the hot spot average fuel and clad-ding temperature. The average fuel temperature increases to a value lower than the nominal full power value.

The minimum DNBR at all times remains above the safety analysis limit. The calculated sequence of events for this accident is shown in Table 15.4-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.1.5 Radiological Evaluation An evaluation of radiological consequences is not performed since no fuel or cladding fail-ures occur. Radiological consequences are negligible since fuel and clad temperatures are less than nominal full power conditions.

15.4.1.6 Conclusions No fuel or clad damage occurs. The core and the reactor coolant system are not adversely affected since the DNBR remains well above the safety analysis limit.

15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL AT POWER 15.4.2.1 Description of Event An uncontrolled rod cluster control assembly (RCCA) withdrawal at power causes an increase in core heat flux. Since the heat extraction from the steam generator lags behind the core heat generation rate until the steam pressure reaches the relief or safety value setpoint, there is a net increase in reactor coolant temperature. Unless terminated by manual or auto-matic action, this power mismatch and resultant coolant temperature rise would eventually result in a departure from nucleate boiling (DNB). To prevent the possibility of damage to the cladding, the reactor trip system (RTS) is designed to terminate any such transient with an adequate margin to DNB.

15.4.2.2 Frequency of Event The uncontrolled RCCA withdrawal at power is classified as an ANS Condition II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.4.2.3 Event Analysis The analysis of the DNB during rod withdrawal accidents is performed for a wide range of conditions. The plant is analyzed at 10%, 60% and 100% thermal power with reactivity inser-tion rates from approximately one pcm/sec to 100 pcm/sec. The extremes of moderator and doppler feedback effects are incorporated into maximum and minimum feedback cases. In addition, reactor and reactor coolant system (RCS) transient responses (including neutron flux, TAVG, pressure, and DNBR) are shown for representative rapid (100 pcm/sec) and grad-ual (5 pcm/sec) reactivity insertion cases.

Page 121 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.2.3.1 Protective Features The following design features provide protection for this event:

A. Reactor trip is actuated by a power range neutron flux trip signal if any two-out-of-four channels exceed neutron flux setpoints. High and low setpoints are used depending on whether the reactor thermal power is greater or less than approximately 8% (P-10 permis-sive).

B. Reactor trip is actuated if any two-out-of-four delta T channels exceed an overtemperature delta T setpoint. The setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

C. Reactor trip is actuated on high pressurizer pressure to protect against overpressure of the reactor coolant system. Credit for this function is not taken in the analysis of the DNB cases.

D. Pressurizer safety valves may open to provide protection against overpressure of the reac-tor coolant system.

E. Main steam safety valves (MSSVs) may open for this event and provide an additional heat sink.

Additional protection is provided by the overpower delta T and the pressurizer water high level reactor trip signals which are not credited in this analysis.

15.4.2.3.2 Single Failures Assumed No single failure in the reactor trip system will prevent the protective action credited in this analysis. The safety valves are considered passive components and are assumed not to fail to open on demand. A single failure in one train of the reactor trip system is considered the lim-iting failure.

15.4.2.3.3 Operator Actions Assumed No operator actions are credited in the analysis.

15.4.2.3.4 Chronological Description of Event The event starts with the RCCA bank withdrawal followed by reactor trip and occurrence of the minimum DNBR. The typical sequences of events, as demonstrated by two representa-tive cases with rapid and gradual RCCA withdrawal rates, are shown in Table 15.4-2.

15.4.2.3.5 Impact on Fission Product Barriers The DNBR remains greater than the DNBR safety analysis limit. No additional fuel cladding failures relative to those assumed during normal operation are anticipated. The reactor cool-ant system (RCS) pressure limits are not exceeded. The cladding and RCS pressure boundary maintain their integrity as fission product barriers.

Page 122 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES No discharge of water from the pressurizer is expected. The capacity of the pressurizer relief tank is not exceeded, and the discharged activity in the steam relief is contained ensuring con-trol of radioactive materials.

15.4.2.4 Reactor Core and Plant System Evaluation 15.4.2.4.1 Input Parameters and Initial Conditions DNB Case A. The initial reactor thermal power, reactor coolant pressure, and reactor coolant tempera-tures are at nominal values. The reactor coolant average temperature is at the maximum end of the TAVG window (576.0F) for the full power cases. Table 15.0-8 summarizes these initial conditions including TAVG values assumed for the 10% and 60% power cases.

B. Minimum and maximum reactivity feedback conditions are analyzed. For minimum nega-tive feedback, a positive (+5 pcm/ºF) moderator temperature coefficient is assumed for cases initialized below 70% power corresponding to the beginning of core life. For mini-mum reactivity feedback cases initialized at 100% power, a zero moderator temperature coefficient is assumed. A variable doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed (see Figure 15.0-2).

For maximum negative feedback, a conservatively large positive moderator density coeffi-cient and a large (in absolute magnitude) negative doppler power coefficient are assumed.

C. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the two control banks having the maximum combined worth at maximum speed.

D. The RCCA trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.

E. The reactor is tripped on high neutron flux or overtemperature delta T. Instrumentation set-points with maximum delay times are included in Table 15.0-5.

F. Uniform steam generator tube plugging level of 10% is assumed.

RCS Pressure Case A. The initial NSSS power is set to 8% (10% indicated minus 2% uncertainty) of the nominal power level. Minimum (2190 psia) and maximum (2310 psia) reactor coolant system pres-sures are analyzed. The initial reactor coolant average temperature is set to a value (553.9F) corresponding to the indicated power level of 10%.

B. Minimum reactivity feedback conditions are analyzed. For minimum negative feedback, a positive (+5 pcm/F) moderator temperature coefficient is assumed, corresponding to the beginning of core life and the power level assumed. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed (see Figure 15.0-2).

Page 123 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES C. The maximum positive reactivity insertion rate is greater than that for the simultaneous withdrawal of the two control banks having the maximum combined worth at maximum speed.

D. The RCCA trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position.

E. The reactor is tripped on high pressurizer pressure or high neutron flux. Instrumentation setpoints with maximum delay times are included in Table 15.0-5.

F. Uniform steam generator tube plugging of 10% is assumed.

15.4.2.4.2 Methodology This event is analyzed using RETRAN. This computer code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and main steam safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level. RETRAN is described in Section 15.0.7.2.

DNB Case The core limits, as illustrated in Figure 15.0-1, are used as input to RETRAN to determine the minimum DNBR during the transient. The DNBR is based on core limits originally deter-mined using the Revised Thermal Design Procedure (Reference 3). Allowances for uncer-tainties in the initial conditions are included in the predicted DNBR when using this method.

The effect of RCCA movement skewing the axial power distribution is normally accounted for in the overtemperature delta T setpoint. A compensating term, which is a function of the axial neutron flux difference, decreases the setpoint proportional to a decrease in the margin to DNB. The axial neutron flux difference compensation is not explicitly included in the accident analysis overtemperature setpoint calculation (see Table 15.0-6). This exclusion causes a larger delta T to develop prior to satisfying the overtemperature delta T trip setpoint conditions. The accident analysis trip occurs later than the corresponding plant trip for the same conditions, which results in a more conservative (lower) prediction of the minimum DNBR.

RCS Pressure Case The Revised Thermal Design Procedure is not required for the RCS Pressure cases, and the uncertainties associated with the initial conditions are applied in conservative directions (Sec-tion 15.0.1).

15.4.2.4.3 Acceptance Criteria General acceptance criteria appropriate for this Condition II event are:

A. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

B. Fuel integrity should be maintained by ensuring that the centerline fuel temperature is less than its melting temperature.

Page 124 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES C. An incident of moderate frequency should not generate a more serious plant condition with-out other incidents occurring independently.

The primary acceptance criterion is that the reactor trip system terminates the transient before the DNBR decreases below the safety analysis DNBR limit defined in Section 4.4. Reactor trip must also terminate the transient before the pressurizer overfills due to heat up and expan-sion of the reactor coolant. Overfilling must be prevented since water discharges from the pressurizer could exceed the capacity of the pressurizer relief tank and cause a more severe plant condition than the initiating Condition II event.

15.4.2.4.4 Results DNB Case The plant response to a rapid (100 pcm/sec) RCCA withdrawal incident starting at full power with minimum feedback is shown in Figures 15.4-3 through 15.4-5. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since the flux transient is rapid with respect to the thermal time constants of the plant, small changes in TAVG and pressure result, and a large margin to DNB is maintained.

The plant response for a slower (5 pcm/sec) RCCA withdrawal rate at full power with maxi-mum feedback is shown in Figures 15.4-6 through 15.4-8. Reactor trip on overtemperature T occurs after a longer period and the rise in temperature and pressure is consequently larger than for rapid control rod assembly withdrawal. Again, the minimum DNBR is greater than the safety analysis limit.

The calculated sequences of events at full power for the rapid and gradual RCCA withdrawal incidents are given in Table 15.4-2.

Figure 15.4-9 shows the minimum DNBR as a function of reactivity insertion rate at full power for the minimum and maximum reactivity feedback cases. It can be seen that the high neutron flux and overtemperature delta T trip channels provide protection over the whole range of reactivity insertion rates. The minimum DNBR is never less than the safety analysis limit.

Figures 15.4-10 and 15.4-11 show the minimum DNBR as a function of reactivity insertion rate for RCCA withdrawal incidents starting at 60% and 10% power respectively. The results are similar to the 100% power case, except that as the initial power is decreased, the range over which the overtemperature delta T trip is effective is increased. In neither case does the DNBR fall below the DNBR safety analysis limit.

In Figures 15.4-9 through 15.4-11, the shape of the curves of minimum DNBR versus reactiv-ity insertion rate are due to the reactor and reactor coolant system (RCS) transient responses and the resulting reactor trip system (RTS) protective trips.

Figure 15.4-11 is illustrative of the plants DNBR response. With respect to the minimum reactivity feedback curve, reactor trip is initiated by the high neutron flux trip for high reac-tivity insertion rates (ranging between approximately 100 pcm/sec and 24 pcm/sec). The neutron flux level in the core rapidly rises for these insertion rates, while core heat flux and Page 125 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES coolant temperature lag due to the thermal capacity of the fuel and the reactor coolant system (RCS) fluid. The reactor is tripped before significant increases in heat flux or coolant tem-perature occur, which results in higher minimum DNBRs during the transient. As the reactiv-ity insertion rate decreases within this range, the core heat flux and coolant temperatures are more nearly in equilibrium with the neutron flux and the minimum DNBR decreases. With a further decrease in reactivity insertion rate (at approximately 24 pcm/sec), the overtempera-ture delta T and high neutron flux trips become equally effective in terminating the transient.

At lower insertion rates (less than 24 pcm/sec), the effectiveness of the overtemperature delta T trip increases and the minimum DNBR values become greater. The average temperature contribution is lead-lag compensated in the overtemperature delta T circuit in order to offset piping and thermal capacity effects during power increases. With the lower insertion rates, the power increase rate and coolant average temperature rise are both slower, and the lead-lag compensation can increasingly account for the reactor coolant systems thermal lag.

For the maximum reactivity feedback curve in Figure 15.4-11, the rise in reactor coolant tem-perature is high enough to cause the main steam safety valve (MSSV) setpoint to be reached before trip. Opening the MSSVs, which act as an additional heat load on the RCS, sharply decreases the rate of rise of the RCS average temperature. The decreased rate of measured temperature rise is accentuated by the lead-lag compensation, causing the overtemperature delta T trip setpoint to be reached later, resulting in lower minimum DNBRs.

The plant response to the RCCA withdrawal incident, which is limiting (insertion rate of 55 pcm/sec) with respect to RCS pressure concerns, is shown in Figures 15.4-20 and 15.4-21.

Reactor trip on high pressurizer pressure occurs shortly after the start of the accident. After reactor trip, the pressure transient turns around prior to reaching the safety analysis limit.

15.4.2.5 Radiological Evaluation There are no additional fuel failures or releases of activity from the primary side. Discharge of secondary coolant steam activities from the atmospheric relief valves (ARVs) or MSSVs may occur for this event. The doses to unrestricted areas are minor and only a small fraction of 10 CFR 50.67 guidelines.

15.4.2.6 Conclusions The power range neutron flux and overtemperature delta T trip channels provide adequate protection over the entire range of reactivity insertion rates. These trips ensure that the DNBR is always greater than the safety analysis limit. For very slow transients, the pressur-izer water high level channels will cause a reactor trip before the overtemperature delta T trip channels to prevent the pressurizer from overfilling and becoming water solid.

15.4.3 STARTUP OF AN INACTIVE REACTOR COOLANT LOOP 15.4.3.1 Description of Event Operation of the plant with an inactive loop causes reversed flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperatures of the inac-tive and active loops are equal. If the reactor is operated at power with an inactive loop and with the secondary side of the inactive steam generator unisolated, there is a temperature drop Page 126 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES across the steam generator in the inactive loop. With the reverse flow, the hot leg temperature of the inactive loop is lower than the core inlet temperature. The re-start of the idle reactor coolant pump, without bringing the loop temperature closer to the average temperature, would result in the injection of cooler water into the core. Since the moderator temperature coefficient can be negative, the resulting feedback can cause a subsequent increase in reactor power.

15.4.3.2 Frequency of Event Startup of an inactive reactor coolant loop is classified as an ANS Condition II event of mod-erate frequency. Section 15.0.8 discusses Condition II events.

15.4.3.3 Event Analysis The plant is analyzed at 8.5% of full power since operation above this power with one inac-tive loop is prohibited by the plant Technical Specifications. The analysis is performed using conservative assumptions to demonstrate that the resulting power transient due to startup of the inactive reactor coolant pump is neither severe nor requires a trip of the reactor.

This event was not re-analyzed as the result of changes due to the 18 month fuel cycle (see Section 15.4.3.4.5).

15.4.3.3.1 Protective Features The power range neutron flux (low setting) trip provides protection against a positive reactiv-ity excursion from low power conditions such as this event. The reactor trip system (RTS) is actuated when two out of the four power range channels indicate a power level above approx-imately 25%.

The power range neutron flux (low setting) setpoint used in safety analysis (35% power) is greater than the maximum power conditions for this event; therefore, specific RTS protective actions are not credited in the analysis.

15.4.3.3.2 Single Failures Assumed No single failure in the power range neutron flux instrumentation channels or the trip actua-tion logic trains prevents the RTS from performing a protective function.

15.4.3.3.3 Operator Actions Assumed No operator actions are credited in this analysis.

15.4.3.3.4 Chronological Description of Event The plant is initially at steady state, low power conditions with one reactor coolant pump run-ning. The second reactor coolant pump is started. Reactor coolant flow instantaneously increases to nominal full flow conditions. The resulting power transient, due to the introduc-tion of the cooler reactor coolant, is analyzed for approximately forty seconds during which time the power peaks and the reactor returns to a stable condition.

Page 127 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.3.3.5 Impact on Fission Product Barriers The DNBR remains greater than the 95/95 DNBR limit for the limiting fuel rods. Reactor coolant system (RCS) pressure is expected to remain near nominal values. The cladding and RCS pressure boundary maintain their integrity as fission product barriers.

15.4.3.4 Reactor Core and Plant System Evaluation 15.4.3.4.1 Input Parameters and Initial Conditions A. The plant is operating at a low power level of 130 MWt with one reactor coolant pump run-ning.

B. A high heat transfer coefficient between the primary and secondary system is used for the inactive loop. This condition causes the temperature of the water in the inactive loop from the steam generator plenum to the reactor exit plenum to be essentially at the saturation temperature on the secondary side.

C. The core power to flow ratio is taken to be constant at the normal loop operational value.

D. The secondary side pressure corresponds to the above core power.

E. The cold leg of the active loop is conservatively 20ºF greater than the hot leg of the inactive loop, which is at the steam generator saturation temperature at the beginning of the tran-sient. The actual temperature difference is smaller since the reactor is operating at power.

F. On starting, the idle pump accelerates to full flow instantaneously, i.e., no slip, and the time to accelerate the pump and coolant is zero.

G. The delay before the slug of cold coolant reaches the inlet to the reactor core is taken as 4.0 seconds. The slug lasts 15 seconds. The cold water entering the reactor plenum chamber is assumed to mix with the water coming from the active loop.

H. A low doppler coefficient of -1.0 pcm/ºF is assumed in order to minimize the negative reac-tivity feedback from the fuel with increasing power and fuel temperature.

I. A maximum negative moderator coefficient of -35 pcm/ºF is assumed. This assumption conservatively maximizes the reactivity feedback resulting from the introduction of cooler moderator into the core.

J. The coolant temperature exiting from both steam generators is the same after the cold water slug.

15.4.3.4.2 Methodology This analysis uses an analog simulation of the plant to determine the transient response to the introduction of cooler coolant and increased flow to the core.

A detailed DNB analysis is not performed. Instead, an adequate DNBR is demonstrated by verifying that the core response (TAVG, pressurizer pressure and reactor power) does not exceed the reactor core safety limits defined in the Technical Specifications. This approach is used since the core power is appreciably below the setpoint (35% typically in safety analyses) for the power range neutron flux (low setting); reactor coolant flow and pressurizer pressure are near their nominal full power values during the transient; TAVG is less than full power Page 128 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES conditions during and after the transient. The ability to demonstrate the core safety limits are bounding ensures that the DNBR 95/95 limit is met for the limiting fuel rods. Because the power level is well below nominal full power conditions, there is ample margin available to offset miscellaneous DNBR penalties described in Section 4.4.3.

15.4.3.4.3 Acceptance Criteria General acceptance criteria appropriate for this Condition II event are:

A. Pressure in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An incident of moderate frequency should not generate a more serious plant condition with-out other incidents occurring independently.

The primary acceptance criteria are that TAVG, core thermal power, and pressurizer pressure remain bounded by the reactor core safety limits, which ensures the DNBR criterion is met.

Primary and secondary side pressure limits are not approached since TAVG decreases during the transient.

15.4.3.4.4 Results The transient responses are shown in Figures 15.4-12 through 15.4-15. Figure 15.4-12 shows that the buildup in nuclear power is slow. Figure 15.4-14 shows the decrease in core inlet temperature following startup of the inactive loop, reversal of flow, and introduction of the cold coolant. The effects of the flow of cold coolant on TAVG and pressurizer pressure are shown in Figures 15.4-13 and 15.4-15. The cold water flow is taken to last 15 seconds after the initial 4-second transient delay and accounts for the initial drop in TAVG and pressurizer pressure.

The results show that the power and temperature excursions are not severe for an initial 20ºF change in coolant temperature across the inactive loop. The increase in thermal power (Fig-ure 15.4-12) and reductions in TAVG and pressure (Figures 15.4-13 and 15.4-15) result in plant conditions that are well within the core safety limits.

The temperature change due to startup of an inactive loop is expected to be less than the nom-inal value used in the analysis. In addition, consideration of actual pump performance is expected to result in a more gradual, less severe transient. For example, the time constant of the pump is more realistically about 10 seconds versus the instantaneous change in flow assumed in the analysis.

The effects of startup of an inactive coolant loop are less severe than the effects of a small steam line break with one loop operable, originally analyzed by Westinghouse and reported in Reference 4. To accommodate the steam line break (and hence the startup of an inactive loop), the Technical Specifications require that a higher shutdown margin be maintained for one-loop operation.

Page 129 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.3.4.5 Effect of 18 Month Fuel Cycle Changes Technical evaluations were performed of the effects resulting from conversion to the 18 month fuel cycle. The evaluation (Reference 12) included consideration of the replacement steam generators, use of the Revised Thermal Design Procedure to determine the core design DNBR limit value, the extension of the full power TAVG operating window to lower tempera-tures, and the use of an increased nuclear enthalpy rise hot channel factor in core design. The evaluation determined that the analysis results are unaffected by these changes.

15.4.3.5 Radiological Evaluation An evaluation of radiological consequences is not performed since no fuel or additional clad-ding failures occur. Plant conditions during the transient are bounded by full power opera-tion.

15.4.3.6 Conclusions The peak power during the transient is a small fraction of full thermal power. The power range high neutron flux (low setting) setpoint typically assumed in safety analyses is not reached during the transient. The resulting TAVG from this transient is less than the full power TAVG, and the pressure does not change significantly from nominal full power condi-tions. The transient response is well bounded by normal full power operation.

15.4.4 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION 15.4.4.1 Description of Event Reactivity can be added to the core by feeding unborated, primary grade water into the reactor coolant system (RCS) via the reactor makeup water portion of the chemical and volume con-trol system. The normal dilution procedures call for a limit on the rate and magnitude for any dilution under strict administrative controls. Boron dilution is a manual operation. A boric acid blend system allows the operator to match the concentration of reactor coolant makeup water to that existing in the coolant. The chemical volume and control system is designed to limit, even under various postulated failure modes, the potential rate of dilution to a value that provides the operator with sufficient time to identify and terminate dilution.

There is only a single common source of reactor makeup water to the RCS from the reactor makeup water system, and isolating this source can terminate inadvertent dilution. The oper-ation of the reactor makeup water pumps is required to supply makeup water to the chemical volume and control system. The charging pumps and the reactor makeup water pumps must be running to add this makeup water to the reactor coolant system (RCS).

The rate at which unborated makeup water is added is limited by the capacity of the reactor makeup water pumps. The limiting rate is 120 gpm with both makeup pumps running (60 gpm each). For unborated water to be delivered at this rate to the RCS at pressure, two charging pumps must be operated at full speed. Normally, two charging pumps are operating at half speed, while the third pump is idle.

Page 130 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The boric acid from the boric acid storage tank is blended with the reactor makeup water in the blender and the composition is determined by the preset flow rates of boric acid and reac-tor makeup water on the reactor makeup control. Two separate operations are required to inadvertently dilute the reactor coolant system. First, the operator must switch from the auto-matic makeup mode to the dilute mode. Second, the start switch must be turned. Omitting either step would prevent dilution. This makes the possibility of inadvertent dilution very small.

Information on the status of the reactor coolant makeup is continuously available to the oper-ator. Lights are provided on the control board to indicate the operating condition of pumps in the chemical volume and control system. Alarms are actuated to warn the operator if boric acid or demineralized water flows deviate from preset values as a result of system malfunc-tion.

To cover all phases of plant operation, boron dilution during refueling (MODE 6), cold shut-down (MODE 5), startup (MODE 2), and power operation (MODE 1) are analyzed. In addi-tion, several single failure paths are considered while the plant is on residual heat removal, which addressed the concern of Reference 21.

15.4.4.2 Frequency of Event Inadvertent dilution of the reactor coolant boron concentration due to chemical volume and control system malfunctions is classified as an ANS Condition II event of moderate fre-quency. Section 15.0.8 discusses Condition II events.

15.4.4.3 Event Analysis Refueling, cold shutdown, startup, and power operation (in automatic and manual control) are considered (References 17 and 18). Initiating events, plant parameters and consequences are mode-dependent and are identified in the analysis of each postulated dilution event. The effects of the Extended Power Uprate are included.

15.4.4.3.1 Protective Features and Single Failures Assumed Various protective trips, indications, and alarms are credited depending on the boron dilution event.

15.4.4.3.1.1 Reactor in Mode 1 or Mode 2 The following reactor trip functions provide protection for this event:

1. Reactor trip if any two-out-of-four delta T channels exceed an overtemperature delta T set-point.

2. Reactor trip by a power range neutron flux trip signal if any two-out-of-four channels exceed neutron flux setpoints. High and low setpoints are used depending on reactor ther-mal power.

3. Reactor trip by an intermediate range neutron flux trip signal when either of two indepen-dent intermediate range channels indicates a flux above a pre-selected, manually adjustable setpoint.

Page 131 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES No single failure in the reactor trip system will prevent the protective action credited in this analysis. A single failure in one train of the reactor trip system is considered the limiting fail-ure when critical.

Applicable indications and alarms prior to reaching a trip setpoint include:

1. Axial flux difference alarms with the reactor in automatic control above approximately 15% power

2. Overtemperature delta T alarms

3. Overtemperature delta T turbine runback (turbine latched)

4. Control rod insertion limits low and low-low alarms with rod control in automatic in MODE 1.

15.4.4.3.1.2 Reactor in MODES 3 to 6 Source range neutron flux instrumentation provides indication to the operator when the reac-tor is in MODES 3 to 6 and at the beginning of MODE 2. Indication and alarms derived in each of two independent channels include:

1. High flux at shutdown alarm

2. Audible count rate (selected to one channel)

3. Indicated source range neutron flux The source range channels do not provide a reactor protective trip for boron dilution events; however, their monitoring function is credited in the safety analyses for indication of reactiv-ity changes resulting from boron dilution.

15.4.4.3.1.3 Indication and Alarms System status indication and alarms on the main control board for chemical volume and con-trol system and the reactor makeup water system for detection of potential boron dilution events include:

1. Indication of boric acid and blended flow rates

2. Deviation alarms if blended or boric acid flow rates deviate from preset ranges

3. Indication of pump running status for chemical volume and control system and the reactor makeup water systems 15.4.4.3.2 Operator Actions Assumed The event analyses require the operator to terminate the transients by isolating the source of flow causing the boron dilution. The minimum time intervals that must be available to the operator to identify the cause and terminate the dilution before a loss of shutdown margin occurs are calculated from the time the dilution begins. The calculated time intervals must be greater than or equal to 30 min for refueling events and greater than or equal to 15 min for all other plant operating modes. The operator is then expected to re-establish boron concentra-tions and shutdown margins required by the Technical Specifications.

Page 132 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.4.3.3 Chronological Description of Event The sequence of events depends on the plant condition at the time of the unplanned or inad-vertent coolant dilution. Each event starts with an initiating dilution flow and proceeds to a final or limiting diluted boron concentration. Additional details are described in the event analyses.

15.4.4.3.4 Impact on Fission Product Barriers The boron dilution events at power are characterized by the gradual addition of positive reac-tivity. These events are bounded by the uncontrolled RCCA withdrawal at power events ana-lyzed in Section 15.4.2 which determined that the fuel cladding and RCS pressure boundary maintain their integrity as fission product barriers. For all other dilution events not at power, fuel cladding and pressure boundary integrity are maintained since boron dilution can be ter-minated before the core can become critical. When the reactor vessel is open for refueling, overpressurization is not a concern regardless of any dilution event.

15.4.4.4 Reactor Core and Plant System Evaluation 15.4.4.4.1 Methodology Boron dilution analyses are performed to cover all phases of plant operation. For boron dilu-tion events at power, the reactivity insertion rate due to boron dilution is compared to the insertion rates used in the RCCA withdrawal at power in Section 15.4.2. The analyses in Sec-tion 15.4.2 were performed for a wide range of power, core feedback, and reactivity insertion conditions. The core response and consequences from boron dilution at power are bounded if the reactivity insertion rates fall within the analyzed ranges in Section 15.4.2.

Boron dilution events occurring when the reactor is not at power are analyzed by determining boron concentration as a function of time until shutdown margin is lost or the supply of dilut-ing fluid is exhausted. The time to the loss of shutdown margin is then compared to the acceptance criteria times for the operator to perform corrective actions.

Two types of dilution processes are considered depending on the initiating event and reactor mode:

1. Batch processes where fluid is added and the volume increases, and

2. Continuous processes where the rates of fluid addition and removal are the same.

Density corrections are used in the continuous dilution processes when the RCS and source of dilution differ in temperature and pressure. Conservative initial and critical (final) boron con-centrations are used to minimize the amount of boron that must be removed to lose shutdown margin. Maximum flow rates are used in order to maximize dilution rates.

15.4.4.4.2 Acceptance Criteria General acceptance criteria for this Condition II event are:

A. Pressures in the reactor coolant and main steam systems must be maintained below 110% of the design pressures.

Page 133 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An incident of moderate frequency must not generate a more serious plant condition with-out other faults occurring independently.

D. The operator must have available 30 minutes during refueling and 15 minutes for all other modes to terminate dilution.

The specific criteria used for the boron dilution at power event require that the reactivity insertion rates be bounded by the RCCA withdrawal at power in Section 15.4.2, and the oper-ator must have at least 15 minutes to terminate dilution. For dilution events not at power, the operator must have sufficient time as defined above to stop the transient before criticality is reached and a potentially worse plant condition occurs.

15.4.4.4.3 Dilution During Refueling (MODE 6)

The refueling (MODE 6) dilution analysis assumes the reactor coolant is at a low level up to the midplane of the vessel nozzles. The minimum boron concentration assumed in the anal-ysis is based on a ratio of initial boron concentration to critical boron concentration and is cycle specific. Periodic sampling ensures the concentration is maintained.

The valves on the suction side of the charging pumps (i.e., from the volume control tank) are adjusted to maintain refueling water boron concentration by the addition of concentrated boric acid solution. Administrative procedures limit the charging flow to one pump (with two pumps locked out) during refueling. The maximum dilution occurs if two charging pumps are inadvertently operated at full flow while aligned to the reactor makeup water system.

During refueling, the operator has prompt and definite indication of any boron dilution from the audible count rate derived from the source range BF3 detector instrumentation. The count rate increases exponentially as the reactor approaches criticality. In addition to audible count rate, high count rate is alarmed in the main control room.

15.4.4.4.3.1 Input Parameters and Initial Conditions A. The reactor coolant system (RCS) pressure is 14.7 psia and temperature is 140ºF. The reac-tor makeup water is initially 40ºF, which maximizes the effect of the diluting volume added to the RCS.

B. One residual heat removal pump is running with cross-ties open to ensure continuous, uni-form mixing of the coolant in the reactor vessel.

C. A minimum RCS water volume of 2041 ft3 is used. This value corresponds to the volume of the residual heat removal system with cross-ties open and the reactor vessel filled to the nozzle midplane.

D. The maximum dilution flow of unborated water is 120 gpm. This condition requires the inadvertent operation of two charging pumps to supply the maximum possible flow from the reactor makeup water system.

E. The minimum ratio of initial boron concentration over the critical boron concentration is 1.2914.

Page 134 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES F. Valve 289 in the seal injection flowpath to the reactor coolant pumps is closed. This condi-tion results in the maximum amount of dilution since the entire charging (diluting) flow goes to the vessel.

15.4.4.4.3.2 Results The dilution of the refueling water takes greater than 30 minutes. This period is ample time for the operator to recognize the audible high count rate signal and isolate the reactor makeup water source by closing valves and stopping the reactor makeup water pumps.

15.4.4.4.4 Dilution During Cold Shutdown (MODE 5)

A plant-specific evaluation of the boron dilution event during cold shutdown was performed.

This evaluation is based upon the operating procedure outlined in Reference 2. The operating procedure is based upon a generic boron dilution analysis assuming active RCS and RHR vol-umes which are consistent with respect to Ginna. Additionally, the operating procedure accommodates mid-loop cold shutdown operation. The operating procedure is applicable for maximum dilution flow rates up to 300 gal/min and minimum RHR flow rates of 1000 gal/

min. Current plant procedures require one reactor makeup water pump to be secured when no reactor coolant pumps are running, limiting the maximum dilution flow rate to 120 gal/min.

In the event of a boron dilution accident during plant shutdown, use of the operating proce-dure provides the plant operator with sufficient information to maintain an appropriate boron concentration to conservatively assure at least 15 min will be available for operator action to terminate the dilution prior to the reactor reaching a critical condition.

15.4.4.4.5 Dilution at Startup (MODE 2)

The reactor is at hot zero power (HZP) conditions in MODE 2 when unborated reactor makeup water is unintentionally added to the RCS via the operation of two charging pumps.

This event can only occur if the reactor makeup water system is aligned to the charging pump suction header due to multiple valve lineup problems in the chemical volume and control sys-tem.

15.4.4.4.5.1 Input Parameters and Initial Conditions A. The RCS is at nominal hot zero power (HZP) conditions of 2250 psia and 547ºF. The reac-tor makeup water is initially 40ºF.

B. The maximum unborated dilution flow is 120 gpm.

C. The volume of reactor coolant is 5123 ft3. This is the volume of the RCS excluding the pressurizer and surge line. This volume assumes 10% steam generator tube plugging.

D. The critical boron concentration is 1800 ppm with all but the most reactive RCCA inserted.

The use of a boron concentration greater than the actual critical boron concentration conser-vatively reduces the dilution transient time.

E. The minimum change in boron concentration from a condition of HZP, no xenon, with all but the most reactive RCCA inserted in the core to a condition of HZP, no xenon, with all RCCAs at their insertion limits is 200 ppm.

Page 135 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES F. Based on (D) and (E), the minimum initial boron concentration is 2000 ppm.

15.4.4.4.5.2 Results The time to reduce the reactor coolant boron concentration from 2000 ppm to 1800 ppm is about 25 minutes. Once again, this time is adequate for the operator to terminate dilution flow.

15.4.4.4.6 Dilution at Power (MODE 1)

For dilution at power, the time to lose shutdown margin must be long enough to allow identi-fication of the problem and terminate dilution. Boron dilution, however, starts before the operator can detect dilution at power. The times necessary for detection must be considered because they decrease the time available to the operator to start corrective actions before reaching minimum concentration limits.

As noted in Section 15.4.4.3.2, there must be at least 15 min from the initiation of the event until plant shutdown margin is lost. For conservatism, the Mode 1 calculations calculate the time from reactor trip until shutdown margin is lost for manual rod control, and time from the lo-lo rod insertion alarm until shutdown margin is lost for automatic rod control. For all other modes, the time is from initiation of the event.

For this event, the effective reactivity addition rate is a function of the reactor coolant tem-perature and boron concentration. The reactivity insertion rate is based on conservative val-ues for the expected boron concentration at power and for the charging flow. Again, the reactor makeup water system is assumed to be unintentionally aligned to the charging pumps through the chemical volume and control system.

15.4.4.4.6.1 Input Parameters and Initial Conditions A. The initial coolant average temperature is 580F (high TAVG of 576F + 4ºF uncertainty).

The initial pressurizer pressure is 2250 psia. The reactor makeup water is initially 40ºF.

This set of initial conditions minimizes the boron dilution times.

B. A conservatively high charging flow of 127 gpm is used.

C. The volume of reactor coolant is 5123 ft3 and includes the active RCS as described in Sec-tion 15.4.4.4.5.

D. The critical boron concentration is 1800 ppm. This value is for hot zero power (HZP), no xenon, and all RCCAs inserted except for the most reactive RCCA.

E. The reactor has all rods out at the full power insertion limits in either automatic or manual control.

F. The minimum change in boron concentration from a condition of HZP with all RCCAs inserted except for the most active RCCA out of the core to a condition of hot full power (HFP) with all RCCAs at their insertion limits is 300 ppm.

G. A conservative boron concentration of 2100 ppm at power is assumed, following from (D) and (F).

Page 136 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.4.4.6.2 Results With the reactor in manual control and no operator action taken to terminate the transient, the increase in power and temperature cause the reactor to reach a reactor trip setpoint (i.e., over-temperature delta T or high nuclear flux). After reactor trip, which occurs at approximately three minutes into the transient, the operator has more than 15 minutes to stop dilution before the reactor returns to criticality. With the reactor in manual control, the boron dilution tran-sient is essentially equivalent to an uncontrolled rod withdrawal at power. The maximum reactivity insertion rate for a boron dilution transient is conservatively 2.4 pcm/sec, which is within the range of insertion rates analyzed for the uncontrolled RCCA withdrawal at power in Section 15.4.2. Prior to the reactor trip, the operator will have received alarms on overtem-perature delta T and turbine runback.

With the reactor in automatic controla, a boron dilution will result in a power and temperature increase such that the rod control system will attempt to compensate by the slow insertion of the control rods. This action will result in rod insertion limit and axial flux alarms. The mini-mum time to the complete loss of shutdown margin after the alarms is greater than 15 minutes at beginning-of-life. The time is significantly longer at the end-of-life due to the lower critical boron concentration needed to make the core subcritical.

15.4.4.4.7 Dilution from a Single Failure While in Residual Heat Removal Mode -

Inadvertent Draining of the Spray Additive Tank.

A review (Reference 13) of system flow diagrams and testing procedures for the containment sprays pumps and eductors determined there is no single failure or operator error that could result in introducing sodium hydroxide into the residual heat removal system; therefore, a boron dilution event via this path is not considered possible.

15.4.4.4.8 Dilution from a Single Failure While in Residual Heat Removal Mode (MODE

5) -Boron Dilution from the Reactor Coolant Drain Tank.

The contents of the reactor coolant drain tank are normally pumped to the waste holdup tank or the chemical volume and control system holdup tanks for processing. One manual valve on the outlet side of each reactor coolant drain pump separates the pump discharge from the residual heat removal system. If one of these valves is inadvertently opened (single failure) the flow from the reactor coolant drain tank would be split between the normal flow path and the residual heat removal system depending on the head difference between the two discharge points. The worst case dilution occurs if the entire contents of the reactor coolant drain tank are pumped into the residual heat removal system.

15.4.4.4.8.1 Input Parameters and Initial Conditions A. The reactor coolant drain tank is completely full with 350 gal of unborated water.

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 137 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES B. The reactor is in cold shutdown at 2.45% (delta k)/k. The cold shutdown boron concentra-tion is initially 1655 ppm with all RCCAs inserted except for the most active RCCA stuck out of the core.

C. The RCS is on residual heat removal with the water level drained down to the midplane of the nozzles. The reactor coolant volume available for dilution is 2000 ft3.

D. Boron worth at cold shutdown is 90 ppm/(% delta k)/k.

15.4.4.4.8.2 Results The resulting dilution is small due to the relatively small volume of the reactor coolant drain tank compared to the volume of water in the reactor vessel. Dilution is terminated when the volume of water in the reactor coolant drain tank is depleted. This dilution event results in a reactivity insertion of less than 0.5% (delta k)/k.

15.4.4.4.9 Dilution from a Single Failure While in Residual Heat Removal Mode (MODE

5) -Boron Dilution Due to Resin Changing in the Purification System.

A postulated boron dilution event could occur during the changing of resins in the reactor coolant purification system as follows:

1. The B deborating demineralizer is lined up for normal operation with the inlet valve closed. The A deborating demineralizer is being lined up to flush its resins.

2. The resin outlet valve on the B deborating demineralizer is inadvertently opened (single failure).

3. When the A deborating demineralizer resin outlet valve is opened, a flow path is made from the reactor makeup water system to the A deborating demineralizer through the B demineralizer to the normal low-pressure letdown system to the residual heat removal sys-tem.

The resin flush procedure requires the operator to monitor the radioactivity through the A deborating demineralizer resin outlet valve and secure the reactor makeup water when the activity reduces to near background. Therefore, the dilution event would be terminated when the resin is flushed from the A deborating demineralizer. Failure to secure the reactor makeup water would be a second failure which is beyond the scope of this analysis. Nonethe-less, this dilution incident has been analyzed to determine the margins available.

In addition to the audible source range signal, the operator has loop levels indicators to aid in detection of this dilution event. The level indicators are installed in the control room when-ever the RCS is operating on residual heat removal with the loops partially drained (see Sec-tion 5.4.5.4.3).

15.4.4.4.9.1 Input Parameters and Initial Conditions A. The reactor is in cold shutdown at 2.45% (delta k)/k with an initial boron concentration of 1655 ppm.

Page 138 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES B. The RCS is on residual heat removal with the water level drained down to the midplane of the nozzles. The reactor coolant volume available for dilution is 2000 ft3.

C. The design flow of one reactor makeup water pump is used as the diluting flow rate, 60 gpm.

D. Boron worth at cold shutdown is 90 ppm/(% delta k)/k.

E. A dilution time of 10 minutes is assumed.

F. The critical boron concentration is 1328 ppm for a cold core, beginning of life, with all but the most reactive RCCA inserted.

15.4.4.4.9.2 Results After 10 minutes of flushing, the volume of water in the A deborating demineralizer would have been changed approximately three times. By this time, the activity in the resin outlet valve would have returned to near background and the source of dilution water secured. Less than 0.71% (delta k)/k would be added through dilution during this period, and the shutdown margin requirement in the Technical Specifications for one loop in operation can still be met.

If it is assumed that the source of dilution is not secured, it would take 61 minutes of dilution before the reactor could go critical. This is ample time for the operator to recognize the audi-ble change in the source range count rate signal and the increase in the RCS loop level and isolate the source of dilution.

15.4.4.4.10 Dilution from a Single Failure While in Residual Heat Removal Mode (MODE

6) -Boron Dilution from Reactor Coolant Drain Tank After Refueling.

A postulated boron dilution could occur following refueling (MODE 6) when the fuel transfer canal is washed down using demineralized water. This scenario is similar to Section 15.4.4.4.9 except the reactor coolant drain tank is refilled with demineralized water. If a valve on the outlet side of the reactor coolant drain tank pump is inadvertently left open, the flow would split (depending on head difference) between the waste holdup tank and the resid-ual heat removal system. Again, the worst-case dilution occurs if the entire flow goes into the residual heat removal system.

15.4.4.4.10.1 Input Parameters and Initial Conditions A. The RCS is on residual heat removal with the water level drained down to the midplane of the nozzles. The reactor coolant volume is initially 2000 ft3.

B. The initial boron concentration is 2300 ppm (the minimum concentration required for refu-eling (MODE 6) by the Technical Specifications).

C. The critical boron concentration is 1330 ppm with all RCCAs in the core during refueling.

D. The dilution flow is 150 gpm based on the larger of the two reactor coolant drain tank pumps.

15.4.4.4.10.2 Results Greater than 50 minutes of continuous dilution would be required before the reactor could go critical. In addition, the volume of water in the RCS is increased more than 50%. This is Page 139 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ample time for the operator to isolate the source of dilution after recognizing the change in the audible source range count rate signal or the increase in the RCS loop level.

15.4.4.5 Radiological Evaluation Dilution events at power are similar to a gradual rod withdrawal at power. The radiological consequences are bounded by the minor doses at the exclusion area boundary (EAB) assessed in Section 15.4.2. For all other dilution events, radiological consequences are negligible since boron dilution is terminated before the reactor becomes critical.

15.4.4.6 Conclusions An erroneous dilution is considered highly unlikely because boration processes are controlled by plant procedures and administrative controls. Nevertheless, if an unintentional dilution of boron in the reactor coolant system occurs, numerous alarms and indications are available to alert the operator to the condition. The reactivity addition is gradual enough to allow the operator adequate time to recognize and terminate the dilution before all shutdown margin is lost.

15.4.5 RUPTURE OF A CONTROL ROD DRIVE MECHANISM HOUSING - ROD CLUSTER CONTROL ASSEMBLY EJECTION 15.4.5.1 Description of Event In order for this accident to occur, a rupture of the control rod drive mechanism housing must be postulated creating a full system pressure differential acting on the drive shaft. The resul-tant core thermal power excursion is limited by the doppler reactivity effect of the increased fuel temperature and terminated by a reactor trip actuated by power range flux trip signals.

A failure of a control rod drive mechanism housing which allows a rod cluster control assem-bly (RCCA) to be rapidly ejected from the core is not considered credible for the following reasons:

A. Each control rod drive mechanism housing is completely assembled and shop-tested per the requirements of the ASME Code, and subjected to inservice leak checks during plant start up.

B. The mechanism housings are individually hydrotested at 3105 psig as they are installed on the reactor vessel head to the head adapters and checked during the hydrotest of the com-pleted reactor coolant system (RCS).

C. Stress levels in the mechanism are not affected by system transients at power or by the ther-mal movement of the coolant loops. Moments induced by the design-basis earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class A components.

D. The latch mechanism housing and rod travel housing are each a single length of forged type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures that will be encountered. The joints between the latch mechanism housing and rod travel hous-ing are threaded joints reinforced by canopy-type rod welds.

Page 140 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.5.1.1 Nuclear Design Even if a rupture of a control rod drive mechanism housing is postulated, the use of chemical shim inherently limits the severity of an ejected RCCA. In general, the reactor is operated with the RCCAs inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated for by boron changes. Further, the location and grouping of RCCA banks are selected during the nuclear design to lessen the severity of a RCCA ejection accident. Therefore, should a RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, is expected.

However, it may be occasionally desirable to operate with larger than normal insertions. For this reason, a rod insertion limit is defined as a function of power level. Operation with the RCCAs above this limit guarantees adequate shutdown capability and acceptable power dis-tribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if a RCCA bank approaches its insertion limit or if one RCCA deviates from its bank. Operating instructions require boration at the low and low-low level alarms.

15.4.5.1.2 Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of a control rod drive mechanism hous-ing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to the worst ejected rods are not in the core when the reactor is critical. Damage to an adja-cent housing could, at worst, cause the RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod is adjacent to the ejected rod.

15.4.5.2 Frequency of Event This event is classified as an ANS Condition IV limiting fault. Due to the extremely low pos-sibility of a RCCA ejection accident, some fuel damage could be considered an acceptable consequence. Section 15.0.8 discusses Condition IV limiting faults.

15.4.5.3 Event Analysis The four cases analyzed cover the range of possible initial reactor conditions to assure conser-vative predictions of possible fuel damage Case (1) Beginning of Life, Full Power Case (2) Beginning of Life, Zero Power Case (3) End of Life, Full Power Case (4) End of Life, Zero Power 15.4.5.3.1 Protective Features The following protective features are available for this event:

Page 141 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES A. For the zero power case, reactor trip is actuated by the power range neutron flux low trip signal when two out of the four power range channels indicate a power level above approx-imately 25%. This setting is manually blocked when increasing power (in conjunction with the P-10 permissive) and is automatically reinstated when power decreases below the approximately 8% (P-10 permissive).

B. For the full power case, reactor trip is actuated by the power range neutron flux high trip signal when two out of the four power range channels indicate a power level above approx-imately 108%. This trip function is always active.

The power range high flux trip low and high settings is the only automatic reactor trip cred-ited in this analysis.

15.4.5.3.2 Single Failures Assumed No single failure in the power range flux instrumentation channels or the trip actuation logic trains will prevent the reactor trip system from performing its protective function or adversely affect the consequences of this accident.

15.4.5.3.3 Operator Actions Assumed No operator actions are assumed in this analysis; however, the operator is expected to follow appropriate mitigation procedures if the reactor depressurizes due to the failed control rod drive housing.

15.4.5.3.4 Chronological Description of Event Table 15.4-4 gives the sequence of events for the RCCA ejection accident for all four cases:

beginning of life full and zero power, and end of life full and zero power.

15.4.5.3.5 Impact on Fission Product Barriers Limited cladding damage may occur during a RCCA ejection accident. The maximum enthalpy addition to the fuel pellets is insufficient to cause the prompt rupture of the fuel and the immediate mechanical failure of the cladding. The fuel and cladding damage is minimal and core cooling geometry is maintained. Although prompt fuel rupture does not occur, the nuclear heat flux can exceed the amount required to cause localized DNB for less than 10% of the fuel rods. For these rods, cladding perforations are assumed with the consequential release of fission product gap activity to the reactor coolant.

The RCS pressure boundary integrity can be violated because the ejection of an RCCA and failure of the drive housing can result in a small break (approximately 2 in2) in the reactor vessel head. The pressure transient caused by the power excursion remains less than the faulted condition permitted by the ASME Boiler and Pressure Vessel Code,Section III (even with no credit for pressure relief through the break area). The pressure rise does not result in additional damage to the pressure boundary. The pressure boundary function, although potentially lost at the vessel, remains intact in the steam generators. Thus, the steam genera-tor tubes can serve as a fission product barrier against the transport of activity to the second-Page 142 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ary side of the steam generators during the transient. The containment system remains available as a barrier for the activity released through the failed housing.

15.4.5.4 Reactor Core and Plant System Evaluation 15.4.5.4.1 Input Parameters and Initial Conditions A. For the full power cases, the core is at 1811 MWt . The reactor coolant average tempera-ture is at the maximum end of the nominal TAVG window, plus uncertainties (580.0F) .

B. For the hot zero power cases, the RCS is at the no load TAVG (547ºF) temperature. One reactor coolant pump is running. Table 15.0-8 summarizes these initial conditions.

C. The RCCA bank for the ejected rod is at the maximum insertion limits permitted by the technical specifications. This condition results in the ejected RCCA having its maximum reactivity worth during the transient.

D. Conservative moderator density coefficients are used for the beginning and end of life. The coefficients selected minimize the negative reactivity feedback due to core moderator heat-up during the transient. The moderator density coefficient curves are determined by adjust-ing the critical boron concentrations using the nuclear core design codes.

E. The doppler reactivity defect is determined as a function of power level. A doppler weight-ing factor is applied as described in Section 15.4.5.4.2.4. The doppler defect and weighting factor are given in Table 15.4-3. A minimum (absolute value) defect maximizes the nuclear power peak for the full power and zero power cases.

F. Pessimistic estimates of the effective delayed neutron fraction (betaeff) of 0.49% at begin-ning of cycle and 0.43% at end of cycle are used. Calculations typically yield values no less than 0.70% at beginning-of-life and 0.50% at end-of-life for the first cycle. The acci-dent is sensitive to the delayed neutron fraction if the ejected rod worth is equal to or greater than betaeff such as in zero power transients. Use of the conservative values maxi-mizes the nuclear power rises for the full and zero power cases.

G. The trip reactivity insertion assumed is given in Table 15.4-3 and includes the effect of one stuck RCCA. The shutdown reactivity is simulated by dropping a rod of the required worth into the core. A curve of rod insertion versus time is used which assumes that insertion to the dashpot does not occur until 1.8 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip setpoint before significant shutdown reactivity is inserted into the core.

H. The start of rod motion occurs 0.5 seconds after the high neutron flux trip setpoint is reached. A high neutron flux setpoint of 118% is used which is conservative compared to the 115% setpoint required by the rod withdrawal at power analysis. This delay is assumed to consist of 0.2 seconds for the instrument channel to produce a signal, 0.15 seconds for the trip breaker to open, and 0.15 seconds for the coil to release the rods.

15.4.5.4.2 Methodology The RCCA ejection transient is analyzed in two stages: first, an average core channel calcu-lation, and then a hot region calculation. The average core calculation is performed using Page 143 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES spatial neutron kinetics methods to determine the average power generation with time includ-ing the various total core feedback effects, i.e., doppler and moderator reactivities. The hot spot enthalpy and temperature transients are determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient.

A detailed discussion of the analysis method is in Reference 19.

15.4.5.4.2.1 Average Core Analysis The spatial kinetics computer code, TWINKLE (Reference 5), is used for the average core transient analysis. TWINKLE solves the two-group neutron diffusion theory kinetics equa-tion in one, two, or three spatial dimensions for six delayed neutron groups and up to 2000 spatial points. The computer code includes a multi-region, transient fuel-clad-coolant heat transfer model for calculation of pointwise doppler and moderator feedback effects. Further description of TWINKLE appears in Section 15.0.7.3.

TWINKLE is used in the analysis as a one-dimensional axial kinetics code since it allows a more realistic representation of the spatial effects of axial moderator feedback and rod cluster control assembly movement. Because the radial dimension is missing, it is still necessary to employ very conservative methods (described in Section 15.4.5.4.2.2) for calculating the ejected rod worth and hot channel factor.

15.4.5.4.2.2 Ejected Rod Worths and Hot Channel Factors The values for the ejected rod worth and hot channel factor are calculated using either three-dimensional static methods or by a synthesis method employing one-dimensional and two-dimensional calculations. Standard nuclear design codes are used to determine rod worths and hot channel factors. No credit is taken for the flux flattening effects of reactivity feed-back. The calculation is performed for the maximum allowed bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation.

Appropriate margins are added to the ejected rod worth and hot channel factors to account for calculation uncertainties.

15.4.5.4.2.3 Hot Spot Analysis In the hot spot analysis, the initial heat flux is equal to the nominal value times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 seconds, the time for full ejection of the rod. Therefore, the assump-tion is made that the hot spot locations before and after ejection are coincident. This assump-tion is very conservative because after ejection, the peak heat flux occurs in or adjacent to the assembly with the ejected rod, and before ejection, the power in this region is necessarily depressed.

The hot spot analysis is performed using the detailed fuel and cladding transient heat transfer computer code, FACTRAN (Reference 7). This computer code calculates the transient tem-Page 144 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES perature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant condi-tions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative pellet radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat trans-fer before DNB and the Bishop-Sandburg-Tong correlation to determine the film-boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used assum-ing zero bulk fluid quality. The DNBR is not calculated; instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calcu-lated by the code; however, it is adjusted in order to force the full power steady-state tempera-ture distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 15.0.7.1.

15.4.5.4.2.4 Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels where the power is higher than average. Thus, the effect of reactivity feedback is larger than that predicted by a simple single channel analysis as performed in TWINKLE.

Physics calculations are performed for temperature changes with a flat temperature distribu-tion and with a large number of axial and radial temperature distributions. Reactivity changes are compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single channel feedbacks, correct them to effec-tive whole core feedbacks for the appropriate flux shape.

In this analysis, since a one-dimensional (axial) spatial kinetics method is employed, axial weighting is unnecessary if the initial condition is made to match the ejected rod configura-tion. A radial doppler weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time to account for the missing spatial dimen-sion. The selection and use of doppler weighting factors have also been shown to be conser-vative compared to three-dimensional analyses (Reference 19). No weighting is applied to the moderator feedback.

15.4.5.4.2.5 System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likeli-hood of fuel dispersal into the coolant. The pressure surge may then be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.

A detailed calculation of the pressure surge for an ejected rod worth of one dollar at beginning of life, hot full power, indicates that the peak pressure does not exceed that which would cause reactor pressure vessel stress to exceed the faulted condition stress limits (Reference 19).

Page 145 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.5.4.3 Acceptance Criteria The following acceptance criteria used for the RCCA ejection accident ensure that there is lit-tle or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves:

A. Average fuel pellet enthalpy at the hot spot must be below 200 cal/g.

B. Fuel melting will be limited to less than the innermost 10% of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion (A) above.

C. Peak reactor coolant pressure must be less than that which could cause component stresses to exceed the faulted condition stress limits in the ASME Boiler and Pressure Vessel Code,Section III.

D. Any activity release must result in doses at the exclusion area boundary (EAB) within the guidelines of 10 CFR 50.67.

Criteria A and B are derived from comprehensive studies of the threshold of fuel failure and the threshold of significant conversion of the fuel's thermal energy to mechanical energy car-ried out as part of the SPERT project by the Idaho Nuclear Corporation. Extensive tests of UO2 zirconium-clad fuel rods representative of those in pressurized-water reactor type cores demonstrated failure thresholds in the range of 240 cal/g to 257 cal/g. Other rods of a slightly different design (such as those used in boiling water reactors) exhibited failures as low as 225 cal/g. These results differ significantly from the TREAT results, which indicated a failure threshold of 280 cal/g. Limited results indicate that this threshold decreases by about 10%

with fuel burnup.

The clad failure mechanisms appear to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/g for unirradiated rods and 200 cal/g for irradiated rods; catastrophic failure (large fuel dispersal, large pressure rise) even for irradi-ated rods did not occur below 300 cal/g.

The original FSAR included an additional criterion that the average clad temperature at the hot spot must remain below 2700ºF. The elimination of this criterion as a basis for evaluating RCCA ejection results is consistent with the revised Westinghouse acceptance criteria for this event described in Reference 6.

The RCS pressure boundary and the offsite activity release criteria are consistent with the guidance in ANSI/ANS N18.2-1973 for Condition IV events (Reference 20).

15.4.5.4.4 Results The results of the analysis performed for the four cases is given in Table 15.4-3. The analyses were performed for both the 422V+ and the OFA fuel types. As expected, the OFA design was shown to be more limiting than the 422V+ fuel design due to the dimensional differences between the two fuel designs. The results presented are those of the most limiting type (OFA). The nuclear power and hot spot fuel and clad temperature transients are presented in Page 146 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Figures 15.4-16a, 15.4-16b, 15.4-17a and 15.4-17b. The sequences of events for these cases are presented in Table 15.4-4.

For all cases, reactor trip occurs very early in the transient, the trip terminates the nuclear power excursion, and the reactor remains subcritical.

The ejection of a RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents are discussed in Section 15.6. Following the RCCA ejection, the operator would follow the same emergency instruc-tions as for any other loss-of-coolant accident to recover from the event.

15.4.5.4.4.1 Beginning of Life, Full Power - Case (1)

For Case (1), control bank D was assumed inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.32% delta k and 5.00, respectively. The maximum clad average temperature reached was 2313ºF. The peak hot spot fuel center temperature reached melting, conservatively assumed at 4900ºF. How-ever, melting was restricted to less than 10% of the pellet.

15.4.5.4.4.2 Beginning of Life, Zero Power - Case (2)

For Case (2), control bank D was assumed to be fully inserted and banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.75%

delta k and a hot channel factor of 11. The clad average temperature reached 2881ºF; the maximum fuel center temperature was 3934ºF.

15.4.5.4.4.3 End of Life, Full Power - Case (3)

For Case (3), control bank D was assumed inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.40% delta k and 5.69, respectively. This resulted in a maximum clad average temperature of 2306ºF. The peak hot spot fuel temperature reached melting, conservatively assumed at 4800ºF. However, melting was restricted to less than 10% of the pellet.

15.4.5.4.4.4 End of Life, Zero Power - Case (4)

The ejected rod worth and hot channel factors for Case (4) were obtained assuming control bank D to be fully inserted and banks C and B at their insertion limits. The results were 0.90% delta k and 12.0, respectively. The maximum clad average and fuel center tempera-tures were 2981 ºF and 3920 ºF. The doppler weighting factor for Case (4) is significantly higher than for the other cases due to the very large transient hot channel factor.

15.4.5.4.4.5 Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that which could cause stress to exceed the faulted condition stress limits. Since the severity of the present analysis does not exceed the worst-case analysis, the accident will not result in an excessive pressure rise or further damage to the RCS.

Page 147 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.4.5.4.4.6 Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the hotter side of the rod (that is, toward the hot spot). Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. Since the 14 x 14 fuel design is also under-moderated, the same effect would be observed. In practice, no signifi-cant bowing is anticipated since the structural rigidity of the core is more than sufficient to withstand the forces produced.

Boiling in the hot spot region would produce a net flow away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling sufficient to distort the lattice is hypothetically postulated, the large void frac-tion in the hot spot region would produce a reduction in the total core moderator to fuel ratio and a large reduction in this ratio at the hot spot. The net effect would therefore be negative feedback. It can be concluded that no conceivable mechanism exists for net positive feedback resulting from lattice deformation. In fact, small negative feedback may result. The effect is conservatively ignored in the analysis.

15.4.5.5 Radiological Evaluation As part of the Control Room Emergency Air Treatment System (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistency, new x/Q values and off-site doses were also analyzed. Reference 22 is now considered to be the Control Rod Ejection Accident (REA) dose analysis of record. The analysis was per-formed using the alternate source term (AST) per 10CFR 50.67 and Reference 23. The new methodology and anlysis was approved by the NRC in Reference 24 as supplemented by Ref-erence 25. The assumptions used in the analysis are summarized in Table 15.4-5 and the results are contained in Table 15.4-6.

15.4.5.6 Conclusions Conservative analyses indicate that the fuel and cladding limits are not exceeded, and there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, there is no dan-ger of further damage to the RCS. Generic analyses have demonstrated that the fission prod-uct release, as a result of a number of fuel rods entering DNB, is limited to less than 10% of the fuel rods in the core.

15.4.6 ROD CLUSTER CONTROL ASSEMBLY DROP 15.4.6.1 Description of Event Dropping of a full-length rod cluster control assembly (RCCA) occurs when the drive mecha-nism is de-energized. A dropped RCCA would cause a power reduction and an increase in Page 148 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES the hot channel factor. If no protective action occurred, the rod control system would restore the power level to the pre-event level. This action could lead to a reduced safety margin or possibly DNB, depending upon the magnitude of the resultant hot channel factor.

If a RCCA drops into the core during power operation, it would be detected by a rod bottom signal, by an ex-core nuclear instrument, or by both. The microprocessor rod position indica-tion (MRPI) system senses each RCCAs position and provides a rod bottom signal for any dropped RCCA (MRPI indication of 0 or 8 steps is indication of rod on bottom due to the 422V+ fuel). The other independent indication of a dropped RCCA is derived from the ex-core power range nuclear instruments. This rod drop detection circuit is actuated when a rapid decrease in the local neutron flux is sensed in any of the four channels. The circuitry is designed to accommodate normal load variations in order to avoid spurious actuation. A rod drop signal from the rod position indication channel or from one or more of the four power range channels blocks further automatic rod withdrawala by the rod control system.

15.4.6.2 Frequency of Event The dropped RCCA(s), dropped RCCA bank, and statically misaligned RCCA incidents are classified as ANS Condition II events of moderate frequency. Section 15.0.8 discusses Con-dition II events.

15.4.6.3 Event Analysis The following events are analyzed:

Case (1) One or more dropped RCCAs from the same group. RCCA banks are in automatic control.

Case (2) A dropped RCCA bank. RCCA banks are in automatic control.

Case (3) A static misalignment where the worst-case RCCA is fully inserted with bank D fully withdrawn.

Case (4) A static misalignment where the worst-case RCCA is fully inserted with bank D at its insertion limit.

Case (5) A static misalignment where the worst-case RCCA remains fully withdrawn when bank D is at its insertion limit.

Cases (1) and (2) are analyzed in the automatic control modes because failure of the rod block system to function would result in the rod control system remaining in automatic con-trol mode.

15.4.6.3.1 Protective Features Two independent systems consisting of the rod bottom detection and power range nuclear instrumentation systems provide redundant input to the rod control system to prevent rod withdrawalb when in automatic control. The rod drop protection does not perform a reactor

a. The automatic rod withdrawal function of the reactor coolant system has been disabled. The block automatic rod withdrawal function on a rod drop is no longer used.

Page 149 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES protective trip or an emergency safety features mitigating function (i.e., no credit for any direct trip due to the dropped rods is taken). The rod withdrawal block is neither safety grade nor credited in the analysis.

The normal rod control system (manual mode of operation) may be used by the operator to recover from this event but is not required to mitigate the transient.

15.4.6.3.2 Single Failures Assumed No single failure is postulated since the limiting cases require no mitigating actions of safety-related equipment .

15.4.6.3.3 Operator Actions Assumed No operator actions are credited in the analysis of this event to satisfy the acceptance criteria.

Because the Technical Specifications limit the time allowed in this configuration, the operator is expected to take action to establish stable plant conditions per the appropriate procedures.

15.4.6.3.4 Chronological Description of Event The reactor is initially at steady state, full power for all cases. For Cases (1) and (2) the tran-sient continues after rod drop until minimum DNBRs are obtained and nuclear power returns to quasi-steady state conditions. No chronology is defined for Cases (3) to (5) since the inser-tions resulting from the misaligned RCCA configurations are analyzed under steady state conditions.

15.4.6.3.5 Impact on Fission Product Barriers The DNBR is maintained greater than the safety analysis limit for this event. No fuel clad-ding failures are expected. The reactor coolant system pressure does not increase signifi-cantly during these events. The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.4.6.4 Reactor Core and Plant System Evaluation 15.4.6.4.1 Input Parameters and Initial Conditions A. The initial reactor power, flow, pressure and temperature are assumed at their nominal val-ues as shown in Table 15.0-8. The reactor coolant average temperature is at the maximum TAVG (576.0 ºF).

B. Automatic and manual rod controls are operable depending on the rod drop event analyzed.

Both modes are considered since the control mode can increase the severity of the event.

C. The pressurizer spray and pressurizer power operated relief valves are operational since they reduce primary system pressure and minimize the calculated DNBR values.

D. No automatic power reduction features such as turbine runback are actuated.

b. The automatic rod withdrawal function of the reactor coolant system has been disabled. The block automatic rod withdrawal function on a rod drop is no longer used.

Page 150 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES E. The core life is at its most limiting time with respect to DNB.

15.4.6.4.2 Methodology 15.4.6.4.2.1 One or More Dropped Rod Cluster Control Assemblies From the Same Group LOFTRAN and VIPRE-W are used in this analysis. The capabilities of these codes are described in Section 15.0.7.

LOFTRAN is used to determine the transient reactor state points (temperature, pressure, and power). The transient reactor statepoints are based on a generic 2-loop dropped rod analysis performed as part of the Westinghouse Owners Group (WOG) dropped rod protection modifi-cation program, WCAP-11394-P-A (Reference 9). Nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power conditions specific to Ginna. By incorporating the primary conditions from the transient analysis and the hot channel factor from the nuclear analysis, thermal hydraulic analyses are performed using VIPRE-W to verify that the DNB design basis is met. The transient response analysis, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accor-dance with the methodology described in Reference 9.

15.4.6.4.2.2 Dropped Rod Cluster Control Assembly Bank A dropped RCCA bank results in a symmetric power change in the core. As discussed in Reference 9, assumptions made for the dropped RCCA analysis (see Section 15.4.6.4.2.1) provide a bounding analysis for the dropped RCCA bank.

15.4.6.4.2.3 Statically Misaligned Rod Cluster Control Assembly The DNBR analysis assumes that initial reactor power, pressure, and reactor coolant system temperatures are at the nominal values but with the increased radial peaking factor associated with the misaligned RCCAs. The peaking factors are determined from steady-state analyses of power distributions resulting from the statically misaligned RCCAs. The power distribu-tions are analyzed using appropriate nuclear physics design codes. The nominal conditions and limiting peaking factors are then input to the VIPRE-W to determine the DNBR.

15.4.6.4.3 Acceptance Criteria General acceptance criteria appropriate for this Condition II event are:

A. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

B. Fuel integrity should be maintained by ensuring that the centerline fuel temperature is less than its melting temperature.

C. An incident of moderate frequency should not generate a more serious plant condition with-out other incidents occurring independently.

The primary acceptance criterion for these the statically misaligned RCCA analyses is that the minimum DNBR remains greater than the safety analysis DNBR limit (see Section 4.4).

Page 151 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES DNBR is the only acceptance criterion required for the rod drop analyses consistent with the methodology described in Reference 9.

15.4.6.4.4 Results 15.4.6.4.4.1 One or More Dropped Rod Cluster Control Assemblies Single or multiple dropped RCCAs within the same group (Case 1) result in a negative reac-tivity insertion. The core is not adversely affected during this period since power is rapidly decreasing. Either reactivity feedback or control bank withdrawal will reestablish power.

Following a dropped rod event in manual rod control, the plant will establish a new equilib-rium condition. Without control system interaction, a new equilibrium is achieved at a reduced power and a reduced primary temperature due to reactivity feedback.

For a dropped RCCA event in the automatic rod control modea, the rod control system detects the drop in power and initiates control bank withdrawal. Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the con-trol bank to restore nominal power. Thus, the automatic rod control mode of operation is the limiting case. Figures 15.4-18 and 15.4-19 show a typical transient response to a dropped RCCA (or RCCAs) in the automatic rod control mode. In all cases, the minimum DNBR remains above the DNBR limit value.

Following plant stabilization, the operator may manually retrieve a single dropped RCCA using the rod control system (manual mode) and approved operating procedures.

15.4.6.4.4.2 Dropped Rod Cluster Control Assembly Bank A dropped RCCA bank (Case 2) is bounded by the dropped RCCA event discussed above (Reference 9).

15.4.6.4.4.3 Statically Misaligned Rod Cluster Control Assembly The more severe DNBRs from statically misaligned RCCAs arise from cases where one RCCA is fully inserted with all rods out (Case 3) or bank D is at its insertion limit (Case 4), or where bank D is inserted to its insertion limit with one RCCA fully withdrawn (Case 5). Mul-tiple independent alarms, including a bank insertion limit alarm, alert the operator before the postulated conditions are approached.

For RCCA misalignments with one RCCA fully inserted (Cases 3 and 4), the DNBR does not fall below the safety analysis DNBR limit.

For RCCA misalignments with Bank D inserted to its full-power insertion limit with any one RCCA fully withdrawn (Case 5) or fully inserted (Case 4), the DNBR does not fall below the safety analysis DNBR limit.

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 152 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES DNB does not occur for the RCCA misalignment incidents; thus, there is no reduction in the ability of the primary coolant to remove heat from the fuel rod. The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associ-ated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation rate is well below that which would cause fuel melting.

Detailed results will vary from cycle to cycle depending on fuel arrangements; therefore, the insertion limits and DNBR considerations are re-evaluated for each cycle.

After identifying a RCCA group misalignment condition, the operator must take action as required by the plant Technical Specifications and operating instructions.

15.4.6.5 Radiological Evaluation An evaluation of radiological consequences is not performed since no fuel failures result from statically misaligned or dropped RCCAs.

15.4.6.6 Conclusions The analyzed events do not propagate beyond the Condition II category since, in each case, the reactor reaches a stable state.

For cases of dropped RCCA assemblies (Case 1) or dropped banks (Case 2), the DNBR remains greater than the safety analysis DNBR limit; therefore, the DNB design criterion is met, and the events do not result in core damage.

For all static misalignment cases of any RCCA fully inserted (Cases 3 and 4) or bank D inserted to its rod insertion limits with any single rod cluster control assembly in that bank fully withdrawn (Case 5), the DNBR remains greater than the safety analysis DNBR limit, and the events do not result in core damage.

Page 153 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.4

1. Sung, Y.X, et. al., "VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal Hydralic Safety Analysis," WCAP-14565-A (Propriatary) and WCAP-15306 (Non-Proprietary), October 1999.

2. RGE-05-28, Revised Boron Dilution Interim Operating Procedure for Ginna, April 2005.

3. A. J. Friedland and S. Ray, Revised Thermal Design Procedure, WCAP-11397-P-A (Pro-prietary), April 1989.

4. Letter from LeBoeuf, Lamb, Leiby, and MacRae, Attorneys for RG&E, to B. C. Rusche, NRC,

Subject:

Application for Amendment to Operating License, dated September 22, 1975.

5. R. F. Barry and D. H. Risner, TWINKLE-A Multi Dimensional Neutron Kinetics Com-puter Code, WCAP-7979-P-A (Proprietary), WCAP-8028-A (Non-Proprietary), January 1975.

6. Letter from W. J. Johnson, Westinghouse, to R. C. Jones, NRC,

Subject:

Use of 2700F PCT Acceptance Limit in Non-LOCA Accidents, NS-NRC-89-3466, dated October 1989.

7. H. G. Hardgrove, FACTRAN - A Fortran-IV Code for Thermal Transients in Uranium-Dioxide Fuel Rod, WCAP-7908-A, December 1989.

8. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics XV-2, XV-12, XV-16, XV-17, XV-20, Radiological Consequences Draft Safety Evaluations, dated September 24, 1981.

9. R. L. Haessler, D. B. Lancaster, F. A. Monger, and S. Ray, Methodology for the Analysis of the Dropped Rod Event, WCAP-11394-P-A, dated January 1990.

10. Westinghouse NMD Core Engineering letter FA-94-268,

Subject:

R. E. Ginna Upgrade THINC-III Deck, dated October 24, 1994.

11. P. J. Kersting, Assessment of Clad Flattening and Densification Power Spike Factor Elimination in Westinghouse Nuclear Fuel, WCAP-13589-A, March 1995, approved by NRC SER FLI-95-038, NRC SER on Topical Report WCAP-13589, dated February 1995.

12. Letter from K. C. Hoskins, Westinghouse, to R. W. Eliasz, RG&E,

Subject:

Final Non-LOCA Analysis Licensing/Summary Report, NTD-NSRLA-OPL-95-571, dated Decem-ber 5, 1995.

13. Letter from L.D. White, RG&E, to A. Schwenzer, NRC,

Subject:

Postulated Boron Dilu-tion Due to NaOH, dated January 10, 1978.

14. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Inadvertent Boron Dilution at Shutdown, dated July 13, 1981.

Page 154 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

15. Letter from F. Noon, Westinghouse, to B. A. Snow, RG&E,

Subject:

Inadvertent Boron Dilution at Shutdown while on RHR, RGE-80-85, dated July 9, 1980.

16. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics XV-1, XV-2, XV-3, XV-4, XV-5, XV-6, XV-7, XV-8, XV-10, XV-12, XV-14, XV-15, and XV-17 Design Basis Events Accidents and Transients, dated September 4, 1981.

17. Design Analysis, DA-NS-99-019, Rev. 0, titled: Boron Dilution, dated February 4, 1999.

18. Westinghouse Calculation Note CN-TA-98-148, Rev. 1, (Proprietary) titled: Cycle 28 Reload Safety Evaluation - Mode 6 Botron Dilution, dated May 14, 1999.

19. D. H. Risher, An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods, WCAP-7588, Revision 1-A, January 1975.

20. ANSI/ANS-N18.2-1973, American National Standard for Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants, August 1973.

21. Letter from D. L. Ziemann, NRC, to L.D. White, RG&E,

Subject:

Incomplete Response, dated January 25, 1979.

22. DA-NS-2002-050, Control Rod Ejection Accident Offsite and Control Room Doses, Revision 2.

23. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

24. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant -Amendment RE: Modification of the Control Room Emergency Air Treat-ment System (CREATS) and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123), dated February 25, 2005.

25. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant -Correction to Amendment No. 87 RE: Modification of the Control Room Emergency Air Treatment System (CREATS) (TAC No. MB9123), dated May 18, 2005.

Page 155 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.4-1 TIME SEQUENCE OF EVENTS FOR UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL FROM A SUBCRITICAL CONDITION Event Time of Each Event (sec)

Initiation of uncontrolled rod withdrawal, 75 pcm/sec reactivity inser- 0 tion rate, from 10-9 of nominal power Power range high-neutron-flux low setpoint reached 9.98 Peak nuclear power occurs 10.11 Rods begin to fall into core 10.48 Peak heat flux occurs/Minimum DNBR occurs 11.72 Peak clad temperature occurs 11.98 Peak average fuel temperature occurs 12.18 Peak fuel centerline temperature occurs 13.68 Page 156 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.4-2 TIME SEQUENCE OF EVENTS FOR UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY WITHDRAWAL AT POWER Event Time of Each Event (sec)

CASE A (Minimum feedback)

Initiation of uncontrolled rod cluster control assembly withdrawal at 0 full power and maximum reactivity insertion rate (100 pcm/sec)

Power range high-neutron-flux high trip point reached 1.2 Rod begins to fall into core 1.7 Minimum DNBR occurs 2.3 CASE B (Maximum feedback)

Initiation of uncontrolled rod cluster control assembly withdrawal at 0 full power and at a small reactivity insertion rate (5 pcm/sec)

Power range high-neutron-flux high trip point reached 213.9 Rods begin to fall into core 215.9 Minimum DNBR occurs ~215.9 Page 157 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.4-3 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT Time in Life Parameters Beginning Beginning End End Power level, MWt 1811 0 1811 0 Ejected rod worth, % delta k 0.32 0.95 0.40 0.90 Delayed neutron fraction, % 0.49 0.49 0.43 0.43 Feedback reactivity weighting 1.231 2.008 1.316 2.041 Doppler defect, pcm 1000 1000 950 950 Trip reactivity, % delta k 3.5 2.0 3.5 2.0 FQ before rod ejection 2.6 - <2.6 -

FQ after rod ejection 5.00 11.0 5.69 12.0 Number of operational pumps 2 1 2 1 Maximum fuel pellet average tem- 4069 3564 4055 3627 perature, F Maximum fuel center temperature, 4970 3934 4883 3920 F

Maximum clad average tempera- 2313 2831 2306 2481 ture, F Maximum fuel stored energy, cal/g 177.9 151.8 177.2 155.1 Fuel melt at the hot, % 6.62 0.0 9.00 0.0 Zirconium-water reaction, % <16 <16 <16 <16 Page 158 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.4-4 TIME SEQUENCE OF EVENTS FOR ROD CLUSTER CONTROL ASSEMBLY EJECTION Event Time of Each Event (sec)

BCL HFP ECL HFP Initiation of rod ejection 0.0 0.0 Power range high-neutron-flux high 0.04 0.02 setpoint reached Peak nuclear power occurs 0.14 0.13 Rods begin to fall into core 0.54 0.52 Peak fuel average temperature occurs 1.74 1.81 Peak clad temperature occurs 1.45 2.00 BCL HZP ECL HZP Initiation of rod ejection 0.0 0.0 Power range high-neutron-flux low set- 0.02 0.15 point reached Peak nuclear power occurs 0.06 0.18 Rods begin to fall into core 0.92 0.65 Peak clad temperature occurs 1.99 1.51 Peak fuel average temperature occurs 2.00 1.55 Page 159 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.4-5 REA CONTAINMENT ASSUMPTIONS Parameter Value Reactor power, MWt 1811 Failed Fuel, % of core 15 Melted fuel, % of core 0.375 Peaking factor, fraction 1.75 Initial Primary Coolant Activity iodine 60Ci/gm of DE 1-131 noble gas 1% fuel defects Iodine forms particulate 0.95 elemental 0.0485 organic 0.0015 Containment net free volume, ft3 1E6 Containment Leak Rate, %/day 0-24 hr 0.2

> 24 hr 0.1 Containment fan cooler flow and operation number of operating units 2 flow rate per unit, cfm 30,000 total filtered flow rate, cfm HEPA (2 units) 60,000 initiation delay CRFCs (HEPA) 53 sec termination of particulate iodine removal, 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> Containment fan cooler iodine removal effi-ciency, % 0 elemental 0 organic 95 particulate Natural deposition coefficient, 1/hr 0.023 Atmospheric dispersion X/Q sec/m3 EAB 0-2 hr 2.17E-4 LPZ 0-8 hr 2.51E-5 8-24 1.78E-5 24-96 8.50E-6 96-720 2.93E-6 Page 160 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Parameter Value Breathing rate m3/sec EAB & LPZ 0-8 hr 3.47E-4 8-24 1.75E-4 24-720 2.32E-4 REA SECONDARY SIDE ASSUMPTIONS Parameter Value Reactor power, MWt (including 2% uncer- 1811 tainty)

Failed Fuel, % of core 15 Melted fuel, % of core 0.375 Peaking factor, fraction 1.75 Initial secondary coolant iodine activity, ci/gm 0.1 of DE I-131 Primary-to-secondary leakage leak rate, gpd per SG 500 duration, hr 8 Mass of primary coolant, gm 1.28E8 Initial mass of secondary coolant, gm per 2 7.72E7 SGs Steam released from S.S. to environment, gm/

min 7.95E5 0-2 hr. 6.11E5 2-8 hr.

Steam generator iodine partition coefficient (mass-based) elemental 100 organic 1 Iodine species assumed in the SG water elemental iodine 0.97 organic iodide 0.03 Page 161 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.4-6 RESULTS FOR REA DOSE, REM TEDE EAB, max 2-hour LPZ Containment Leak, 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> Secondary side releases, 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> Containment leakage, gap and RC 2.384E-01 7.82E-02 Secondary side, gap and coolant, 3.480E-01 9.795E-02 Elemental Iodine Secondary side, gap and RC, Noble 2.638E-01 6.165E-02 Gas Secondary side, gap and coolant, 3.143E-01 1.195E-01 Methyl Iodide Containment leakage, core melt 2.226E-02 6.388E-03 Secondary side, melt elemental 4.32E-02 1.218E-02 iodine Secondary side, melt methyl 3.911E-02 1.487E-02 Secondary side, melt, noble gas 6.589E-02 1.539E-02 TOTAL 1.34E+00 4.06E-01 Acceptance Criteria 6.3 6.3 Page 162 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.5 INCREASE IN REACTOR COOLANT INVENTORY Inadvertent actuation of the Emergency Core Cooling System (ECCS) or a chemical and vol-ume control system malfunction that increases the reactor coolant inventory can lead to an increase in system pressure and pressurizer level.

During power operations at Ginna Station, the high-pressure safety injection pumps cannot deliver flow at full operating pressure because the pump shutoff head is approximately 1500 psi. Therefore, during power operation the safety injection pumps can not increase RCS inventory.

During power operation, the charging pumps are capable of increasing RCS inventory. The three positive displacement charging pumps can deliver a maximum of 180 gpm (charging flow is normally maintained at 46 gpm). An estimate of pressurizer fill time can be obtained by taking into account the charging line pressure drop and associated relief valves. If all 3 charging pumps were running at maximum speed with the RCS at normal pressure, the D/P required to force 180 gpm into the RCS would raise charging pump discharge pressure above the setpoint of the charging pump relief valves, and a portion of the total 180 gpm charging flow would be directed back to the VCT. Additionally, as the RCS pressurized due to the compression of the pressurizer gas bubble resulting from the CVCS malfunction, the amount of the charging flow that would be added to the RCS would decrease. Prior to a reactor trip, maximum deliverable flow to the RCS via the charging flow path and the RCP seal injection flow path is estimated to be less than 150 gpm. At this rate it would take approximately 6 min to fill the pressurizer to the high level reactor trip setpoint. Following the reactor trip, the RCS cools down and depressurizes slightly. The cooldown causes an increase in the pressur-izer steam space. The small depressurization is assumed to increase charging flow. A conser-vative value of 180 gpm is assumed (maximum flow from three charging pumps). Following reactor trip, it would take 12 min to fill the pressurizer at 180 gpm. The total time to fill the pressurizer is, therefore, 18 min. This is considered sufficient time for the operator to termi-nate the event based on the available alarms and indications (high pressurizer level, high pres-surizer pressure, and low volume control tank level).

The overpressure consequences during operation at low primary system temperature are dis-cussed in Section 5.2.2.

Page 163 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.5

1. CAL-NOTE-68, "Estimates the Time Required to fill the Pressurizer Steam Space Assuming Three charging Pumps re Running," dated 12/15/2005.

Page 164 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6 DECREASE IN REACTOR COOLANT INVENTORY 15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY VALVE OR PRESSURIZER POWER OPERATED RELIEF VALVE (PORV) 15.6.1.1 Description of Event The most severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve. The event results in a rapidly decreasing RCS pressure. The effect of the pressure decrease is a decrease in the neu-tron flux via the moderator density feedback, but the Reactor Control System (if in the auto-matic mode) functions to maintain the power and average coolant temperature until reactor trip occurs. The pressurizer level increases initially due to expansion caused by depressuriza-tion and then decreases following reactor trip.

15.6.1.2 Frequency of Event The inadvertent opening of a pressurizer safety valve incident is classified as an ANS Condi-tion II event of moderate frequency. Section 15.0.8 discusses Condition II events.

15.6.1.3 Event Analysis 15.6.1.3.1 Protective Features The following features provide protection for this event:

1. Reactor trip is actuated by an overtemperature T signal if any two-out-of-four T chan-nels exceed a variable setpoint during the transient. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure conditions to protect against DNB.

2. Reactor trip is actuated on two-out-of-four low pressurizer pressure (RTS) signals.

15.6.1.3.2 Single Failures Assumed A single failure is assumed in one train of the reactor trip system (RTS). The other operable train will, however, trip the reactor.

15.6.1.3.3 Operator Actions Assumed No operator actions are credited in this analysis.

15.6.1.3.4 Chronological Description of Event The event starts with the opening of a pressurizer safety valve. The sequence of events is shown in Table 15.6-9.

15.6.1.3.5 Impact on Fission Product Barriers The DNBR is expected to be greater than the safety analysis limit for this event. No fuel clad-ding failures are expected. Reactor coolant and steam pressures are expected to decrease.

Page 165 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The fuel cladding and reactor coolant pressure boundary maintain their integrity as fission product barriers.

15.6.1.4 Reactor Core and Plant System Evaluation 15.6.1.4.1 Input Parameters and Initial Conditions A. Initial values of reactor power, pressure, and average temperature assumed are consistent with the Revised Thermal Design Procedure. The vessel average temperature is at the max-imum TAVG (576.0F) value. Plant characteristics and initial conditions are described in Section 15.0.1.

B. A zero moderator coefficient of reactivity conservative for BOL operation is assumed in order to provide a conservatively low amount of negative reactivity feedback due to changes in moderator temperature. The spatial effect of void due to local or subcooled boil-ing is not considered in the analysis with respect to reactivity feedback or core power shape.

C. A small (absolute value) Doppler coefficient of reactivity is assumed such that the resultant amount of negative feedback is conservatively low in order to maximize any power increase due to moderator reactivity feedback.

D. It should also be noted that in the analysis, power peaking factors are kept constant at the design values while, in fact, the core feedback effects would result in considerable flatten-ing of the power distribution. This would significantly increase the calculated DNBR; however, no credit is taken for this effect.

E. No credit is taken for the pressurizer heaters when the reactor coolant system pressure decreases during the transient. Operation of the heaters would tend to increase the DNBR, which is non-conservative for this analysis.

F. A constant rod worth of 10 pcm/step is assumed. This rod differential worth is conservative since it causes the rod control system to attempt maintaining the full power TAVG, which delays reactor trip.

G. The accident is simulated by the opening of a pressurizer safety valve. For conservatism, the valve area is increased by about 24% to ensure a conservative blowdown.

H. Maximum steam generator tube plugging is assumed.

15.6.1.4.2 Methodology The inadvertent opening of a pressurizer safety valve or pressurizer power operated relief valve (PORV) incident is analyzed using the RETRAN code. The code computes pertinent plant variables, including temperatures, pressures, and power level. Section 15.0.7 provides an additional description of RETRAN and its capabilities.

The Revised Thermal Design Procedure (Reference 17) is used. Uncertainties in initial condi-tions are included in the DNBR limit using this procedure.

15.6.1.4.3 Acceptance Criteria The general acceptance criteria for a Condition II event are:

Page 166 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES A. Pressures in the reactor coolant and main steam systems should be maintained below 110%

of the design pressures.

B. Fuel cladding integrity is maintained by ensuring that the minimum DNBR remains greater than the 95/95 DNBR limit in the limiting fuel rods.

C. An accident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Primary pressure decreases due to the accident itself, and secondary side pressure tends to decrease due to a small cooldown. Therefore, the specific criterion used for this incident is that the DNBR remains greater than the safety analysis limit described in Section 4.4.

15.6.1.4.4 Resultsa Figure 15.6-1a illustrates the nuclear power transient following the accident. Reactor trip on overtemperature T occurs as shown on Figure 15.6-1b. The pressure decay transient fol-lowing the accident is given on Figure Figure 15.6-1b. The loop average temperature follow-ing the accident is given on Figure 15.6-1c. The resulting DNBR never goes below the limit value as shown on Figure 15.6-1d.

15.6.1.5 Radiological Consequences An evaluation of radiological consequences is not performed since no fuel failure occurs.

Steam released from the pressurizer safety valve is to the pressurizer relief tank inside con-tainment. Since this does not result in an uncontrolled release to the environment, normal plant operations can be used for the cleanup or discharge of the radioactive contaminants under controlled conditions.

15.6.1.6 Conclusions By showing that the DNBR remains above the safety analysis limit value, the analysis of the inadvertent opening of a pressurizer safety valve demonstrates that the overtemperature T RTS signal provides adequate protection.

15.6.2 RADIOLOGICAL CONSEQUENCES OF SMALL LINES CARRYING PRIMARY COOLANT OUTSIDE CONTAINMENT An analysis was conducted by the NRC under the Systematic Evaluation Program (Topic XV-16), to ensure that any release of radioactivity from a postulated failure of small lines carrying primary coolant outside containment would result in limited exposure, well within 10 CFR 100 exposure guidelines. The doses calculated by the NRC (Reference 2) were 12 rem thy-roid and 1 rem whole body which were below 10% of the 10 CFR 100 exposure guidelines.

a. This event has been evaluated relative to the deletion of the automatic rod withdrawal feature in the rod control system. The evaluation determined that the results presented herein are conservative and remain valid.

Page 167 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.3 STEAM GENERATOR TUBE RUPTURE 15.6.3.1 Description of Event The design-basis steam generator tube rupture (SGTR) accident consists of the double-ended break of one steam generator tube. The accident takes place with the reactor coolant contam-inated with fission products from continuous, full power operation prior to the accident. The accident results in the contamination of the secondary system from reactor coolant discharged through the ruptured tube. Activity can be discharged to the environment from the operation of the steam generator atmospheric relief valves (ARV) or main steam safety valves (if the setpoints are reached), or from noncondensable gases released via the main condenser during the accident and subsequent cooldown of the plant.

The operator is required to perform numerous actions to mitigate the SGTR accident and sta-bilize the plant. Offsite doses are reduced by minimizing the amount of coolant discharged through the ruptured tube and isolating the ruptured steam generator. The operator is required to reduce reactor coolant system (RCS) pressure to equilibrate with the ruptured steam gener-ator secondary side pressure to minimize the coolant discharge through the ruptured tube.

This action must be performed while the operator is attempting to cool down the plant, con-trol primary and secondary side inventories, and isolate the ruptured steam generator. Failure to control the coolant discharge in a timely manner can cause overfilling of the ruptured steam generator with additional consequences.

Analyses of the SGTR accident focus on two areas:

1. Analyses are performed to demonstrate that sufficient margin to overfill exists because of the number of operator actions required to mitigate this accident.

2. Offsite doses are analyzed to ensure that possible consequences are within allowable guide-lines. The dose analysis requires thermal hydraulic calculations be performed to determine the amount of reactor coolant discharged to the ruptured steam generator and the amounts of steam released from the steam generators.

The effects of limiting single failures and the times for required operator actions are explicitly included in the analyses.

15.6.3.2 Frequency of Event The complete severance of a steam generator tube is unlikely to occur over the life of the plant. The event is a Condition IV limiting fault since it can result in the loss of the reactor coolant system boundary or the release of significant amounts of radioactive material to the environment. Because the tubes are made of highly ductile Inconel-690 material, the more probable failure modes are one or more leaks of undetermined origin. Tube leaks or failures large enough to cause losses of reactor coolant are considered Condition II or III events, depending on whether an orderly shutdown and cooldown can or cannot be performed with normal makeup systems.

Page 168 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.3.3 Event Analysis Separate thermal hydraulic analyses are performed for the steam generator overfill and mass release cases. The analyses model a double-ended break of one steam generator tube located at the top of the tube sheet on the outlet (cold leg) side of the steam generator. The location of the break on the cold side of the steam generator results in higher primary to secondary flow than a break on the hot side of the steam generator (Reference 3).

Typically, it is not known beforehand which assumed plant operating conditions give the bounding result for each type of analysis. In addition, certain plant and operator assumptions differ in the two types of analysis (see Sections 15.6.3.3.2 and 15.6.3.3.3). Therefore, a range of sensitivity cases were analyzed separately for the margin to overfill and mass release analyses. The sensitivity of the margin to overfill, upon changes of the following analytical parameters, was investigated in References 61, 62 and 63 with plant specific models: high RCS average temperature vs. low RCS average temperature; steam gener- ator tube plugging percentage; decay heat; location of the single failure; and operators timing. All cases are analyzed with a loss of offsite power.

The margin to overfill transient is analyzed until the ruptured steam generator secondary side and reactor coolant system (RCS) pressures equalize, at which time the ruptured tube flow is considered isolated.

The mass release cases determine the maximum integrated primary to secondary break flows and steam releases for the SGTR radiological analysis. These cases are analyzed through tube flow isolation and cooldown to residual heat removal system in-service conditions to obtain the total steam releases from the intact and ruptured steam generators. (At this point, the plant proceeds to MODE 5 (cold shutdown) conditions without additional steam release using the residual heat removal system.)

Only the results for the limiting margin to overfill and mass release cases are presented. Dose calculations are performed for the limiting mass release case with the largest integrated flash-ing flow since it gives the maximum offsite doses.

The analysis is performed for Ginna Extended Power Uprate (EPU) at a core power of 1811 MWt.

15.6.3.3.1 Protective Features Protective features credited in the analysis include:

1. Reactor Trip System (RTS) - Reactor trip is actuated if any two-out-of-four delta T chan-nels exceed an overtemperature delta T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressurizer pressure to protect against DNB.

2. Engineered Safety Features Actuation System (ESFAS) - A safety injection actuation signal is generated on two-out-of-three low pressurizer pressure (ESFAS) signals.

3. Safety Injection - The safety injection signal will result in the startup of three safety injec-tion pumps supplying two reactor coolant system (RCS) cold leg injection paths.

Page 169 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

4. Feedwater Isolation- A safety injection signal or an engineered safety feature sequence ini-tiation signal will result in feedwater isolation causing all main feedwater isolation, main feedwater regulating, bypass and feedwater isolation valves to rapidly close tripping the main feedwater pumps, and closing the main feedwater pump discharge valves.

5. Main Steam Isolation - The control room operator closes the main steam isolation valve from the affected generators. Isolating main steam prevents the continued depressurization of the steam generators and limits the pressure differential between the secondary and pri-mary systems.

6. Auxiliary Feedwater - The trip of both main feedwater pumps results in actuation of the two motor-driven auxiliary feedwater pumps. Offsite power is assumed to be lost at the time of reactor trip, which results in actuation of the turbine-driven auxiliary feedwater pump. Auxiliary feedwater valves are required for feed flow control to the intact steam generator and isolation of flow to the ruptured generator.

7. Steam Generator Atmospheric Relief Valves (ARV) - The RCS must be cooled down to MODE 5 (cold shutdown) to prevent the occurrence of saturated conditions in the core.

Since offsite power is assumed to be lost at the time of reactor trip, the condenser is not available, and the ARVs are the only means available to the operator to perform this task.

The ARV on the intact steam generator is used to dump steam and cool the RCS, in this way reducing RCS pressure while maintaining adequate subcooling. Continued pressure reduc-tion eventually results in terminating tube flow. At the end of the event, the ruptured steam generators ARV must be opened to reduce its pressure as the RCS pressure approaches residual heat removal system in-service conditions.

The steam generator ARVs also prevent overpressurization of the steam generators below the main steam safety valve (MSSV) setpoint after reactor trip.

8. Pressurizer Power Operated Relief Valves (PORVs) - The pressurizer PORVs are used by the operator to control depressurization of the RCS before termination of safety injection and during the approach to residual heat removal system in-service conditions.

9. Main Steam Safety Valves (MSSVs) - The MSSVs protect the secondary side against over-pressurization (with the ARVs) following reactor trip.

10. Residual Heat Removal - Residual heat removal is required for long term cooling as the plant is brought to MODE 5 (cold shutdown) conditions.

15.6.3.3.2 Single Failures Assumed The effects of single failures in margin to overfill and mass release analyses were investigated in References 3 and 5 for the reference plant and in references 60 and 61 for Ginna. The limiting single failures for SGTR analyses are described below.

15.6.3.3.2.1 Single Failure - Margin to Overfill The limiting single failure for margin to overfill considerations is either the ARV failing closed on the intact S/G or the ARV failing open on the ruptured S/G, with the most lim- iting single failure location depending upon operator response times as detailed in Ref- erences 60 and 61.

Page 170 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES A stuck-closed ARV on the intact S/g must be locally opened before the RCS cooldown can begin. the additional time to open the ARV will delay depressurization of the RCS, causing an increase in the amount of reactor coolant discharged to the secondary side of the ruptured S/G.

A stuck-open ARV negatively affects the margin to overfill in two ways: 1) It drops the ruptured S/G pressure and cools the RCS, which in turn increases the break flow rate.

2) It results in a lower RCS cooldown target temperature (to ensure subcooling is main- tained during the depressurization) and the lower target temperature results in a longer cooldown, which in turn, extends the time it takes to terminate break flow. Although the ruptured S/G mass releases are higher than the stuck-closed ARV case, the increase in integrated break flow exceeds the extra steam released.

The analyisis determined that the limiting single failure for MTO is a stuck-open ARV on the ruptured S/G if the oprators time to isolate the stuck-open ARV is greater than 8 minutes (measured from S/G isolation). Furthermore, Reference 60 shows that the S/G will overfill if it takes an operator greater than 10 minutes (from S/G isolatin) to isolate the stuck-open ARV. However, if the operators time to recover from the single failure is 8 minutes or less, then the analysis determined that the most limiting single failure is an ARV failing closed on the ruptured S/G. Since time validations at the plant simulator confirm opeartors capability to recover from either singe failure in 8 minutes or less, the most limiting single failure for MTO is the ARV failing closed on the intact S/G (Case A of Reference 60).

15.6.3.3.2.2 Single Failure - Mass Release The limiting single failure for the mass release analyses is the ARV failing open on the rup-tured steam generator (Reference 5). Failure of this ARV causes an uncontrolled depressur-ization of the ruptured steam generator resulting in increased primary to secondary flow.

Pressure in the ruptured steam generator remains less than the RCS until the failed ARV is isolated and recovery actions are completed.

15.6.3.3.3 Operator Actions Assumed 15.6.3.3.3.1 Operator Actions to Terminate Tube Rupture Flow Important operator actions in the Westinghouse Owners Group (WOG) Emergency Response E-3 Guidelines are explicitly modeled in the analysis. These actions are intended to terminate flow though the ruptured steam generator tube before proceeding to long-term cooldown.

The operator actions that are modeled include:

1. Identify the ruptured steam generator.

Several means are available to the operator. The predominant indications are an unex-pected rapid increase in the ruptured steam generators narrow range level following the reactor trip, high radiation from a steam generator blowdown radiation monitor, or high radiation from a steam line radiation monitor.

Page 171 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

2. Isolate steam flow from the ruptured steam generator and throttle auxiliary feedwater flow to the ruptured steam generator.

Isolating the ruptured steam generator minimizes radiological releases and reduces the pos-sibility of overfilling by minimizing the accumulation of feedwater. In order to minimize the margin to overfill, the TDAFW is assumed to be secured within 6 minutes of the tube rupture. This action also enables the operator to establish a pressure differential between the ruptured and intact steam generators as a necessary step toward terminating primary to secondary flow. For the reference plant analysis in Reference 3, it was assumed that the ruptured steam generator will be isolated when the level in the steam generator reaches between being just on span and 50% on the narrow range instrument or after an operator action time of 10 minutes, whichever is longer. Reference 3 assumed that the rup- tured steam generator would be isolated when level in the steam generator reached midway between these points (33% narrow range level). The ruptured steam generator was assumed to be isolated at 33% narrow range level or at 10 minutes, whichever was longer.

3. Cool down the RCS by dumping steam from the intact steam generator.

The RCS is cooled down as rapidly as possible to a temperature less than the saturation temperature corresponding to the ruptured steam generators pressure. The cooldown is performed using the intact steam generators ARV since neither the steam dump valves nor the condenser are available following the assumed loss of offsite power. The cooldown continues until RCS subcooling at the ruptured steam generator pressure is 20F plus an allowance of 18F for instrument uncertainty.

4. Depressurize the RCS after cooldown to minimize break flow and restore pressurizer level.

After cooldown of the RCS, safety injection is terminated since it is the principal contribu-tor to tube flow. Depressurizing the RCS is required to ensure an adequate RCS inventory and reliable pressurizer level indication prior to stopping injection. Since offsite power is assumed to be lost at the time of reactor trip, the reactor coolant pumps are not running and thus normal pressurizer spray is not available. It is assumed that the operator depressurizes the RCS using a PORV. The operator continues to depressurize until any of the following is satisfied:

a. RCS pressure is less than the ruptured steam generator pressure and pressurizer level is greater than 10%, or

b. Pressurizer level is greater than 75% (80% minus 5% allowance for level uncertainty),

or

c. RCS subcooling is less than the 18F allowance for subcooling instrument uncer-tainty.

5. Terminate safety injection to prevent repressurization of the RCS and terminate primary to secondary flow.

Safety injection is terminated when all of the following are satisfied:

a. The RCS pressure stabilizes or starts to increase

b. Reactor coolant system subcooling is greater than the 18 F allowance for subcooling instrument uncertainty Page 172 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

c. Minimum auxiliary feedwater flow is available or the intact steam generator level is in the narrow range

d. The pressurizer level is greater than the 10 % allowance for level uncertainty.

Operator action times were initially established from evaluations of plant simulator studies and field data from five actual SGTR events (Reference 3). These action times consist of two components: initiation times (for the operator to start actions) and plant/system response times (for the plant conditions to reach performance objectives such as tempera-ture, pressure, flow, etc., required by the recovery action). The latter times are determined from the thermal hydraulic transient analyses of the SGTR accident.The operator action times were successively modified to more accurately reflect values typically at the Ginna simulator (Reference 65). Such changes included longer delay to initiate cooldown after isolating the ruptured S/G, and longer times for RCS depressurization and safety injection termination (actions 3, 4 and 5 of this paragraph) while at the same time crediting early termination of AFW and faster operator action to recover from the single failure. The net effect of these changes was conservative on the margin to Overfill scenario (less margin to overfull with the modified times), while it was non- conservative for the mass release scenario (less mass release with the modified times). Thus, the changes to the operators action times were only applied to the Margin to Overfill analysis. The operator action times are summarized in Table 15.6-4.

15.6.3.3.3.2 Operator Actions Due to Single Failures Additional operator actions are required to recover from the single failures postulated for the overfill and mass release analyses (see Section 15.6.3.3.2). These operator actions (Reference 4), which occur outside the control room, include identifying and locally opening the intact steam generator ARV, locally closing the intact steam generator ARV block valve, and locally closing the ruptured steam generator ARV block valve. The times associated with performing these operator actions are listed in Table 15.6-2.

15.6.3.3.3.3 Operator Actions for Cooldown to MODE 5 (Cold Shutdown)

Following termination of tube rupture flow, the operator is required to perform additional actions to bring the plant to MODE 5 (cold shutdown) conditions. The operator actions are defined in the WOG E-3 guidelines. Only two of the actions are explicitly considered in the analysis.

The operator is required to cool the RCS to the residual heat removal system in-service tem-perature by feeding and steaming the intact steam generator. The SGTR long-term mass release analysis assumes the operator performs this action by dumping steam to the atmo-sphere via the ARV. Although other preferable cooldown methods (such as steam dump to the condenser to minimize activity releases) are identified in the WOG guidelines, steam dump to the atmosphere is necessary because offsite power is assumed to be lost at the time of reactor trip, causing the condenser to be unavailable.

Cooldown of the ruptured steam generator is performed after the RCS is cooled to the resid-ual heat removal system in-service temperature. With a loss of offsite power, the operator immediately releases steam from the ruptured steam generator to the atmosphere. (This Page 173 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES method is conservative for radiological calculations since it maximizes the activity released from the plant.) The operator maintains equal pressure between the RCS and ruptured steam generator secondary side using the PORV as needed until the residual heat removal system is brought on line.

With the exception of being on residual heat removal in 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, explicit operator action times are not defined since cooldown can proceed more gradually after tube rupture flow is termi-nated.

15.6.3.3.4 Chronological Description of Event The chronologies from tube rupture to the termination of break flow for the limiting margin to overfill and mass release cases are shown in Table 15.6-3 and Table 15.6-5, respectively.

After the break flow is terminated, the limiting mass release case is continued until, by 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the residual heat removal system in-service conditions are reached. During this period, the plant response is characterized by steaming off the intact steam generator to cool the RCS to the residual heat system in-service temperature. At this point, the ruptured steam generator is depressurized until the RCS reaches the residual heat removal system in-service pressure.

The SGTR accident is then considered ended. The corresponding steam releases as a function of time for this sequence are shown in Table 15.6-7.

15.6.3.3.5 Impact on Fission Product Barriers The fuel cladding maintains its integrity as a fission product barrier. Although iodine spiking may result during depressurization of the RCS, the number of pre-existing cladding defects (as limited by the Technical Specifications on coolant specific activity) does not increase.

The radiological calculations for the iodine spiking cases incorporate this assumption in the iodine spiking source term.

The tube rupture results in the loss of the reactor coolant pressure boundary integrity in the ruptured steam generator. The tube rupture flow significantly increases the activity concen-trations in the ruptured steam generators secondary side water and steam regions. The loss of the pressure boundary is the principal transport mechanism for radionuclides ultimately released to the environment. The pressure boundary integrity of the remaining tubes in the ruptured and intact steam generators is not challenged since the RCS pressure does not increase during this event. The integrity of the intact generators tubes is important for limit-ing offsite doses since this generator is used to dump large quantities of steam to cool down and approach residual heat removal system in-service conditions after termination of the rup-tured tube flow.

No discharge of water from the pressurizer is expected. The capacity of the pressurizer relief tank is not exceeded, and the discharged activity in the steam relief is contained ensuring con-trol of radioactive materials.

Page 174 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.3.4 Reactor Core and Plant System Evaluation 15.6.3.4.1 Input Parameters and Initial Conditions Parameters and initial conditions common to the margin to overfill and mass release analyses are:

A. The plant is at 1817 MWt Nuclear Steam Supply System (NSSS) power, operating at the high (576.0 F) or low (564.6 F) end of the TAVG window depending on the case analyzed.

Other initial conditions are summarized in Table 15.6-1.

B. The highest worth rod cluster control assembly is stuck in its fully withdrawn position at reactor trip.

C. Reactor trip occurs when the overtemperature delta T setpoint is reached. No reactor trip delay is assumed since it maximizes the secondary side inventory in the ruptured steam generator and steam releases from both steam generators. It was also assumed that loss of offsite power occurs at the time of reactor trip.

D. The turbine automatically trips following a reactor trip. Zero delay is assumed since it min-imizes the steam flow to the turbine and maximizes the secondary side water inventory in the ruptured steam generator and steam releases from both steam generators.

E. The condenser is unavailable for steam dump following reactor trip due to the assumed loss of offsite power. All subsequent steam relief is through the atmospheric relief valves (ARV) (and main steam safety valves (MSSV), if needed).

F. A low ARV setpoint of 1065 psia is used since control at lower steam generator pressures causes a greater primary to secondary side pressure differential and tube flow.

G. A greater than nominal safety injection setpoint is used (see Table 15.6-1). The higher set-point causes a higher primary to secondary side pressure differential that results in greater break flow through the ruptured tube and longer time to pressure equalization.

H. Safety injection flow is from three safety injection (SI) pumps injecting into both reactor coolant loops (see Figure 15.6-1). No actuation delays are assumed after the injection set-point is reached. These assumptions conservatively increase the break flow through the ruptured tube.

I. Auxiliary feedwater from all three preferred pumps is automatically started following reac-tor trip and loss of offsite power. Maximum flow is equally split between the steam gener-ators, which are at nearly equal pressures until isolation. Maximum flow maximizes the mass of water in the ruptured steam generator at the time of isolation (see Section 15.6.3.7).

J. Operation of charging and letdown systems and pressurizer heaters are not credited. Oper-ation of these systems delays the reactor trip, which reduces the severity of the analyzed transient.

For the margin to overfill cases:

A. The initial water mass in both steam generators corresponds to 60.0% on the narrow range level. This mass represents the nominal (52%) steam generator water level at full power with a +8.0% instrument uncertainty applied. A higher initial mass in the ruptured steam Page 175 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES generator is conservative for reducing the margin to overfill. (The total fluid mass shown in Table 15.6-1 corresponds to TAVG at 564.6F at full power with 10% tube plugging level assumed.)

B. Turbine runback on overtemperature delta T at 10% per minute prior to reactor trip is simu-lated but is not credited for delaying reactor trip. Turbine runback increases the secondary water mass with reduced load, because the feedwater controller attempts to maintain steam generator level as power decreases before the trip.

C. The ruptured steam generators fluid mass is artificially increased to simulate a turbine run-back to 89% power prior to trip. The mass (94,000 lbm) corresponds to the initial maxi-mum level at full power plus the differential mass between 100% and 89% power. (Figure 15.6-3 shows the initial masses in the intact and ruptured steam generators.)

D. Conservatively low decay heat rates are used. Decay heat has competing effect on the margin to overfill: higher decay heat yields a benefit by increasing steam releases from the ruptured S/G, but results in a penalty from a longer cooldown and a conser- vatively delayed break flow termination. Conversely, lower decay heat yields a penalty by reducing steam releases from the ruptured S/G, but results in a benefit from a shorter cooldown and earlier break flow termination. References 61, 62 and 64 docu- ment that lower decay heat is more conservative for Ginna.

For the mass release analyses:

A. A turbine runback is not assumed since it delays reactor trip. An earlier reactor trip results in greater steam releases to the atmosphere from both steam generators.

B. The steam generator water mass corresponds to 48.0% on the narrow range level. This mass represents the full power, nominal steam generator water level with a -4.0% instru-ment uncertainty applied. A lower initial mass in the ruptured steam generator increases the predicted offsite doses. (The value shown in Table 15.6-1 corresponds to TAVG at 576.0F with 10% tube plugging level assumed.)

C. Conservatively high decay heat rates are used. Higher decay heat conservatively results inhigher steam release from the ruptured S/G.

15.6.3.4.2 Methodology The RETRAN02 code is used for the margin to overfill and the mass release analyses.

RETRAN02 is described in Section 15.0.7.

The margin to overfill analyses are performed with the RETRAN02 code using methodology consistent with that described in Reference 3 with plant-specific parameters. The ruptured steam generators secondary side water mass is calculated as a function of time to demon-strate that overfill does not occur. The analysis is performed from the start of the rupture until break flow is terminated at equalization of primary and secondary pressures. The methodol-ogy includes the explicit modeling of operator actions in the WOG E-3 guidelines required for mitigation of the SGTR accident.

The mass release analyses are performed with the RETRAN02 code using methodology con-sistent with that described in References 3 and 5. The plant response, the integrated primary Page 176 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES to secondary break flow, feedwater flows to both steam generators, and the steam releases to the condenser and to the atmosphere up to the time tube flow is terminated are calculated using RETRAN02 results. When calculating the amount of break flow that flashes to steam, 100% of the break flow is assumed to come from the hot leg side of the break.

The steam release and feedwater flow from the time of tube flow termination to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, and from 2 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, are determined from mass and energy balances using the RCS and intact steam generator conditions. Following termination of tube flow, the intact steam generators ARV is assumed to cool down the plant at the maximum allowable rate of 100F/hour to a residual heat removal system in-service temperature of 330 F.

The ruptured steam generator is assumed to be depressurized to the residual heat removal sys-tem in-service pressure of 340 psia immediately after the cooldown of the RCS. The amount of steam released is determined from mass and energy balances; no changes in thermody-namic conditions are assumed from termination of tube flow until depressurization is started since the ruptured steam generator is isolated. Steam releases from both steam generators are considered terminated at 8 or 40 hours4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br /> when the residual heat removal system in-service con-ditions are reached.

Margin to overfill and mass release analyses include the effects of the limiting single failures and operator recovery actions described in Sections 15.6.3.3.2 and 15.6.3.3.3, respectively.

15.6.3.4.3 Acceptance Criteria No acceptance criteria are used for the margin to overfill and mass release analyses. Both analyses are performed using conservative assumptions to demonstrate the ability of the oper-ator to limit the system transient and establish parameters for providing a bounding radiologi-cal consequence assessment.

Radiological acceptance criteria applicable to SGTR accidents are:

A. Radiological doses should not exceed 10 CFR 50.67 guidelines with a pre-existing iodine spike in the reactor coolant B. Radiological doses should not exceed Regulatory Guide 1.183 guidelines with an accident-initiated iodine spike and the reactor coolant at its equilibrium iodine concentration for con-tinued full power operation.

15.6.3.4.4 Results Only the results for the limiting margin to overfill and mass release cases are presented.

15.6.3.4.4.1 SGTR Margin to Overfill Transient Analysis Results are presented for the worst-case margin to overfill analysis (Case A of Reference 60).

The minimum margin to overfill occurs with a steam generator tube plugging level of 0% and with the reactor initially operating with TAVG at 564.6F. The sequence of events is summa-rized in Table 15.6-3 and Figures 15.6-2 to 15.6-7 show primary and secondary side responses until the SGTR flow is terminated. The SGTR margin to overfill analysis includes 100 seconds of steady state operation prior to break initiation.

Page 177 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES The reactor coolant flow to the secondary side through the ruptured tube immediately causes the pressurizer level and pressure to decrease as shown in Figure 15.6-2. The continued decrease in pressurizer pressure causes the overtemperature delta T setpoint to be reached 66 seconds post SGTR, followed by immediate reactor and turbine trips. The reactor coolant pumps trip due to the assumed loss of offsite power at the time of reactor trip. Immediately following reactor trip, the temperature differential across the hot and cold legs decreases as core power decays. The temperature differential then increases as shown in Figure 15.6-4 as both pumps coast down and natural circulation flow develops.

With the steam dump valves closed after trip (due to the loss of condenser vacuum resulting from the assumed loss of offsite power at the time of reactor trip), the secondary side pres-sures in both steam generators increase rapidly to the ARV setpoint as shown in Figure 15.6-

3. The pressurizer level and pressure continue to drop, and safety injection is actuated via the low pressurizer pressure setpoint at 369 seconds (see Figure 15.6-2 and Table 15.6-3).

The operator isolates the ruptured steam generator by stopping turbine driven auxiliary feedwater flow at 5 minutes post trip and isolating steam flow and throttling motor-driven auxiliary feedwater flow at 10 minutes post SGTR (see Table 15.6-3). The operator actions are assumed at 10 minutes since the ruptured steam generators narrow range level has previ-ously returned to greater than 33% (see Section 15.6.3.3.3.1, item 2). After 10 minutes, the increase in fluid mass in the ruptured steam generator shown in Figure 15.6-3 is due to the ruptured tube flow.

There is a 10 minute operator delay time before initiating the cooldown (see Table 15.6-4 and Section 15.6.3.3.3.1, item 3). The intact steam generators ARV is assumed to fail at the start of cooldown. An additional delay is required for the operator to identify and open the ARV (see Section 15.6.3.3.3.2), and at 1480 seconds, the valve is opened. The subsequent reduc-tion in the intact steam generators pressure is shown in Figure 15.6-3, and the resulting cooldown of the RCS temperature is shown in Figure 15.6-4. The pressurizer pressure also decreases during this cooldown as shown in Figure 15.6-2. The cooldown is continued until RCS subcooling at the ruptured steam generator pressure is 20F plus an allowance of 18F for instrument uncertainty. After cooldown, it takes the operator 5 minutes to close the ARV block valve. The valve is completely closed at 2701 seconds.

The operator begins to depressurize the RCS using the PORV at 2941 seconds after a 4 min-ute delay (see Section 15.6.3.3.3.1, item 4, and Table 15.6-4). Depressurization is terminated at 2974 seconds when the RCS pressure is reduced below the ruptured steam generators pressure and the pressurizers level is greater than 5%. The depressurization reduces pressur-izer pressure and the break flow and increases safety injection flow to refill the pressurizer as shown in Figures 15.6-2 and 15.6-5. Note that the analysis used 5% pressurizer level as condition for terminating depressurization, while the SGTR Emergency Operating Pro-cedure states 10%. The impact of this difference is conservative for MTO, as an impact of 10% in the analysis would result in slightly increased period or reversed break flow, which is a benefit for the MTO analysis.

Safety injection is not terminated in the analysis until the criteria in Section 15.6.3.3.3.1, item 5, are satisfied. The RCS pressure is allowed to increase to 50 psi above the ruptured steam Page 178 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES generator pressure to ensure that the RCS pressure is increasing when safety injection is ter-minated. The operator terminates safety injection after a two minute delay (see Table 15.6-4) at 3094 seconds and the RCS pressure begins to decrease as shown in Figure 15.6-2.

The intact steam generators ARV is opened to dump steam (see Figure 15.6-6) and maintain an adequate RCS subcooling margin. When the ARV is opened, the increased energy transfer from the primary to the secondary side also aids in the depressurization of the RCS to the rup-tured steam generators pressure (see Figures 15.6-2 and 15.6-3). The primary to secondary flow continues until the RCS and ruptured steam generator pressures equalize at approxi-mately 3709 seconds.

The primary to secondary flow rate and water volume in the ruptured steam generator are shown in Figure 15.6-5 and 15.6-7, respectively. Figure 15.6-7 shows a 108 ft3 margin to overfill relative to the total steam generators total volume of 4512.7 ft3.

15.6.3.4.4.2 SGTR Mass Release Transient Analysis The maximum mass release (Case 5 of Reference 63) occurs with a steam generator tube plugging level of 10% and with the reactor initially operating with TAVG at 576.0F. The sequence of events is summarized in Table 15.6-5, and the primary and secondary side responses appear in Figures 15.6-8 to 15.6-13. Total mass releases for use in the dose analy-ses are summarized in Table 15.6-7. The SGTR mass release transient analysis includes 100 seconds of steady state operation prior to break initiation.

The mass release and margin to overfill results are similar until 10 minutes from break initia-tion. The mass-release transient modeled a low initial secondary inventory and minimum auxiliary feedwater flow. As a result, the ruptured steam generator level did not reach 33%

until 942 sec. Isolating the ruptured steam generator was, therefore, delayed until 942 sec. At 942 sec, the ruptured steam generator's ARV is assumed to fail open (see Section 15.6.3.3.2.2). The failure of the ARV causes the steam generator to rapidly depressurize and the primary to secondary flow through the ruptured tube to increase (see Figures 15.6-9 and 15.6-11). The ruptured steam generators depressurization causes the RCS pressure and tem-perature to decrease more rapidly than the overfill case (see Figures 15.6-8 and 15.6-10) as well as a greater cooldown of the intact steam generator. The operator identifies and locally closes the block valve for the failed ARV after 15 minutes (see Section 15.6.3.3.3.2). The depressurization of the ruptured steam generator ceases at 1842 seconds, and its pressure begins to increase as shown in Figure 15.6-9.

There is a 5 minute operator action delay time imposed prior to initiating cooldown after the failed ARVs block valve is closed (see Table 15.6-4). The cooldown is performed using the intact steam generators ARV to dump steam to the atmosphere and continues until the RCS subcooling at the ruptured steam generator pressure is 20F plus an allowance of 18F for instrument uncertainty (see Section 15.6.3.3.3.1, item 3). Because of the lower pressure in the ruptured steam generator when the cooldown is initiated, the RCS must be cooled to a lower temperature to satisfy the cooldown criterion. The net effect is that the cooldown period is longer relative to the overfill case. The cooldown is completed at 4373 seconds when the operator closes the ARV on the intact steam generator. The reductions in the intact Page 179 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES steam generator pressure and the RCS temperature during the cooldown period are shown in Figures 15.6-9 and 15.6-10, respectively.

The RCS depressurization begins later than the limiting margin to overfill case. After a 2 minute delay (see Table 15.6-4), the operator uses the PORV to depressurize starting at 4493 seconds. Depressurization is terminated at 4546 seconds when the RCS pressure is less than the ruptured steam generators pressure and the pressurizers level is above 5% (see Section 15.6.3.3.3.1, item 4). During depressurization, safety injection flow will refill the pressurizer while break flow is reduced as shown in Figures 15.6-8 and 15.6-11, respectively.

Like the overfill analysis, safety injection is terminated when the criteria in Section 15.6.3.3.3.1, item 5, are satisfied and the RCS pressure reaches 50 psi above the ruptured steam generators pressure. At this point, a 1 minute operator delay (see Table 15.6-4) is assumed before shutting down safety injection at 4607 seconds. The RCS pressure begins to decrease as shown in Figure 15.6-8. The intact steam generators ARV is then opened (see Figure 15.6-12) to maintain RCS temperature and subcooling margin. Figure 15.6-11 shows that the primary to secondary flow continues until the RCS and ruptured steam generator pressures equalize at 5684 seconds.

The maximum integrated flashing break flow is 6586 lbm. The limiting single failure used in the mass release analyses is intended to maximize the total flow through the ruptured tube.

The effect of the single failure and operator recovery assumptions can be observed by com-paring the integrated SGTR flow in Figure 15.6-11 and the steam relief flow in Figure 15.6-12 to the margin to overfill results in Figures 15.6-5 and 15.6-6.

Following termination of the tube flow, the RCS is cooled down using the intact steam gener-ator. The steam releases are presented in Table 15.6-7. Since the condenser is in service until reactor trip, any radioactivity released to the atmosphere before reactor trip is through the condenser air ejector. After reactor trip, the releases are assumed to be via the ARVs. Table 15.6-7 indicates that approximately 82,900 lbm of steam is released to the atmosphere from the ruptured steam generator within the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> (i.e., the ruptured steam generator is iso-lated within this interval). After 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />, 26,800 lbm of steam is released to the atmosphere from the ruptured steam generator when it is depressurized after the RCS is cooled to the residual heat removal system in-service temperature (see Section 15.6.3.3.3.3). Therefore, 175,870 lbm of reactor coolant flows through the tube rupture before break flow is termi-nated.

15.6.3.5 Radiological Consequences As part of the Control Room Emergency Air Treatment System (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistency, new x/Q values and offsite doses were also analyzed. Reference 53 is now considered to be the Steam Generator Tube Rupture analysis of record. The analysis was performed using the alternate source term (AST) per 10 CFR 50.67 and Reference 54. The two cases evaluated were with a pre-accident iodine spike to the Technical Specifications limit, and an accident-initiated iodine spike of a factor of 335. The new methodology and analysis was approved by the NRC in Reference 55 as supplemented by Reference 56. The assumptions used in the analysis are summarized in Table 15.6-6, and the results are contained in Table 15.6-8.

Page 180 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.3.6 Conclusions Margin to overfill and mass release analyses were performed for the SGTR accident. The minimum margin to overfill occurs with the reactor initially at full power at low TAVG (564.6F) and a 0% steam generator tube plugging level. The maximum mass release occurs with the reactor initially at full power at high TAVG (576.0F) and a 10% steam generator tube plugging level. ARV failures are the worst-case single failures and result in the limiting over-fill and mass release conditions. The effects of operator actions required to recover from the single failures and terminate ruptured tube flow are included in the analyses.

The margin to overfill analyses demonstrate that the operator can terminate flow through the ruptured tube without filling the steam lines with water, which could result in increased radio-logical consequences. The mass release analyses determine the maximum amounts of steam discharged from the plant and reactor coolant flowing in to the ruptured steam generator.

Both quantities are used in determining limiting dose consequences.

The radiological consequences of a SGTR accident at the exclusion area boundary (EAB) and low population zone (LPZ) are within the allowable guidelines in 10 CFR 50.67.

15.6.4 PRIMARY SYSTEM PIPE RUPTURES A loss-of-coolant accident (LOCA) is defined as a rupture of the reactor coolant system (RCS) piping or of any line connected to the system. The small break LOCA includes all pos-tulated pipe ruptures with a total cross-sectional area less than 1.0 ft2. The small break LOCA analyses are described in Section 15.6.4.1. The large break LOCA includes postulated pipe ruptures with a total cross-sectional area greater than 1.0 ft2. The large break LOCA analyses are described in Section 15.6.4.2.

15.6.4.1 Loss of Reactor Coolant from Small Ruptured Pipes or From Cracks in Large Pipes Which Actuates Emergency Core Cooling System (ECCS) 15.6.4.1.1 Description of Event Two classes of small breaks are evaluated: (1) those breaks whose mass release remains within the capability of the charging pumps and (2) postulated pipe breaks less than 1.0 ft2 area which actuate the emergency core cooling system (ECCS).

Ruptures of small cross section (i.e., very small breaks) will cause expulsion of the coolant at a rate that can be accommodated by the charging pumps, which would maintain an opera-tional water level in the pressurizer permitting the operator to execute an orderly shutdown.

Since no additional cladding failures would occur, there is no fuel damage, and any activity released to the containment is from the fission products in the reactor coolant.

The maximum break size for which the normal makeup system can maintain the pressurizer level is obtained by comparing the calculated flow from the RCS through the postulated break against the charging pump makeup flow at normal RCS pressure and temperature, i.e., 2280 psia and 560F. A makeup flow rate from one charging pump is typically adequate to sustain Page 181 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES pressurizer pressure at 2280 psia for a break through a 0.125 inch diameter hole. This break results in a loss of approximately 15 gpm.

The small break LOCAs analyzed in this section are for those breaks beyond the capability of a single charging pump resulting in the actuation of the ECCS.

15.6.4.1.2 Frequency of Event Small break LOCAs corresponding to Condition III events are analyzed in this section. Small break LOCAs less than 1.0 ft2 area would prevent the orderly shutdown and cooldown of the reactor assuming reactor coolant makeup is provided by normal makeup systems. As such, small break LOCAs are considered ANS Condition III events (Reference 16). Condition III occurrences are faults which may occur very infrequently during the life of the plant. Very small breaks where a charging pump can provide sufficient flow to permit an orderly shut-down are classified as ANS Condition II events of moderate frequency. Section 15.0.8 dis-cusses the ANS classification categories.

15.6.4.1.3 Event Analysis Generic analyses using NOTRUMP were performed and presented in Reference 13. These analyses demonstrate that, in a comparison of cold leg, hot leg, and pump suction leg break locations, the cold leg break location is limiting as a result of reduced core flow due to the loop seal effect.

Analyses were performed for cold leg breaks with a spectrum of break sizes with equivalent diameters ranging from 1.5 to 3 inches. The plant was assumed to be at full power in all cases at high TAVG (576F) conditions. The loss of offsite power to the emergency safeguards buses is assumed coincident with the reactor trip.

The analyses were performed for Ginna Extended Power Uprate (EPU) at a core power of 1811 MWt.

15.6.4.1.3.1 Protective Features Protective features credited in the small break LOCA analysis include:

1. Reactor Trip System (RTS) - Reactor trip is actuated on two-out-of-four low pressurizer pressure (RTS) signals.

2. Engineered Safety Features Actuation System (ESFAS) - A safety injection actuation signal is generated on two-out-of-three low pressurizer pressure (ESFAS) signals.

3. Safety Injection - The safety injection signal will result in the startup of the high-head safety injection pumps. The single failure assumed in the analysis and start of one diesel generator will result in the startup of one safety injection pump plus the swing injection pump supplying two RCS cold leg injection paths.

4. Feedwater Isolation- A safety injection signal will result in feedwater isolation causing all main feedwater regulating, bypass, and main feedwater isolation valves to rapidly close.

An engineered safety feature sequence initiation signal will result in all main feedwater reg-ulating and bypass valves to rapidly close.

Page 182 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

5. Auxiliary Feedwater - The single failure assumed in the analysis and start of one diesel gen-erator will result in start of one motor-driven auxiliary feedwater pump aligned to one steam generator. On loss of offsite power, the turbine-driven auxiliary feedwater pump starts feeding both steam generators. The analysis assumes no flow to either steam genera-tor during the short-term transient response..

6. Main Steam Safety Valves (MSSVs) - The MSSVs protect the secondary side against over-pressurization following reactor trip. The MSSVs are considered passive components and do not fail to open.

7. Accumulators - Two accumulators provide reactor coolant for makeup of the RCS inven-tory for small break LOCAs. The accumulators perform their function when the RCS pres-sure decreases below the accumulators pressure. The accumulators are not assumed to fail given their passive design.

15.6.4.1.3.2 Single Failures Assumed The most limiting single active failure for a small break loss-of-coolant accident (LOCA) has been determined to be the failure of a diesel generator to start for the limiting power availabil-ity condition, loss of offsite power. This scenario results in the loss of one high-head safety injection pump, one low-head (residual heat removal) safety injection pump, one motor driven auxiliary feedwater pump, two containment recirculation fan coolers, and one contain-ment spray pump. However, since the Ginna emergency core cooling system (ECCS) config-uration contains a "swing pump" (a high-head safety injection pump that automatically aligns to the affected cold leg when the high-head safety injection pump normally aligned to that cold leg fails to start), there is always one high-head safety injection pump connected to each cold leg. This analysis assumes two high-head safety injection pumps, each connected to a cold leg.

15.6.4.1.3.3 Operator Actions Assumed For the small break LOCAs, operator actions are assumed to realign the high-head safety injection suction to the discharge of the residual heat removal during the switchover to cold leg recirculation, resulting in a 10 minute interruption of cold leg safety injection.

15.6.4.1.3.4 Chronological Description of Event For postulated breaks exceeding makeup capability, depressurization of the reactor coolant system (RCS) causes fluid to flow to the RCS from the pressurizer, resulting in a pressure and level decrease in the pressurizer. Reactor trip occurs when the reactor trip low pressurizer pressure setpoint is reached. The safety injection system is actuated when the appropriate safety injection low pressurizer pressure setpoint is reached. The consequences of the acci-dent are limited in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduc-tion of nuclear power to a residual level that corresponds to the delayed fission and fission product decay.

2. Injection of borated water ensures sufficient flooding of the core to prevent excessive clad-ding temperatures.

Page 183 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Before the break occurs, the plant is in an equilibrium condition, i.e., the heat generated in the core is being removed via the secondary system. Reactor trip and reactor coolant pump trip are assumed coincident with loss of offsite power. The effects of reactor coolant pump coast-down are included in the blowdown analysis. During blowdown, heat from decay, hot inter-nals, and the vessel continues to be transferred to the RCS. Heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures.

In the case of continued heat addition to the secondary system, pressure increases and steam dump may occur. Makeup to the secondary side is automatically provided by the auxiliary feedwater pumps. The safety injection signal stops normal feedwater flow by closing the main feedwater isolation valves and initiates emergency feedwater flow by starting auxiliary feedwater pumps. The secondary flow aids in the reduction of RCS pressure. When the RCS depressurizes to 714.7 psia, the accumulators begin to inject water into the reactor coolant loops.

The time sequence of events for each of the small break LOCAs evaluated are provided in Table 15.6-13.

15.6.4.1.3.5 Impact on Fission Product Barriers The fuel cladding peak temperatures remain below the required limits of 10 CFR 50.46 (Ref-erence 12). The analyses show that fuel rods can become partially uncovered during limiting small break LOCA transients; therefore, fission products are assumed to be released even though these releases would be precluded by the performance of the ECCS.

The RCS pressure boundary is breached by the postulated small break; therefore, pressure boundary integrity is lost for this event.

The containment system remains available as a barrier to the release of radioactivity.

15.6.4.1.4 Reactor Core and Plant System Evaluation 15.6.4.1.4.1 Input Parameters and Initial Conditions Input important to a small break LOCA are selected in accordance with sensitivities calcu-lated for small break LOCAs using NOTRUMP (Reference 13).

A. Core power level is assumed to be 1811 MWt. All breaks are analyzed at high TAVG (576.0F) conditions.

B. Key assumptions used in the small break LOCA analyses are provided in Table 15.6-11.

C. The safety injection flow characteristics as a function of RCS pressure are provided in Table 15.6-10. The characteristics assume 5% pump degradation with one line spilling to containment. Credit for safety injection flow delivery to the RCS was delayed 32 seconds after the safety injection signal was generated at the pressurizer pressure low setpoint.

D. Main steam safety valve set pressures and flows are provided in Table 15.6-12.

E. The accident analysis assumed nominal accumulator water volume (1115 ft3) with a mini-mum cover gas pressure of 114.7 psia.

Page 184 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES F. Minimum ECCS availability is assumed for the analysis, and pumped ECCS water is con-servatively assumed to be at the maximum refueling water storage tank (RWST) tempera-ture.

G. The small break LOCA analysis assumes the core continues to operate at full rated power until the control rods are completely inserted.

15.6.4.1.4.2 Methodology The small break LOCA analyses were performed with the Westinghouse 1985 small break LOCA emergency core cooling system (ECCS) NOTRUMP evaluation model (References 9, 10, 11 and 21). This evaluation model consists of the NOTRUMP code (References 9, 10 and

21) and the LOCTA code (Reference 11).

The NOTRUMP small break LOCA evaluation model was developed to provide a better esti-mate calculation of small break LOCA behavior in a Westinghouse designed nuclear steam supply system while complying with the requirements of 10 CFR 50.46 and Appendix K (Reference 12) of 10 CFR 50. In order to provide a better estimate calculation of the reactor coolant systems (RCS) response NOTRUMP employed better estimate models and model-ing assumptions whenever possible and wherever allowed by Appendix K (Reference 12).

NOTRUMP models the RCS as volume nodes interconnected by flow paths. The intact and broken loops are modeled explicitly. The transient behavior of the system is determined from the governing conservation equations of mass, energy, and momentum applied throughout the system. The multinode capability of the program enables an explicit and detailed spatial rep-resentation of various system components. In particular, it enables a proper calculation of the behavior of the loop seal during a LOCA.

The Ginna residual heat removal pumps inject directly to the reactor vessel in the upper ple-num region during the cold leg injection phase. The effect of flow from the residual heat removal pumps is generally not important in the small break LOCA analyses since the shutoff head is lower than the RCS pressure during the typical time portion of the transient consid-ered here. Therefore, the NOTRUMP model did not include any upper plenum injection residual heat removal flow.

Westinghouse LOCA methodology conservatively assumes that one of the injection lines is spilling during a LOCA. The safety injection flows used in the LOCA analysis are calculated assuming that the branch line with least resistance (Loop B) is spilling rather than injecting to the RCS. However, the high-head safety injection pumps for Ginna are not headered; there-fore, the spilling assumption has no other effect on delivered flow.

Peak clad temperature calculations are performed with the LOCTA-IV (Reference 11) code using the NOTRUMP calculated core pressure, fuel rod power history, and uncovered core steam flow and mixture heights as boundary conditions. While NOTRUMP models an aver-age core rod, LOCTA-IV models the hot rod and the average hot assembly rod. The LOCTA-IV model accounts for the power shape distribution effect which is greater in the upper core regions during typical small break LOCAs. This distribution is limiting for small break LOCAs since it maximizes vapor superheating and fuel rod heat generation at the uncovered elevations. The fuel rod initial conditions, which include temperature, rod internal pressure, Page 185 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES and fission gas composition, are calculated in accordance with the Westinghouse improved fuel performance models (Reference 48).

15.6.4.1.4.3 Acceptance Criteria The acceptance criteria for the small break LOCA analysis are defined per 10 CFR 50.46 (Reference 12). The acceptance criteria are summarized below:

A. The calculated peak fuel element cladding temperature is below 2200F.

B. The maximum local metal-water reaction is less than 17% of the total cladding thickness before oxidation.

C. The maximum hydrogen generation is less than 1% of the hypothetical amount that would be generated if all cladding (except for the cladding surrounding the plenum volume) were to react.

D. The core geometry remains amenable to cooling.

E. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.

15.6.4.1.4.4 Results To identify the limiting break size, a spectrum of breaks ranging from 1.5 to 3 inches in diameter were analyzed. The thermo-hydraulic transient results for the breaks in the spec-trum analyzed are summarized in Table 15.6-13, while the rod heat up results for those tran-sients are summarized in Table 15.6-14.

The worst small break is the 2 inch equivalent diameter high TAVG break. This break has the highest peak clad temperature for the spectrum of breaks analyzed. The depressurization transient for this break is shown in Figure 15.6-15. The core mixture level, showing the extent of core uncovery, is shown in Figure 15.6-16.

The cladding temperature transient is shown in Figure 15.6-17 for the break with the highest cladding temperature. The peak clad temperature of 1167F occurred at 1650 seconds.

The core exit vapor flow rate is shown in Figure 15.6-18. The hot spot heat transfer coeffi-cient for the core uncovery time is shown in Figure 15.6-19. The hot spot fluid temperature for this worst break is shown in Figure 15.6-20.

Figure 15.6-21 presents the core axial power shape utilized to perform the small break analy-sis. This power shape was chosen because it provides a limiting distribution of power versus core height while maximizing local power in the upper regions of the reactor core.

Additional break sizes were analyzed to identify the limiting break size. Figures 15.6-22 and 15.6-23 present the reactor coolant system (RCS) pressure transients for the 1.6 inch and the 3 inch breaks. Figures 15.6-24 and 15.6-25 present the core mixture level plots for those same two breaks. The peak clad temperatures for 1.5 inch and the 3 inch breaks were lower than the 2 inch break. The peak clad temperature transients the 1.5 inch and the 3 inch breaks are given in Figures 15.6-26 and 15.6-27, respectively.

Page 186 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.4.1.4.5 Effect of Emergency Core Cooling System (ECCS) Evaluation Model Modifications This section is used to document penalties assigned to the SBLOCA analysis. There are new penalties assigned to the new accident of record.

15.6.4.1.5 Radiological Evaluation The radiological consequences of a small break LOCA are bounded by the large break LOCA provided in Section 15.6.4.2.5.

15.6.4.1.6 Conclusions Analyses presented in Section 15.6.4.1.4 show that the high head portion of the emergency core cooling system (ECCS), together with the accumulators, provide sufficient core flooding to keep the calculated peak clad temperatures below the required limits of 10 CFR 50.46 (Ref-erence 12). Hence, adequate protection is afforded by the ECCS in the event of a small break LOCA.

15.6.4.2 Major Reactor Coolant System Pipe Ruptures (Loss-of-Coolant Accident)

The analysis specified by 10 CFR 50.46, "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Power Reactors" (Reference 12), is presented in this section for a major rupture of the reactor coolant system (RCS) pressure boundary. A major pipe rupture (large break) is defined as a breach in the reactor coolant pressure boundary with a total cross-sectional area greater than 1.0 ft2.

15.6.4.2.1 Description of Event The plant is assumed to be in a full power, equilibrium condition, i.e., the heat generated in the core is being removed through the steam generator secondary system. At the beginning of the blowdown phase, the entire reactor coolant system (RCS) contains subcooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. During blowdown, heat from fission product decay, hot internals, and the vessel con-tinues to be transferred to the reactor coolant. After the break develops, the time to departure from nucleate boiling is calculated. Thereafter, the core heat transfer is unstable, with both nucleate boiling and film boiling occurring. As the core becomes voided, both transition boil-ing and forced convection are considered as the dominant core heat transfer mechanisms.

Radiant heat transfer is also considered.

The heat transfer between the RCS and the secondary system may be in either direction depending on the relative temperatures. In the case of the large break LOCA, the primary pressure rapidly decreases below the secondary system pressure, and the steam generators are an additional heat source.

When the RCS depressurizes to approximately 765 psia, the accumulators begin to inject borated water into the reactor coolant loops. For breaks in the cold leg of the RCS, borated water from the accumulator in the broken loop is assumed to spill to containment and be unavailable for core cooling. Flow from the accumulator in the intact loop may not reach the Page 187 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES core during depressurization of the RCS due to the fluid dynamics present during the emer-gency core cooling system (ECCS) bypass period. ECCS bypass results from the momentum of the fluid flow up the downcomer which entrains ECCS flow out toward the cold leg break.

Bypass of the safety injection diminishes as mechanisms responsible for the bypassing become no longer significant.

The blowdown phase of the transient ends when the RCS (initially assumed to be around 2250 psia) falls to a value approaching that of the containment atmosphere. After blowdown, refill of the reactor vessel lower plenum begins. Refill is completed when emergency core cooling water has filled the lower plenum of the reactor vessel, which is bounded by the bot-tom of the fuel rods (called bottom of core recovery time).

The reflood phase of the transient is essentially the time period lasting from bottom of core recovery until the reactor vessel has been filled with water to the extent that the core tempera-ture rise has been terminated. From the latter stage of blowdown and on into the beginning of reflood, the intact loop safety injection accumulator rapidly discharges borated cooling water into the RCS. Although the portion injected before the end of bypass is lost out the cold leg break, the accumulator eventually contributes to the filling of the reactor vessel downcomer.

The downcomer water elevation head provides the driving force required for the reflooding of the reactor core. The safety injection pumps aid in the filling of the downcomer and core and subsequently supply water to help maintain a full downcomer and complete the reflooding process. The upper plenum injection also aids the reflooding process by providing water to the core through the vessel upper plenum.

The end of the refill phase and the beginning of the reflood phase, i.e., bottom of core time, is not as significant an event or as easily defined for the two-loop upper plenum injection large break LOCA WCOBRA/TRAC evaluation model when compared to previous Westinghouse large break evaluation models. The typical practice for WCOBRA/TRAC analyses is to report the time the collapsed liquid level reaches 95% of the lower plenum as the bottom of core time. However, since a significant portion of the upper plenum safety injection water can flow down the low power/periphery channels of the core, significant cooling of the hot rod can occur before this time due to transverse flows within the core. In some cases, this cooling can be sufficient to cause the peak clad temperature to occur prior to the bottom of core time.

After the water level of the refueling water storage tank (RWST) reaches a minimum allow-able value, coolant for long-term cooling of the core is obtained by switching from the injec-tion mode to the sump recirculation mode of ECCS operation. Spilled borated water is drawn from the containment sump by the low-head safety injection pumps and returned to the upper plenum. Core temperatures are then reduced to long-term steady state levels associated with dissipation of decay heat generation.

Long-term cooling includes long-term criticality control. Criticality control is achieved by maintaining subcriticality with boron in the ECCS and sump without credit for rod cluster control assembly insertion. The necessary RWST and accumulator boron concentrations are a function of each core design and are verified each cycle.

Page 188 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.4.2.2 Frequency of Event The large break LOCA is considered an ANS Condition IV event (Reference 16). Condition IV occurrences are faults which are not expected to occur during the lifetime of the plant but are postulated because the consequences include the potential for the release of significant amounts of radioactive material. Section 15.0.8 discusses the ANS classification categories.

15.6.4.2.3 Event Analysis The analysis was performed using ASTRUM. Westinghouse developed an alternative uncer-tainty methodology called ASTRUM, which stands for Automated Statistical Treatment of Uncertainty Method (Reference 22). This method is still based on the Code Qualification Document (CQD, Reference 19) methodology and follows the steps in the Code Scaling, Applicability, and Uncertainty (CSAU) methodology. However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order statistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncertainty parameters are simultaneously sampled for each case.

This analysis consists of 124 WCOBRA/TRAC cases, which support the following peaking factors:

FdH = 1.72 FQ = 2.60 Also, the uncertainty of the pressurizer pressure used was 60 psi.

All analyzed cases were performed for Ginna Extended Power Uprate (EPU) at a core power of 1811 MWt.

As part of the Increase in Containment Air Temperature project (Reference 66), 15 of the original cases were re-analyzed considering both the increase in Accumulator temperature and Thermal Conductivity Degradation (TCD).

15.6.4.2.3.1 Protective Features Protective features credited in the large break LOCA analysis include:

1. Reactor Trip System (RTS) - Reactor trip is simulated by isolating the steam generator sec-ondary side at the onset of a transient. This assumption is considered conservative since it effectively eliminates heat transfer from the primary system to the secondary loop through the steam generator. Note that no credit is taken for the insertion of the control rods (see Section 15.6.4.2.3.2).

2. Engineered Safety Features Actuation System (ESFAS) - A safety injection actuation signal is generated on two-out-of-three low pressurizer pressure (ESFAS) signals. The low pres-surizer pressure signal is conservatively assumed to generate the safety injection signal although the high containment pressure signal is likely to occur earlier for the large break LOCA.

3. Safety Injection - The safety injection signal will result in the startup of the high-head and low-head safety injection pumps. The single failure assumed in the analysis will result in the startup of one safety injection pump plus the swing injection pump supplying two RCS Page 189 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES cold leg injection paths. The assumed single failure will result in the start up of one of two residual heat removal pumps used for upper plenum injection.

4. Accumulators - Two accumulators are available to inject coolant during the initial phases of large break LOCAs. The accumulators perform their function when the RCS pressure decreases below the accumulators pressure. The accumulators are not assumed to fail given their passive design; however, only one accumulator is credited because of the possi-bility of one accumulators injection spilling out the cold leg break.

15.6.4.2.3.2 Single Failures Assumed For large break loss-of-coolant accidents (LOCAs), the limiting single failure is one which minimizes the amount of emergency core cooling system (ECCS) flow delivered to the core without reducing the capability of the emergency safeguards systems to reduce the contain-ment pressure. A lower containment backpressure reduces the reflooding rate due to the increased difficulty in venting steam as a result of increased steam binding. The lowest con-tainment pressure is obtained only if all containment spray pumps and containment recircula-tion fan coolers (CRFCs) operate subsequent to the postulated LOCA. As such, both trains of active heat removal systems are assumed to fully operate. This is consistent with the NRC Branch Technical Position CSB 6-1 (Reference 18). Therefore, for the purposes of large break LOCA analyses, the most limiting single failure would be the loss of one ECCS train (one high-head safety injection pump and one low-head safety injection pump) with full oper-ation of the spray pumps and containment recirculation fan coolers (CRFCs).

An additional conservative assumption is that the insertion of control rods to shut down the reactor is neglected in the large break LOCA analysis, although in reality some control rod insertion may occur.

15.6.4.2.3.3 Operator Actions Assumed No operator actions are assumed in the large break LOCA analyses. The transients are run until reflood is complete and the core is well on its way to or has achieved quench.

15.6.4.2.3.4 Chronological Description of Event The LOCA transient can be conveniently divided into a number of time periods in which spe-cific phenomena are occurring. For a typical large break, the blowdown period can be divided into the critical heat flux (CHF) phase, the upward core flow phase, and the down-ward core flow phase. These are followed by the refill, reflood, and long-term cooling phases. The important phenomena occurring during each of these phases are discussed for the initial transient. The results are shown in Figures 15.6-35 through 15.6-46.

Critical Heat Flux (CHF) Phase The reactor coolant pumps are assumed to trip coincident with the break opening. Shortly after the break is assumed to open, the vessel depressurizes rapidly and the core flow decreases as subcooled liquid flows out of the vessel into the broken cold leg. The fuel rods go through departure from nucleate boiling (DNB) and the cladding rapidly heats up (Figure 15.6-35 ) while the core power shuts down due to voiding in the core. Control rod insertion is not modeled. The hot water in the core and upper plenum flashes to steam. The water in the upper head flashes and is forced down through the guide tubes. The break flow becomes sat-urated and is substantially reduced (Figure 15.6-36).

Page 190 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Upward Core Flow Phase The colder water in the downcomer and lower plenum flashes and the mixture swells. Since the intact loop pump is assumed to trip at the initiation of the break, it begins to coast down and does not serve to enhance upflow cooling by pushing fluid into the core. However, there is sufficient upflow cooling to begin significantly reducing the heatup in the fuel rods. As the lower plenum fluid depletes, upflow through the core ends (Figure 15.6-37).

Downward Core Flow Phase The break flow begins to dominate and pulls flow down through the core. Figure 15.6-37 shows the total core flow at the bottom of the core. The blowdown PCT occurs as the down-flow increases in intensity and continues to decrease while downflow is sustained. At approximately 13 sec, the pressure in the cold leg falls to the point where the accumulator begins injecting into the cold leg (Figure 15.6-38). Because the break flow is still high, much of the accumulator emergency core cooling system (ECCS) water entering the downcomer is bypassed out the break. As the system pressure continues to decrease, the break flow, and consequently the core flow, is reduced. The break flow further reduces and the accumulator water begins to fill the downcomer and lower plenum. The core flow is nearly stagnant during this period and the hot assembly experiences a near adiabatic heatup.

Refill Phase The high head safety injection (HHSI) pump begins to inject (Figure 15.6-39) into the cold leg at approximately 38 sec, assuming a delay time of 32 sec after the SI signal is initiated when a loss of offsite power is assumed. Since the break flow has significantly reduced by this time, much of the ECCS entering the downcomer via the cold leg is retained in the down-comer and refills the lower plenum. The low head safety injection (LHSI) pump is assumed to begin injecting (Figure 15.6-40) cold ECCS water into the upper plenum at approximately 36 sec, assuming a delay of 30 sec for the loss of offsite power case, after the SI signal is ini-tiated. The water enters the vessel at the hot leg nozzle centerline elevation and falls down to the upper core plate through the outer global channels. The liquid drains down through the low power region via the open hole channel of the CCFL region. The hot assembly continues to experience a nearly adiabatic heatup as the lower plenum fills with ECCS water (Figures 15.6-35 and 15.6-42).

Reflood At approximately 48 sec, the intact loop accumulator is empty of water and begins injecting nitrogen into the cold leg (Figure 15.6-38). The in-surge in the downcomer forces the down-comer liquid into the lower plenum and core regions (Figures 15.6-41 through Figure 15.6-43). During this time, core cooling is increased, and the hot assembly clad temperature decreases slightly.

The clad temperature in the hot assembly returns to a nearly adiabatic heatup for about 30 sec until the core again begins to refill. The LHSI liquid flows down through the low power region and then across the core into the average assemblies near the bottom of the core. This water quenches the bottom of the core, which produces vapor that flows up through the aver-Page 191 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES age and hot assemblies providing bottom-up cooling. The reflood PCT occurs at approxi-mately 70 sec.

By about 120 sec, a quench front is established that progresses up the core, moving the PCT elevation higher into the core until the rods quench at about 220 sec (Figure 15.6-46). The system pressure is constant near atmospheric pressure by this time (Figure 15.6-45), and the vessel liquid inventory continues to increase until the end of the transient (Figure 15.6-44).

15.6.4.2.3.5 Impact on Fission Product Barriers The fuel cladding peak temperatures and metal-water reactions remain below the required limits of 10 CFR 50.46 (Reference 12). Large fractions of fission products are assumed to be released from the fuel even though these releases would be precluded by the performance of the ECCS.

The RCS pressure boundary is breached by the postulated large break; therefore, pressure boundary integrity is lost for this event.

The containment system remains available as a barrier to the release of radioactivity.

15.6.4.2.4 Reactor Core and Plant System Evaluation 15.6.4.2.4.1 Input Parameters and Initial Conditions Table 15.6-16 and the following summarize key plant and model parameters whose range and uncertainty are considered in the large-break LOCA analysis. The assumed initial conditions for the initial case calculations are also given.

1.0 Plant Physical Description

a. Dimensions: Nominal geometry is assumed. Nominal geometry input is accounted for in the code uncertainty since experiments were also subject to thermal expansion and dimen-sional uncertainty effects.

b. Flow Resistance: Best estimate values of loop flow resistance are assumed. Variations in this parameter are accounted for in the model uncertainty.

c. Pressurizer Location: The pressurizer is assumed to be on the broken loop. This has been determined as the limiting location for the pressurizer (Reference 22).

d. Hot Assembly Location: The location assumed for the hot assembly is that which reduces the direct flow of water from the upper head or upper plenum. This location is chosen to be under a source plate.

e. Hot Assembly Type: The hot assembly is a fresh assembly of Westinghouse 14x14 Van-tage+422 fuel.

f. Steam Generator Tube Plugging (SGTP) Level: The most limiting value of SGTP level is identified on a plant-specific basis. The limiting value over the expected range is con-firmed and included in the final reference transient.

2.1 Plant Initial Operating Conditions Page 192 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 2.2 Reactor Power

a. Initial Core Average Linear Heat Rate: Maximum power with 0% measurement uncer-tainty is assumed. This technique will bound any potential future mini-uprate which would reduce the measurement uncertainty below 2%.

b. Hot Rod Peak Linear Heat Rate: The hot rod FQ is assumed to be the median expected value, without uncertainties, between the desired Technical Specifications limit and the maximum value for steady state depletion. The value of FQ assumed in the initial transient is, therefore, substantially higher than the value likely to be measured during normal sched-uled surveillance. Variations in this parameter are accounted for in the uncertainty analysis.

c. Hot Rod Average Linear Heat Rate: The hot rod average linear heat rate is derived from the desired Technical Specification value. The value of FH assumed in the initial transient is, therefore, substantially higher than the value likely to be measured during most of the fuel cycle. Variations in this parameter are accounted for as part of the uncertainty analysis.

d. Hot Assembly Average Linear Heat Rate: The power generated in the hot assembly rod is 4% lower than that generated in the hot rod. Variations in this parameter due to hot assembly power and its redistribution are accounted for as part of the uncertainty analysis.

e. Hot Assembly Peak Linear Heat Rate: Consistent with the average linear heat rates, the peaking factor used to calculate the peak nuclear energy generated in the hot assembly aver-age rod is 4% lower than the value assumed in the hot rod. Variations in this parameter are accounted for as part of the uncertainty analysis.

f. Axial Power Distribution: The power distribution used in the initial transient calculation is more conservative than expected during normal operation. It is characterized by a top-skewed power shape, an FQ higher than the maximum value expected for baseload opera-tion, and an FH in excess of the Technical Specification limits (Figure 15.6-33). Variations in axial power distribution due to transient operation are accounted for as part of the uncer-tainty analysis.

g. Low Power Region (PLOW): A relative power of 60% of the core average is assumed for the low power region. The limiting value over the expected operating range for this param-eter is determined in the confirmatory studies.

h. Hot Assembly Burnup: Beginning of Life (BOL) conditions in the hot assembly are assumed in the initial transient. The time in cycle is a sampled parameter in the ASTRUM methodology (Reference 22).

i. Prior Operating History: The reactor is assumed to have been operating, since fuel cycle startup, at 1811 MWt. When a given axial power distribution is considered, it is assumed to have existed since this startup time. This means that the distribution of fission products coincides with the steady state fission rate distribution. This assumption conservatively places both the initial fission rate and stored energy, and the subsequent decay heat produc-tion, at the same axial location.

j. Moderator Temperature Coefficient: A value greater than or equal to the maximum specified value in the Technical Specifications is assumed to conservatively estimate core reactivity and fission power.

Page 193 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

k. Hot Full Power (HFP) Boron Concentration: A low value typical of those used in cur-rent cores at BOL conditions is assumed.

2.3 Fluid Conditions

a. Average Fluid Temperature (TAVG): TAVG is assumed at the maximum nominal expected value of 576F during normal full power operation. The minimum nominal value of TAVG is analyzed as part of the confirmatory calculations. Variations in the uncertainty of this parameter are included in the uncertainty analysis.

b. Pressurizer Pressure: The nominal operating value of pressurizer pressure is assumed.

The effect of uncertainties in this parameter is accounted for in the uncertainty analysis.

c. Loop Flowrate: A loop flowrate equal to the thermal design flowrate (TDF) at 10% SGTP is assumed for the best-estimate LBLOCA analysis.

d. Upper Head Temperature (TUH): The appropriate best estimate value of TUH is assumed. Since variation in this parameter is small, uncertainties are not included.

e. Pressurizer Level: The nominal value of pressurizer level is assumed. Because the pres-surizer level variations are typically small and the effect on PCT is small (Table 23-1 of Reference 19), uncertainties are not included.

f. Accumulator Water Temperature: A nominal value is assumed in the initial transient, with variations treated as part of the uncertainty analysis.

g. Accumulator Pressure: A nominal value of accumulator pressure is assumed in the initial transient, with variations in pressure treated as part of the uncertainty analysis.

h. Accumulator Water Volume: A nominal value of accumulator water volume is assumed in the initial transient, with variations in water volume treated as part of the uncertainty analysis.

i. Accumulator Line Resistance: A best-estimate value of accumulator line resistance is assumed in the initial transient. Uncertainty in line resistance is included in the uncertainty analysis.

j. Accumulator Boron Concentration: A minimum value of 2100 ppm for the accumulator is modeled.

3.0 Accident Boundary Conditions

a. Break Location: A break near the midpoint in the cold leg is assumed. Scoping studies reported in the CQD (Reference 19) show that the cold leg remains the limiting location for large LOCA. This conclusion is also applicable to two-loop plants with upper plenum injection, because the physical phenomena leading to this result are the same. More specif-ically, a break in the hot leg is not limiting because of the constant core upflow during blowdown. A break in the crossover (pump suction) leg is not limiting because the pump resistance to reverse flow results in strong core upflow cooling during blowdown, and reduced loss of inventory during reflood, after the downcomer level reaches the loop eleva-tion.

Page 194 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

b. Break Type: The cold leg split break (a longitudinal break in the pipe) is assumed in the initial transient. The effect of variations in break type is accounted for in the uncertainty analysis.

c. Break Size: For split breaks, the limiting break size is determined on a plant-specific basis for the initial transient. The uncertainty in the break size is accounted for as part of the uncertainty analysis. For a DECLG break, a nominal cold leg area is assumed.

d. Offsite Power: A loss of offsite power (LOOP) is assumed in the initial transient. A calcu-lation assuming offsite power available (OPA) is performed as part of the confirmatory runs to confirm the limiting condition.

e. Safety Injection (SI) Flow: Minimum SI flow is assumed, calculated using methods con-sistent with those currently employed for Appendix K analysis. Scoping studies reported in the CQD (Reference 19) indicate that increased SI flow reduces PCT. This parameter is, therefore, bounded. Table 15.6-17 shows the high head and low head SI flow versus pres-sure curves used in the analysis.

f. Safety Injection (SI) Temperature: Nominal values are assumed. Variations are accounted for in the uncertainty analysis.

g. Safety Injection (SI) Delay: Maximum values consistent with the offsite power assump-tion are used for the initial transient (LOOP) and the confirmatory runs.

h. Containment Pressure: A conservatively low containment pressure transient is assumed for the initial transient. This pressure transient is later confirmed against the approved con-tainment model, COCO (References 23 and 24), and mass and energy releases from the ref-erence WCOBRA/TRAC calculation. Figure 15.6-34 contains the containment pressure assumed in the initial transient. Note: This containment pressure is different than the con-tainment pressure used in the confirmatory studies (Figure 15.6-48 ).

i. Single Failure Assumption: The worst single failure is assumed to be that one train of SI fails, leaving one LHSI pump and one HHSI pump operable. This assumption is consistent with the recommended scenario outlined in the CQD (Reference 19).

j. Rod Drop Time: Consistent with the current design basis for this plant, all control rods are assumed not to insert during the large-break LOCA.

4.0 Model Parameters All model parameters are used at their best estimate or as coded values in the initial transient.

Table 15.6-16 summarizes the initial transient assumptions described above. For those parameters where a best estimate or nominal value was used, the corresponding uncertainty treatment is also given. The nuclear fuel rods were initialized with internal gas properties, radial power profiles, and fuel average temperatures from the Westinghouse Nuclear Fuel Core Technologies PAD code (Reference 48).

15.6.4.2.4.2 Methodology The analysis was performed using ASTRUM. Westinghouse developed an alternative uncer-tainty methodology called ASTRUM, which stands for Automated Statistical Treatment of Uncertainty Method (Reference 22). This method is still based on the CQD (Reference 19)

Page 195 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES methodology and follows the steps in the CSAU methodology (Reference 26). However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order sta-tistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncertainty parameters are simultaneously sampled for each case.

The ASTRUM methodology is based on order statistics. The technical basis of the order sta-tistics is described in Section 11 of Reference 22. The determination of the Peak Clad Tem-perature (PCT) uncertainty, Local Maximum Oxidation (LMO) uncertainty, and Core-Wide Oxidation (CWO) uncertainty relies on a statistical sampling technique. According to the sta-tistical theory, 124 WCOBRA/TRAC calculations are necessary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, CWO).

The uncertainty contributors are sampled randomly from their respective distributions for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are ran-domly sampled for each WCOBRA/TRAC calculation, includes initial conditions, power dis-tributions, and model uncertainties. The time in the cycle, break type (split or double-ended guillotine), and break size for the split break are also sampled as uncertainty contributors within the ASTRUM methodology.

The three 10 CFR 50.46 criteria (PCT, LMO, and CWO) are satisfied by running a sufficient number of WCOBRA/TRAC calculations (sample size). In particular, the statistical theory predicts that 124 calculations are required to simultaneously bound the 95 percentile of three parameters with a 95-percent confidence level. The 15 cases re-run as part of Reference 66, demonstrate the continued compliance with the 10 CFR 50.46 design basis limits.

Appendix K Compliance The LB BELOCA evaluation model with ASTRUM (Reference 22) conforms to 10 CFR 50, Appendix K, insofar as Reference 22 provides the documentation required by Part II of Appendix K. The realistic calculation is used to demonstrate compliance with the acceptance criteria of 10 CFR 50.46.

Emergency Core Cooling System (ECCS) Evaluation Model The evaluation model used to comply with the requirements of 10 CFR 50.46 (Reference 12),

and USNRC Regulatory Guide 1.157 (Reference 25), is described in this section. The analyt-ical techniques used for the large-break LOCA analysis are in compliance with 10 CFR 50.46 (Reference 12), and are described in References 19, 20, and 22.

In 1988, the NRC staff amended the requirements of 10 CFR 50.46 and Appendix K, "ECCS Evaluation Models" to permit the use of a realistic evaluation model to analyze the perfor-mance of the ECCS during a hypothetical LOCA. This decision was based on an improved understanding of LOCA thermal-hydraulic phenomena gained by extensive research pro-grams. Under the amended rules, best estimate thermal-hydraulic models may be used in place of models with Appendix K features. The rule change also requires, as part of the LOCA analysis, an assessment of the uncertainty of the best estimate calculations. It further requires that this analysis uncertainty be included when comparing the results of the calcula-tions to the prescribed acceptance criteria of 10 CFR 50.46 (Reference 12). Additional guid-ance for the use of best estimate codes is provided in Regulatory Guide 1.157 (Reference 25).

Page 196 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES To demonstrate use of the revised ECCS rule, the NRC and its consultants developed a method called Code Scaling, Applicability, and Uncertainty (CSAU) evaluation methodology (Reference 26). This method outlined an approach for defining and qualifying a best estimate thermal-hydraulic code and quantifying the uncertainties in a LOCA analysis.

A Westinghouse LOCA evaluation methodology for three- and four loop Pressurized Water Reactor (PWR) plants based on the revised 10 CFR 50.46 rules was developed with the sup-port of EPRI and Consolidated Edison. The methodology is documented in WCAP-12945-P-A, "Code Qualification Document (CQD) for Best-Estimate LOCA Analysis," (Reference 19).

More recently, Westinghouse developed an alternative uncertainty methodology called ASTRUM (Reference 22). This method is still based on the CQD methodology and follows the steps in the CSAU methodology. However, the uncertainty analysis (Element 3 in the CSAU) is replaced by a technique based on order statistics. The ASTRUM methodology replaces the response surface technique with a statistical sampling method where the uncer-tainty parameters are simultaneously sampled for each case.

The safety evaluation prepared by the NRC in Reference 66 determined that the 15 cases re-run for the containment temperature increase license amendment did not meet the ASTRUM methodology. The NRC found the evaluation acceptable for increasing containment temperature, because of Ginnas commitment to re-perform the entire analysis upon approval of a Thermal Conductivity Degradation (TCD) model.

The three 10 CFR 50.46 criteria (peak clad temperature, maximum local oxidation and core-wide oxidation) are satisfied by running a sufficient number of WCOBRA/TRAC calcula-tions (sample size). In particular, the statistical theory predicts that 124 calculations are required to simultaneously bound the 95 percentile of three parameters with a 95-percent con-fidence level.

The thermal-hydraulic computer code which was reviewed and approved for the calculation of fluid and thermal conditions in the PWR during a large-break LOCA is WCOBRA/TRAC Version MOD7A, Revision 6 (Reference 22).

WCOBRA/TRAC combines two-fluid, three-field, multi-dimensional fluid equations used in the vessel with one-dimensional drift-flux equations used in the loops to allow a complete and detailed simulation of a PWR.

The two-fluid formulation uses a separate set of conservation equations and constitutive rela-tions for each phase. The effects of one phase on another are accounted for by interfacial fric-tion and heat and mass transfer interaction terms in the equations. The conservation equations have the same form for each phase; only the constitutive relations and physical properties differ. Dividing the liquid phase into two fields is a convenient and physically accurate way of handling flows where the liquid can appear in both film and droplet form.

The droplet field permits more accurate modeling of thermal-hydraulic phenomena such as entrainment, de-entrainment, fallback, liquid pooling, and flooding.

WCOBRA/TRAC also features a two-phase, one-dimensional hydrodynamics formulation.

In this model, the effect of phase slip is modeled indirectly via a constitutive relationship, which provides the phase relative velocity as a function of fluid conditions. Separate mass Page 197 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES and energy conservation equations exist for the two-phase mixture and for the vapor.

The reactor vessel is modeled with the three-dimensional, three-field model, while the loop, major loop components, and safety injection points are modeled with the one-dimensional model.

All geometries modeled using the three-dimensional model are represented as a matrix of cells. The number of mesh cells used depends on the degree of detail required to resolve the flow field, the phenomena being modeled, and practical restrictions such as computing costs and core storage limitations.

The basic building block for the mesh is the channel, a vertical stack of single mesh cells.

Several channels can be connected together by gaps to model a region of the reactor vessel.

Regions that occupy the same level form a section of the vessel. Vessel sections are con-nected axially to complete the vessel mesh by specifying channel connections between sec-tions. Heat transfer surfaces and solid structures that interact significantly with the fluid can be modeled with rods and unheated conductors.

The noding diagram for R. E. Ginna is shown in Figures 15.6-31 and 15.6-32. The vessel channel layout is shown in Figure 15.6-31. Figure 15.6-32 shows the one-dimensional com-ponent layout for the loops. Within the channels and components, additional subdivisions into cells are present, as illustrated in these Figures.

A typical calculation using WCOBRA/TRAC begins with the establishment of a steady state initial condition with all loops intact. The input parameters and initial conditions for this steady state calculation are discussed in Section 15.6.4.2.4.1.

Following the establishment of an acceptable steady state condition, the transient calculation is initiated by introducing a break into one of the loops. The evolution of the transient through blowdown, refill, and reflood follows continuously using the same computer code.

WCAP-16009-P-A (Reference 22) provides ASTRUM methodology and also includes a description of the code models and their implementation. Volumes II and III of the CQD (Reference 19) presented a detailed assessment of the computer code WCOBRA/TRAC through comparisons to experimental data. From this assessment, a quantitative estimate was obtained of the code's ability to predict peak clad temperatures (PCT) in a PWR large-break loss-of-coolant accident (LOCA). Modeling of a PWR introduced additional uncertainties, which were identified and discussed in Section 21 of the CQD Volume IV (Reference 19). A list of key LOCA parameters was compiled as a result of these studies. Models of several PWRs were used to perform sensitivity studies and establish the relative importance of these parameters. The final step of the best-estimate methodology, in which all the important uncertainties of the LOCA parameters are accounted for to estimate a PCT, local maximum oxidation (LMO), and core-wide oxidation (CWO) at 95-percent probability, is described in the following sections. The methodology is summarized below:

Plant Model Development In this step, a WCOBRA/TRAC model of the plant is developed. A high level of noding detail is used to insure an accurate simulation of the transient. Specific guidelines are fol-lowed to assure that the model is consistent with models used in the code validation. This Page 198 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES results in a high level of consistency among plant models, with some plant-specific modeling dictated by hardware differences such as in the upper plenum of the reactor vessel or the Emergency Core Cooling System (ECCS) injection configuration.

Determination of Plant Operating Conditions In this step, the expected or desired operating range of the plant to which the analysis is to be applied is established using information supplied by the utility. The parameters considered are based on a "key LOCA parameters" list that was developed as part of the methodology. A set of these parameters, at mostly nominal values, is chosen as initial conditions to the plant model. A transient is run utilizing these parameters and is known as the "initial transient."

Next, several confirmatory runs are made, which vary a subset of the key LOCA parameters over their expected operating range. Because certain parameters are not included in the uncertainty analysis, these parameters are set at their bounding condition. This analysis is commonly referred to as the confirmatory analysis. Section 1-2-11 of Reference 22 describes the parameters of interest for the confirmatory analysis. The most limiting input conditions, based on these confirmatory runs, are then combined into the model that will represent the limiting state for the plant, which is the starting point for the assessment of uncertainty.

Assessment of Uncertainty The ASTRUM methodology is based on order statistics. The technical basis of the order sta-tistics is described in Section 11 of WCAP-16009-P-A (Reference 22). The determination of the PCT uncertainty, LMO uncertainty, and CWO uncertainty relies on a statistical sampling technique. According to the statistical theory, 124 WCOBRA/TRAC calculations are neces-sary to assess against the three 10 CFR 50.46 criteria (PCT, LMO, and CWO).

The uncertainty contributors are sampled randomly from their respective distribution for each of the WCOBRA/TRAC calculations. The list of uncertainty parameters, which are ran-domly sampled for each WCOBRA/TRAC calculation, include initial conditions, power dis-tributions, and model uncertainties. The time in the cycle, break type (split or double-ended guillotine), and break size for the split break are also sampled as uncertainty contributors within the ASTRUM methodology.

Results from the 124 calculations are tallied by ranking the PCT from highest to lowest. A similar procedure is repeated for LMO and CWO. The highest rank of PCT, LMO, and CWO will bound 95-percent of their respective populations with 95-percent confidence level.

Plant Operating Range The plant operating range over which the uncertainty evaluation applies is shown in Table 15.6-19. If operation is maintained within these ranges, the large-break LOCA analysis for the R. E. Ginna Nuclear Plant using WCOBRA/TRAC is valid.

Containment Pressure Boundary Conditions The system hydraulic transient is influenced by the containment pressure transient response to the mass and energy released from the reactor coolant system by the LOCA. In the best estimate emergency core cooling system (ECCS) evaluation model with ASTRUM, the con-Page 199 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES tainment pressure transient is provided as a boundary condition to the system hydraulic tran-sient. The containment pressure transient applied is to be conservatively low and include the effect of the operation of all pressure reducing systems and processes. The COCO computer code (Reference 23) is used to generate the containment pressure response to the mass and energy release from the break.

Potential for Short-Term Recriticality During Reflood Following a Large-Break LOCA Reference 59 documented a concern that a short-term recriticality could occur during core reflood following a large-break LOCA if the accumulator boron concentration was not suffi-ciently high. An evaluation is performed for each cycle to ensure that the minimum accumu-lator boron concentration is sufficient to maintain the core subcritical during post-LOCA reflood. This evaluation is tracked in the cycle-specific Reload Safety Analysis Checklist.

15.6.4.2.4.3 Acceptance Criteria The acceptance criteria for the large-break LOCA analysis are defined in 10 CFR 50.46 (Ref-erence 12). These acceptance criteria are summarized below. It is stated in Reference 12 that there must be a high level of probability that the following (summarized) acceptance criteria are met.

1. The calculated maximum fuel element cladding temperature shall not exceed 2200F.

2. The calculated total oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation.

3. The calculated total amount of hydrogen generated from the chemical reaction of the clad-ding with the water or steam shall not exceed 0.01 times the hypothetical amount that would be generated if all the metal in the cladding cylinders surrounding the fuel, excluding the cladding surrounding the plenum volume, were to react.

4. Calculated changes in core geometry shall be such that the core remains amenable to cool-ing.

5. Long-term core cooling shall be provided following the successful initial operation of the ECCS.

These criteria ensure that significant margin exists for ECCS performance following a LOCA.

15.6.4.2.4.4 Results Confirmatory Sensitivity Studies A number of sensitivity calculations were carried out to investigate the effect of the key LOCA parameters, and to determine the reference transient. In the sensitivity studies per-formed, LOCA parameters were varied one at a time. For each sensitivity study, a compari-son between the base case and the sensitivity case transient results was made. The results of these analyses lead to the following conclusions:

1. Modeling maximum steam generator tube plugging (10%) results in a higher PCT than minimum steam generator tube plugging (0%).

Page 200 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

2. Modeling loss of offsite power (LOOP) results in a higher PCT than no loss of offsite power (no-LOOP).

3. Modeling the maximum value of vessel average temperature (TAVG = 576F) results in a higher PCT than minimum value of vessel average temperature (TAVG = 564.6F).

4. Modeling the minimum power fraction (PLOW = 0.2) in the low power/periphery channel of the core results in a higher PCT than maximum power fraction (PLOW = 0.6).

Uncertainty Evaluation and Results The ASTRUM methodology requires the execution of 124 WCOBRA/TRAC transients to determine a bounding estimate of the 95th percentile of the Peak Clad Temperature (PCT),

Local Maximum Oxidation (LMO), and Core-Wide Oxidation (CWO) with 95% confidence level. The results for the R. E. Ginna Nuclear Power Plant are given in Table 15.6-20, which shows the limiting peak clad temperature of 1870F, the limiting local maximum oxidation of 3.43%, and the limiting core-wide oxidation of 0.30%. Table 15.6-15 contains a sequence of events for the limiting PCT case. The maximum peak clad temperature increased as part of the Containment Air Temperature Increase project (Reference 66).

The effect of the integral fuel burnable absorber (IFBA) fuel on PCT and LMO was analyzed as part of the ASTRUM methodology. The IFBA rods are treated as having a local effect, i.e.,

their presence in the core does not contribute to the global thermal-hydraulic response during a large-break LOCA. The analysis results indicate that as far as the PCT limit, IFBA fuel is bounded by the non-IFBA fuel. However, the IFBA fuel was more limiting with respect to the LMO. Note that IFBA has no effect on the calculation of the CWO value, which is based on global parameters and relies on WCOBRA/TRAC results only.

Transition Core Evaluation The base LBLOCA analysis discussed in this section was performed assuming a full core of 422 Vantage+ fuel. As part of the R. E. Ginna Nuclear Power Plant large-break LOCA analy-sis, additional calculations were performed to assess the effect of transition cores from the resident OFA fuel to the 422 Vantage+ fuel design. It was determined that the analysis results for the full core of 422 Vantage+ are applicable to the transition cycles.

15.6.4.2.5 Radiological Evaluation As part of the Control Room Emergency Air Treatment System (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistancy, new x/Q values and off-site doses were also analyzed. Reference 57 is now considered to be the Large Break LOCA dose analysis of record. The analysis was performed using the alter-nate source term (AST) per 10 CFR 50.67 and Reference 54. The new methodology and anal-ysis was approved by the NRC in Reference 55 as supplemented by Reference 56 and Reference 67. The assumptions used in the analysis are summarized in Table 15.6-21 with the results listed in Table 15.6-21A. The core activity (Reference 58) is listed by isotope in Table 15.6-22 and inventory release fractions are contained in Table 15.6-23.

Page 201 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.6.4.2.6 Conclusions It must be demonstrated that there is a high level of probability that the limits set forth in 10 CFR 50.46 are met. The demonstration that these limits are met for the R. E. Ginna Nuclear Power Plant is as follows:

1. The calculated maximum fuel element cladding temperature shall not exceed 2200F. The results presented in Table 15.6-20 indicate that this regulatory limit has been met with a cal-culated limiting reflood PCT95%of 1870F.

2. The calculated maximum local oxidation of the cladding shall nowhere exceed 0.17 times the total cladding thickness before oxidation. The results presented in Table 15.6-20 indi-cate that this regulatory limit has been met with a calculated maximum local oxidation of 3.43 percent.

3. The calculated total amount of hydrogen generated from the chemical reaction of the clad-ding with water or steam shall not exceed 0.01 times the hypothetical amount (or 1 percent) that would be generated if all of the metal in the cladding cylinders surrounding the fuel were to react. The results presented in Table 15.6-20 indicate that this regulatory limit has been met with a calculated maximum core-wide oxidation of 0.30 percent.

4. Calculated changes in core geometry shall be such that the core remains amenable to cool-ing. This requirement is met by demonstrating that the PCT does not exceed 2200F, the maximum local oxidation does not exceed 17%, and the seismic and LOCA forces are not sufficient to distort the fuel assemblies to the extent that the core cannot be cooled. The approved methodology (Reference 19) specifies that effects of LOCA and seismic loads on core geometry do not need to be considered unless grid crushing extends beyond the assem-blies in the lower power channel, as defined in the WCOBRA/TRAC model. This situation has not been calculated to occur for the R. E. Ginna Nuclear Power Plant; therefore, this regulatory limit is met.

5. 10 CFR 50.46 acceptance criterion (b)(5) requires that long-term core cooling be provided following the successful initial operation of the ECCS. The approved Westinghouse posi-tion on this criterion is that this requirement is satisfied if a coolable core geometry is main-tained, and the core remains subcritical following the LOCA (Reference 27). This position is unaffected by the use of the best-estimate LOCA methodology.

Offsite doses resulting from large break LOCAs are acceptable, i.e., within 10 CFR 50.67 guidelines.

Page 202 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.6

1. Report for Small Break Accidents for Westinghouse NSSS System, WCAP-9600, June 1979.

2. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

SEP Topics XV-2, XV-12, XV-16, XV-17, XV-20, Radiological Consequences Draft Safety Evaluations, dated September 24, 1981.

3. Lewis, Huang, Behnke, Fittante, Gelman, SGTR Analysis Methodology to Determine the Margin to Steam Generator Overfill, WCAP-10698-P-A (Proprietary Version),

August 1987.

4. Letter from R. W. Eliasz, RG&E, to Westinghouse,

Subject:

Ginna Specific Operator Action Times for SGTR Analysis, dated February 7, 1985.

5. Lewis, Huang, Rubin, Evaluation of Offsite Radiation Doses for a Steam Generator Tube Rupture Accident, Supplement 1 to WCAP-10698-P-A (Proprietary Version), March 1986.

6. NRC Regulatory Guide 1.4, Revision 2, Assumptions Used for Evaluating the Potential Radiological Consequences of a LOCA for Pressurized Water Reactors, dated June 1974.

7. NRC Regulatory Guide 1.109, Revision 1, "Calculation of Annual Doses to Man From Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance With 10CFR Part 50 Appendix I", October 1977.

8. Letter from E. Meliksetian (Westinghouse) to P. Bamford (RG&E), NF-RG-02-16, CAD-02-103,

Subject:

Results of Dose Analyses for Ginna Cycle 30, dated March 13, 2002.

9. P. E. Meyer, et al., NOTRUMP - A Nodal Transient Small Break and General Network Code, WCAP-10079 P-A (Proprietary Version), WCAP-10080-NP-A (Non-Proprietary Version), August 1985.

10. N. Lee, et al., Westinghouse Small Break ECCS Evaluation Model Using The NOTRUMP Code, WCAP-10054-P-A (Proprietary Version), WCAP-10081-NP-A (Non-Proprietary Version), August 1985.

11. F. M. Bordelon, et al., LOCTA-IV Program: Loss-of-Coolant Transient Analysis, WCAP-8301 (Proprietary Version), WCAP-8305 (Non-Proprietary Version), June 1974.

12. 10 CFR 50.46 and 10 CFR 50 Appendix K, "Acceptance Criteria for Emergency Core Cooling Systems for Water Cooled Nuclear Power Reactors," Federal Register, Volume 39, Number 3, January 1974, as amended in Federal Register, Volume 53, September 1988.

13. S. D. Rupprecht, et al., Westinghouse Small Break LOCA ECCS Evaluation Model Generic Study With the NOTRUMP Code, WCAP-11145-P-A (Proprietary Version),

WCAP-11372-A (Non-Proprietary Version), October 1986.

14. DELETED Page 203 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

15. DELETED

16. ANS-51.1/N18.2-1973, Nuclear Safety Criteria for the Design of Stationary Pressurized Water Reactor Plants.

17. A. J. Friedland and S. Ray, Revised Thermal Design Procedure, WCAP-11397-P-A (Pro-prietary Version), April 1989.

18. Branch Technical Position CSB 6-1, Minimum Containment Pressure Model For PWR ECCS Performance Evaluation, dated November 24, 1975.

19. Bajorek, S. M., et al, 1998, "Westinghouse Code Qualification Document for Best Esti-mate Loss of Coolant Accident Analysis," WCAP-12945-P-A (Proprietary), Volume I, Revision 2, and Volumes II through V, Revision 1, and WCAP-14747 (Non-Proprietary).

20. Dederer, S. L., et al, 1999, "Application of Best Estimate Large Break LOCA Methodol-ogy to Westinghouse PWRs with Upper Plenum Injection," WCAP-14449-P-A (Propri-etary), Revision 1, and WCAP-14450 (Non-Proprietary).

21. Thompson, C. M., et al, Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary Ver-sion), WCAP-10081-NP-A, Addendum 2, Revision 1 (Non-Proprietary Version), July 1997.

22. Nissley, M. E., et al, January 2005, "Realistic Large-Break LOCA Evaluation Methodol-ogy Using the Automated Statistical Treatment of Uncertainty Method (ASTRUM),"

WCAP-16009-P-A.

23. F. M. Bordelon and E. T. Murphy, Containment Pressure Analysis Code (COCO),

WCAP-8327 (Proprietary Version), WCAP-8326 (Non-Proprietary Version), June 1974.

24. Bordelon, F. M., et al, 1974, "Westinghouse Emergency Core Cooling System Evaluation Model - Summary," WCAP-8339.

25. USNRC Regulatory Guide 1.157, "Best-Estimate Calculations of Emergency Core Cool-ing System Performances," May 1989.

26. Boyack, B., et al, "Qualifying Reactor Safety Margins: Application of Code Scaling Applicability and Uncertainty (CSAU) Evaluation Methodology to a Large Break Loss-of-Coolant-Accident," NUREG/CR-5249, 1989.

27. Letter from D. B. Vassallo (USNRC) to C. Eicheldinger, Westinghouse, "Topical Report Evaluation for the Westinghouse ECCS Evaluation Model: Supplementary Information,"

May 30, 1975.

28. DELETED

29. Letter from R. H. Owoc, Westinghouse, to R. W. Eliasz, RG&E, NSD-SAE-ESI-97-447,

Subject:

Response to NRC LOCA Audit Questions, dated August 1, 1997.

Page 204 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

30. DELETED

31. DELETED

32. DELETED

33. DELETED

34. DELETED

35. Letter from R. H. Owoc, Westinghouse, to R. W. Eliasz, RG&E, NSD-SAE-ESI-97-512,

Subject:

Large and Small Break LOCA Evaluation for Accumulator Water Volume and RWST Temperature - Phase 1, dated September 11, 1997.

36. DELETED

37. Letter from B. McKenzie, Westinghouse, to P. Bamford, RG&E, 98RG-G-0032,

Subject:

ZIRLOTM Safety Assessment, dated October 8, 1998.

38. DELETED

39. DELETED

40. DELETED

41. DELETED

42. DELETED

43. Letter from K. C. Hoskins, Westinghouse, to R. W. Eliasz, RG&E,

Subject:

Final Non-LOCA Analysis Licensing/Summary Report, NTD-NSRLA-OPL-95-571, dated Decem-ber 5, 1995.

44. DELETED

45. DELETED

46. DELETED

47. Rochester Gas & Electric 50.59 Evaluation # 2002-0001, Revision 0, SI Pump Discharge Check Valves 878G & 878J Replacement, dated March 12, 2002.

48. J.P. Foster, S. Sidener, "Westinghouse Improved Performance Analysis and Design Model (PAD 4.0)," WCAP-15063-P-A, Revision 1, with errata, July 2000.

49. Letter from S. P. Swigert, Westinghouse, to J. Widay, RG&E, RGE-03-11,

Subject:

10 CFR 50.46 Annual Notification and Reporting for 2002, dated March 7, 2003.

50. Letter from S. P. Swigert, Westinghouse, to J. Widay, RG&E, RGE-03-18,

Subject:

Transmittal of SECY Large Break LOCA Analysis Engineering Report and Associated Documentation, dated March 27, 2003.

Page 205 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

51. Letter from S. P. Swigert, Westinghouse, to J. Widay, RG&E, RGE-04-19,

Subject:

10 CFR 50.46 Annual Notification and Reporting for 2003, dated March 17, 2004.

52. Letter from D. Warren, Westinghouse, to M. Korsnick, Constellation, RGE-05-22, Sub-ject: 10 CFR 50.46 Annual Notification and Reporting for 2004, dated April 6, 2005.

53. DA-NS-2001-087, Large Break LOCA Offsite and Control Room Doses, Revision 2.

54. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

55. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant -Amendment re: Modification of the Control Room Emergency Air Treat-ment System and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123), dated February 25, 2005.

56. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant -Correction to Amendment No. 87 re: Modification of the Control Room Emergency Air Treatment System (TAC No. MB9123), dated May 18, 2006.

57. DA-NS-2001-087, Large Break LOCA Offsite and Control Room Doses, Revision 4.

58. DA-NS-2002-037, HABIT Code Nuclear Data Library, Revision 1.

59. NSAL-07-7, Short-Term Recriticality During a PWR Large Break LOCA.

60. CN-CRA-12-30 Steam Generator Tube Rupture for the Ginna Extended Power Uprate Rev. 0.

61. CALC-2013-0006 RELAP5 Modeling of Ginna SGTR: Sensitivity Calculations in Support of SGTR Analysis Update Rev. 0.

62. CALC-2010-0030 (CN-CRA-09-54) Ginna Steam Generator Tube Rupture Opera- tor Action Scoping Rev. 0.

63. CN-CRA-04-67 Steam Generator Tube Rupture for the Ginna Extended Power Uprate Rev. 0.

64. NSAL-07-11 Westinghouse Nuclear Safety Advisory Letter, Decay Heat Assumption in Steam Generator Tube Rupture Margin-to-Overfill Analysis Methodology Dated 11/15/2007.

65. ECP-13-000137 ESR-13-0054 ESR (000) - Update SGTR Safety Analysis Rev. 0.

66. Letter from M.C. Thadani, NRC, to J.E. Pacher, Ginna NPP,

Subject:

R.E. Ginna Nuclear Power Plant - Issuance of Amendment RE: Revision to Technical Specification Section 3.6.5, Containment Air Temperature. (TAC NO. MF0900), dated August 12, 2014.

(License Amendment No. 116)

67. 50.59 Evaluation 5059EVAL-2014-0001, ECP-13-000048 - Containment Air Temperature Increase and Associated Changes.

Page 206 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-1 COMPARISON OF NOMINAL AND PLANT PARAMETERS USED IN STEAM GENERATOR TUBE RUPTURE (SGTR) ANALYSIS Nominal SGTR Overfill SGTR Dose Analysis Analysis Initial reactor coolant system pressure 2250 2190 2190 (psia)

Initial steam generator water mass (lbm) 85,359 94,000 70,000 Reactor trip delay (sec) 1.0 0.0 0.0 Turbine trip delay (sec) 0.3 0.0 0.0 Pressurizer pressure for safety injection 1765 1715 1715 (psia)

Steam generator relief pressure setpoints 1100/1155 1065 1065 (psia)

Safety injection system pump delay 9.0 0.0 0.0 (sec)

Auxiliary feedwater delay (sec) 32 0.0 60 Auxiliary feedwater flow rate per steam 450 468 370 generator (gpm)

Auxiliary feedwater temperature (F) 70 100 100 Safety injection flow vs. reactor coolant See Figure 15.6-1 system pressure (lbm/sec vs. psia)

Decay heat 100% ANS 89.65% ANS 120% ANS Page 207 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-2 OPERATOR ACTION TIMES Action Time (min)

MASS RELEASE ANALYSISa 15 Faulted steam generator atmospheric relief valve (ARV) block valve closing-local action MARGIN TO OVERFILL ANALYSISb 8 Intact steam generator atmospheric relief valve (ARV) opening-local action Intact steam generator atmospheric relief valve 5 (ARV) closing- local action

a. For the mass release analysis the ruptured steam generator ARV is assumed to fail open at steamline iso-lation. A time of 15 minutes to isolate a stuck-open ARV is conservatively used in the mass release analysis, even though such action time would result in steam generator overfilled if assumed in the MTO analysis. See Section15.6.3.3.2.1.

b. For the overfill analysis, the intact steam generator ARV is assumed to fail closed when the cooldown should be initiated. The analysis assumed that 3 minutes are required to identify and locate the failed intact steam generator ARV and 5 minutes required to open the valve.

Page 208 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-3 SEQUENCE OF EVENTS - MARGIN TO OVERFILL ANALYSIS EVENT Time Time From (seconds) SGTR (minutes)

SGTR 100 0 Reactor trip 166 1.1 Safety injection 369 4.5 Early Termination of TDAFW 466 6.1 Ruptured steam generator isolated 700 10.0 Manual opening of intact steam generator ARV initiated 1480 23.0 Manual opening of intact steam generator ARV completed 1780 28.0 RCS cooldown target temperature reached 2401 38.4 Manual isolation of intact steam generator ARV completed 2701 43.4 Pressurizer power operated relief valve (PORV) opened 2941 47.4 Pressurizer PORV closed 2974 47.9 Safety injection terminated 3094 49.9 Break flow terminated 3709 60.2 Page 209 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-4 OPERATOR ACTION TIMES FOR DESIGN BASIS STEAM GENERATOR TUBE RUPTURE ANALYSIS Action Time Identify and isolate ruptured steam generator Maximum of 6 minutes to secure TDAFW flow to ruptured steam gen-erator. Maximum of 10 minutes or cal-culated time to reach 33% narrow range level in the ruptured steam generator Operator action time to initiate cooldown 10 minutes from complete isolation of ruptured steam generator Cooldown Calculated time for RCS cooldown Operator action time to initiate depressurization 4 minutes from end of cooldown Depressurization Calculated time for RCS depressuriza-tion Operator action time to terminatea safety injection Maximum of 2 minutes from end of depressurization or time to terminatea safety injection Pressure equalization Calculated time for equalization of RCS and ruptured steam generator pressures

a. The critical operator action time is the period of time from the completion of the depressurization to the initiation of SI termination. The thermal-hydraulic analysis also includes the time from satisfying the SI termination criteria to securing SI flow, which is typically the brief time spent at the MCB shutting off the SI pumps. Therefore, this time ends when SI flow is terminated by securing the SI pumps at the MCB.

Page 210 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-5 SEQUENCE OF EVENTS - OFFSITE RADIATION DOSE ANALYSISa EVENT TIME (sec) TIME FROM SGTR (minutes)

SGTR 100 0 Reactor trip 174 1.2 Safety injection 342 4.0 Ruptured steam generator isolated 942 14.0 Ruptured steam generator atmospheric relief 942 14.0 valve (ARV) fails open Ruptured steam generator atmospheric relief 1842 29.0 valve (ARV) block valve closed Intact steam generator atmospheric relief valve 2143 34.1 (ARV) opened Break flow stops flashing 2636 42.3 Intact steam generator atmospheric relief valve 4373 71.2 (ARV) closed Pressurizer power operated relief valve (PORV) 4493 73.2 opened Pressurizer power operated relief valve (PORV) 4546 74.1 closed Safety injection terminated 4607 75.1 Break flow terminated 5684 93.1 a.This sequence of events corresponds to the bounding mass release analysis documented in Reference 63, without changes to the operator action times as discussed in 15.6.3.3.3.1 Page 211 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-6 SGTR DOSE ANALYSIS ASSUMPTIONS Parameter Value Reactor power, MWt 1811 Initial reactor coolant activity, pre-accident iodine spike iodine Ci/gm of D.E. I-131 60 noble gas fuel defect level, % 1.0 Initial reactor coolant activity, accident initi-ated iodine spike iodine Ci/gm of D.E. I-131 1.0 noble gas fuel defect level, % 1.0 Concurrent iodine spike factor 335 Duration of concurrent iodine spike, hours 8 Initial secondary coolant iodine activity, Ci/ 0.1 gm of D.E. I-131 Primary-to-secondary leakage to intact SG Leak rate (cold conditions)

Duration of leakage, hours 150 gal/day 40 Mass of primary coolant, gm >1.247 x 108 Initial mass of secondary coolant, gm faulted SG intact SG 3.86 x 107 3.86 x 107 Steam generator elemental iodine partition coefficients (mass-based)

Activity release from faulted SG via boiling of bulk water 100 via flashed break flow 1.0 Activity realease from intact SG 100 Steam generator partition coefficients for organic iodide and noble gas release 1.0 Iodine species assumed in the reactor coolant and SG water elemental iodine 0.97 organic iodide 0.03 Page 212 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Parameter Value Atmospheric dispersion X/Q sec/m3 EAB 0-2 hr 2.17E-4 LPZ 0-8 hr 2.51E-5 8-24 1.78E-5 24-96 8.50E-6 96-720 2.93E-6 Breathing rate m3/sec <

EAB & LPZ 0-8 hr 3.47E-4 8-24 1.75E-5 24-720 2.32E-4 Page 213 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-7 STEAM RELEASES AND RUPTURE FLOW Time periods Mass (lbm) 0 to 74 74 seconds 5584 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> to 8 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> to 40 seconds to 5584 seconds to 2 hours hours seconds hours Ruptured SG to:

Condensera 189,000 - 0 0 0 Atmosphere - 82,900 0 26,800 0 Intact SG to:

Condenser 188,410 - - - 0 Atmosphere - 108,800 68,000 515,900 1,760,100 Rupture flow 4,200 171,600 - -

Event Time Line:

74 seconds: Reactor trip 5584 seconds: SG and RCS pressures are equal, rupture flow is terminated.

8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> or 40 hour4.62963e-4 days <br />0.0111 hours <br />6.613757e-5 weeks <br />1.522e-5 months <br />s: RHR operating conditions are achieved, steaming to the environment is terminated.

a. The analysis conservatively treats steam relased to the condenser the same as direct release to the atmo-sphere, i.e., elemental iodine partition is 100.

Page 214 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-8 RESULTS FOR SGTR, REM TEDE EAB MAX - 2 HR LPZ, 8 hr rem TEDE rem TEDE Accident Initiated Iodine Spike 9.7E-2 1.4E-2 Acceptance Criteria 2.5 2.5 Pre-Accident Iodine Spike 3.2E-1 4.3E-2 Acceptance Criteria 25 25 SGTR - 8 Hour RHR IN-SERVICE Accident Initiated Iodine Spike elemental iodine 1.061E-01 1.405E-02 methyl iodide 4.242E-02 8.007E-03

>noble gas 4.84E-02 5.612E-03 TOTAL 2.0E-01 2.8E-02 Pre-Accident Iodine Spike elemental iodine 3.341E-01 4.107E-02 methyl iodide 9.273E-02 1.442E-02

>noble gas 4.848E-02 5.612E-03 TOTAL 4.8E-01 6.1E-02 SGTR - 40 HOUR RHR IN-SERVICE Accident Initiated Iodine Spike elemental iodine 1.061E-01 1.580E-02 methyl iodide 4.242E-02 8.492E-03 noble gas 4.84E-02 5.619E-03 TOTAL 2.0E-01 3.0E-02 Pre-Accident Iodine Spike elemental iodine 3.341E-01 4.130E-02 methyl iodide 9.273E-02 1.472E-02 noble gas 4.848E-02 5.619E-03 TOTAL< 4.8E-01 6.1E-02 Page 215 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-9 TIME SEQUENCE OF EVENTS - ACCIDENTAL DEPRESSURIZATION OF THE RCS Event Time (sec)

Inadvertent opening of one RCS relief valve 0.0 OTDT reactor trip setpoint reached 20.9 Rods begin to drop 22.9 Minimum DNBR occurs 23.0 Page 216 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-10 TOTAL SMALL BREAK LOSS-OF-COOLANT ACCIDENT SAFETY INJECTION AND SPILL FLOW RCS Pressure (psia) Intact Loop Injection Broken Loop Broken Loop Spill Flow (gpm) Injection Flow (gpm) Flow (gpm) (breaks (breaks <8.75 in. 8.75 in. diameter) diameter) 14.7 300.0 300.0 385.0 114.7 300.0 300.0 385.0 214.7 300.0 300.0 385.0 314.7 300.0 300.0 385.0 414.7 300.0 300.0 385.0 514.7 300.0 300.0 385.0 614.7 288.9 288.9 385.0 714.7 272.7 272.7 385.0 814.7 252.9 252.9 385.0 914.7 229.1 229.1 385.0 1014.7 200.7 200.7 385.0 1114.7 166.6 166.6 385.0 1214.7 125.1 125.1 385.0 1314.7 62.0 62.0 385.0 1389.7 0.0 0.0 385.0 Page 217 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-11 SMALL BREAK LOSS-OF-COOLANT ACCIDENT KEY ASSUMPTIONS A. Core Parameters Analyzed Core Power Level 1811 MWt Calometric Uncertainty 0%

Fuel Type 422V+, OFA Total Core Peaking Factor, FQ 2.60 Channel Enthalpy RIse Factor. FH 1.72 Axial Offset +25%

K(z) Limit 1.0 everywhere B. Reactor Coolant System Thermal Design Flow 85,100 gpm/loop Nominal Vessel AVerage Temperature Range 564.6 - 576.0F Presurizer Pressure 2250 psia Pressurizer Pressure Uncertainty 60 psi C. Reactor Protection System Reactor Trip Setpoint >1730 psia Reactor Trip Signal Processing Time (Includes Rod Drop 5.0 seconds Time)

D. Auxiliary Feedwater System Maximum AFW Temperature 104F Minimum AFW Flow rate 0 - 170 gpm/SG Initiation Signal Low Pressurizer Pressure SI Signal AFW Delivery Delay Time 600 seconds E. Steam Generators Steam Generator Tube Plugging 10%

MFW Isolation Signal Low Pressurizer Pressure SI Signal MFW Isolation Delay Time 2.0 seconds MFW Flow Coastdown Time 10.0 seconds Page 218 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Feedwater Temperature 390 - 435F Steam Generator Safety Valve Flow Rates Table 15.6-12 F. Safety Injection Limiting Single Failure 1 Emergency Diesel Genera-tor Maximum SI Water Temperature 104F Low-Low Pressurizer Pressure Signal 1715 psia SI Delay Time 32 seconds Safety Injection Flow Rates Table 15.6-10 G. Accumulators Water/Gas Temperature 120F[b]

Initial Accumulator Water Volumea 1115 ft3 Minimum Cover Gas Pressure 714.7 psia H. RWST Draindown Input Maximum Containment Spray Flow 1800 gpm per pump Minimum Usable RWST Volume 184,950 gal Maximum Delay Time for Switchover to Cold Leg Recircula- 600 seconds (HHSI) tion, sec Minimum SI Flow Rate During Switchover No SI flow is modeled during switchover Minimum SI Flow Rate After Switchover Table 15.6-10 Maximum SI Water Temperature After Switchover to Cold 212F Leg Recirculation Signal is Generated

a. Corresponds to a range of 1090 ft3 to 1140 ft3.

b. It was determined that the increase in the initial temperature of containment and the accumulators to 125°F would negligibly impact the results of the analysis (Reference 66).

Page 219 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-12 SMALL BREAK LOSS-OF-COOLANT ACCIDENT MAIN STEAM SAFETY VALVE (MSSV) ASSUMPTIONS MAIN STEAM SAFETY VALVE (MSSV) DATA VALUE UNITS Number of safety valves per steam generator 4 -

Set pressure for valve 1 1085 psig Set pressure for valve 2 1140 psig Set pressure for valve 3 1140 psig Set pressure for valve 4 1140 psig Percent uncertainty for valves 1-4 1  %

Percent accumulation for valves 1-4 3  %

Rated flow for valve 1 797,700 lbm/hr Rated flow for valve 2 837,600 lbm/hr Rated flow for valve 3 837,600 lbm/hr Rated flow for valve 4 837,600 lbm/hr Page 220 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-13 SMALL BREAK LOSS-OF-COOLANT ACCIDENT TIME SEQUENCE OF EVENTS Equivalent Break Diameter Event Time (sec) 1.5 inch 2 inch 3 inch Break initiation 0 0 0 Reactor trip signal 51.0 25.6 11.4 S-Signal 58.6 26.7 11.9 Safety Injection Begins 90.6 58.7 43.9 Loop Seal Clearinga 85 511 236 Core Uncovery 2820 1157 415 Accumulator Injection Begins 8544 2832 673<

RWST Low Level N/A 5357 2683 Core Recovery 4750 2570 897

a. Loop seal clearing is defined as break vapor flow > 1 lb/s Page 221 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-14 SMALL BREAK LOSS-OF-COOLANT ACCIDENT FUEL CLADDING RESULTS Equivalent Break Diameter Resultsa 1.5 inch 2 inch >3 inch Time-in-Life BOL BOL BOL PCT(F) 1011 1167b 1117 PCT Time (s) 3578 1650 748 PCT Elevation (ft) 11.25 11.50 11.00 HR Burst Time(s) N/A N/A N/A HR Burst Elevation (ft) N/A N/A N/A Maximum Local ZrO2(%) 0.02 0.07 0.02 Maximum Local ZrO2 Elev (ft) 11.25 11.25 11.25 Total Hydrogen Generation (%) <<1.0 <<1.0 <<1.0

a. The results provided are applicable to the resident OFA fuel.

b. Most recent 10 CFR 50.46 report contains all PCT penalties and benefits.

Page 222 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-15 LARGE BREAK LOSS-OF-COOLANT ACCIDENT ANALYSIS TIME SEQUENCE OF EVENTS FOR DECLG BREAK Event Time (sec)a Start of Transient 0.0 Safety Injection Signal 4.0 Accumulator Injection Begins 13.0 Low Head Safety Injection Begins 34.0 High Head Safety Injection Begins 36.0 End of Blowdown 38.0 Bottom of Core Recovery 46.0 Accumulator Empty 49.0 PCT Occurs 242.0 End of Transient 450.0

a. All results are from the WCOBRA/TRAC Computer Code Page 223 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-16 Key LBLOCA Parameters and Initial Transient Assumptions for R. E. Ginna Analysis ParameterInitial transientUncertainty Treatment 1.0 Plant Physical Description

a. Dimensions Nominal Sampled

b. Flow resistance Nominal Sampled

c. Pressurizer location Broken loop Bounded

d. Hot assembly location Under limiting location Bounded

e. Hot assembly type 14x14 422 Vantage+ Bounded

f. SG tube pluggin level High (10%) Boundeda 2.0 Plant Initial Operating Conditions 2.1 Reactor Power

a. Core average linear heat rate (AFLUX) Nominal-Based on core power of 1.811 Boundedb MWt(102% of uprated power)b

b. Hot rod peak linear heat rate (PLHR) Derived to support a Tech Spec (TS) limit Sampled FQ=2.6 and maximum baseload FQ=2.10

c. Hot rod average linear heat rate (HRFLUX) Derived to support TS FH=1.72 Sampled

d. Hot assembly average linear heat rate (HAFLUX) HRFLUX / 1.04 Sampled

e. Hot assembly peak linear heat rate (HAPHR) PLHR / 1.04 Sampled

f. Axial power distribution (PBOT,PMID) Figure 15.6-33 Sampled

g. Low power region relative power (PLOW) 0.6 Boundeda

h. Cycle burnup ~1 MWD/MTU Sampled

i. Prior operating history Equilibrium decay heat Bounded

j. Moderator Temperature Coefficient (MTC) Tech Spec Maximum (0) Bounded

k. HFP Boron 800 ppm Generic Page 224 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ParameterInitial transientUncertainty Treatment 2.2 Fluid Conditions TAVG High Nominal TAVG=576F Nominal is Boundeda, unc'y is Sampled

b. Pressurizer Pressure Nominal (2250 psia) Sampled

c. Loop Flow 85,100 gpm Bounded

d. TUH THOT None

e. Pressurizer Level Nominal (467.3 ft3) at High TAVG None

f. Accumulator Temperature< Nominal (105.0F) Sampled

g. Accumulator pressure Nominal (764.7 psia) Sampled

h. Accumulator liquid volume Nominal (1125 ft3) Sampled

i. Accumulator line resistance Nominal Sampled

j. Accumulator boron Minimum (2100 ppm) Bounded 3.0 Accident Boundary Conditions

a. Break location Cold leg Bounded

b. Break type Split Sampled

c. Break size 0.5 times nominal cold leg area Sampled

d. Offsite Power LOOP (pumps tripped at transient onset)"3" VALIGN="TOP" align="left" MORE-ROWS="0">Boundeda

e. Safety injection flow Minimum (Table 15.6-17) Bounded

f. Safety injection temperature Nominal (75F) Sampled

g. Safety injection delay Maximum delay Bounded

h. Containment pressure Bounded Minimum (Figure 15.6-34) Bounded

i. Single failure ECCS: Loss of one train of SI Bounded

j. Control rod drop time No control rods Bounded 4.0 Model Parameters Page 225 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ParameterInitial transientUncertainty Treatment

a. Critical flow Nominal (CD=1.0) Sampled

b. Resistance uncertainties in broken loop Nominal (as coded) Sampled

c. Initial stored energy/fuel rod behavior Nominal (as coded) Sampled

d. Core heat transfer Nominal (as coded) Sampled

e. Delivery and bypassing of ECC Nominal (as coded) Conservative

f. Steam binding/entrainment Nominal (as coded) Conservative

g. Non-condensable gases/accumulator nitrogen Nominal (as coded) Conservative

h. Condensation Nominal (as coded) Sampled

a. Confirmed by plant specific studies

b. Technique used to bound any potential future mini-uprate.

Page 226 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-17 LARGE BREAK LOCA ANALYSIS SAFETY INJECTION FLOW VERSUS PRESSURE R. E. Ginna High Head Safety Injection (HHSI) Flow Versus Pressure Pressure (psia) Flow (gpm) 14.7 300 114.7 300 214.7 300 314.7 300 414.7 300 514.7 300 614.7 289 714.7 273 814.7 253 914.7 229 1014.7 201 1114.7 167 1214.7 125 1314.7 62 1389.7 0 R. E. Ginna Low Head Safety Injection (LHSI) Flow Versus Pressure Pressure (psia) Flow (gpm) 14.7 1200 20 1176 40 1083 60 980 80 866 100 735 120 570 140 220 214.7a 0a Page 227 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

a. The RHR pump will just start to inject at an RCS pressure of 155 psia, assuming 1 train injecting to the most restrictive loop, the pump degraded 10% and the RWST level 28%. For comparison, this injection point would be 165 psia if the pump is non-degraded.

Page 228 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-18a PARAMETERS FOR CONTAINMENT PRESSURE - DRY CONTAINMENT DATA Net free volume 1.066 X 106 ft3 Initial conditions Pressure 14.5 psia Temperature 90F Refueling water storage tank (RWST) temperature 50F Service water temperature 30F Outside temperature -20 F Spray system Number of pumps operating 2 Runout flow rate 1800 gpm each Actuation time 9 seconds Safeguards containment recirculation fan coolers (CRFCs)

Number of fan coolers operating 4 Fastest post accident initiation of fan coolers 0 seconds Page 229 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-18b STRUCTURAL HEAT SINK DATA Total Material of Each Thickness of Exposed Wall Description Layer Layer (in) Area (ft2)

Insulated portion of dome and contain- Stainless Steel 0.019 36,285 ment wall Insulation 1.250 Carbon Steel 0.375 Concrete 42.0 Uninsulated portion of dome Carbon Steel 0.375 12,370 Concrete 30.0 Basement floor Concrete 24.0 7230 Carbon Steel 0.250 Concrete 24.0 Wall of Sump A Carbon Steel 0.25 2270 Concrete 36.0 Floor of Sump A Concrete 24.0 280 Carbon Steel 0.250 Concrete 12.0 Walls of Sump B Concrete 24.0 210 Carbon Steel 0.250 Concrete 12.0 Floor of Sump B Concrete 24.0 120 Carbon Steel 0.250 Concrete 12.0 Inside of refueling cavity Stainless Steel 0.250 6170 Concrete Various,30.0 Minimuma Bottom of refueling cavity Stainless Steel 0.250 1260 Concrete 24.0 Area on outside of refueling cavity walls Stainless Steel 0.250 6750 Concrete Various,30.0 Minimuma Loop Compartments Concrete Various, 30.0 10,370 Minimuma Floor Area Intermediate Level (area Concrete 6.0 5320 respresents only one side of floor)

Operating Floor (area represents only one Concrete 24.0 6500 side of floor) 1.48 inch Thick I-Beam Carbon Steel 1.48 2000 Page 230 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Total Material of Each Thickness of Exposed Wall Description Layer Layer (in) Area (ft2) 0.94 inch Thick I-Beam Carbon Steel 0.94 630 0.52 inch Thick I-Beam Carbon Steel 0.52 4220 0.61 inch Thick I-Beam Carbon Steel 0.61 1190 Cylindrical Supports for SG and RCP's Carbon Steel 0.50 470 Containment Crane Rectangular Support Carbon Steel 0.75 4430 Structure Carbon Stee 2.0 380 Beams for Crane Structure + Trolley Carbon Steel 0.79 1220 Carbon Steel 1.52 1910 Carbon Steel 1.44 260 Structure on Operating Floor (area rep- Concrete 24.0 2060 resents only one side of structure)

Grating, Stairs, Misc. Steel (original Carbon Steel 0.125 7000 FSAR value)

a. For these various thickness concrete wall layers, the minimum thickness (2.5ft) is modeled in the COCO containment back pressure calculation.

Page 231 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-19 PLANT OPERATING RANGE ALLOWED BY THE BEST-ESTIMATE LARGE BREAK LOCA ANALYSIS (R. E. GINNA)

Parameter Operating Range 1.0 Plant Physical Description a) Dimensions< No in-board assembly grid deformation during LOCA + SSE b) Flow Resistance N/A c) Pressurizer Location N/A Hot assembly location Anywhere in core except low power assembliesa e) Hot assembly type Fresh 14x14 Vantage+422 fuel assembly f) SG tube plugging level 10%

2.0 Plant Initial Operating Conditions 2.1 Reactor Power (cont) a) Core average linear heat rate Core Power 100% of 1811 MWt b) Peak linear heat rate FQ2.6 c) Hot rod average linear heat rate FH1.72 d) Hot assemble average linear heat rate -PHA1.72/1.04 e) Hot assembly peak linear heat rate FQ,HA2.61/1.04 f) Axial power distribution (PBOT,PMID) Figure 15.6-47 g) Low power region relative power (PLOW) 0.2PLOW0.6 h) Hot assembly burnup 75,000 MWD/MTU, lead roda i) Prior operating history All normal operating histories j) MTC 0 at HFP k) HFP boron (minimum) 800 ppm (at BOL) 2.2 Fluid Conditions Page 232 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Parameter Operating Range a) TAVG 564.6-4FTAVG576.0+4F b) Presurizer Pressure 2250+/-60 psia c) Loop Flow 85,100 gpm/loop d) TUH Current upper internals, THOT UH e) Pressurizer level Nominal level, automatic control f) Accumulator temperature 60FTACC125F g) Accumulator pressure 714.7 psia PACC804.7 psia h) Accumulator liquid volume 1090 ft3 VACC1140 ft3 i) Accumulator fL/D Currenlt line confirguration j) Minimum accumulator boron 2100 gpm 3.0 Accident Boundary Conditions a) Break location N/A b) Break type N/A c) Break size N/A d) Offsite power Available or LOOP e) Safety injection flow Table 15.6-17 f) Safety injection temperature 50FTSI104F g) Safty injection delay LHSI 19.0 seconds (with offsite power) 30.0 seconds (with LOOP)

HHSI 21.0 seconds (with offsite power) 32.0 seconds (with LOOP) h) Containment pressure Bounded - The pressure curve (Figure 15.6-48) is based on COCO containment pres-sure calculation using conditions supplied in Table 15.6-18a and 15.6-18b.

i) Single failure Loss of one ECCS train j) Control rod drop time N/A

a. 24 peripheral locations will not physically be lead power assembly.

Page 233 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-20 LIMITING LARGE BREAK PCT AND OXIDATION RESULTS FOR R. E. GINNA Parameter Resulta 95/95 Peak Clad Temperature (PCT) 1,870Fb 95/95 Maximum Cladding Oxidation (LMO) 7.38%c 95/95 Maximum Core-wide Oxidation (CWO) 0.97%c

a. The results provided are applicable to the resident OFA fuel

b. Most recent 10 CFR 50.46 report contains all PCT penalties and benefits.

c. Note that results come from limited number of cases performed to support License Amendment No. 116 (Reference 66).

Page 234 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-21 ASSUMPTIONS FOR ANALYSIS OF RADIOLOGICAL CONSEQUENCES OF THE LOSS-OF-COOLANT ACCIDENT Parameter Value Reactor power, MWt (including 2% uncertainty) 1811 Containment net free volume, ft3 1.0E6 Containment sprayed fraction 0.78 Containment Leak Rate, %/day 0-24 hours 0.2

> 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 0.1 Containment fan cooler flow and operation number of operating units (per train) 2 flow rate per unit, cfm 30,000 total filtered flow rate, cfm N/A CARBON (1 unit) 60,000a HEPA (2 units) 50 initiation delay, sec. N/A termination of iodine removal, hours Containment fan cooler iodine removal efficiency, %

Elemental N/A Organic N/A Particulate 95 Containment injection spray flow rate, gpm (per train) 1200 initiation delay, sec 80 termination (end of spray injection), min 52 Iodine and particulate removal by spray coefficient, per hour 20 Elemental 3.5b Particulate Containment sump volume, ft3 264,700 ECCS leakage Continuous leakage rate, gal/hr 4 Start time, hr 1 Termination time, hr 720 Airborne fraction 0-3 hr 0.07 3-8 hr 0.04 8-14 hr 0.03 14-720 hr 0.02 Page 235 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Parameter Value Atmospheric dispersion x/Q, sec/m3 EAB 0-2 hr 2.17E-4 LPZ 0-8 hr 2.51E-5 8-24 hr 1.78E-5 24-96 hr 8.50E-6 96-720 hr 2.93E-6 Breathing rates, m3/sec EAB & LPZ 0-8 hr 3.47E-4 8-24 hr 1.75E-4 24-720 hr 2.32E-4

a. 12,000 cfm is recirculated within the lower containment volume (unsprayed region)

b. Represents the 10th percentile value calculated using the Powers model Page 236 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-21A LBLOCA DOSE

SUMMARY

, REM TEDE EAB MAX - 2 HR LPZ 720 hr rem TEDE rem TEDE Containment Leakage 2.982 0.981 ECCS Leakage 0.1239 0.1973 Total 3.1 1.2 Acceptance Criteria 25 25 Page 237 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-22 Total Core Activity (Curies) at End of 525-day Fuel Cycle - including Decay 1811 Mwt Shutdown 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> 60 days noble gases KR 85 5.85E-05 5.84E+05 5.79E+05 KR 85M 1.36E+07 2.63E+00 0.00E+00 KR 87 2.62E+07 5.66E-17 0.00E+00 KR 88 3.68E+07 9.18E-04 0.00E+00 XE131M 5.59E+05 5.41E+05 4.68E+04 XE133 1.01E+08 7.03E+07 >4.50E+04 XE133M< 3.17E+06 1.31E+06 2.92E+02 XE134M 7.56E+05 0.00E+00 0.00E+00 XE135 2.56E+07 1.32E+05 0.00E+00 XE135M 2.04E+07 4.36E+02 0.00E+00>

XE138 8.61E+07 0.00E+00 0.00E+00 Halogens BR 83 6.42E+06 1.76E-06 0.00E+00 BR 84 1.12E+07 0.00E+00 0.00E+00 BR 85 1.34E+07 0.00E+00 0.00E+00 1127 0.00E+00 0.00E+00 0.00E+00 1129 1.83E+00 1.83E+00 1.84E+00 1130 2.10E+06 7.73E+03 1.80E-29 1131 5.08E+07 3.64E+07 2.97E+05 1132 7.51E+07 3.07E+07 2.13E+02 1133 1.03E+08 3.78E+06 1.53E-13 1134 1.14E+08 2.07E-26 0.00E+00 1135 9.72E+07 2.72E+03 0.00+00 Rb and Cs RB 86 1.30E+05 1.11E+05 1.39E+04 CS134 1.10E+07 1.10E+07 1.04E+07 CS136 3.24E+06 2.60E+06 1.36E+05 Page 238 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS 1811 Mwt Shutdown 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> 60 days CS137 6.30E+06 6.30E+06 6.27E+06 other isotopes SR 89 4.95E+07 4.68E+07 2.18E+07 SR 90 4.63E+06 4.63E+06 4.62E+06 Y 90 4.84E+06 4.70E+06 4.62E+06 SR 91 6.20E+07 4.21E+04 0.00E+00 Y 91 6.38E+07 6.12E+07 3.16E+07 SR 92 6.70E+07 5.23E-04 0.00E+00 Y 92 6.73E+07 8.91E-01 0.00E+00 Y 92 6.73E+07 8.91E-01 0.00E+00 Y 93 7.73E+07 8.18E+04 0.00E+00 ZR 95 8.60E+07 8.22E+07 4.49E+07 NB 95 8.66E+07 8.64E+07> 6.77E+07 ZR 97 8.59E+07 1.42E+06 1.92E-18 MO 99 9.67E+07 3.38E+07 2.61E+01 TC 99M 8.49E+07 3.26E+07 2.52E+01 RU103 7.71E+07 7.17E+07 2.68E+07 RU105 5.23E+07 8.93E+00 0.00E+00 RH105 4.68E+07 7.68E+06 3.00E-05 RU106 2.61E+07 2.59E+07 2.33E+07 SB127 5.45E+06 2.61E+06 1.12E+02 TE127 5.40E+06 3.18E+06 4.89E+05 TE127M 7.02E+05 6.98E+05 4.99E+05 SB129 1.63E+07 1.78E+00 0.00E+00 TE129 1.62E+07 1.43E+06 4.51E+05 TE129M 2.38E+06 2.19E+06 6.93E+05>

TE131M 7.32E+06 7.30E+05 2.62E-08 TE132 7.22E+07 2.98E+07 2.06E+02 BA139 9.31E+07 1.52E-14 0.00E+00 BA140 8.94E+07 7.13E+07 3.46E+06 Page 239 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS 1811 Mwt Shutdown 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> 60 days LA140 9.26E+07 8.03E+07 3.98E+06 LA141 8.35E+07 1.99E+00 0.00E+00 CE141 8.48+07 7.80E+07 2.37E+07 LA142 8.22E+07 3.04E-12 0.00E+00 CE143 7.89E+07 9.73E+06 5.81E-06 PR143 7.74E+07 6.87E+07 4.02E+06 CE144 6.46E+07 6.39E+07 >5.58E+07 ND147 3.39E+07 2.61E+07 7.90E+05 Actinides NP239 1.05E+09> 3.09E+08> 1.16E+03 PU238 2.23E+05 2.25E+05 2.27E+05 PU239 1.85E+04 1.87E+04 1.88E+04 PU240 2.79E+04 2.79E+04 2.79E+04 PU241 6.15E+06 6.15E+06 6.10E+06 AM241 7.55E+03 7.66E+03 9.16E+03 CM242 1.75E+06 1.73E+06 1.37E+06 CM244 2.06E+05 2.06E+05 2.05E+05 Page 240 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 15 ACCIDENT ANALYSIS Table 15.6-23 Core Inventory Fraction Released into Containment Nuclide Group Gap Release Phase Early In-Vessel Totala Phase Halogens 0.05 0.35 0.4 Noble Gases 0.05 0.95 1.0 Alkali Metals 0.05 0.25 0.3 Tellurium 0 0.05 0.05 Ba, Sr 0 0.02 0.02 Noble Metals 0 0.0025 0.0025 Cerium 0 0.0005 0.0005 Lanthanides 0 0.0002 0.0002

a. Fractions apply to both containment and ECCS leakage Timing of LOCA Core Inventory Release Phases Releaase Phase Onset Duration Gap Release 30 sec 0.5 hra Early In-Vessel 0.5 hr 1.3 hr

a. The duration of the gap release, specified in Reference 54 is 0.5 hr. The specified start of the gap released is modeled as 0.5 hr-30 sec = 0.492 hr, rather then 0.5 hr.

Nuclide Groupsa Halogens I Noble Gases Kr, Xe Alkali Metals Cs, Rb Tellurium Group Te, Sb, Se, Ba, Sr Noble Metals Ru, Rh, Pd, Mo, Tc, Co Lanthanides La, Zr, Nd, Eu, Nb, Pm, Pr, Sm, Y, Cm, Am Cerium Ce, Pu, Np

a. See analysis of record (Reference 53) for specific core concentrations.

Page 241 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Nuclide Composition, fraction Form In Containment Atmosphere In ECC Solution Iodine Elemental 0.0485 0.97 Organic 0.0015 0.03 Particulate 0.95 0 All other nuclides particulate 1.0 1.0 Page 242 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.6-24 SMALL BREAK LOCA PCT

SUMMARY

DELETED Page 243 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT 15.7.1 RADIOACTIVE GAS WASTE SYSTEM FAILURE The following components containing gaseous radioactive wastes are examined under severe failure mode conditions for effects on the plant safety profile:

1. Gas Decay Tank and

2. Volume Control Tank 15.7.1.1 Gas Decay Tank Rupture 15.7.1.1.1 Description of Event The waste gas decay tank accident is defined as an unexpected and uncontrolled release to the atmosphere of the radioactive fission gases that are stored in the waste gas storage system.

Failure of a gas decay tank or associated piping could result in a release of this gaseous activ-ity.

The gas decay tanks contain the gases vented from the reactor coolant system, the volume control tank, and the chemical and volume control system holdup tanks. Sufficient volume is provided in each of four tanks to store the gases evolved during a reactor shutdown. The sys-tem is adequately sized to permit storage of these gases for 45 days prior to discharge.

As the components of the waste gas system are not subjected to any high pressures or stresses and are designed to Seismic Category I, a rupture or failure is highly unlikely. In addition to the tanks which have a design pressure greater than atmospheric, the piping and the valves are designed to code requirements given in Section 11.3.2.2.2. However, a rupture of a gas decay tank is analyzed to define the limit of the hazard that could result from any malfunction in the radioactive gaseous waste system.

15.7.1.1.2 Frequency of Event The waste gas decay tank rupture is classified as an ANS Condition III infrequent event. Sec-tion 15.0.8 discusses Condition III events.

15.7.1.1.3 Event Analysis The effects of the waste gas decay tank rupture are analyzed based upon conditions resulting in the maximum amount of activity that could accumulate from operation with cladding defects in 1% of the fuel elements.

The radioactive release from the waste gas decay tank provides the maximum noble gas source term for assessing whole body gamma dose following the tank rupture.

Non-volatile fission product concentrations are greatly reduced as the coolant being letdown is passed through the purification demineralizers. For example, the removal factor for iodine is at least 10. The decontamination (partition) factor for iodine between the liquid and vapor phase is expected to be on the order of 10,000. Based on the above analysis and operating Page 244 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES experience, activity stored in a gas decay tank consists primarily of noble gases released from the processed coolant and only negligible quantities of less volatile isotopes. Accordingly, since there is no significant quantity of radioactive iodine within the gas decay tank, a thyroid dose is not calculated.

The effects of the 18-month fuel cycle program are included in the calculated doses.

15.7.1.1.3.1 Single Failures Assumed The analysis assumes no protective actions are performed to mitigate the consequences of this event; therefore, no limiting single failure is applicable.

15.7.1.1.3.2 Operator Actions Assumed No operator actions are credited in the analysis.

15.7.1.1.3.3 Chronological Description of Event Activity from the ruptured tank is realeased to the environment considering a two hour release rate and a puff release. The two hour release rate is consistent with the Fuel Handling Accident. The puff release was incorporated in response to a NRC staff concern. However, results are identical for both cases.

15.7.1.1.3.4 Impact on Fission Product Barriers The tank rupture event occurs outside the containment building; hence, fission product barrier (i.e., fuel cladding, reactor coolant pressure boundary, and containment) integrity is unaf-fected. The tank rupture results in the release of the contained radioactivity; however, the accident has no impact on the design basis limits associated with the plants fission product barriers.

15.7.1.1.4 Reactor Core and Plant System Evaluation The waste gas decay tank rupture does not affect the reactor core or nuclear steam supply safety performance.

15.7.1.1.4.1 Input Parameters and Initial Conditions A. The waste gas decay tank is assumed to have an inventory of 100,000 Ci of equivalent Xe-133. This is the maximum value allowed by the Explosive Gas and Storage Tank Radioac-tivity Monitoring Program (see Technical Specifications) in each tank.

B. The 470 ft3 gas decay tank is assumed to be isolated from the remainder of the waste gas system at the time of the rupture. The waste gas system is designed and operated such that the failure of one tank does not result in the additional release of radioactivity stored in any other gas decay tank.

C. The atmospheric dispersion factors are as follows:

EAB 0 - 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> 2.17E4 Page 245 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES LPZ 0 - 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> 2.51E-5 8 - 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> 1.78E-5 24 - 96 hours0.00111 days <br />0.0267 hours <br />1.587302e-4 weeks <br />3.6528e-5 months <br /> 8.50E-6 96 - 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br /> 2.93E-6 D. The control room dose in considered in Section 6.4.3.1.

15.7.1.1.4.2 Methodology The doses due to immersion in a semi-infinite cloud of radioactive materials are determined based upon methods, parameters, and equations given in Reference 22.

15.7.1.1.4.3 Acceptance Criteria Acceptance criteria appropriate for this Condition III event are:

NUREG-0133, Preparation of Radiological Effluent Technical Specifications for Nuclear Power Plants (Reference 18, Section 5.6.1), requires that the quantity of radioactive gas in each gas storage tank be limited to a predetermined curie content. This ensures that, in the event of an uncontrolled release of the tank contents, the resulting total body exposure to an individual at the nearest exclusion area boundary (EAB) will not exceed 0.5 rem.

15.7.1.1.4.4 Results The failure of the gas decay tank results in the release of the radioactive contents to the auxil-iary building and assumed to diffuse from the building to the environment.

The calculated dose to an individual at the nearest exclusion area boundary (EAB) as a result of the postulated gas decay tank rupture is approximately 1.25E-1 Rem TEDE.

The calculated dose to an individual (30 days) at the Low Population Zone (LPZ) is approxi-mately 1.45E-2 Rem TEDE.

15.7.1.1.5 Radiological Evaluation As part of the Control Room Emergency Air Treatment System (CREATS) modification, the control room dose was reanalyzed because of the new system configuration. For consistency, new x/Q values and off-site doses were also analyzed. Reference 21 is now considered to be the Gas Decay Tank (GDT) Release dose analysis of record. Although initially calculated as part of the new conversion to Alternate Source Term (AST) methodology, it was not reviewed by the NRC as part of the submittal because the GDT release is not one of those accidents addressed in Reference 22. However, significant benefit and consistency was gained by per-forming an updated analysis. An analysis was subsequently performed using plant specific source terms as part of Extended Power Uprate (EPU). However, the generic 100,000 Ci source remains conservative, and Reference 21 remains the anaysis of record.

15.7.1.1.6 Conclusions Failure of the waste gas system has been reviewed, and the conservatively computed radio-logical dose consequences have been found to be within the acceptable regulatory guidance.

Page 246 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.1.2 Volume Control Tank Rupture 15.7.1.2.1 Description of Event The volume control tank rupture accident is defined as an unexpected and uncontrolled release to the atmosphere of the contained radioactive fission product gases. The volume control tank contains fission gases and low concentrations of halogens which are normally a source of waste gas activity vented to a gas decay tank. The iodine concentrations and vola-tility are very low at the temperature, pH, and pressure of the fluid in the volume control tank.

Failure of the tank or associated piping would result in the release of this gaseous activity.

The disposition of liquid activity is discussed in Section 15.7.2.

As the volume control tank and associated piping are not subjected to any high pressures or stresses and are of Seismic Category I design, a rupture or failure is highly unlikely. How-ever, a rupture of the volume control tank is analyzed to define the limit of exposure that could result from such an occurrence.

15.7.1.2.2 Frequency of Event The volume control tank rupture is classified as an ANS Condition III infrequent event. Sec-tion 15.0.8 discusses Condition III events.

15.7.1.2.3 Event Analysis The effects of the volume control tank rupture are analyzed based upon conditions resulting in the maximum amount of activity that could accumulate from operation with cladding defects in 1% of the fuel elements.

The analysis of this event is used to demonstrate that the plant is adequately designed against an atmospheric release of radioactivity due a leak or failure of the radioactive liquid waste system as described in Section 15.7.2. The radioactive release from the volume control tank provides the maximum radiation source term of volatile iodine for assessing thyroid dose consequences, whereas the radioactive release from the waste gas decay tank provides the maximum noble gas source term for assessing whole body gamma dose.

The effects of the 18-month fuel cycle program are included in the volume control tank doses.

15.7.1.2.3.1 Single Failures Assumed The analysis assumes no protective actions are performed to mitigate the consequences of this event; therefore, no limiting single failure is applicable.

15.7.1.2.3.2 Operator Actions Assumed No operator actions are credited in the analysis.

15.7.1.2.3.3 Chronological Description of Event The sequence of events is as follows:

Page 247 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

>Elapsed Time Events 0 Event begins with postulated tank failure and the release of radioactive gases to the building.

<1 hour Detection of the puff release is by an alarmed increase in the activity released from the auxiliary building via the vent monitor (R-13 and R-14) and/or area radiation monitor alarms.

15.7.1.2.3.4 Impact on Fission Product Barriers The volume control tank rupture event occurs outside the containment building; hence, fis-sion product barrier (i.e., fuel cladding, reactor coolant pressure boundary, and containment) integrity is unaffected. The tank rupture results in the release of the contained radioactivity; however, the accident has no impact on the design basis limits associated with the plants fis-sion product barriers.

15.7.1.2.4 Reactor Core and Plant System Evaluation The volume control tank rupture does not affect the reactor core or nuclear steam supply safety performance.

15.7.1.2.4.1 Input Parameters and Initial Conditions A. Rupture of the volume control tank is assumed to release all the contained noble gases and the contained iodine in the fraction that evaporates plus that small amount contained in the 60 gpm flow from the demineralizers which would continue for up to 5 minutes before iso-lation would occur.

B. The activities available for release of equivalent Xenon-133 are 1000 Ci and for equivalent Iodine-131, 0.07 Ci, which include the 1.33 factor for volumetric specific activity increase resulting from the fluid temperature decrease to 130F.

C. The rupture of the volume control tank is assumed to occur instantaneously releasing the entire volatile contents of the tank to the outside atmosphere at ground level.

D. In calculating offsite (exclusion area boundary) plume centerline exposure, it is assumed that the activity is dispersed as a Gaussian plume downwind, taking into account building wake dilution. No credit is taken for the buoyant lift effect of the hydrogen present in the released gas. Dispersion coefficients based on conservative meteorology (Reference 11) are used. A wind velocity of 1 m/sec is assumed to remain in one direction for the duration of the accident.

15.7.1.2.4.2 Methodology The whole body and thyroid doses due to immersion in a semi-infinite cloud of radioactive materials are determined based upon methods, parameters, and equations given in Meteorol-ogy and Atomic Energy, (Reference 12).

Page 248 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.1.2.4.3 Acceptance Criteria The acceptance criteria appropriate for this Condition III event is that failure of the volume control tank should result in doses that are a small fraction of the guideline values of 10 CFR 100. A small fraction means 10% or less of the 10 CFR 100 exposure guideline values, i.e.,

30 rem for the thyroid and 2.5 rem for the whole-body doses.

15.7.1.2.4.4 Results The failure of the volume control tank results in the release of the radioactive contents to the auxiliary building ventilation system with the subsequent unimpeded release to the surround-ing site environs.

The calculated gamma whole body dose to an individual at the nearest exclusion area bound-ary (EAB) as a result of the volume control tank rupture is approximately 3.6 mrem. The equivalent iodine-131 thyroid dose at the exclusion area boundary (EAB) is 17 mrem.

15.7.1.2.5 Radiological Evaluation The offsite doses at the exclusion area boundary (EAB) resulting from the volume control tank rupture are 0.017 rem thyroid and 0.0036 rem whole body, which is a small fraction of the guidelines values of 10 CFR 100.

15.7.1.2.6 Conclusions Failure of the volume control tank has been reviewed, and the conservatively computed radio-logical doses due to the atmospheric release have been found to be a small fraction of the acceptable regulatory guidance.

15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM FAILURE 15.7.2.1 Description of Event Accidents in the auxiliary building which could result in the release of radioactive liquids are those that involve the rupture or leaking of storage tanks or system pipe lines. The major tanks are described below.

The largest storage vessels containing radioactive waste materials are the chemical and vol-ume control system holdup tanks (33,000 gallons each) which are used to store the normal recycle or waste fluids for processing. The tanks are equipped with relief valves and are Seis-mic Category I components. The chemical and volume control system holdup tanks are described in Section 9.3.4.3.4.1.

The waste holdup tank is a horizontal tank (21,000 gallons) to which the auxiliary building floor drains are routed. It is continuously maintained at atmospheric pressure. The tank vent line is routed through the auxiliary building charcoal filters. The waste holdup tank is described in Section 11.2.2.4.

The spent resin storage tanks (1,122 gallons each) are liquid waste tanks that are projected to contain the largest (curie) inventory of liquid radioactive waste. Loss of water from this tank Page 249 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES could potentially result in the release of volatilized radioactive isotopes to the environs due to the inability to remove decay heat generated by the spent resins. The spent resin storage tanks are described in Section 11.4.1.2.

The volume control tank (1,500 gallons) contains gases and volatile radioactive liquids. The tank is equipped with a relief valve and is a Seismic Category I component. In addition, level alarms and automatic tank isolation / valve control ensure that a safe condition is maintained during system operation. The volume control tank is described in Section 9.3.4.3.1.9.

Piping external to the containment, running between the containment and the auxiliary build-ing and the waste disposal tank area, is run below grade in concrete trenches.

All liquid waste components that contain significant levels of radioactivity are located in the auxiliary building, and any liquid from a failure of a tank or piping will be collected in the building sump to be pumped back into the liquid waste processing system. Any subsequent discharge of radioactive liquid to the lake would be conducted under administrative controls and would not result in the discharge of activity concentrations into the lake in excess of the limits given in the Offsite Dose Calculation Manual.

15.7.2.2 Frequency of Event The radioactive liquid waste system failures are classified as ANS Condition III infrequent event. Section 15.0.8 discusses Condition III events.

15.7.2.3 Event Analysis The selection and evaluation of the effects of radioactive liquid waste system failures are ana-lyzed based upon the following limiting conditions:

Liquid Waste System Failure The limiting condition associated with this failure results from the accidental release/dis-charge of a batch of liquid waste to the environs. An evaluation of an accidental release of liquid waste is based upon a review of the operating procedures for discharging liquid efflu-ents, the surveillance radiation monitoring equipment provided, the radiation monitor failure mode, and the consequences of a radiation monitor failure.

Volatized Release from Liquid Tank Failures Spent Resin Storage Tank Failure-The limiting conditions associated with the failure of a spent resin storage tank results from the loss of water in the tank and the subsequent potential for the release of volatile radioactive isotopes to the environs due to the inability to remove decay heat generated by the spent res-ins.

Volume Control Tank Failure-The limiting conditions resulting from volume control tank accidental volatized and gaseous releases are described and their effects are analyzed in Section 15.7.1.2.

Page 250 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.2.3.1 Single Failures Assumed No limiting single failures are assumed since it can be shown that design features and admin-istrative controls provide adequate assurance that radioactive liquids are not released in an uncontrolled manner after a liquid waste system failure.

15.7.2.3.2 Operator Actions Assumed Operator actions credited in the analyses are based on plant operating procedures intended to control the discharge of liquid effluents (see Section 15.7.2.4.4.1 for more details).

Radioactive liquid waste system tank failures do not affect the reactor core or nuclear steam supply safety performance. However, systems evaluations are preformed of liquid waste sys-tem tank failures and their mitigation using available plant design features and administrative/

procedural controls.

15.7.2.3.3 Chronological Description of Event The event begins with postulated tank or piping failure and the release of radioactive liquids to the floor; drains route the liquid to the auxiliary building sump. Detection and corrective actions are initiated to pump back the released liquids to the liquid waste system for process-ing or to initiate corrective actions to stabilize and control the release of radioactivity. The detection of the event is based on tank level alarms, area radiation monitor alarms, effluent monitors, or auxiliary building ventilation process radiation monitor alarms.

15.7.2.3.4 Impact on Fission Product Barriers The waste component failure events occur outside the containment building; hence, fission product barrier (i.e., fuel cladding, reactor coolant pressure boundary, and containment) integ-rity is unaffected. Tank ruptures result in the release of the contained radioactivity; however, the accident has no impact on the design basis limits associated with the plants fission prod-uct barriers.

15.7.2.4 Reactor Core and Plant System Evaluation 15.7.2.4.1 Input Parameters and Initial Conditions With regard to the assessment of liquid releases:

A. Failure of liquid waste components will result in the release of the liquid contents to the auxiliary building sump.

B. The capacity of the building sump and basement volume is sufficient to hold the full vol-ume of a chemical and volume control system holdup tank without overflowing to areas outside the building.

C. The release of liquid radioactive waste to the environment is under administrative/proce-dural controls and monitored surveillance.

With regard to the assessment of the spent resin storage tank:

Page 251 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES A. The loss of water from the spent resin tank will result in the heatup of resin material from decay heat with the potential for release to the environment of the volatized radioactivity unless the temperature of the resin is maintained below its operating limit of 140F.

B. The tank contains only the mixed-bed resin from one mixed-bed demineralizer (spent resin volume is 20 ft3) discharged to the spent resin storage tank following operation of the plant for one cycle with 1% fuel defects. This yields the maximum heat generation per unit vol-ume of resin in the tank and the maximum level of radioactivity (17,000 curies) in the tank.

C. Water is lost immediately following discharge of mixed-bed resins into the spent resin stor-age tank.

D. There are no heat losses through the tank walls.

E. Resin specific gravity is 1.14 with a void fraction of 0.4 giving a resin density of 43 lb/ft3.

Mean heat capacity of resin is 0.31 Btu/lb-F.

15.7.2.4.2 Methodology The credibility of an accidental release of radioactive waste is assessed based upon a review and evaluation of the administrative/procedural controls and the monitored surveillance of waste releases.

An assessment of the corrective actions required to prevent the release of volatilized radioac-tive materials from the spent resin storage tank is made based upon a review of the required operator actions and the capability of installed equipment to maintain the resin temperature below the normal resin operating limit.

15.7.2.4.3 Acceptance Criteria Failure of liquid waste system components should not result in radionuclide concentrations in excess of the limits specified in 10 CFR 20, Appendix B, at the nearest potable water supply in an unrestricted area. If these limits cannot be maintained, special design features or other corrective actions need to be provided to mitigate the effects of the postulated failure.

15.7.2.4.4 Results The failure of liquid waste tank results in the release of the radioactive contents to the auxil-iary building sumps with the subsequent pump back to the liquid waste processing system.

The release of liquid-derived radioactive releases is limited by operator actions in accordance with administrative/procedural controls.

15.7.2.4.4.1 Accidental Release of Liquid Waste Assessment The evaluation of the accidental release of radioactive fluids from the waste disposal system is based upon system design and waste discharge procedures.

Liquid wastes are contained in the sump and processed back to the liquid radwaste system for clean-up and discharge under controlled conditions.

Page 252 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Design features prevent the uncontrolled release of effluent fluids. The last stop valve in the discharge line is a manual, locked closed valve under administrative control. The monitor tank pump must be manually started. The radiation trip valve must be manually opened. This valve automatically closes on a high radiation signal from the liquid waste process monitor or upon loss of power to the monitor. The monitor alarms on high radiation or if it fails off scale.

Release is controlled by the Offsite Dose Calculation Manual.

It is concluded that the safety features built into the equipment combined with the administra-tive controls imposed on the operator provide a high degree of assurance against accidental release of waste liquids.

15.7.2.4.4.2 Spent Resin Storage Tank Assessment The loss of water from a spent resin storage tank actuates a low level alarm to warn the oper-ator. Resin contained in the tank can then be cooled by periodically flushing water from the reactor makeup water tank through the resin. Two cooling water pathways are available:

1. Through the primary makeup water injection pipeline used when resin is removed from the tank.

2. Through the primary makeup pipeline used when resin is sluiced from the demineralizers into the tank.

The heat generation rate, q (Btu/hr), due to fission product decay of 17,000 curies in the spent resin storage tank is approximated closely as a function of time, t (hours), by:

q=143e-0.0116t+ 40e-0.00127t+30 where the first term is a short-lived, the second an intermediate-lived, and the last term is a long-lived isotope contribution.

On this basis, the resin bed temperature, T (F) as a function of time, t (hour) is:

T=46(1 - e-0.0116t) + 118(1 - e-0.00127t) + 0.11t + T0 where To is the initial resin temperature.

With an initial bed temperature of 104F, it will take 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> for the bed to heat to 140F, the normal resin operating limit. At or below a temperature of 140F, the radioactivity will not be released from the resin. The actual time to heat to 140F will be greater than 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> because of the conservative assumptions made in the calculation. The heat accumulated in the resin through the initial 55 hours6.365741e-4 days <br />0.0153 hours <br />9.093915e-5 weeks <br />2.09275e-5 months <br /> will be 15,000 Btu. The bed can be maintained at 140F or less by back-flushing the resin with primary water at 55-hour intervals. Flush water will be collected by the floor drain system and will be pumped to the waste holdup tank. If a 10F rise is taken in the flush water, the total quantity of water required would be about 200 gallons per back-flush operation to remove the 15,000 Btu accumulated in the resin.

Page 253 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Therefore, the loss of water from the spent resin storage tank presents no hazard offsite or onsite because means are available to detect the situation and keep the resin temperature under control until the resin can be removed to burial facilities.

15.7.2.4.5 Effects of 18-month Fuel Cycle The effect of the 18-month fuel cycle program is included in the volume control tank doses reported in Section 15.7.1.2. The change to the 18 month fuel cycle has no significant impact on the assessment and mitigation of the other liquid tank failures because it is shown that no uncontrolled release to the environs occurs.

15.7.2.5 Radiological Evaluation The failure of a liquid waste tank will not result in an uncontrolled release of radioactive liq-uid waste materials. Controlled releases of liquid waste will be in accordance with procedural controls which will ensure compliance with the limits specified in 10 CFR 20, Appendix B, at the nearest potable water supply in an unrestricted area.

Volatilized volume control tank liquids evaluated in Section 15.7.1.2 were shown to satisfy acceptable regulatory requirements.

15.7.2.6 Conclusions Failure of the limiting liquid waste tanks has been reviewed and the results of the evaluations found to comply with the acceptable regulatory guidance. No additional design features are required for mitigation of the consequences of this event.

15.7.3 FUEL HANDLING ACCIDENTS 15.7.3.1 Description of Event A fuel handling accident (FHA) during refueling could release a fraction of the fission prod-uct inventory to the environment. Two accident scenarios are considered:

1. a refueling accident in containment and

2. a refueling accident in the auxiliary building.

The possibility of a fuel handling incident is very remote because of the many administrative controls and physical limitations imposed on fuel handling operations as described in Section 9.1.4 and the following subsections.

15.7.3.1.1 MODE 6 (Refueling) Preparations All refueling operations are conducted in accordance with prescribed procedures under the direct supervision of a person holding a senior operator license in accordance with 10 CFR 50.54(m)(2)(iv). Also, before any refueling operations begin, rod cluster control assemblies are inserted into the core and the reactor trip breakers are opened. Boron concentration in the coolant is raised to the MODE 6 (Refueling) concentration and verified by sampling. MODE 6 (Refueling) boron concentration is sufficient to maintain the clean, cold, fully loaded core subcritical with all rod cluster control assemblies withdrawn. The refueling cavity is filled Page 254 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES with water meeting the same boric acid specifications. As the vessel head is raised, a visual check is made to verify that the drive shafts are free in the mechanism housings.

After the vessel head is removed, the rod cluster control assembly drive shafts are removed from their respective assemblies using the manipulator crane auxiliary hook and the drive shaft unlatching tool. A calibrated load cell is used to indicate that the drive shaft is free of the rod cluster control assembly as the lifting force is applied.

15.7.3.1.2 Fuel Handling Equipment Safety Features The fuel handling equipment (manipulator crane, fuel transfer system and spent fuel pool bridge crane) is designed so that fuel cannot be raised above a position which provides ade-quate shield water depth for the safety of operating personnel. This safety feature applies to handling facilities in the containment and in the spent fuel pool area.

The structural design of the Independent Spent Fuel Storage Installation (ISFSI) 125 ton crane and the 125 tone crane support structure in the Canister Preparation Building were con-structed in accordance with ASME NOG-1, NUREG-0554, CMAA-70 and the Ginna UFSAR.

Adequate cooling of fuel during underwater handling is provided by convective heat transfer to the surrounding water. The spent fuel assembly is immersed continuously while in the refueling cavity or spent fuel pool. Even if a spent fuel assembly becomes stuck in the trans-fer tube, natural convection will maintain adequate cooling.

MODE 6 (Refueling) boron concentration, as specified in the cycle-specific Core Operating Limits Report (COLR), is sufficient to maintain the clean, cold, fully loaded core subcritical by at least 5% (delta k)/k with all rod cluster control assemblies inserted. The refueling cavity is filled with water with the same boron concentration.

Two nuclear instrumentation system source range channels are continuously in operation and provide warning of any approach to criticality during refueling operations within contain-ment. This instrumentation provides a continuous audible signal in the containment and would annunciate a local horn and an annunciator light in the control room if the count rate increased above a preset low level.

In the spent fuel pool, the design of storage racks and manipulation facilities is such that:

A. Fuel at rest is positioned by positive restraints in an ever safe, always subcritical, geometri-cal array.

B. Administrative controls restrict fuel manipulation to only one assembly at a time.

C. Violation of procedures by placing one fuel assembly in juxtaposition with any group of assemblies in racks will not result in criticality.

D. Crane interlocks and administrative controls do not permit the handling of heavy objects, such as a spent fuel shipping container, above the fuel racks.

All these safety features make the probability of a fuel handling incident very low. Neverthe-less, it is possible that a fuel assembly could be dropped during the handling operations.

Page 255 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.3.1.3 Fuel Handling Operations Precautions Special precautions are taken in all fuel handling operations to minimize the possibility of damage to fuel assemblies during transport to and from the spent fuel pool and during instal-lation in the reactor. All handling operations on irradiated fuel are conducted underwater.

The handling tools used in the fuel handling operations are conservatively designed, and the associated devices are of a fail-safe design.

In the fuel storage area, administrative controls and geometric constraints ensure that the fuel assemblies are spaced in a pattern which prevents any possibility of a criticality accident.

Crane interlocks and administrative controls prevent carrying heavy objects, such as a spent fuel transfer cask, over the fuel assemblies in the storage racks. In addition, administratively, only one fuel assembly can be handled at a given time over storage racks containing spent fuel.

The motions of the cranes which move the fuel assemblies are limited to a relatively low maximum speed. Caution is exercised during fuel handling to prevent the fuel assembly from striking another fuel assembly or structures in the containment or spent fuel pool.

The fuel handling equipment suspends the fuel assembly in the vertical position during fuel movements, except when the fuel is moved through the transport tube.

In 1996, the technical specifications requirements related to the equipment hatch were revised to allow use of an installed retractable overhead door assembly to isolate the equipment hatch opening (References 15 and 16). For the analysis of the fuel handling accident, the contain-ment was assumed to be closed as required by the then current Technical Specifications, with the equipment hatch isolated by use of the retractable overhead door assembly (Reference 15).

In preparation for the Independent Spent Fuel Storage Installation (ISFSI), operational in 2010, a Canister Preparation Building (CPB) was constructed to house a new 125 ton fuel-cask handling crane, a 30 ton overhead crane, and other ancillary equipment necessary for canister preparation and storage activities. A 125 ton single failure proof crane is required to handle the cask and fully loaded canister. The 125 ton crane transfers the DSC/Transfer cask loaded with spent fuel from the Spent Fuel Pool to the self-propelled modular transporter within the CPB. The Dry Shielded Canister (DSC), with spent fuel assemblies shielded by the transfer cask, is then ultimately transported to the Horizontal Storage Modules (HSM's) located on the ISFSI pad. The ISFSI pad site serves as the R. E. Ginna facility for the interim storage of sealed, leak proof, and self contained Dry Shielded Canister (DSC) holding spent fuel.

15.7.3.1.4 Consequence of Dropped Fuel Assembly The design of the fuel assembly is such that the fuel rods are restrained by grid clips which provide a total restraining force of approximately 60 lb on each fuel rod. If the fuel rods are in contact with the bottom plate of the fuel assembly, any force transmitted to the fuel rods is limited due to the restraining force of the grid clips. The force transmitted to the fuel rods during fuel handling is not sufficient to breach the fuel rod cladding. If the fuel rods are not in contact with the bottom plate of the assembly, the rods would have to slide against the 60-lb Page 256 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES friction force. This would absorb the shock and thus limit the force on the individual fuel rods. However, after the reactor is shut down, the fuel rods contract during subsequent cooldown and would not be in contact with the bottom plate of the assembly.

Considerable deformation would have to occur before the rod would make contact with the top plate and apply any appreciable load on the fuel rod. Based on the above, it is unlikely that any damage would occur to the individual fuel rods during handling. If one assembly is lowered on top of another, no damage to the fuel rods would occur that would breach the integrity of the cladding.

If during handling the fuel assembly strikes against a flat surface, the loads would be distrib-uted across the fuel assemblies and grid clips, and essentially no damage would be expected in any fuel rods.

If the fuel assembly were to strike a sharp object, it is possible that the sharp object might damage the fuel rods with which it comes in contact, but breaching of the cladding is not expected. However, analysis on postulated cladding failures has been performed, and the results are discussed in Section 15.7.3.4.

Preliminary analyses have been made assuming the extremely remote situation where a fuel assembly is dropped 14 ft and strikes a flat surface, where one assembly is dropped on another, and where one assembly strikes a sharp object. The analysis of a fuel assembly assumed to be dropped and striking a flat surface considered the stresses to which the fuel cladding was subjected and any possible buckling of the fuel rods between the grid clip sup-ports. The results showed that the axial load at the bottom section of the fuel rod, which would receive the highest loading (approximately 100 lb), was below the critical buckling load (250 lb), and the stresses were relatively low and below the yield stress. For the case where one assembly was postulated to be dropped on top of another fuel assembly, the loads would be transmitted through the end plates and the rod cluster control assembly guide tubes of the struck assembly before any of the loads reached the fuel rods.

The end plates and guide thimbles absorb a large portion of the kinetic energy because of bending in the lower plate of the falling assembly. Also, energy is absorbed in the struck assembly top end plate before any load can be transmitted to the fuel rods. The results of this analysis indicated that the buckling load on the fuel rod was below the critical buckling loads and the stresses in the cladding were relatively low and below yield.

Refueling experience with Westinghouse reactors has verified the fact that no fuel cladding integrity failures are expected to occur during any fuel handling operations.

15.7.3.2 Frequency of Event A fuel handling accident is classified as an ANS Condition IV limiting fault. Section 15.0.8 discusses Condition IV events.

15.7.3.3 Event Analysis Two fuel handling accidents are analyzed:

Page 257 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Case A: Fuel handling accident inside containment with no containment filtration and with activity egress through an open Equipment Hatch.

Case B: Fuel handling accident in the auxiliary building with no credit for spent fuel pool filtration and with activity egress through the open roll-up door in the south wall of the auxiliary building.

Control room doses are calculated for both Cases A and B, and are discussed in Section 6.4.3.1 15.7.3.3.1 Protective Features Case A assumes that activity form the damaged fuel rods is instantaneously released to the pool water. The rate of activity release to the environment is independent of the actual venti-lation flow rate. All radioactive material that escapes the reactor cavity is released to the environment over a two hour period.

Case B assumes that activity from the damaged fuel rods is instantaneously released to the spent fuel pool water. All radioactive material that escapes from the spent fuel pool is released to the environment over a 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> period. Since the released activity escapes through the open roll-up door in the south wall of the auxiliary building, the spent fuel pool filters are not credited.

15.7.3.3.2 Single Failures Assumed Both Cases A and B assume no single failure.

The analysis assumes no protective actions are performed to mitigate the consequences of the fuel handling accident inside the containment or in the auxiliary building .

15.7.3.3.3 Operator Actions Assumed No operator actions are credited in the fuel handling accident analyses. However, procedures are in place to assist the operators in mitigating the radiological consequences of the event.

15.7.3.3.4 Chronological Description of Event A fuel handling accident in containment or the auxiliary building begins with the dropping of a fuel assembly which damages all rods in the assembly. The entire gap inventory is released into the water. Partitioning of the iodine occurs in the water before entering the atmosphere; noble gases escape without benefit of partitioning. In the containment and in the auxiliary building the gases are released through open penetrations with no credit for filtration. All activity is assumed to be released to the environment over a two hour period.

15.7.3.3.5 Impact on Fission Product Barriers A fuel handling accident is postulated to result in a breach of the fuel cladding fission product barrier.

For fuel handling accidents, there is no reactor coolant pressure boundary between the clad-ding and the atmosphere.

Page 258 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.3.4 Reactor Core and Plant System Evaluation 15.7.3.4.1 Input Parameters and Initial Conditions The input parameters and initial conditions associated with the assessment of the radiological consequences of the postulated fuel handling accidents are summarized in Table 15.7-2.

During core alterations or movement of irradiated fuel assemblies within containment, the personnel and equipment hatch openings are closed, or capable of being closed under admin-istrative control as required by the technical specifications. Thus, closure is not credited in the accident analysis.

During fuel handling in the auxiliary building, the open roll-up door in the south wall of the auxiliary building is assumed to be open. Thus, closure and filtration are not credited in the accident analysis.

15.7.3.4.2 Methodology The methods utilized in performing offsite dose consequence analyses are based upon the cal-culation models and assumptions in Regulatory Guide 1.183(Reference 22).

15.7.3.4.3 Acceptance Criteria The dose to an individual from a postulated fuel handling accident should be less than 6.3 Rem TEDE at the Exclusion Area Boundary (EAB) or Low Population Zone (LPZ).

15.7.3.4.4 Results The results are contained in Table 15.7-3.

15.7.3.5 Radiological Evaluation As part of the Technical Specification revision to allow both containment personnel interlock doors to remain open under administrative control during refueling operations, control room and offsite doses were reanalyzed because of the reduced fission product decay period and because of the new auxiliary building system configuration. To comply with restrictions in Footnote 11 to Table 3 of Reference 22, revised non-LOCA gas gap release fractions were calculated in Reference 27. Revised control room x/Q values were calculated consistent with the regulatory requirements of Reference 28, using the NRC approved code ARCON96, (Ref-erence 29). The revised x/Q values and doses are documented in Reference 30, which is now considered to be the Fuel Handling Accident (FHA) of record. Fission product inventory and activity released is summarized in Table 15.7-1. The analysis assumptions are contained in Table 15.7-2, and the results are contained in Table 15.7-3. The analysis was performed using the alternate source term (AST) methodology per 10 CFR 50.67 and Reference 22. The new methodology and analysis was submitted to the NRC in Reference 31 and subsequently approved by the NRC in Reference 32. These supersede the previous analysis of record (Ref-erence 23) and NRC SERs (Reference 24-25).

Page 259 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.7.3.6 Conclusions Fuel handling accidents inside containment and in the auxiliary building have been reviewed and the offsite and control room dose consequences found to meet 10 CFR 50.67.

Page 260 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.7

1. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Radiological Efflu-ent Technical Specifications - Ginna, dated September 28, 1983.

2. NRC Regulatory Guide 1.25, Assumptions Used for Evaluating the Potential Radiolog-ical Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors.

3. ORIGEN 2.1, Isotope Generation and Depletion Code, Matrix Exponential Method, ORNL Radiation Shielding Information Center, August 1991.

4. Westinghouse Radiation Analysis Design Manual for Standard 412 Plant, Standard Infor-mation Package Volume 3-1, Revision 3, November 1978.

5. Westinghouse Calculation ST-RESC-M-265, ORIGEN Fission Product Library Modifi-cation, A. H. Fero, February 10, 1977.

6. Rochester Gas and Electric Corporation Design Analysis DA-NS-97-052, Comparison of Design Bases Input Parameters and Technical Specification Minimum Requirements Affecting a Fuel Handling Accident Outside Containment, dated June 24, 1997.

7. S. Q. King, Control Room Doses - FHA and TMA, FTI Doc. No. 32-1258141-00, dated January 20, 1997.

8. Letter from R. C. Mecredy, RG&E, To G. S. Vissing, NRC,

Subject:

Application for Amendment to Facility Operating License, Control Room Emergency Air Treatment System (CREATS) Applicability Change, (LCO 3.3.6 and 3.7.9), dated July 21, 2000.

9. Letter from G. S. Vissing, NRC, to R. C. Mecredy, RG&E,

Subject:

R. E. Ginna Nuclear Power Plant - Amendment Providing Technical Specification Changes for Control Room Emergency Air Treatment System (CREATS) (TAC No. MA9529), dated October 10, 2000.

10. Design Analysis, DA-NS-2000-057, Rev. 0, titled: Gas Tank Rupture Offsite and Control Room Doses, dated July 20, 2000.

11. U.S. Atomic Energy Commission, Calculation of Distance Factors for Power and Test Reactor Sites, TID-14844, dated March 23, 1962.

12. U.S. Atomic Energy Commission, Meteorology and Atomic Energy, dated July 1968.

13. NUREG/CR-6210, Computer Codes for Evaluation of Control Room Habitability (HABIT), dated June 1996.

14. Westinghouse Calculation CN-CRA-95-6, "Ginna (RGE) FHA Offsite Dose Analysis,"

Revision 2, October 26, 1995.

15. Letter from R. C. Mecredy, RG&E, to Allen R. Johnson, NRC,

Subject:

Application for Amendment to Facility Operating License, Revised Containment Requirements During Page 261 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES MODE 6, Cost Beneficial Licensing Action, Rochester Gas & Electric Corporation, R.

E. Ginna Nuclear Power Plant Docket No. 50-244 dated February 9, 1996.

16. Letter from Allen R. Johnson, NRC, to R. C. Mecredy, RG&E,

Subject:

Issuance of Amendment No. 62 to Facility Operating License No. DPR-18, R. E. Ginna Nuclear Power Plant (TAC No. M94186), dated April 1, 1996.

17. Letter from D. M. Crutchfield, NRC, to J. E. Maier, RG&E,

Subject:

Fuel Handling Accident Inside Containment, dated October 7, 1981.

18. NUREG-0133, Preparation of Radiological Effluent Technical Specifications for Nuclear Power Plants, dated October 1978.

19. Design Analysis, DA-NS-2002-027, Rev. 0, Cycle 30 Radiological Doses for Fuel Han-dling and Tornado Missile Accidents, Rochester Gas and Electric Corporation, Ginna Station.

20. Letter from E. Meliksetian, Westinghouse, to P. Bamford, RG&E, NF-RG-02-19, CAD-02-116,

Subject:

Calculation Notes for Cycle 30 Dose Analyses, dated March 22, 2002.

21. DA-NS-2002-057, Gas Decay Tank Rupture Offsite and Control Room Doses, Revision 2.

22. Regulatory Guide 1.183, Alternate Radiological Source Terms for Evaluating Design Basis Accidents at Nuclear Power Reactors, July 2000.

23. DA-NS-2002-004, Fuel Handing Accident Offsite and Control Room Doses, Revision 3.

24. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant - Amendment re: Modification of the Control Room Emergency Air Treat-ment System and Change to Dose Calculation Methodology to Alternate Source Term (TAC No. MB9123), dated February 25, 2005.

25. Letter from D. Skay, NRC, to M. G. Korsnick, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant - Correction to Amendment No. 87 re: Modification of the Control Room Emergency air Treatment System (TAC No. MB9123), dated May 18, 2005.

26. Letter from P. D. Milano, NRC, to M. G. Korsnick, Ginna NPP, subject: R. E. Ginna Nuclear Power Plant - Amendment re: 16.8% Power Uprate (TAC No.MC7382), dated July 11, 2006.

27. DA-NS-08-049, Ginna Gas Gap Isotopic Fraction Calculation, Revision 0.

28. Regulatory Guide 1.194, Atmospheric Relative Concentrations for Control Room Radio-logical Habitability Assessments at Nuclear Power Plants, June 2003.

29. NUREG/CR-6331, Atmospheric Relative Concentrations in Building Wakes, Revision 1.

30. DA-NS-08-50, Ginna Fuel Handling Accident Offsite and Control Room Doses, Revi-sion 0.

Page 262 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES

31. License Amendment Request: Revision of Technical Specification 3.9.3 to Allow Refu-eling Operations inside Containment with Both Personnel Hatch Air Lock Doors Open under Administrative Control and Obtain Regulatory Review of the Supporting Dose Analysis, (TAC NO ME0203), dated December 4, 2008.

32. Letter from D. V. Pickett, NRC, to J. T. Carlin, Ginna NPP,

Subject:

R. E. Ginna Nuclear Power Plant - Amendment Re: Containment Operability during Refueling Operations (TAC NO ME0203), dated August 12, 2009.

Page 263 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.7-1 FISSION PRODUCT INVENTORY AND ACTIVITY RELEASED FROM POOL Nuclide Total Core Core Gap Peaking Overall Activity Activity - Damage Fraction Factor (P) Pool DF Released 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> Fraction (G) from Pool, decay, (F) Ci (A)

Ci(Ac)

I-131 4.03E+07 0.008264 0.16 1.75 200 4.66E+02 I-132 3.95E+07 0.008264< 0.10 1.75 200 2.86E+02 I-133 9.61E+06 0.008264 0.15 1.75 200 1.04E+02 I-134 8.52E-17 0.008264 0.10 1.75 200 6.16E-22 I-135 5.22E+04 0.008264 0.10 1.75 200 3.77E-01 Kr-85m 1.97E+02 0.008264 0.10 1.75 1 2.86E-01 Kr-85 5.85E+05 0.008264 0.20 1.75 1 1.69E+03 Kr-87 2.25E-10 0.008264 0.10 1.75 1 3.25E-13 Kr-88 8.59E-01 0.008264 0.10 1.75 1 1.24E-03 Xe-133m 1.82E+06 0.008264 0.15 1.75 1 3.94E+03 Xe-133 8.20E+07 0.008264 0.15 1.75 1 1.78E+05 Xe-135m 8.36E+03 0.008264 0.10 1.75 1 1.21E+01 Xe-135 1.04E+06 0.008264 0.10 1.75 1 1.51E+03 Core damage fraction is 1/121 = 0.008264. The total number of fuel assemblies in the core is 121.

The activity released from the pool (A) is calculated as follows:

A = Ac*F*G*P DF Page 264 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.7-2 FHA DOSE ANALYSIS ASSUMPTIONS Parameter Value Reactor power, MWt (including 2% uncertainty) 1811 Power Peaking Factor 1.75 Number of damaged fuel assemblies 1 Fission product inventory in damaged assemblies after Values shown in Table 15.7-1 decay Time after Reactor Shutdown,hr 72a Fuel rod gap fractions I-131 0.16 P-133 0.15 other halogens 0.10 Kr-85 0.20 Xe-133,Xe-133m 0.15 other noble gases 0.10 Iodine species above water elemental iodine 0.57 organic iodide 0.43 Pool DF elemental iodine 500 organic iodide 1 particulate infinite Overall Pool DF 200 Containment net free volume, ft3 1E6 Exhaust flow rate, cfm 7.68E4 Duration of activity release, hr 2 Iodine removal efficiency Containment FHA (all iodine forms) 0 Fuel Pool FHA (all iodine forms) 0 Atmospheric dispersion, X/Q, sec/m3 EAB 0-2 hr 2.17E-4 LPZ 0-8 hr 2.51E-5 8-24 1.78E-5 24-96 8.50E-6 96-720 2.93E-6 Breathing Rate, m3/sec EAB & LPZ 0-8 hr 3.47E-4

a. Still 100 hours0.00116 days <br />0.0278 hours <br />1.653439e-4 weeks <br />3.805e-5 months <br /> in Tornado Missile Accident Analysis Page 265 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 6 ENGINEERED SAFETY FEATURES Table 15.7-3 FHA DOSE. REM TEDE EAB Max - 2 hr LPZ, 2 hr FHA - inside Containment via roll-up door 1.4820 1.7142E-1 FHA - Spent Fuel Pool 1.4820 1.7142E-1 Acceptance Criteria 6.3 6.3 Page 266 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 6 ENGINEERED SAFETY FEATURES Table 15.7-4 Table DELETED Table DELETED Page 267 of 275 Revision 26 5/2016

GINNA/UFSAR CHAPTER 6 ENGINEERED SAFETY FEATURES Table 15.7-5 Table DELETED Table DELETED Page 268 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES Table 15.7-6 Table DELETED Table DELETED Page 269 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM 15.8.1 ANTICIPATED TRANSIENTS WITHOUT SCRAM (ATWS)

The effects of anticipated transients without scram (ATWS) events are not considered as part of the design basis for the transients analyzed in Chapter 15. This ATWS discussion is included since ATWS considerations are within the licensing basis of the plant.

An ATWS event is an anticipated operational occurrence (AOO) (such as a loss of feedwater, loss of power to the station auxiliaries, loss of condenser vacuum or turbine trip), which is accompanied by the failure of the reactor trip system (RTS) to shut down the reactor. The final ATWS rule, 10 CFR 50.62(c)(1), requires the incorporation of a diverse (from the reac-tor trip system) actuation of the auxiliary feedwater system and turbine trip for Westinghouse-designed plants. The installation of the NRC-approved ATWS Mitigating System Actuation Circuitry (AMSAC) satisfies this final ATWS rule. The basis for this rule and the AMSAC design are supported by Westinghouse generic analyses documented in Reference 1. These analyses were performed based on guidelines published in NUREG-0460 (1978) (Reference 2). The AMSAC system installed at Ginna is described in Section 7.2.6.

15.8.2 FREQUENCY OF EVENT The ATWS core damage frequency used in SECY-83-293s (Reference 6) assessment is a tar-get value of 1 x 10-5/yr with AMSAC. This value conservatively assumes that any overpres-sure greater than the allowable ASME Boiler and Pressure Vessel Code value immediately results in core damage. The target frequency is several orders of magnitude greater than the actual ATWS contribution to core damage frequency determined in the Ginna Probabilistic Safety Assessment (Reference 7).

15.8.3 EVENT ANALYSIS Reference 1 describes the methods used in the analyses and provides reference analyses for 2-loop, 3-loop, and 4-loop plant designs. For operation of Ginna at EPU conditions, the generic analyses documented in Reference 1 were evaluated for their continued applicability.

15.8.3.1 Single Failures Assumed An ATWS event occurs when the reactor trip function fails when required after an anticipated operational occurrence (AOO). The functional failure can occur if RTS signals and actuation logic fail in both trains, the shunt and undervoltage coils fail to open the trip breakers, or mul-tiple rod cluster control assemblies (RCCAs) fail to insert after the trip breakers open. The functional failure is dominated by common mode failures of the trip breakers. (RTS breaker reliability improvements, post-maintenance testing, and administrative programs related to ATWS prevention at Ginna are addressed in Reference 3.)

15.8.3.2 Operator Actions Assumed The following operator actions ensure successful mitigation of the broad range of ATWS events:

Page 270 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES A. Manual scram within the first 60 seconds of the event if the RTS fails to automatically scram. This action is a backup to the RTSs failure to generate an automatic trip signal.

B. Manual rod insertion initiated within the first 60 seconds of the event. The operator starts to drive in at least one bank of rod cluster control assemblies (RCCAs).

C. Initiating boration using the high-pressure safety injection pumps or the chemical and vol-ume control system (CVCS) within 10 minutes for long-term shutdown.

D. Tripping rod drive motor-generator sets or completing manual insertion of the RCCAs into the core within 10 minutes for long-term shutdown.

E. Initiating containment isolation within 10 minutes.

Ginna emergency operating procedures (EOPs) instruct the operator to immediately trip the buses feeding the rod drive motor-generator sets after failure of the control rods to insert.

Per Westinghouse Owners Group guidance, Ginna EOPs instruct the operator to manually ini-tiate containment ventilation isolation in response to an ATWS. This action isolates contain-ment ventilation to mitigate the dose consequences of pressure-increasing ATWS events without causing non-ventilation systems which aid in the mitigation to be lost due to contain-ment isolation. The EOPs also direct verifying that safety injection is occurring if plant con-ditions warrant a safety injection, thus causing containment isolation. These two actions meet the intent of item E above (from Reference 1).

15.8.3.3 Chronological Description of Event The ATWS event consists of an anticipated operational occurrence (AOO) requiring a reactor trip. The reactor trip function is not performed. If main feedwater remains available, the event is adequately mitigated when the operator performs long-term shutdown actions. If main feedwater is lost, the scenario progresses through operator insertion of rods, AMSAC start-up of auxiliary feedwater, pressure relief, and long-term shutdown.

15.8.3.4 Impact on Fission Product Barriers Generic studies (Reference 1) performed for various ATWS events show that the DNBR remains acceptable; therefore, the fuel cladding is expected to maintain its integrity as a fis-sion product barrier.

Successful mitigation of ATWS events limits reactor coolant system (RCS) pressures to less than the allowable ASME Boiler and Pressure Vessel Code Level C service limit of 3200 psig such that the integrity of the RCS pressure boundary is maintained. For ATWS pressure tran-sients exceeding ASME Level C criteria, the pressure boundary may fail.

The ATWS event will not result in a loss of containment integrity or isolation capability.

Pressurizer power operated relief valves (PORVs) and pressurizer safety valves open during ATWS transients. The rupture disc on the pressurizer relief tank is expected to blow open, and all further discharges through the valves will be released to containment. The mass and energy releases for the reference ATWS analyses are much less than the main steam line break or loss-of-coolant accidents. The containment pressures are well below the contain-Page 271 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES ments design basis (Reference 1). The containment maintains its integrity as a barrier against the dispersion of fission products.

15.8.4 REACTOR CORE AND PLANT SYSTEM EVALUATION The ATWS transients are grouped into those below and above 40% power. Below 40%

power, ATWS is readily mitigated by plant systems. Above 40% power, AMSAC is required.

For operation of Ginna at EPU conditions, the generic analyses documented in Reference 1 were evaluated for their continued applicability. The loss of normal feedwater and loss of load ATWS events are the two most limiting RCS overpressure transients documented in the Reference 1 generic analyses. The loss of load ATWS is analyzed for plants with steam-driven main feedwater pumps where, as a result of the initiating turbine-trip event, a loss of condenser vacuum occurs with a consequential loss of main feedwater. For plants such as Ginna, with electric motor-driven main feedwater pumps, a loss of feedwater does not occur for a loss of load, making it a non-limiting event. Thus, only the loss of normal feedwater event was evaluated for the EPU.

15.8.4.1 Input Parameters and Initial Conditions The primary input to the loss of normal feedwater ATWS evaluation for the EPU is the refer-ence 2-loop ATWS model and analysis from Reference 1. The nominal and initial conditions were updated to the EPU NSSS design parameters for 1817 MWt, and the steam generator data was revised to reflect the Ginna BWI steam generator parameters and heat transfer char-acteristics.

A. The plant is initially at full power with pressure and TAVG at nominal conditions.

B. The reactor is in automatic control before the ATWS; however, no credit is taken for auto-matic rod insertion in response to increasing TAVG once the ATWS transient begins.

C. No credit is taken for automatic scram.

D. Pressurizer pressure control (pressurizer power operated relief valves (PORVs), heaters, and spray) are assumed to operate normally. The pressurizer power operated relief valves (PORVs) operate at 2350 psia.

E. The nominal setpoint for the pressurizer safety valves is 2500 psia. Three percent (3%)

pressure accumulation for steam relief and 10% accumulation for water relief are then assumed for the safety valves during the transient.

F. A moderator temperature coefficient for hot full power of -5.5pcm/F is assumed. (This assumes the coefficient is less than -5.5pcm/F for 95% of the cycle.)

G. AMSAC starts auxiliary feedwater flow within 60 seconds for ATWS transients where main feedwater is lost.

H. AMSAC trips the turbine within 30 seconds if the transient does not cause the turbine to trip.

I. Normal control systems are operable unless made inoperable as the result of the postulated event.

Page 272 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES J. Automatic start-up of safety injection is not credited. Similarly, no credit is taken for makeup to the reactor coolant system (RCS) from the chemical and volume control system (CVCS) during the initial part of the ATWS event. Manual controls to start safety injection and boration remain operable.

15.8.4.2 Methodology The methodology described in Reference 1 was used for the Ginna EPU ATWS analysis. The general approach was to demonstrate that the conclusions of the representative 2-loop plant analyses presented in Reference 1 remain valid for the Ginna EPU conditions and BWI steam generators. Compliance with the ATWS Rule is then demonstrated, as long as this analysis results in peak RCS pressures less than the ASME Boiler and Vessel Code Level C service stress criterion of 3200 psig.

As was done in Reference 1, the loss of normal feedwater ATWS event was analyzed using the LOFTRAN code (Reference 4). The code simulates the neutron kinetics, thermal-hydrau-lic conditions, a pressurizer, steam generators, reactor coolant pumps, and control and protec-tion systems. Section 15.0.7 provides an additional description of LOFTRAN and its capabilities.

he NOTRUMP code (Reference 5) was used to determine the overall steam generator heat transfer coefficient and the corresponding total liquid mass for the Ginna BWI steam genera-tor input to the LOFTRAN loss of normal feedwater ATWS analysis.

15.8.4.3 Acceptance Criteria The acceptance criteria necessary to demonstrate compliance with the ATWS rule are:

A. The maximum RCS pressure must be less than 3200 psig. This limit is based on a conser-vative bound for ASME Boiler and Pressure Vessel Code Level C service limits for the reactor vessel and all components comprising the RCS. Exceeding this limit, and still demonstrating compliance to the ATWS Rule, is permissible if criterion (B) issatisfied.

B. Activity release should result in calculated doses within the guidelines of 10 CFR 100 (Ref-erences 1 and 2).

DNB is not considered since generic analyses established that DNBRs remain acceptable for ATWS transients (Reference 1).

15.8.4.4 Results The results of the ATWS evaluation for Ginna at EPU conditions with BWI steam generators show that the peak RCS pressure obtained did not exceed the ASME Boiler and Vessel Code Level C service stress criterion of 3200 psig. As such, the analytical basis for the final ATWS rule continues to be met for operation of Ginna at EPU conditions with BWI steam genera-tors.

Page 273 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES 15.8.5 RADIOLOGICAL EVALUATION Reactor coolant fission and corrosion products can be discharged inside containment or leaked from the primary to secondary side in the steam generators. In addition, iodine spiking due to pre-existing plant conditions or caused by the transient can increase the amount of radioiodine in the reactor coolant. Activity release paths include containment purge flow before isolation, containment leakage after isolation, secondary side steam relief, and Emer-gency Core Cooling System (ECCS) leakages. These effects were included in radiological analyses of the reference ATWS plant (Reference 1). The analyses assumed manual actuation of containment isolation at 10 minutes consistent with the assumption that there are no auto-matic reactor trip and safety injection signals. Although ATWS events are beyond design basis considerations, the analyses for the reference Westinghouse plant demonstrate that the offsite doses are conservatively within 10 CFR 100 guidelines.

15.

8.6 CONCLUSION

S To remain consistent with the basis of the final ATWS rule and the supporting analyses docu-mented in Reference 1, the peak RCS pressure reached in the Ginna EPU ATWS evaluation with BWI steam generators should not exceed the ASME Boiler and Pressure Vessel Code Level C service limit stress criterion of 3200 psig. This value corresponds to the maximum allowable pressure for the weakest component in the reactor pressure vessel (the nozzle safe end).

The results of the ATWS evaluation for Ginna at EPU conditions with BWI steam generators show that the peak RCS pressure is lower than the ASME Boiler and Pressure Vessel Code Level C service limit stress criterion of 3200 psig. Therefore, the analytical basis for the final ATWS rule continues to be met for operation of Ginna for the EPU with BWI steam genera-tors.

Page 274 of 275 Revision 26 5/2016

GINNA/UFSAR Chapter 15 ACCIDENT ANALYSES REFERENCES FOR SECTION 15.8

1. Letter from T. M. Anderson, Westinghouse, to S. H. Hanauer, NRC,

Subject:

ATWS Submittal, NS-TMA-2182, dated December 30, 1979.

2. NUREG-0460, Vol. 4, Anticipated Transients Without Scram for Light Water Reactors, March 1980.

3. Letter from J. E. Maier, RG&E, to D. M. Crutchfield, NRC,

Subject:

Generic Letter 83-28, dated November 4, 1983.

4. T. W. T. Bunett, et. al., LOFTRAN Code Description, WCAP-7907-P-A (proprietary ver-sion), WCAP-7907-A (non-proprietary version), dated April 1984.

5. P. E. Meyer, et. al., NOTRUMP-A Nodal Transient Small Break and General Network Code, WCAP-10079-NP-A (non-proprietary version), dated August 1985.

6. SECY-83-293, Amendments to 10 CFR 50 Related to Anticipated Transients Without Scram (ATWS) Events, July 19, 1983.

7. R.E. Ginna Nuclear Power Plant Probabilistic Safety Assessment, Rev. 4, February 2002.

Page 275 of 275 Revision 26 5/2016