ML17065A090

Final Safety Analysis Report, Revision OL-22, Chapter 15, Accident Analysis

ML17065A090
Person / Time
Site:	Callaway
Issue date:	03/08/2017
From:	Klos L Plant Licensing Branch IV
To:	Diya F Union Electric Co
Klos L
References
Download: ML17065A090 (381)

Text

CALLAWAY - SP TABLE OF CONTENTS CHAPTER 15.0 ACCIDENT ANALYSIS Section Page 15.0 ACCIDENT ANALYSIS ................................................................................ 15.0-1 15.0.1 CLASSIFICATION OF PLANT CONDITIONS ........................................ 15.0-1 15.0.1.1 Condition I - Normal Operation and Operational Transients ............. 15.0-1 15.0.1.2 Condition II - Faults of Moderate Frequency ..................................... 15.0-3 15.0.1.3 Condition III - Infrequent Faults ......................................................... 15.0-4 15.0.1.4 Condition IV - Limiting Faults ............................................................ 15.0-5 15.0.2 OPTIMIZATION OF CONTROL SYSTEMS ........................................... 15.0-5 15.0.2.1 Setpoint Study .................................................................................... 15.0-5 15.0.2.2 End of Life Coastdown ....................................................................... 15.0-6 15.0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES ............................................................. 15.0-7 15.0.3.1 Design Plant Conditions .................................................................... 15.0-7 15.0.3.2 Initial Conditions ................................................................................ 15.0-7 15.0.3.3 Power Distribution ............................................................................. 15.0-8 15.0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES.............................................................................................. 15.0-9 15.0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS............................................................................... 15.0-9 15.0.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES ........................................................................................... 15.0-10 15.0.7 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS - POWER RANGE NEUTRON FLUX .................................................................... 15.0-11 15.0.8 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS .................................................................... 15.0-12 15.0.9 FISSION PRODUCT INVENTORIES ................................................... 15.0-12 15.0-i

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.0.10 RESIDUAL DECAY HEAT .................................................................... 15.0-13 15.0.10.1 Total Residual Heat ......................................................................... 15.0-13 15.0.10.2 Distribution of Decay Heat Following Loss-of-Coolant Accident ...... 15.0-13 15.0.11 COMPUTER CODES UTILIZED ........................................................... 15.0-13 15.0.11.1 FACTRAN ........................................................................................ 15.0-14 15.0.11.2 LOFTRAN ........................................................................................ 15.0-14 15.0.11.3 LEOPARD ....................................................................................... 15.0-15 15.0.11.4 TURTLE .......................................................................................... 15.0-15 15.0.11.5 TWINKLE ......................................................................................... 15.0-15 15.0.11.6 THINC .............................................................................................. 15.0-15 15.0.11.7 LOCA COMPUTER CODES ............................................................ 15.0-16 15.0.11.8 RETRAN........................................................................................... 15.0-16 15.0.11.9 VIPRE............................................................................................... 15.0-17 15.0.11.10 ANC.................................................................................................. 15.0-17 15.0.12 LIMITING SINGLE FAILURES ............................................................. 15.0-17 15.0.13 OPERATOR ACTIONS.......................................................................... 15.0-17 15.0.14 REFERENCES ..................................................................................... 15.0-20 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM ............ 15.1-1 15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE..................................... 15.1-1 15.1.1.1 Identification of Causes and Accident Description ............................. 15.1-1 15.1.1.2 Analysis of Effects and Consequences .............................................. 15.1-2 15.1.1.3 Conclusions........................................................................................ 15.1-4 15.1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW....................................................... 15.1-4 15.1.2.1 Identification of Causes and Accident Description ............................. 15.1-4 15.1.2.2 Analysis of Effects and Consequences .............................................. 15.1-5 15.1.2.3 Conclusions........................................................................................ 15.1-8 15.1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW.................... 15.1-8 15.0-ii

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.1.3.1 Identification of Causes and Accident Description ............................ 15.1-8 15.1.3.2 Analysis of Effects and Consequences .............................................. 15.1-9 15.1.3.3 Conclusions...................................................................................... 15.1-12 15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE .................................................................................... 15.1-12 15.1.4.1 Identification of Causes and Accident Description ........................... 15.1-12 15.1.4.2 Analysis of Effects and Consequences ............................................ 15.1-13 15.1.4.3 Conclusions...................................................................................... 15.1-13 15.1.5 STEAM SYSTEM PIPING FAILURE ..................................................... 15.1-14 15.1.5.1 Identification of Causes and Accident Description ........................... 15.1-14 15.1.5.2 Analysis of Effects and Consequences ............................................ 15.1-16 15.1.5.3 Radiological Consequences............................................................. 15.1-21 15.1.5.4 Conclusions...................................................................................... 15.1-25 15.1.5.5 Steam Line Break with Coincident Control Rod Withdrawal ............ 15.1-25 15.1.5.6 Steam System Piping Failure at Full Power ..................................... 15.1-25 15.

1.6 REFERENCES

...................................................................................... 15.1-29 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM .......... 15.2-1 15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW .......................................... 15.2-1 15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD ........................................... 15.2-2 15.2.2.1 Identification of Causes and Accident Description ............................. 15.2-2 15.2.2.2 Analysis of Effects and Consequences .............................................. 15.2-3 15.2.2.3 Conclusions........................................................................................ 15.2-4 15.2.3 TURBINE TRIP........................................................................................ 15.2-4 15.2.3.1 Identification of Causes and Accident Description ............................. 15.2-4 15.2.3.2 Analysis of Effects and Consequences .............................................. 15.2-5 15.2.3.3 Conclusions........................................................................................ 15.2-8 15.2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES .... 15.2-8 15.0-iii

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.2.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP ................................................................................... 15.2-8 15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES........................................................................................... 15.2-9 15.2.6.1 Identification of Causes and Accident Description ............................. 15.2-9 15.2.6.2 Analysis of Effects and Consequences ............................................ 15.2-11 15.2.6.3 Radiological Consequences............................................................. 15.2-13 15.2.6.4 Conclusions...................................................................................... 15.2-16 15.2.7 LOSS OF NORMAL FEEDWATER FLOW............................................ 15.2-16 15.2.7.1 Identification of Causes and Accident Description ........................... 15.2-16 15.2.7.2 Analysis of Effects and Consequences ............................................ 15.2-17 15.2.7.3 Conclusions...................................................................................... 15.2-19 15.2.8 FEEDWATER SYSTEM PIPE BREAK .................................................. 15.2-19 15.2.8.1 Identification of Causes and Accident Description ........................... 15.2-19 15.2.8.2 Analysis of Effects and Consequences ............................................ 15.2-21 15.2.8.3 Conclusions...................................................................................... 15.2-25 15.

2.9 REFERENCES

...................................................................................... 15.2-25 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE ................... 15.3-1 15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW................. 15.3-1 15.3.1.1 Identification of Causes and Accident Description ............................. 15.3-1 15.3.1.2 Analysis of Effects and Consequences .............................................. 15.3-2 15.3.1.3 Conclusions........................................................................................ 15.3-3 15.3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW............ 15.3-3 15.3.2.1 Identification of Causes and Accident Description ............................. 15.3-3 15.3.2.2 Analysis of Effects and Consequences .............................................. 15.3-5 15.3.2.3 Conclusions........................................................................................ 15.3-5 15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR).... 15.3-6 15.3.3.1 Identification of Causes and Accident Description ............................. 15.3-6 15.0-iv

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.3.3.2 Analysis of Effects and Consequences .............................................. 15.3-6 15.3.3.3 Radiological Consequences............................................................... 15.3-9 15.3.3.4 Conclusions...................................................................................... 15.3-12 15.3.4 REACTOR COOLANT PUMP SHAFT BREAK ..................................... 15.3-12 15.3.4.1 Identification of Causes and Accident Description ........................... 15.3-12 15.3.4.2 Conclusions...................................................................................... 15.3-13 15.

3.5 REFERENCES

...................................................................................... 15.3-13 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES ......................... 15.4-1 15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION............................................................................................. 15.4-2 15.4.1.1 Identification of Causes and Accident Description ............................. 15.4-2 15.4.1.2 Analysis of Effects and Consequences .............................................. 15.4-4 15.4.1.3 Conclusions........................................................................................ 15.4-6 15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER .................................................................... 15.4-6 15.4.2.1 Identification of Causes and Accident Description ............................. 15.4-6 15.4.2.2 Analysis of Effects and Consequences .............................................. 15.4-8 15.4.2.3 Conclusions...................................................................................... 15.4-11 15.4.3 ROD CLUSTER CONTROL ASSEMBLY MISOPERATION (System Malfunction or Operator Error)............................................................... 15.4-11 15.4.3.1 Identification of Causes and Accident Description ........................... 15.4-11 15.4.3.2 Analysis of Effects and Consequences ............................................ 15.4-14 15.4.3.3 Conclusions...................................................................................... 15.4-17 15.4.4 STARTUP OF AN INACTIVE REACTOR COOLANT PUMP AT AN INCORRECT TEMPERATURE ............................................................. 15.4-17 15.4.4.1 Identification of Causes and Accident Description ........................... 15.4-17 15.4.4.2 Analysis of Effects and Consequences ............................................ 15.4-18 15.4.4.3 Conclusions...................................................................................... 15.4-20 15.0-v

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.4.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE ....................................................................... 15.4-20 15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT................................................................... 15.4-21 15.4.6.1 Identification of Causes and Accident Description ........................... 15.4-21 15.4.6.2 Analysis of Effects and Consequences ........................................... 15.4-23 15.4.6.3 Conclusions...................................................................................... 15.4-30 15.4.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY IN IMPROPER POSITION..................................................................... 15.4-31 15.4.7.1 Identification of Causes and Accident Description ........................... 15.4-31 15.4.7.2 Analysis of Effects and Consequences ............................................ 15.4-32 15.4.7.3 Conclusions...................................................................................... 15.4-33 15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS .......................................................................................... 15.4-33 15.4.8.1 Identification of Causes and Accident Description ........................... 15.4-33 15.4.8.2 Analysis of Effects and Consequences ............................................ 15.4-37 15.4.8.3 Radiological Consequences............................................................. 15.4-43 15.4.8.4 Conclusions...................................................................................... 15.4-47 15.

4.9 REFERENCES

..................................................................................... 15.4-48 15.5 INCREASE IN REACTOR COOLANT INVENTORY .................................... 15.5-1 15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION .............................................. 15.5-1 15.5.1.1 Identification of Causes and Accident Description ............................. 15.5-1 15.5.1.2 Analysis of Effects and Consequences .............................................. 15.5-2 15.5.1.3 Conclusions........................................................................................ 15.5-6 15.5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY ................................. 15.5-6 15.5.2.1 Identification of Causes and Accident Description ............................. 15.5-6 15.0-vi

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.5.2.2 Analysis of Effects and Consequences .............................................. 15.5-7 15.5.2.3 Conclusions........................................................................................ 15.5-9 15.5.3 A NUMBER OF BWR TRANSIENTS....................................................... 15.5-9 15.

5.4 REFERENCES

........................................................................................ 15.5-9 15.6 DECREASE IN REACTOR COOLANT INVENTORY................................... 15.6-1 15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE ..................................................................................................... 15.6-1 15.6.1.1 Identification of Causes and Accident Description ............................. 15.6-1 15.6.1.2 Analysis of Effects and Consequences .............................................. 15.6-2 15.6.1.3 Conclusions........................................................................................ 15.6-3 15.6.2 BREAK IN INSTRUMENT LINE OR OTHER LINES FROM REACTOR COOLANT PRESSURE BOUNDARY THAT PENETRATE CONTAINMENT ...................................................................................... 15.6-3 15.6.2.1 Radiological Consequences............................................................... 15.6-4 15.6.3 STEAM GENERATOR TUBE FAILURE.................................................. 15.6-6 15.6.3.1 STEAM GENERATOR TUBE RUPTURE WITH POSTULATED STUCK-OPEN ATMOSPHERIC STEAM DUMP VALVE ................................ 15.6-7 15.6.3.2 STEAM GENERATOR TUBE RUPTURE WITH FAILURE OF FAULTED STEAM GENERATOR AFW CONTROL VALVE ............................. 15.6-19 15.6.3.3 Conclusions...................................................................................... 15.6-30 15.6.3.4 Conclusions...................................................................................... 15.6-31 15.6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT .............................................................................. 15.6-31 15.6.5 LOSS-OF-COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY...................................................................... 15.6-31 15.6.5.1 Identification of Causes and Frequency Classification..................... 15.6-31 15.6.5.2 .................................Sequence of Events and Systems Operations15.6-32 15.6.5.3 ............................................ Analysis of Effects and Consequences15.6-36 15.6.5.4 Radiological Consequences ............................................................ 15.6-44 15.0-vii

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15.6.6 A NUMBER OF BWR TRANSIENTS .................................................... 15.6-50 15.

6.7 REFERENCES

..................................................................................... 15.6-50 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT ....... 15.7-1 15.7.1 RADIOACTIVE WASTE GAS DECAY TANK FAILURE ......................... 15.7-1 15.7.1.1 Identification of Causes ...................................................................... 15.7-1 15.7.1.2 Sequence of Events and System Operations..................................... 15.7-1 15.7.1.3 Core and System Performance .......................................................... 15.7-1 15.7.1.4 Barrier Performance ........................................................................... 15.7-1 15.7.1.5 Radiological Consequences............................................................... 15.7-2 15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE ............. 15.7-5 15.7.2.1 Identification of Causes ...................................................................... 15.7-5 15.7.2.2 Sequence of Events and System Operation ...................................... 15.7-5 15.7.2.3 Core and System Performance .......................................................... 15.7-5 15.7.2.4 Barrier Performance ........................................................................... 15.7-5 15.7.2.5 Radiological Consequences............................................................... 15.7-5 15.7.3 POSTULATED RADIOACTIVE RELEASE DUE TO LIQUID TANK FAILURES ............................................................................................... 15.7-8 15.7.4 FUEL HANDLING ACCIDENTS .............................................................. 15.7-8 15.7.4.1 Identification of Causes and Accident Description ............................. 15.7-8 15.7.4.2 Sequence of Events and Systems Operations................................... 15.7-9 15.7.4.3 Core and System Performance .......................................................... 15.7-9 15.7.4.4 Barrier Performance ........................................................................... 15.7-9 15.7.4.5 Radiological Consequences............................................................... 15.7-9 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM....................................... 15.8-1 15A.1 GENERAL ACCIDENT PARAMETERS .................................................. 15.A-1 15A.2 OFFSITE RADIOLOGICAL CONSEQUENCES CALCULATIONAL MODELS.................................................................................................. 15.A-1 15A.2.1 ACCIDENT RELEASE PATHWAYS .................................................. 15.A-1 15A.2.3 TWO - REGION SPRAY MODEL IN CONTAINMENT (LOCA) ......... 15.A-5 15.0-viii

CALLAWAY - SP TABLE OF CONTENTS (Continued)

Section Page 15A.2.4 OFFSITE THYROID DOSE CALCULATION MODEL........................ 15.A-8 15A.2.5 OFFSITE TOTAL-BODY DOSE CALCULATIONAL MODEL............. 15.A-9 15A.3 CONTROL ROOM RADIOLOGICAL CONSEQUENCES CALCULATIONAL MODELS ................................................................... 15.A-9 15A.3.1 INTEGRATED ACTIVITY IN CONTROL ROOM.............................. 15.A-10 15A.3.2 CONTROL ROOM THYROID DOSE CALCULATIONAL MODEL............................................................................................. 15.A-12 15A.3.3 CONTROL ROOM BETA-SKIN DOSE CALCULATIONAL MODEL............................................................................................. 15.A-13 15A.3.4 CONTROL ROOM TOTAL-BODY DOSE CALCULATION .............. 15.A-13 15A.4 REFERENCES ...................................................................................... 15.A-14 15.0-ix

CALLAWAY - SP LIST OF TABLES Number Title 15.0-1 Nuclear Steam Supply System Power Ratings 15.0-2 Summary of Initial Conditions and Computer Codes 15.0-3 Nominal Values of Pertinent Plant Parameters Utilized in the Accident Analyses 15.0-4 Trip Points and Time Delays to Trip Assumed in Accident Analyses 15.0-5 DELETED 15.0-6 Plant Systems and Equipment Available for Transient and Accident Conditions 15.0-7 Single Failures Assumed in Accident Analyses 15.0-8 Operator Actions Required for Small and Large LOCAs 15.0-9 Short Term Operator Actions Required for Steam Generator Tube Rupture 15.1-1 Time Sequence of Events for Incidents That Result in an Increase in Heat Removal by The Secondary System 15.1-1a Time Sequence of Events for the Steamline Rupture - full power core response limiting break size (0.87 ft2) 15.1-2 Equipment Required Following a Rupture of a Main Stean Line 15.1-3 Parameters Used in Evaluating the Radiological Consequences of a Main Steam Line Break 15.1-4 Radiological Consequences of a Main Steam Line Break 15.1-5 Safety Injection Flow for Steam Line Break Analyses 15.2-1 Time Sequence of Events for Incidents Which Result in a Decrease in Heat Removal by the Secondary System 15.2-2 Parameters Used in Evaluating Radiological Consequences of Loss of Nonemergency AC Power 15.2-3 Radiological Consequences of Loss of Nonemergency AC Power 15.0-x Rev. OL-17i 1/10

CALLAWAY - SP LIST OF TABLES (Continued)

Number Title 15.2-4 Deleted 15.3-1 Time Sequence of Events for Incidents Which Result in a Decrease in Reactor Coolant System Flow Rate 15.3-2 Summary of Results for Locked Rotor Transients 15.3-3 Parameters Used in Evaluating the Radiological Consequences of a Locked Rotor Accident 15.3-4 Radiological Consequences of a Locked Rotor Accident 15.4-1 Time Sequence of Events for Incidents Which Result in Reactivity and Power Distribution Anomalies 15.4-2 Parameters Used in the Analysis of the Rod Cluster Control Assembly Ejection Accident 15.4-3 Parameters Used in Evaluating the RCCA Ejection Accident 15.4-4 Radiological Consequences of a Rod-Ejection Accident 15.5-1 Time Sequence of Events for Incidents Which Result in an Increase in Reactor Coolant Inventory 15.6-1 Time Sequence of Events for Incidents Which Result in a Decrease in Reactor Coolant Inventory 15.6-2 Parameters Used in Evaluating the Radiological Consequence of the CVCS Letdown Line Rupture OUtside of Containment 15.6-3 Radiological Consequences of a CVCS Letdown Line Break Outside of Containment 15.6-4 Parameters Used in Evaluating the Radiological Consequences of a Steam Generator Tube Rupture (SGTR) 15.6-5 Radiological Consequences of a Steam Generator Tube Rupture WITH STUCK-OPEN ATMOSPERHIC STEAM DUMP VALVE 15.6-5a Radiological Consequences of a Steam Generator Tube Rupture WITH OVERFILL 15.0-xi Rev. OL-17i 1/10

CALLAWAY - SP LIST OF TABLES (Continued)

Number Title 15.6-6 Parameters Used in Evaluating the Radiological Consequences of a Loss-Of-Coolant-Accident 15.6-7 Design Comparison to the Regulatory Positions of Regulatory Guide 1.4 Assumptions Used for Evaluating the Potential Radiological Consequences of a Loss of Coolant Accident for Pressurized Water Reactors, Revision 2, June 1974 15.6-8 Radiological Consequences of a Loss-of-Coolant-Accident 15.6-9 Summary of Large Break LOCA Analysis Assumptions 15.6-10 Minimum and Maximum Safety Injection Flows For LBLOCA 15.6-10a Deleted 15.6-10b Deleted 15.6-11 Input Parameters Used in the Small Break LOCA Analysis 15.6-12 Safety Injection Flows vs. Pressure for SBLOCA - Minimum Safeguards, Spill to RCS Pressure 15.6-13 Large Break LOCA Results 15.6-14 Large Break LOCA Time Sequence of Events 15.6-15 NOTRUMP Transient Results 15.6-16 Beginning of Life (BOL) Rod Heatup Results 15.7-1 Design Comparison to the Regulatory Positions of Regulatory Guide 1.24 Assumptions Used for Evaluating the Potential Consequences of a Pressurized Water Reactor Radioactive Gas Storage Tank Failure Revision 0, Dated March 23, 1972 15.7-2 Design Comparison to the Regulatory Positions of Regulatory Guide 1.25 Assumptions Used for Evaluating the Potential Radiological Consequences of a Fuel Handling Accident in the Fuel Handling and Storage Facility for Boiling and Pressurized Water Reactors Revision 0, Dated March 23, 1972 15.0-xii Rev. OL-17i 1/10

CALLAWAY - SP LIST OF TABLES (Continued)

Number Title 15.7-3 Parameters used in evaluating the radiological consequences of a waste gas decay tank rupture 15.7-4 Radialogical Consequences of a Waste Gas Decay Tank Rupture 15.7-5 Parameters used in Evaluating the Radiological Consequences of a Liquid Radwaste Tank Failure 15.7-6 Radiological Consequences of a Liquid Radwaste Tank Failure 15.7-7 Parameters used in Evaluating the Radiological Consequences of a Fuel-Handling Accident 15.7-8 Radiological Consequences of a Fuel Handling Accident 15A-1 Parameters Used in Accident Analysis 15A-2 Limiting Short-Term Atmospheric Dispersion Factors (/Qs) for Accident analysis 15A-3 Fuel and Rod Gap Inventories - Core (Ci) 15A-4 Dose Conversion Factors Used in Accident Analysis 15A-5 Initial Radioactivity For Accidents That Use the Primary-to-Secondary Leakage Release Pathway 15.0-xiii Rev. OL-17i 1/10

CALLAWAY - SP LIST OF FIGURES Number Title 15.0-1 Illustration of Overtemperature and Overpower T Protection 15.0-2 Doppler Power Coefficient Used in Accident Analysis 15.0-3 RCCA Position Versus Time to Dashpot 15.0-4 Normalized Rod Worth Versus Percent Inserted 15.0-5 Normalized RCCA Bank Reactivity Worth Versus Normalized Drop Time 15.0-6 Deleted 15.0-7 Abbreviations and Symbols Used in Sequence Diagrams 15.0-8 Excessive Heat Removal Due to Feedwater Systems Malfunction 15.0-9 Excessive Load Increase 15.0-10 Depressurization of Main Steam System 15.0-11 Loss of External Load 15.0-12 Loss of Offsite Power to Station Auxiliaries (Blackout) 15.0-13 Loss of Normal Feedwater 15.0-14 Major Rupture of a Main Feedwater Line 15.0-15 Loss of Forced Reactor Coolant Flow 15.0-16 Uncontrolled Rod Cluster Control Assembly Bank Withdrawal 15.0-17 Dropped Rod Cluster Control Assembly 15.0-18 Single Rod Cluster Control Assembly Withdrawal at Full Power 15.0-19 Startup of an Inactive Reactor Coolant Loop 15.0-20 Boron Dilution 15.0-21 Rupture of Control Rod Drive Mechanism Housing 15.0-xiv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.0-22 Inadvertent ECCS Operation at Power 15.0-23 Accidental Depressurization of Reactor Coolant System 15.0-24 Steam Generator Tube Rupture 15.0-25 Loss of Coolant Accident 15.0-26 CVCS Letdown Line Rupture 15.0-27 GWPS Gas Decay Tank Rupture 15.0-28 Floor Drain Tank Failure 15.0-29 Fuel Handling Accident in Fuel Building 15.0-30 Fuel Handling Accident Inside Containment 15.0-31 Spent Fuel Cask Drop Accident 15.1-1 Nuclear Power, Core Heat Flux and Pressurizer Pressure Transients for HFP Feedwater Malfunction - Flow Increase Case 15.1-1A Nuclear Power, Core Heat Flux and Pressurizer Pressure Transients for HFP Feedwater Temperature Reduction Incident 15.1-1B Nuclear Power, Core Heat Flux and Core Reactivity Transients for HZP Feedwater Malfunction - Flow Increase, Multi-Loop Case 15.1-2 Reactor Coolant Loop Delta-T, Vessel Average Temperature and DNBR Transients for HFP Feedwater Malfunction - Flow Increase Case 15.1-2A Reactor Coolant Loop Delta-T, Vessel Average Temperature and DNBR Transients for HFP Feedwater Temperature Reduction Incident 15.1-2B Vessel Average Termperature, Pressurizer Pressure and Water Volume Transieants for HZP Feedwater Malfunction - Flow Increase, Multi-Loop Case 15.0-xv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.1-3 Nuclear Power, Pressurizer Pressure and Water Volume Transients for Ten Percent Step Load Increase, Minimum Reactivity Feedback, Manual Reactor Control 15.1-4 DNBR and Vessel Average Temperature Transients for Ten Percent Step Load Increase, Minimum Reactivity Feedback, Manual Reactor Control 15.1-5 Nuclear Power, Pressurizer Pressure and Water Volume Transients for Ten Percent Step Load Increase, Maximum Reactivity Feedback, Manual Reactor Control 15.1-6 DNBR and Vessel Average Temperature Transients for Ten Percent Step Load Increase, Maximum Reactivity Feedback, Manual Reactor Control 15.1-7 Nuclear Power, Pressurizer Pressure and Water Volume Transients for Ten Percent Step Load Increase, Minimum Reactivity Feedback, Automatic Reactor Control 15.1-8 DNBR and Vessel Average Temperature Transients for Ten Percent Step Load Increase, Minimum Reactivity Feedback, Automatic Reactor Control 15.1-9 Nuclear Power, Pressurizer Pressure and Water Volume Transients for Ten Percent Step Load Increase, Maximum Reactivity Feedback, Automatic Reactor Control 15.1-10 DNBR and Vessel Average Temperature Transients for Ten Percent Step Load Increase, Maximum Reactivity Feedback, Automatic Reactor Control 15.1-11 Keff Versus Temperature 15.1-12 Deleted 15.1-13 Deleted 15.1-14 Doppler Power Feedback 15.1-15A Nuclear Power and Core Heat Flux Transients for a Steam Line DER, Offsite Power Available 15.0-xvi Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.1.15B Pressurizer Pressure and Pressurizer Water Volume Transients for a Steam Line DER, Offsite Power Available 15.1-16A Vessel Inlet and Loop Average Temperature Transients for a Steam Line DER, Offsite Power Available 15.1-16B Reactivity and Core Boron Transients for a Steam Line DER, Offsite Power Available 15.1-17A Feedwater Flow and Steam FlowTransients for a Steam Line DER, Offsite Power Available 15.1-17B Steam Pressure and Core Flow Transients for a Steam Line DER, Offsite Power Available 15.1-18A Nuclear Power and Core Heat Flux Transients for a Steam Line DER, No Offsite Power Available 15.1-18B Pressurizer Pressure and Pressurizer Water Volume Transients for a Steam Line DER, No Offsite Power Available 15.1-19A Vessel Inlet and Loop Average Temperature Transients for a Steam Line DER, No Offsite Power Available 15.1.19B Reactivity and Core Boron Transients for a Steam Line DER, No Offsite Power Available 15.1-20A Feedwater Flow and Steam Flow Transients for a Steam Line DER, No Offsite Power Available 15.1-20B Steam Pressure and Core Flow Transients for a Steam Line DER, No Offsite Power Available 15.1-21 Steamline Rupture Full Power Core Response - Nuclear Power and Core Heat Flux 15.1-22 Steamline Rupture Full Power Core Response - Pressurizer Pressure and Water Volume 15.1-23 Steamline Rupture Full Power Core Response - Vessel Inlet and Loop Average Temperature 15.0-xvii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.1-24 Steamline Rupture Full Power Core Response - Feed Flow, Steam Flow, SG Pressure 15.1-25 Steamline Rupture Full Power Core Response - Break Flow 15.1-26 Steamline Rupture Full Power Core Response - DNBR 15.2-1 Turbine Trip Event with Pressurizer Spray and Power-Operated Relief Valves 15.2-2 Turbine Trip Event with Pressurizer Spray and Power-Operated Relief Valves 15.2-3 Turbine Trip Event with Pressurizer Spray and Power-Operated Relief Valves 15.2-4 Turbine Trip Event with Pressurizer Spray and Power-Operated Relief Valves 15.2-5 Turbine Trip Event without Pressurizer Spray and Power-Operated Relief Valves 15.2-6 Turbine Trip Event Without Pressurizer Spray and Power-Operated Relief Valves 15.2-7 Turbine Trip Event Without Pressurizer Spray and Power-Operated Relief Valves 15.2-8 Turbine Trip Event Without Pressurizer Spray and Power-Operated Relief Valves 15.2-9 Nuclear Power and Steam Generator Pressure Transients for Loss of AC Power 15.2-10 Reactor Coolant Temperature and Mass Flow Rate Transients for Loss of AC Power 15.2-11 Pressurizer Pressure and Water Volume Transients for Loss of AC Power 15.2-12 Nuclear Power and Steam Generator Pressure Transients for Loss of Normal Feedwater to all Steam Generators 15.0-xviii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.2-13 Reactor Coolant Temperature and Mass Flow Rate Transients for Loss of Normal Feedwater to all Steam Generators 15.2-14 Pressurizer Pressure and Water Volume Transients for Loss of Normal Feedwater to all Steam Generators 15.2-15 Nuclear Power, Core Heat Flux and Total Core Reactivity Transients for Main Feedwater Line Rupture with Offsite Power Available 15.2-16 Pressurizer Pressure and Water Volume Transients for Main Feedwater Line Rupture with Offsite Power Available 15.2-17 Reactor Coolant Flow Mass Rate and Feedwater Line Break Flow Transients for Main Feedwater Line Rupture with Offsite Power Available 15.2-18 Temperature Transient in Faulted Loop for Main Feedwater Line Rupture with Offsite Power Available 15.2-19 Temperature Transients in Intact Loops for Main Feedwater Line Rupture with Offsite Power Available 15.2-20 Steam Generator Shell Pressure Transient for Main Feedwater Line Rupture with Offsite Power Available 15.2--21 Nuclear Power, Core Heat Flux and Total Core Reactivity Transients for Main Feedwater Line Rupture Without Offsite Power 15.2-22 Pressurizer Pressure and Water Volume Transients for Main Feedwater Line Rupture Without Offsite Power 15.2-23 Reactor Coolant Mass Flow Rate and Feedwater Line Break Flow Transients for Main Feedwater Line Rupture Without Offsite Power 15.2-24 Temperature Transient Infaulted Loop for Main Feedwater Line Rupture Without Offsite Power 15.2-25 Temperature Transient in Intact loops for Main Feedwater Line Rupture Without Offsite Power 15.2-26 Steam Generator Shell Pressure Transient for Main Feedwater Line Rupture Without Offsite Power 15.0-xix Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.2-27 Deleted 15.2-28 Deleted 15.2-29 Deleted 15.2-30 Deleted 15.2-31 Deleted 15.2-32 Deleted 15.2-33 Deleted 15.2-34 Deleted 15.2-35 Deleted 15.2-36 Deleted 15.2-37 Deleted 15.2-38 Deleted 15.2-39 Deleted 15.2-40 Deleted 15.2-41 Deleted 15.2-42 Deleted 15.2-43 Deleted 15.2-44 Deleted 15.2-45 Deleted 15.2-46 Deleted 15.3-1 Flow Transients for Four Loops in Operation, Two Pumps Coasting Down 15.0-xx Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.3-2 Nuclear Power and Pressurizer Pressure Transients for Four Loops in Operation, Two Pumps Coasting Down 15.3-3 Average and Hot Channel Heat Flux Transients for Four Loops in Operation, Two Pumps Coasting Down 15.3-4 DNBR Transient for Four Loops in Operation, Two Pumps Coasting Down 15.3-4A Deleted 15.3-4B Deleted 15.3-5 Core Flow Transient for Four Loops in Operation, Four Pumps Coasting Down 15.3-6 Nuclear Power and Pressurizer Pressure Transients for Four Loops in Operation, Four Pumps Coasting Down 15.3-7 Average and Hot Channel Heat Flux Transients for Four Loops in Operation, Four Pumps Coasting Down 15.3-8 DNBR Transient for Four Loops in Operation, Four Pumps Coasting Down 15.3-8A Deleted 15.3-8B Deleted 15.3-9 Flow Transients for Four Loops in Operation, One Locked Rotor 15.3-10 Peak Reactor Coolant Pressure for Four Loops in Operation, One Locked Rotor 15.3-11 Nuclear Power, Average and Hot Channel Heat Flux Transients for Four Loops in Operation, One Locked Rotor 15.3-12 Maximum Clad Temperature at Hot Spot for Four Loops in Operation, One Locked Rotor 15.3-13 Thru 15.3-24 Deleted 15.0-xxi Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.4-1 Core Average Neutron Flux Transient for Uncontrolled Rod Withdrawal from a Subcritical Condition 15.4-2 Thermal Flux Transient for Uncontrolled Rod Withdrawal from a Subcritical Condition (Heat Flux vs. Time) 15.4-3 Fuel and Clad Temperature Transients for Uncontrolled Rod Withdrawal from a Subcritical Condition 15.4-4 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (110 pcm/sec Withdrawal Rate) 15.4-5 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (110 pcm/sec Withdrawal Rate) 15.4-6 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (110 pcm/sec Withdrawal Rate) 15.4-7 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate) 15.4-8 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate) 15.4-9 Uncontrolled RCCA Bank Withdrawal from Full Power with Minimum Reactivity Feedback (1 pcm/sec Withdrawal Rate) 15.4-10 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal from 100 Percent Power 15.4-11 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal from 60 Percent Power 15.4-12 Minimum DNBR Versus Reactivity Insertion Rate, Rod Withdrawal from 10 Percent Power 15.4-12a Nuclear Power Transient and Core Heat Flux Transient for Dropped Rod Cluster Control Assembly 15.4-12b Pressurizer Pressure Transient and Core Average Temperature Transient for Dropped Rod Cluster Control Assembly 15.0-xxii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.4-13 Nuclear Power Transient for Startup of an Inactive Reactor Coolant Loop 15.4-14 Heat Flux Transient for Startup of an Inactive Reactor Coolant Loop 15.4-15 Core Flow Transient for Startup of an Inactive Reactor Coolant Loop 15.4-16 Core Average Temperature and Pressurizer Pressure Transients for Startup of an Inactive Reactor Coolant Loop 15.4-17 DNBR Transient for Startup of an Inactive Reactor Coolant Loop 15.4-17A Deleted 15.4-17B Deleted 15.4-18 Representative Percent Change in Local Assembly Average Power for an Interchange Between a Region 1 and a Region 3 Assembly 15.4-19 Representative Percent Change in Local Assbly. Avg. Power for an Interchange Between a Region 1 and a Region 2 Assbly. with the Burn. Poison Rods Being Retained by the Region 2 Assembly 15.4-20 Representative Percent Change in Local Assbly. Avg. Power for an Interchange Between a Region 1 and a Region 2 Assbly. with the Burn. Poison Rods Being Transferred to the Region 1 Assembly 15.4-21 Representative Percent Change in Local Assembly Average Power for an Enrichment Error (A Region 2 Assembly Loaded into the Core Central Position) 15.4-22 Representative Percent Change in Local Assembly Average Power for Loading a Region 2 Assembly into a Region 1 Position Near the Core Periphery 15.4-23 Nuclear Power Transient, BOL, HFP, Rod Ejection Accident 15.4-24 Hot Spot Fuel and Clad Temperatures Versus Time, BOL, HFP, Rod Ejection Accident 15.4-25 Nuclear Power Transient, EOL, HZP, Rod Ejection Accident 15.0-xxiii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.4-26 Hot Spot Fuel and Clad Temperatures Versus Time, EOL, HZP, Rod Ejection Accident 15.4-27 Reactor Coolant System Integrated Break Flow Following a Rod Ejection Accident 15.5-1 Inadvertent Operation of ECCS During Power Operation 15.5-2 Inadvertent Operation of ECCS During Power Operation 15.5-3 Inadvertent Operation of ECCS During Power Operation 15.5-4 Chemical and Volume Control System Malfunction, Minimum Reactivity Feedback, without Pressurizer Spray 15.5-5 Chemical and Volume Control System Malfunction, Minimum Reactivity Feedback, without Pressurizer Spray 15.5-6 Chemical and Volume Control System Malfunction, Minimum Reactivity Feedback, with Pressurizer Spray 15.5-7 Chemical and Volume Control System Malfunction, Minimum Reactivity Feedback, with Pressurizer Spray 15.5-8 Chemical and Volume Control System Malfunction, Maximum Reactivity Feedback, without Pressurizer Spray 15.5-9 Chemical and Volume Control System Malfunction, Maximum Reactivity Feedback, without Pressurizer Spray 15.5-10 Chemical and Volume Control System Malfunction, Maximum Reactivity Feedback, with Pressurizer Spray 15.5-11 Chemical and Volume Control System Malfunction, Maximum Reactivity Feedback, with Pressurizer Spray 15.6-1 Nuclear Power and DNBR Transients for Inadvertent Opening of a Pressurizer Safety Valve 15.6-2 Pressurizer Pressure and Vessel Average Temperature Transients for Inadvertent Opening of a Pressurizer Safety Valve 15.0-xxiv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-3a Pressurizer and Steam Generator (Ruptured and Intact Generators)

Pressure Transients for Steam Generator Tube Rupture Event 15.6-3b Reactor Coolant System Temperature (Ruptured Loop) Transient for Steam Generator Tube Rupture Event 15.6-3c Reactor Coolant System Temperature (Intact Loops) Transient for Steam Generator Tube Rupture Event 15.6-3d Steam Flow Rate (Intact Generators) Transient for Steam Generator Tube Rupture Event 15.6-3e Steam Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3f Steam Generator Temperature (Faulted and Intact Generators)

Transients for Steam Generator Tube Rupture Event 15.6-3g Steam Generator Atmospheric Relief Valve Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3h Steam Generator Atmospheric Relief Valve Flow Rate (Intact Generators) Transient for Steam Generator Tube Rupture Event 15.6-3i Faulted Steam Generator Break Flow Rate Transient for Steam Generator Tube Rupture Event 15.6-3j Auxiliary Feedwater Flow Rate and Narrow Range Level (Ruptured Generator) Transients for Steam Generator Tube Rupture Event 15.6-3k Auxiliary Feedwater Flow Rate and Narrow Range Level (Intact Generators) Transients for Steam Generator Tube Rupture Event 15.6-3l Steam Generator Liquid Volume (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3m Pressurizer PORV Flow Rate Transient for Steam Generator Tube Rupture Event 15.6-3n Pressurizer Liquid Volume Transient for Steam Generator Tube Rupture Event 15.0-xxv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-3o Feedwater Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3p Feedwater Flow Rate (Intact Generators) Transient for Steam Generator Tube Rupture Event 15.6-4 Sequence of Events for Large Break LOCA Analysis 15.6-4a Deleted 15.6-4b Deleted 15.6-5 Deleted 15.6-5a Cladding Temperature at PCT and Burst Elevations (CD=0.4, Low Tavg, MIN SI, Cosine Power Shape, non-IFBA) 15.6-5b Cladding Temperature at PCT and Burst Elevations (CD=0.6, Low Tavg, MIN SI, Cosine Power Shape, non-IFBA) 15.6-5c Cladding Temperature at PCT and Burst Elevations (CD=0.8, Low Tavg, MIN SI, Cosine Power Shape, non-IFBA) 15.6-5d Cladding Temperature at PCT and Burst Elevations (CD=1.0, Low Tavg, MIN SI, Cosine Power Shape, non-IFBA) 15.6-5e Cladding Temperature at PCT and Burst Elevations (CD=0.6, High Tavg, MIN SI, Cosine Power Shape, non-IFBA) 15.6-5f Cladding Tempertaure at PCT and Burst Elevations (CD=0.6, High Tavg, MAX SI, Cosine Power Shape, non-IFBA) 15.6-5g Cladding Temperature at PCT and Burst Elevations (CD=0.6, High Tavg, MIN SI, 8.5 Power Shape, non-IFBA) 15.6-5h Cladding Temperature at PCT and Burst Elevations (CD=0.6, High Tavg, MIN SI, Cosine Power Shape, IFBA) 15.6-6 Deleted 15.6-6a Core Pressure During Blowdown (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.0-xxvi Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-6b Core Pressure During Blowdown (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-6c Core Pressure During Blowdown (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-6d Core Pressure During Blowdown (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-6e Core Pressure During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-6f Core Pressure During Blowdown (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-6g Core Pressure During Blowdown (CD=0.6, High TAVG, MIN SI, 8.5 Power Shape, non-IFBA) 15.6-6h Core Pressure During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-7 Deleted 15.6-7a Vessel Liquid Levels During Reflood (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-7b Vessel Liquid Levels During Reflood (CD=0.6 Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-7c Vessel Liquid Levels During Reflood (CD=0.8 Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-7d Vessel Liquid Levels During Reflood (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-7e Vessel Liquid Levels During Reflood (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-7f Vessel Liquid Levels During Reflood (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, Non-IFBA) 15.0-xxvii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-7g Vessel Liquid Levels During Reflood (CD=0.6, High TAVG, MIN SI, 8.5 Power Shape, non-IFBA) 15.6-7h Vessel Liquid Levels During Reflood (CD=0.6, HIgh TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-8 Deleted 15.6-8a Core Inlet Flooding Rate During Reflood (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-8b Core Inlet Flooding Rate During Reflood (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-8c Core Inlet Flooding Rate During Reflood (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-8d Core Inlet Flooding Rate During Reflood (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-8e Core Inlet Flooding Rate During Reflood (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-8f Core Inlet Flooding Rate During Reflood (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-8g Core Inlet Flooding Rate During Reflood (CD=0.6, High TAVG, MIN SI, 8.5 Power Shape, non-IFBA) 15.6-8h Core Inlet Flooding Rate During Reflood (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-9 Deleted 15.6-9a Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, Non-IFBA) 15.6-9b Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, Non-IFBA) 15.6-9c Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, Non-IFBA) 15.0-xxviii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-9d Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, Non-IFBA) 15.6-9e Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, Non-IFBA) 15.6-9f Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, Non-IFBA) 15.6-9g Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, Non-IFBA) 15.6-9h Core Inlet and Outlet Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-10 Deleted 15.6-10a Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.4. Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-10b Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.6. Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-10c Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.8. Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-10d Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=1.0. Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-10e Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-10f Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.0-xxix Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-10g Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.6-10h Cladding Surface Heat Transfer Coefficient at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-11 Deleted 15.6-11a Vapor Temperature at PCT and Burst Elevations (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-11b Vapor Temperature at PCT and Burst Elevations (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-11c Vapor Temperature at PCT and Burst Elevations (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-11d Vapor Temperature at PCT and Burst Elevations (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-11e Vapor Temperature at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-11f Vapor Temperature at PCT and Burst Elevations (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-11g Vapor Temperature at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.6-11h Vapor Temperature at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-12 Deleted 15.6-12a Fluid Quality at PCT and Burst Elevations (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-12b Fluid Quality at PCT and Burst Elevations (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.0-xxx Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-12c Fluid Quality at PCT and Burst Elevations (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-12d Fluid Quality at PCT and Burst Elevations (CD=, 1.0 Low TAVG, MIN SI ,Cosine Power Shape, non-IFBA) 15.6-12e Fluid Quality at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-12f Fluid Quality at PCT and Burst Elevations (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-12g Fluid Quality at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.6-12h Fluid Quality at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-13 Deleted 15.6-13a Fluid Mass Velocity at PCT and Burst Elevations (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-13b Fluid Mass Velocity at PCT and Burst Elevations (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-13c Fluid Mass Velocity at PCT and Burst Elevations (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-13d Fluid Mass Velocity at PCT and Burst Elevations (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-13e Fluid Mass Velocity at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-13f Fluid Mass Velocity at PCT and Burst Elevations (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-13g Fluid Mass Velocity at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.0-xxxi Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-13h Fluid Mass Velocity at PCT and Burst Elevations (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-14 Deleted 15.6-14a Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-14b Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-14c Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-14d Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-14e Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-14f Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-14g Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.6-14h Intact Loop Accumulator Mass Flow Rate During Blowdown (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-15 Deleted 15.6-15a Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.4, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-15b Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.6, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-15c Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.8, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-15d Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=1.0, Low TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.0-xxxii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-15e Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, non-IFBA) 15.6-15f Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.6, High TAVG, MAX SI, Cosine Power Shape, non-IFBA) 15.6-15g Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.6, High TAVG, MIN SI, 8.5 Cosine Power Shape, non-IFBA) 15.6-15h Intact Leg Accumulator and SI Mass Flow Rate During Reflood (CD=0.6, High TAVG, MIN SI, Cosine Power Shape, IFBA) 15.6-16 Code Interface Description for Small Break Model 15.6-17 Small Break Power Shape 15.6-18 2 Inch Cold Leg Break RCS Pressure vs Time 15.6-19 2 Inch Cold Leg Break Core Mixture Level vs Time (Top of Core 22.0778 ft) 15.6-20 3 Inch Cold Leg Break RCS Pressure vs Time 15.6-21 3 Inch Cold Leg Break Core Mixture Level vs Time (Top of Core 22.0778 ft 15.6-22 3 Inch Cold Leg Break Hot Spot Clad Temperature vs Time 15.6-23 4 Inch Cold Leg Break RCS Pressure vs Time 15.6-24 4 Inch Cold Leg Break Core Mixture Level vs Time (Top of Core 22.0778 ft) 15.6-25 4 Inch Cold Leg Break Hot Spot Clad Temperature vs Time 15.6-26 6 Inch Cold Leg Break RCS Pressure vs Time 15.6-27 6 Inch Cold Leg Break Core Mixture Level vs Time (Top of Core 22.0778 ft) 15.6-28 6 Inch Cold Leg Break Hot Spot Clad Temperature vs Time 15.0-xxxiii Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-29 4 Inch Cold Leg Break Core Exit Steam Flow vs Time 15.6-30 4 Inch Cold Leg Break Core Heat Transfer Coefficient vs Time 15.6-31 4 Inch Cold Leg Break Hot Spot Fluid Temperature vs Time 15.6-32 4 Inch BL and IL Pumped SI Flow Rate vs Time 15.6-33 Deleted 15.6-33a Pressurizer and Steam Generator (Ruptured and Intact Generators)

Pressure Transients for SGTR Event with Overfill 15.6-33b Reactor Coolant System Temperature (Ruptured Loop) Transient for SGTR Event with Overfill 15.6-33c Reactor Coolant System Temperature (Intact Loops) Transient for SGTR Event with Overfill 15.6-33d Reactor Coolant System and Steam Generator (Ruptured and Intact Generators) Water Mass Transient for SGTR Event with Overfill 15.6-33e Ruptured Steam Generator Break Flow Flashing Fraction Transient for SGTR Event with Overfill 15.6-33f Steam Generator Temperature (Ruptured and Intact Generators)

Transient for SGTR Event with Overfill 15.6-33g Steam Generator Atmospheric Release Flow Rate (Ruptured Generator) Transient for SGTR Event with Overfill 15.6-33h Steam Generator Atmospheric Release Flow Rate (Intact Generators) Transient for SGTR Event with Overfill 15.6-33i Ruptured Steam Generator Break Flow Rate Transient for SGTR Event with Overfill 15.6-33j Auxiliary Feedwater Flow Rate and Narrow Range Level (Ruptured Generator) Transients for SGTR Event with Overfill 15.6-33k Auxiliary Feedwater Flow Rate and Narrow Range Level (Intact Generators) Transients for SGTR Event with Overfill 15.0-xxxiv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-33l Ruptured Steam Generator Liquid Volume Transient for SGTR Event with Overfill 15.6-33m Pressurizer PORV Flow Rate Transient for SGTR Event with Overfill 15.6-33n Pressurizer Liquid Volume Transient for SGTR Event with Overfill 15.6-34 Deleted 15.6-35 Deleted 15.6-36 Deleted 15.6-37 Deleted 15.6-38 Deleted 15.6-39 Deleted 15.6-40 Deleted 15.6-41 Deleted 15.6-42 Deleted 15.6-43 Deleted 15.6-44 Deleted 15.6-45 Deleted 15.6-46 Deleted 15.6-47 Deleted 15.6-48 Deleted 15.6-49 Deleted 15.6-50 Deleted 15.6-51 Deleted 15.0-xxxv Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-52 Deleted 15.6-53 Deleted 15.6-54 Deleted 15.6-55 Deleted 15.6-56 Deleted 15.6-57 Deleted 15.6-58 Deleted 15.6-59 Deleted 15.6-60 Deleted 15.6-61a Deleted 15.6-61b Deleted 15.6-61c Deleted 15.6-61d Deleted 15.6-61e Deleted 15.6-61f Deleted 15.6-61g Deleted 15.6-61h Deleted 15.6-61i Deleted 15.6-61j Deleted 15.6-61k Deleted 15.6-61l Deleted 15.0-xxxvi Rev. OL-20 11/13

CALLAWAY - SP LIST OF FIGURES (Continued)

Number Title 15.6-61m Deleted 15.6-61n Deleted 15A-1 Release Pathways 15A-2 Allowable Inleakage Values 15.0-xxxvii Rev. OL-20 11/13

CALLAWAY - SP 15.0 ACCIDENT ANALYSIS 15.0.1 CLASSIFICATION OF PLANT CONDITIONS Since 1970, the American Nuclear Society (ANS) classification of plant conditions has been used which divides plant conditions into four categories in accordance with anticipated frequency of occurrence and potential radiological consequences to the public. The four categories are as follows:

a. Condition I: Normal operation and operational transients

b. Condition II: Faults of moderate frequency

c. Condition III: Infrequent faults

d. Condition IV: Limiting faults For the definition of Conditions I, II, III, and IV events, refer to ANSI-N18.2, "Nuclear Safety Criteria for the Design of Stationary PWR Plants," Section 5, 1973.

The basic principle applied in relating design requirements to each of the conditions is that the most probable occurrences should yield the least radiological risk to the public, and those extreme situations having the potential for the greatest risk to the public shall be those least likely to occur. Where applicable, reactor trip system and engineered safeguards functioning is assumed to the extent allowed by considerations, such as the single failure criterion, in fulfilling this principle. This means that seismic Category I, Class 1E, and IEEE qualified equipment, instrumentation, and components are used in the ultimate mitigation of the consequences of Conditions II, III, and IV events. Typical step-by-step sequence-of-events diagrams are provided for each transient in Figures 15.0-8 through 15.0-31. Figure 15.0-7 provides the legend used in these diagrams. The accident analysis radiological consequences evaluation models and parameters are discussed in Appendix 15A.

15.0.1.1 Condition I - Normal Operation and Operational Transients Condition I occurrences are those which are expected frequently or regularly in the course of power operation, refueling, maintenance, or maneuvering of the plant. As such, Condition I occurrences are accommodated with margin between any plant parameter and the value of that parameter which would require either automatic or manual protective action. The analysis of Condition I transients ensures that the operational margins are adequate for normal plant operation. Inasmuch as Condition I events occur frequently or regularly, they must be considered from the point of view of their effect on the consequences of fault conditions (Conditions II, III, and IV). In this regard, analysis of each fault condition described is generally based on a conservative set of initial conditions corresponding to adverse conditions that can occur during Condition I operation.

15.0-1 Rev. OL-22 11/16

CALLAWAY - SP A typical list of Condition I events is given below:

a. Steady state and shutdown operations

1. Power operation

2. Startup

3. Hot standby

4. Hot shutdown

5. Cold shutdown

6. Refueling

b. Operation with permissible deviations Various deviations from normal operation which may occur during continued operation as permitted by the Technical Specifications must be considered in conjunction with other operational modes. These include:

1. Operation with components or systems out of service

2. Leakage from fuel with limited clad defects

3. Excessive radioactivity in the reactor coolant (a) Fission products (b) Corrosion products (c) Tritium

4. Operation with steam generator leaks

5. Testing

c. Operational transients

1. Plant heatup and cooldown

2. Step load changes (up to +/-10 percent)

3. Ramp load changes (up to 5 percent/minute) 15.0-2 Rev. OL-22 11/16

CALLAWAY - SP

4. Load rejection up to and including design basis 50% load rejection transient 15.0.1.2 Condition II - Faults of Moderate Frequency These faults, at worst, result in a reactor trip with the plant being capable of returning to operation. By definition, these faults (or events) do not propagate to cause a more serious fault, i.e., Condition III or IV events. In addition, Condition II events are not expected to result in fuel rod failures or reactor coolant system or secondary system over-pressurization.

For the purposes of this report, the following faults are included in this category:

a. Feedwater system malfunctions that result in a decrease in feedwater temperature.

b. Feedwater system malfunctions that result in an increase in feedwater flow.

c. Excessive increase in secondary steam flow.

d. Inadvertent opening of a steam generator relief or safety valve.

e. Loss of external electrical load.

f. Turbine trip.

g. Inadvertent closure of main steam isolation valves.

h. Loss of condenser vacuum and other events resulting in turbine trip.

i. Loss of nonemergency ac power to the station auxiliaries.

j. Loss of normal feedwater flow.

k. Partial loss of forced reactor coolant flow.

l. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition.

m. Uncontrolled rod cluster control assembly bank withdrawal at power.

n. Rod cluster control assembly misoperation (dropped full length assembly, dropped full length assembly bank, or statically misaligned full length assembly).

o. Startup of an inactive reactor coolant pump at an incorrect temperature.

15.0-3 Rev. OL-22 11/16

CALLAWAY - SP

p. Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant.

q. Inadvertent operation of the emergency core cooling system during power operation.

r. Chemical and volume control system malfunction that increases reactor coolant inventory.

s. Inadvertent opening of a pressurizer safety or relief valve.

t. Break in instrument line or other lines from reactor coolant pressure boundary that penetrate the containment.

15.0.1.3 Condition III - Infrequent Faults By definition, Condition III occurrences are faults which may occur very infrequently during the life of the plant. They will be accommodated with the failure of only a small fraction of the fuel rods, although sufficient fuel damage might occur to preclude resumption of operation for a considerable outage time. The release of radioactivity will not be sufficient to interrupt or restrict public use of those areas beyond the exclusion radius. A Condition III fault will not, by itself, generate a Condition IV fault or result in a consequential loss of function of the reactor coolant system or containment barriers. For the purposes of this report the following faults are included in this category:

a. Steam system piping failure (minor).

b. Complete loss of forced reactor coolant flow.

c. Rod cluster control assembly misoperation (single rod cluster control assembly withdrawal at full power).

d. Inadvertent loading and operation of a fuel assembly in an improper position.

e. Loss-of-coolant accidents resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (small break).

f. Radioactive gas waste system leak or failure.

g. Radioactive liquid waste system leak or failure.

h. Postulated radioactive releases due to liquid tank failures.

i. Spent fuel cask drop accidents.

15.0-4 Rev. OL-22 11/16

CALLAWAY - SP Spent fuel cask drop accidents are not applicable to Callaway Plant. The spent fuel cask handling equipment has been upgraded to single-failure-proof status to provide the maximum practical defense in depth in accordance with NUREG-0612 and to allow the use of the spent fuel cask handling equipment and lifting devices to handle heavy loads in the vicinity of spent fuel without the need for load drop analyses. This is supported by NRC Information Notice 99-15 which stated in general that for cask movements with single-failure-proof cranes, cask drops or tipping accidents need not be considered.

Since the cask cannot drop, no cask rupture can occur and thus no radioactivity can be released.

15.0.1.4 Condition IV - Limiting Faults Condition IV occurrences are faults which are not expected to take place, but are postulated because their consequences would include the potential for the release of significant amounts of radioactive material. They are the most drastic which must be designed against and represent limiting design cases. Condition IV faults are not to cause a fission product release to the environment resulting in an undue risk to public health and safety in excess of guideline values of 10 CFR 100. A single Condition IV fault is not to cause a consequential loss of required functions of systems needed to cope with the fault, including those of the emergency core cooling system and the containment. For the purposes of this report the following faults have been classified in this category:

a. Steam system pipe break.

b. Feedwater system pipe break.

c. Reactor coolant pump shaft seizure (locked rotor).

d. Reactor coolant pump shaft break.

e. Spectrum of rod cluster control assembly ejection accidents.

f. Steam generator tube rupture.

g. Loss-of-coolant accidents, resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary (large break).

h. Design basis fuel handling accidents.

15.0.2 OPTIMIZATION OF CONTROL SYSTEMS 15.0.2.1 Setpoint Study A control system setpoint study is performed in order to simulate performance of the reactor control and protection systems. In this study, emphasis is placed on the 15.0-5 Rev. OL-22 11/16

CALLAWAY - SP development of a control system which will automatically maintain prescribed conditions in the plant even under a conservative set of reactivity parameters with respect to both system stability and equipment performance.

For each mode of plant operation, a group of optimum controller setpoints is determined.

In areas where the resultant setpoints are different, compromises based on the optimum overall performance are made and verified. A consistent set of control system parameters is derived satisfying plant operational requirements throughout the core life and for various levels of power operation.

The study is comprised of an analysis of the following control systems: rod cluster control assembly, steam dump, steam generator level, pressurizer pressure, and pressurizer level.

15.0.2.2 End of Life Coastdown Coastdowns at the end of an operating cycle may be performed by a power reduction on the normal Tavg program (power coastdown), or by a combination of RCS Tavg reduction (Tavg coastdown) followed by a power coastdown. In the latter case, RCS Tavg and power may initially be reduced by maintaining a constant turbine control valve position, and allowing the temperature feedback of the reactor core to control the rate of Tavg and power reduction. If the valves are not at the valved wide open position when depletion of reactivity is reached at the end of an operating cycle, the valves can be gradually opened as Tavg and power begin to decrease.

In order to perform a power coastdown on the normal Tavg program, no specific adjustments to the control or protection system settings are required.

For the combination of a Tavg coastdown followed by a power coastdown, the gain of the steam dump load rejection controller and the settings of the trip open bistables will be adjusted in accordance with the Turbine Trip Without Reactor Trip From P-9 Setpoint analysis for Tavg coastdown (see Section 2.4.2 of Reference 21). This ensures that the steam dumps provide adequate heat removal for load rejections as described in Sections 7.2.1.1.2.f and 18.2.17.7.2. This method of steam dump control may be used for any combination of Tavg coastdown followed by a power coastdown within the analyzed range of Tavg programs. No changes to the plant trip controller settings are required. To improve the reactor control system response to transients, and to provide the operators with a target Tavg for manual control and trip recovery, the programmed reference Tavg may be (but is not required to be) reset periodically during the Tavg coastdown. Once a final Tavg program is reached, no further changes are required during the subsequent power coastdown. The overtemperature delta-T (OTDT) and overpower delta-T (OPDT) setpoint reference temperatures (T for OTDT and T for OPDT) may remain at their corresponding pre-coastdown settings for the duration of the coastdown (see Reference 21).

15.0-6 Rev. OL-22 11/16

CALLAWAY - SP 15.0.3 PLANT CHARACTERISTICS AND INITIAL CONDITIONS ASSUMED IN THE ACCIDENT ANALYSES 15.0.3.1 Design Plant Conditions Table 15.0-1 lists the principal power rating values which are assumed in analyses performed in this report. Two ratings are given:

a. The NSSS rated thermal power. This power rating includes the thermal power generated by the reactor coolant pumps.

b. The rated reactor core thermal power output is 3565 MWt.

Allowances for errors in the determination of the steady-state power level are made as described in Section 15.0.3.2. The core thermal power and pump heat values used for each transient analyzed are given in Table 15.0-2.

The values of other pertinent plant parameters utilized in the accident analyses are given in Table 15.0-3.

15.0.3.2 Initial Conditions For most accidents which are DNB limited, nominal values of initial conditions are assumed. The allowances on power, temperature, and pressure are determined on a statistical basis and are included in the limit DNBR as described in Reference 6. The values used in the analysis of the Callaway Plant are presented in Reference 7 for the Callaway Replacement Steam Generator (RSG) Program and are contained in each cycle's Reload Safety Analysis Checklist (RSAC). The analysis power uncertainty is +/-

2.0% with no bias. The rod control system (T-avg) controller channel statistical allowance (CSA) is +/- 3.0°F with a bias of -1.3/+0.5°F. The pressurizer pressure control system controller CSA is +/- 30 psi with an additional bias of 30 psi. These are analysis values, conservative for use but not reflective of the current plant design. This procedure is known as the revised thermal design procedure (RTDP) and the accidents analyzed with this procedure utilize the WRB-2 DNB correlation (Ref. 10). RTDP allowances may be more restrictive that non-RTDP allowances. The initial conditions for other key parameters are selected in such a manner to maximize the impact on DNBR. Minimum Measured Flow is used in all RTDP transients. This flow accounts for a flow uncertainty of +/- 2.1% for calorimetric and RCS cold leg elbow tap uncertainties with a bias of +0.1%

for feedwater venturi fouling.

For accidents which are not DNB limited, or for which the RTDP is not employed, the WRB-2 DNB correlation is used when coolant conditions are within the ranges of these correlations, otherwise the W-3, ABB-NV, and WLOP DNB correlations are used. The initial conditions are obtained by adding the maximum steady-state errors to rated values 15.0-7 Rev. OL-22 11/16

CALLAWAY - SP in such a manner to maximize the impact on the limiting parameter. The following conservative steady-state errors were assumed in the analysis:

a. Core power +/-2 percent allowance for calorimetric error

b. Average reactor coolant +4.3/-3.5°F allowance for controller system temperature deadband and measurement error

c. Pressurizer pressure +30/-60 psi allowance for steady-state fluctuations and measurement error

d. Reactor coolant flow Thermal design flow is assumed and no steady-state errors are applied Table 15.0-2 summarizes the principal initial conditions, computer codes used, DNB correlations, and thermal hydraulic methods. Other accident specific initial conditions are given in those sections describing the accident. The level of steam generator tube plugging assumed for each transient is listed in Table 15.0-2.

15.0.3.3 Power Distribution The transient response of the reactor system is dependent on the initial power distribution. The nuclear design of the reactor core minimizes adverse power distributions through the placement of fuel assemblies, control rods, and operating instructions. Power distribution may be characterized by the radial factor (FH) and the total peaking factor (FQ). The peaking factors limits are given in the COLR.

For transients which may be DNB limited, the radial peaking factor is of importance. The radial peaking factor increases with decreasing power level due to rod insertion. This increase in FH is included in the core limits illustrated in Figure 15.0-1. All transients that may be DNB limited are assumed to begin with a FH consistent with the design thermal power level.

For transients which may be overpower limited, the total peaking factor (FQ) is of importance. All transients that may be overpower limited are assumed to begin with plant conditions, including power distributions which are consistent with or conservative with respect to reactor operation, as defined in the Technical Specifications.

The axial power shape discussed in Reference 9 is used in the DNBR calculation for transients analyzed at full power. It is also the limiting power shape calculated or allowed for accidents initiated at non-full power or asymmetric RCCA conditions.

The radial and axial power distributions described above are input to the VIPRE code, as described in Section 4.4.

15.0-8 Rev. OL-22 11/16

CALLAWAY - SP For overpower transients that are slow with respect to the fuel rod thermal time constant, for example the chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant incident that lasts many minutes, and the excessive increase in secondary steam flow incident, which may reach equilibrium without causing a reactor trip, the fuel rod thermal evaluations are performed as discussed in Section 4.4. For overpower transients that are fast with respect to the fuel rod thermal time constant, for example, the uncontrolled RCCA bank withdrawal from subcritical or low power startup conditions and RCCA ejection incidents which result in a large power rise over a few seconds, a detailed fuel transient heat transfer calculation must be performed.

15.0.4 REACTIVITY COEFFICIENTS ASSUMED IN THE ACCIDENT ANALYSES The transient response of the reactor system is dependent on reactivity feedback effects, in particular the moderator temperature coefficient and the Doppler power coefficient.

These reactivity coefficients are discussed in detail in Section 4.3.2.3.

In the analysis of certain events, conservatism requires the use of large reactivity coefficient values, whereas in the analysis of other events conservatism requires the use of small reactivity coefficient values. The values are given in Table 15.0-2. Reference is made in that table to Figure 15.0-2, which shows the upper and lower bound Doppler power coefficients as a function of power used in the transient analyses. The justification for use of conservatively large versus small reactivity coefficient values are treated on an event-by-event basis. In some cases, conservative combinations of parameters are used to bound the effects of core life, although these combinations may not represent possible realistic situations.

15.0.5 ROD CLUSTER CONTROL ASSEMBLY INSERTION CHARACTERISTICS The negative reactivity insertion following a reactor trip is a function of the position versus time of the RCCA and the variation in rod worth as a function of rod position. With respect to accident analyses, the critical parameter is the time of insertion up to the dashpot entry, or approximately 85 percent of the rod cluster travel.

The RCCA position versus time assumed in accident analyses is shown in Figure 15.0-3.

The rod cluster control assembly insertion time to dashpot entry is taken as 2.7 seconds.

This time is bounding for Standard, OFA, V5 and V+ fuel. Drop time testing requirements are specified in the Technical Specifications.

Figure 15.0-4 shows the fraction of total negative reactivity insertion versus normalized rod position for a core where the axial distribution is skewed to the lower region of the core. An axial distribution which is skewed to the lower region of the core can arise from an unbalanced xenon distribution. This curve is used to compute the negative reactivity 15.0-9 Rev. OL-22 11/16

CALLAWAY - SP insertion versus time following a reactor trip, which is input to all point kinetics core models used in transient analyses.

There is inherent conservatism in the use of Figure 15.0-4 in that it is based on a skewed flux distribution which would exist relatively infrequently. For cases other than those associated with unbalanced xenon distributions, significant negative reactivity would have been inserted due to the more favorable axial distribution existing prior to trip.

The normalized RCCA negative reactivity insertion versus time is shown in Figure 15.0-5. The curve shown in this figure was obtained from Figures 15.0-3 and 15.0-4. A total negative reactivity insertion following a trip of 4 percent K/K is assumed in the transient analyses, except where specifically noted otherwise. This assumption is conservative with respect to the calculated trip reactivity worth available, as shown in Table 4.3-3A. For Figures 15.0-3 and 15.0-4, the RCCA drop time is normalized to 2.7 seconds.

The normalized RCCA negative reactivity insertion versus time curve for an axial power distribution skewed to the bottom (Figure 15.0-5) is used in those transient analyses for which a point kinetics core model is used. Where special analyses require use of three dimensional or axial one dimensional core models, the negative reactivity insertion resulting from the reactor trip is calculated directly by the reactor kinetics code and is not separable from the other reactivity feedback effects. In this case, the RCCA position versus time of Figure 15.0-3 is used as code input.

15.0.6 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES A reactor trip signal acts to open two trip breakers connected in series feeding power to the control rod drive mechanisms. The loss of power to the mechanism coils causes the mechanisms to release the RCCAs, which then fall by gravity into the core. There are various instrumentation delays associated with each trip function, including delays in signal actuation, in opening the trip breakers, and in the release of the rods by the mechanisms. The total delay to trip is defined as the time delay from the time that trip conditions are reached to the time the rods are free and begin to fall. Safety analysis limits (SALs) assumed in accident analyses and the time delay assumed for each trip function are given in Table 15.0-4.

Accident analyses which assume the steam generator (S/G) Low-Low Water Level trip signal initiates protection functions may be affected by the Environmental Allowance Modifier (EAM) (References 13 and 14) system, which was developed to reduce the incidence of unnecessary feedwater-related reactor trips. The EAM system permits plant operation with a relatively low setpoint for the S/G Low-Low Water Level trip, which does not include the full environmental error allowance. The EAM will automatically enable a higher low-low level trip setpoint, which includes the full environmental error allowance, whenever an adverse containment environment is indicated by a rise in containment pressure.

15.0-10 Rev. OL-22 11/16

CALLAWAY - SP Reference is made in Table 15.0-4 to the overtemperature and overpower T trips shown in Figure 15.0-1. This figure illustrates the allowable reactor coolant loop average temperature and T for minimum measured flow and the NSSS rated thermal power distribution as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are presented on this diagram. The protection lines are drawn to include all adverse instrumentation and setpoint errors so that under nominal conditions trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by any given DNBR can be represented as a line. The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit values for RTDP accidents that rely on the overtemperature and overpower trips for protection. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit values. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressurizer pressure (fixed setpoint); low pressurizer pressure (fixed setpoint); overpower and overtemperature T (variable setpoints).

The limit values, which were used as the DNBR limits for all accidents analyzed with the RTDP (see Table 15.0-2), are conservative compared to the actual design DNBR values required to meet the DNB design basis.

The difference between the safety analysis limit assumed for the analysis and the nominal trip setpoint represents an allowance for instrumentation channel error. Nominal trip setpoints are specified in the Technical Specifications. During plant startup tests it is demonstrated that actual instrument time delays are equal to or less than the assumed values. Additionally, protection system channels are calibrated and instrument response times determined periodically in accordance with the Technical Specifications.

15.0.7 INSTRUMENTATION DRIFT AND CALORIMETRIC ERRORS - POWER RANGE NEUTRON FLUX The nominal power range neutron flux channel overpower trip setpoint is 109% of rated thermal power. The maximum overpower trip setpoint, considering calorimetric errors, errors due to other process measurement factors, and instrumentation errors (including instrumentation drift), is less than 118% of rated thermal power, which is the value used in the safety analysis (see Table 15.0-4).

The calorimetric error is the error assumed in the determination of core thermal power, as obtained from secondary plant measurements. The total ion chamber current (sum of the top and bottom sections) is calibrated (set equal) to this measured power on a periodic basis.

15.0-11 Rev. OL-22 11/16

CALLAWAY - SP The secondary power is obtained from the measurement of steam or feedwater flow, feedwater inlet temperature to the steam generators, and steam pressure. High accuracy instrumentation is provided for use during these measurements. Accuracy tolerances meet or exceed requirements established by the safety analysis.

15.0.8 PLANT SYSTEMS AND COMPONENTS AVAILABLE FOR MITIGATION OF ACCIDENT EFFECTS The plant is designed to afford protection against the possible effects of natural phenomena, postulated environmental conditions, and dynamic effects of the postulated accidents. In addition, the design incorporates features which minimize the probability and effects of fires and explosions. The Operating Quality Assurance Manual discusses the quality assurance program which has been implemented to assure that the NSSS will satisfactorily perform its assigned safety functions. The incorporation of these features in the plant, coupled with the reliability of the design, ensures that the normally operating systems and components listed in Table 15.0-6 will be available for mitigation of the events discussed in Chapter 15.0. In determining which systems are necessary to mitigate the effects of these postulated events, the classification system of ANSI-N18.2-1973 is utilized. The design of safety-related systems (including protection systems) is consistent with IEEE Standard 379-1972 and Regulatory Guide 1.53, in the application of the single failure criterion.

In the analysis of the Chapter 15.0 events, control system action is considered only if that action results in more severe accident results. No credit is taken for control system operation if that operation mitigates the results of an accident. For some accidents, the analysis is performed both with and without control system operation to determine the worst case. The pressurizer heaters are generally assumed not to be energized for the analysis of the Chapter 15 events. Operation of the pressurizer heaters as a result of normal control action or a single failure will be less conservative or have negligible effects for most analyses. Therefore, unless it is shown that such a control action results in more limiting results or more severe consequences, the control action of the pressurizer heaters is not modeled for the analyses performed in Chapter 15. Any exceptions are noted in the text describing the individual analysis assumptions.

15.0.9 FISSION PRODUCT INVENTORIES The calculation of the core fission product inventory employs the ORIGEN 2 computer code modelling a three region enveloping cycle core with a core power level of 3636 MWt (3565 MWt plus 2% postulated calorimetric error). Of the 96 assemblies in core Region 1, 32 have operated at a specific power of 50.7 MW/MTU for 474 days and 64 have operated at a specific power of 57.0 MW/MTU for 474 days. Of the 88 assemblies in core Region 2, 24 have operated at a specific power of 48.5 MW/MTU for 474 days and at 44.3 MW/MTU for 474 days and 64 have operated at a specific power of 52.7 MW/MTU for 474 days and at 33.8 MW/MTU for 474 days. The 9 assemblies in core Region 3 have operated at a specific power of 50.6 MW/MTU for 474 days, at 38.0 MW/

MTU for 474 days, and at 21.1 MW/MTU for 474 days. The average burnups in Regions 15.0-12 Rev. OL-22 11/16

CALLAWAY - SP 1, 2, and 3 at the end of a cycle (MWD/MTU) are 26,000, 42,000, and 52,000, respectively. The isotopic yields utilize data for fissioning of U-235, U-238, and Pu-239 and account for the depletion of U-235. Radiological consequences are evaluated with source terms based on the 3636 MWt core rating (Table 15A-3), Callaway-specific meteorology based on three years of combined meteorological data (Table 15A-2), and appropriate dose conversion factors (Table 15A-4).

15.0.10 RESIDUAL DECAY HEAT 15.0.10.1 Total Residual Heat Residual heat in a subcritical core is calculated for the LOCA per the requirements of Appendix K of 10 CFR 50.46, as described in References 11 and 12. These requirements include assuming infinite irradiation time before the core goes subcritical to determine fission product decay energy. For all other accidents, the same models are used, except that fission product decay energy is based on core average exposure at the end of the equilibrium cycle.

15.0.10.2 Distribution of Decay Heat Following Loss-of-Coolant Accident During a LOCA, the core is rapidly shut down by void formation or RCCA insertion, or both, and a large fraction of the heat generation to be considered comes from fission product decay gamma rays. This heat is not distributed in the same manner as steady state fission power. Local peaking effects which are important for the neutron dependent part of the heat generation do not apply to the gamma ray contribution. The steady state factor of 97.4 percent, which represents the fraction of heat generated within the clad and pellet, drops to 95 percent for the hot rod in a LOCA.

For example, consider the transient resulting from the postulated double ended break of the largest reactor coolant system pipe; 1/2 second after the rupture about 30 percent of the heat generated in the fuel rods is from gamma ray absorption. The gamma power shape is less peaked than the steady state fission power shape, reducing the energy deposited in the hot rod at the expense of adjacent colder rods. A conservative estimate of this effect is a reduction of 10 percent of the gamma ray contribution or 3 percent of the total. Since the water density is considerably reduced at this time, an average of 98 percent of the available heat is deposited in the fuel rods, the remaining 2 percent being absorbed by water, thimbles, sleeves, and grids. The net effect is a factor of 0.95, rather than 0.974, to be applied to the heat production in the hot rod.

15.0.11 COMPUTER CODES UTILIZED Summaries of some of the principal computer codes used in transient analyses are given below. The codes used in the analyses of each transient have been listed in Table 15.0-2.

15.0-13 Rev. OL-22 11/16

CALLAWAY - SP 15.0.11.1 FACTRAN FACTRAN calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod and the transient heat flux at the surface of the clad, using as input the nuclear power and the time-dependent coolant parameters (pressure, flow, temperature, and density). The code uses a fuel model which exhibits the following features simultaneously:

a. A sufficiently large number of radial space increments to handle fast transients such as rod ejection accidents.

b. Material properties which are functions of temperature and a sophisticated fuel-to-clad gap heat transfer calculation.

c. The necessary calculations to handle post-DNB transients: film boiling heat transfer correlations, Zircaloy-water reaction, and partial melting of the materials.

FACTRAN is further discussed in Reference 1.

15.0.11.2 LOFTRAN The LOFTRAN program is used for studies of transient response of a PWR system to specified perturbations in process parameters. LOFTRAN simulates a multiloop system by a model containing reactor vessel, hot and cold leg piping, steam generator (tube and shell sides), and the pressurizer. The pressurizer heaters, spray, relief, and safety valves are also considered in the program. Point model neutron kinetics and reactivity effects of the moderator, fuel, boron, and rods are included. The secondary side of the steam generator utilizes a homogeneous, saturated mixture for the thermal transients and a water level correlation for indication and control. The reactor protection system is simulated to include reactor trips on high neutron flux, overtemperature T, overpower T, high and low pressure, low flow, and high pressurizer level. Control systems are also simulated, including rod control, steam dump, feedwater control, and pressurizer pressure control. The emergency core cooling system, including the accumulators, is also modeled.

LOFTRAN is a versatile program, which is suited to both accident evaluation and control studies as well as parameter sizing.

LOFTRAN also has the capability of calculating the transient value of DNBR, based on the input from the core limits illustrated on Figure 15.0-1. The core limits represent the minimum values of DNBR, as calculated for typical or thimble cells.

LOFTRAN is further discussed in Reference 2.

15.0-14 Rev. OL-22 11/16

CALLAWAY - SP 15.0.11.3 LEOPARD The LEOPARD computer program determines fast and thermal neutron spectra, using only multigroup neutron cross sections, basic geometry, and temperature data. The code optionally computes fuel depletion effects for a dimensionless reactor and recomputes the spectra before each discrete burnup step.

LEOPARD is further described in Reference 3.

15.0.11.4 TURTLE TURTLE is a two-group, two-dimensional neutron diffusion code featuring a direct treatment of the nonlinear effects of xenon, enthalpy, and Doppler feedback. Fuel depletion is allowed.

TURTLE was written for the study of azimuthal xenon oscillations, but the code is useful for general analysis. The input is simple, fuel management is handled directly, and a boron criticality search is allowed.

TURTLE is further described in Reference 4.

15.0.11.5 TWINKLE The TWINKLE program is a multidimensional spatial neutron kinetics code, which was patterned after steady state codes presently used for reactor core design. The code uses an implicit finite-difference method to solve the two-group transient neutron diffusion equations in one, two, and three dimensions. The code uses six delayed neutron groups and contains a detailed multiregion fuel-clad-coolant heat transfer model for calculating pointwise Doppler and moderator feedback effects. The code handles up to 2,000 spatial points, and performs its own steady state initialization. Aside from basic cross section data and thermal-hydraulic parameters, the code accepts as input basic driving functions such as inlet temperature, pressure, flow, boron concentration, control rod motion, and others. Various edits are provided, e.g., channel-wise power, axial offset, enthalpy, volumetric surge, point-wise power, and fuel temperatures.

The TWINKLE code is used to predict the kinetic behavior of a reactor for transients which cause a major perturbation in the spatial neutron flux distribution.

TWINKLE is further described in Reference 5.

15.0.11.6 THINC The THINC code is described in various subsections of Section 4.4. DNB transient calculations previously performed with THINC have been transitioned over to the VIPRE code, with the exception of the generic DNB analysis performed for the RCCA Ejection event. These calculations are described in Section 4.4.4.5..

15.0-15 Rev. OL-22 11/16

CALLAWAY - SP 15.0.11.7 LOCA COMPUTER CODES The computer codes used to analyze the large and small break LOCA are described in Section 15.6.5.

15.0.11.8 RETRAN The RETRAN-02 (Mod 3) code is a one-dimensional, best-estimate, thermal-hydraulic, transient analysis computer code developed from RELAP-4/003 (Reference 16). The NRC issued a Safety Evaluation Report (Reference 17) which concluded that RETRAN-02 is an "acceptable computer program for use in licensing applications for calculating the transients described in Chapter 15 of NUREG-0800, and other transients and events as appropriate and necessary for nuclear power plant operation."

RETRAN is used for studies of transient response of a pressurized water reactor (PWR) system to specified perturbations in process parameters. This code simulates a multi-loop system by a lumped parameter model containing the reactor vessel, hot and cold leg piping, reactor coolant pumps, steam generators (tube and shell sides), steam lines, and the pressurizer. The pressurizer heaters, spray, relief valves, and safety valves may also be modeled. RETRAN includes a point neutron kinetics model and reactivity effects of the moderator, fuel, boron, and control rods. The secondary side of the steam generator uses a detailed nodalization for the thermal transients. The reactor protection system (RPS) simulated in the code includes reactor trips on high neutron flux, high neutron flux rate, over temperature and over power T (OTT/OPT), low reactor coolant system (RCS) flow, high and low pressurizer pressure, high pressurizer level, and low steam generator water level. Control systems are also simulated including rod control and pressurizer pressure control. Parts of the safety injection system, including the accumulators, may also be modeled. RETRAN approximates the transient value of departure from the nucleate boiling ratio (DNBR) based on input from the core thermal safety limits.

RETRAN-02 is a variable nodalization code and, therefore, requires a user to input a control volume/flow path network/heat slab model of both primary and secondary system elements similar in type to those utilized in the RELAP series of codes. The control volume/flow path equilibrium thermal hydraulics have three slip options: homogeneous; drift flux; and a four equation set. Point kinetics or one-dimensional space-time kinetics can be used for the neutronics.

Polynomial fits are used for the thermodynamic properties of water. Air is approximated by an ideal gas. There is an extensive list of forced and natural convection heat transfer correlations covering the entire boiling curve plus a number of condensing heat transfer correlations. A modified Bennett flow regime map can be used to select friction factors.

Critical flow options available use the Moody, isoenthalpic and the extended Henry-Fauske models. Special purpose models include a subcooled void fit, bubble rise, trips and a wide ranging control system which gives the user flexibility to program user-specific modifications, transport delay, auxiliary DNBR, enthalpy transport, and 15.0-16 Rev. OL-22 11/16

CALLAWAY - SP local condition heat transfer. Component models include a two region nonequilibrium pressurizer, centrifugal and jet pumps, valves, non-conducting heat exchangers, steam separators, and turbine. An automatic steady state initialization procedure is also available.

The RETRAN code is discussed in Reference 18.

15.0.11.9 VIPRE The VIPRE computer program performs thermal-hydraulic calculations. The code calculates coolant density, mass velocity, enthalpy, void fractions, static pressure and DNBR distributions along flow channels within a reactor core.

The VIPRE code is described in Reference 19.

15.0.11.10 ANC ANC is an advanced nodal code capable of two-dimensional and three-dimensional neutronics calculations. ANC is the reference model for certain safety analysis calculations, power distributions, peaking factors, critical boron concentrations, control rod worths, reactivity coefficients, etc. In addition, three-dimensional ANC validates one-dimensional and two-dimensional results and provides information about radial (x-y) peaking factors as a function of axial position. It can calculate discrete pin powers from nodal information as well.

The ANC code is described in Reference 20.

15.0.12 LIMITING SINGLE FAILURES The most limiting single failure as described in Section 3.1 of safety-related equipment, where one exists, is identified in each analysis description, and the consequences of this failure are described therein. In some instances, because of redundancy in protection equipment, no single failure which could adversely affect the consequences of the transient has been identified. The failure assumed in each analysis is listed in Table 15.0-7.

15.0.13 OPERATOR ACTIONS For most of the events analyzed in Chapter 15.0 the plant will be in a safe and stable hot standby condition following the automatic actuation of reactor trip. This condition will, in fact, be similar to plant conditions following any normal, orderly shutdown of the reactor.

At this point, the actions taken by the operator would be no different than normal operating procedures. The exact actions taken, and the time at which these actions would occur, will depend on what systems are available (e.g., turbine bypass system, main feedwater system, etc.) and the plans for further plant operation. As a minimum, to maintain the hot stabilized condition, decay heat must be removed via the steam 15.0-17 Rev. OL-22 11/16

CALLAWAY - SP generators. The main feedwater system and the steam dump or atmospheric relief system could be used for this purpose. Alternatively, the auxiliary feedwater system and the steam generator safety valves may be used, both of which are safety grade systems.

Although the auxiliary feedwater system may be started manually, it will be automatically actuated, if needed, by one of the signals shown on Figure 7.3-1 (sheet 2), such as low-low steam generator water level. Also, if the hot standby condition is maintained for an extended period of time (greater than approximately 18 hours2.083333e-4 days <br />0.005 hours <br />2.97619e-5 weeks <br />6.849e-6 months <br />), operator action may be required to add boric acid via the CVCS to compensate for xenon decay and maintain shutdown margin.

Where a stabilized condition is reached automatically following a reactor trip and only actions typical of normal operation are required, this has been stated in the text of the Chapter 15.0 events. For several events involving breaks in the reactor coolant system or secondary system piping, additional requirements for operator action are identified.

For the inadvertent ECCS actuation at power event and loss of non-emergency ac power to station auxiliaries event with continued CVCS operation, timely operator actions are completed from the main control room to terminate NCP flow, open PORV block valves, and assure the availability of the PORVs for automatic pressure relief, as appropriate.

Ensuring the availability of both PORVs on demand will preclude water relief through the pressurizer safety valves and accommodate an assumed single failure. The required operator action times are discussed in Section 15.5.1 and Table 15.5-1 for inadvertent ECCS actuation and Section 15.2.6.2 for loss of ac power with continued CVCS operation.

Following the postulated MSLB, a steamline isolation signal will be generated almost immediately, causing the main steam isolation valves to close within a few seconds. If the break is downstream of the isolation valves, all of which subsequently close, the break will be isolated. If the break is upstream of the isolation valves, or if one valve fails to close, the break will be isolated to three steam generators while the affected steam generator will continue to blow down. Only the case in which one steam generator continues to blow down is discussed here, since the break followed by isolation of all steam generators will terminate the transient.

Steam pressure from the steam generators is relieved by the turbine bypass system, secondary system atmospheric safety valves, or secondary system atmospheric relief valves (also referred to as the atmospheric steam dump valves). The operator is instructed to terminate auxiliary feedwater flow to the affected steam generator, as soon as he determines which steam generator is affected. As soon as an indicated water level returns to the pressurizer and pressure is no longer decreasing, the operator is instructed to terminate the ECCS charging pump flow to limit system repressurization.

For long-term cooling following a steamline break, the operator is instructed to use the intact steam generators for the purpose of removing decay heat and plant stored energy.

This is done by feeding the steam generators with auxiliary feedwater to maintain an indicated water level in the steam generator narrow-range span.

15.0-18 Rev. OL-22 11/16

CALLAWAY - SP A safety injection signal (generated a few seconds after the break on low steamline pressure) will cause main feedwater isolation to occur. The only source of water available to the affected steam generator is then the auxiliary feedwater system.

Following steamline isolation, steam pressure in the steamline with the affected steam generator will continue to fall rapidly, while the pressure stabilizes in the remaining three steamlines. The indication of the different steam pressures will be available to the operator, within a few seconds of steam-line isolation. This will provide the information necessary to identify the affected steam generator so that auxiliary feedwater to it can be isolated. Manual controls are provided in the control room for start and stop of the auxiliary feedwater pumps and for the control valves associated with the auxiliary feedwater system. The means for detecting the affected steam generator and isolating auxiliary feedwater to it requires only the use of safety grade equipment available following the break. The removal of decay heat in the long term (following the initial cooldown), using the remaining steam generators, requires only the auxiliary feedwater system as a water source and the secondary system safety valves to relieve steam.

The operator has available, in the control room, an indication of pressurizer water level from the reactor protection system instrumentation. Indicated water level returns to the pressurizer in approximately 5 to 7 minutes following the steamline break. To maintain the indicated water level, the operator can start and stop the ECCS charging pumps as necessary. The pressurizer level instrumentation and manual controls for the operation of the ECCS centrifugal charging pumps meet the required standards for safety systems.

As indicated, the information for terminating auxiliary feedwater to the affected steam generator is available to the operator within 1 minute of the break, while the information required for stopping the ECCS charging pumps becomes available within 5 to 7 minutes following the break. The requirement to terminate auxiliary feedwater flow to the affected steam generator can be met by switch actions by the operators, i.e., closing auxiliary feed discharge valve. Thus, the required actions to limit the cooldown can be recognized, planned, and performed within 10 minutes. After it is determined that the pressurizer level is restored and SI flow is no longer required, normal charging flow is established and the SI flow is terminated in accordance with the specific actions in the Westinghouse Owners Group Emergency Response Guidelines (ERG). However, note that these actions are not modeled or credited in the FSAR analysis of this event. For decay heat removal and plant cooldown, the operator has a considerably longer time period in which to respond because of the large initial cooldown associated with a steamline break transient.

For a feedwater line break, the required operator actions and times are discussed in Section 15.2.8 and Table 15.2-1. Auxiliary feedwater flow is initiated automatically, as is safety injection. As in the steamline break, the operator terminates auxiliary feedwater flow to the affected steam generator as soon as he determines which generator is affected, using safety grade equipment. Where possible, the operator should also increase auxiliary feedwater flow to the intact steam generators in order to shorten the time until primary temperatures begin to decrease. The analysis presented in Section 15.2.8 does not assume these actions occur.

15.0-19 Rev. OL-22 11/16

CALLAWAY - SP As soon as primary temperature begins to decrease, the operator can use the steam dump system or the steam generator atmospheric relief valves to begin a controlled cooldown. In addition, if the U-tubes of the intact steam generators are covered with water as indicated by post-accident monitoring system (PAMS) steam generator water level instrumentation (see Section 7.5), the operator can modulate the ECCS centrifugal charging pumps, so that the primary pressure decreases while ensuring that voiding does not occur within the RCS. The primary pressure-temperature relationship can be monitored by the operator via the PAMS wide-range RCS pressure and temperature instruments.

Using the above-mentioned PAMS indications, the operator can maintain the plant in a hot shutdown condition for an extended period of time, or can proceed to a cold shutdown condition as desired.

The safety-related indicators for steamline pressure and pressurizer water level noted above are further discussed in Section 7.5.

Tables 15.0-8 and 15.0-9 list the short term operator actions required to bring the plant to a stable condition for the LOCA and steam generator tube rupture (SGTR). Further information (including alarms which alert the operator) on operator action for these two accidents are given in Section 6.3.2.8 for the LOCA and Section 15.6.3 for the SGTR.

Process information available to the operator in the control room following either of these accidents (LOCA or SGTR) is given in Section 7.5.

Instrumentation and controls provided to allow the operator to complete required manual actions are classified as Class 1E. Electrical components are also classified as Class 1E. Mechanical components are classified as Safety Class 1, 2, or 3.

Safety systems required for accident mitigation are designed to function after the occurrence of the worst postulated single failure. There are no adverse impacts as a result of these actions.

15.0.14 REFERENCES

1. Hargrove, H. G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO² Fuel Rod," WCAP-7908, June 1972.

2. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A, April 1984.

3. Barry, R. F., "LEOPARD - A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963.

15.0-20 Rev. OL-22 11/16

CALLAWAY - SP

4. Barry, R. F. and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code,"

WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary), February 1975.

5. Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-P-A (Proprietary) and WCAP-8028-A (Non-Proprietary), January 1975.

6. Friedland, A. J. and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989

7. WCAP-16140, Callaway Replacement Steam Generators Program NSSS Engineering Report, July 2004

8. Delete

9. Davidson, S. L., et al., Reference Core Report, 17x17 Optimized Fuel Asseembly, WCAP-9500, May 1982

10. Davidson, S. L. and Kramer, W. R.; (ed.) "Reference Core Report VANTAGE 5 Fuel Assembly", WCAP-10444-P-A, Appendix A.2.0, September 1985.

11. Bordelon, F. M., et al., "SATAN-VI Program: Comprehensive Space-Time Dependent Analysis of Loss-of-Coolant," WCAP-8302 (Proprietary) and WCAP-8306 (Non-Proprietary), June 1974.

12. Bordelon, F. M., et al., "LOCTA-IV Program: Loss-of-Coolant Transient Analysis,"

WCAP-8301 (Proprietary) and WCAP-8305 (Non-Proprietary), June l974.

13. Catullo, W. J., Jr., et al., "Modifications of the Steam Generator Low-Low Level Trip Setpoint to Reduce Feedwater-Related Trips," WCAP-11342-P-A, Rev. 1, April 1988.

14. Miranda, S., et al., "Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater-Related Trips," WCAP-11325-P-A, Rev. 1, Feburary 1988.

15. Leach, C. E., Gongaware, B. L., Tuley, C. R., Erin, L. E., Miranda, S.,

Implementation of the Steam Generator Low-Low Level Reactor Trip Time Delay and Environmental Allowance Modifier in the Callaway Plant, WCAP-11883 (Proprietary) and WCAP-11884 (Non-Proprietary), August 1988 submitted via ULNRC-1822 dated 8-30-88 and approved via Amendment 43 to Facility Operating License NPF-30 dated 4-14-89.

The folowing exceptions are taken to the surveillance test methodology defined in Section 3.6.2 of WCAP 11883:

15.0-21 Rev. OL-22 11/16

CALLAWAY - SP

1) Each Level channel is tested one-at-a-time during the level channel testing with zero time delay as describd in the WCAP.

2) The TTD function and timers discussed in Reference 15 are no longer applicable in Callaway.

3) Section 3.6.2.2 is titled OUTAGE TESTING. The PROM logic modules and EAM testing described under this section may be performed on-line and not restricted to performance during outages.

16. RETRAN-02 -- A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems," Electric Power Research Institute, EPRI NP-1850-CCM-A, Rev. 2, 1984.

17. Letter from Cecil O. Thomas (NRC) to Dr. Thomas W. Schnatz, Utility Group for Regulatory Applications (UGRA), "Acceptance for Referencing of Licensing Topical Reports EPRI CCM-5, 'RETRAN - A Program for One Dimensional Transient Thermal Hydraulic Analysis of Complex Fluid Flow Systems,' and EPRI NP-1850-CCM, 'RETRAN A Program for Transient Thermal-Hydraulic Analysis of Complex Fluid Flow Systems,'" dated September 2, 1984.

18. D.S. Huegel, et. al., WCAP-14882-P-A (Proprietary)/WCAP-15234-A (Non-proprietary), RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, April 1999.

19. Y.X. Sung, et. al., WCAP-14565-P-A (Proprietary)/WCAP-15306-A (Non-proprietary), VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, October 1999.

20. Y.S. Liu, et. al., WCAP-10965-P-A, ANC: A Westinghouse Advanced Nodal Compter Code, September 1986.

21. Westinghouse Letter SCP-07-17, Callaway Plant Engineering Report and Guidelines in Support of End of Cycle 15 Tavg Coastdown, Revision 1, dated February 9, 2007.

15.0-22 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-1 NUCLEAR STEAM SUPPLY SYSTEM POWER RATINGS NSSS rated thermal power, MWt 3,579 Thermal power generated by the reactor coolant pumps, MWt Nominal 14 Maximum 20 Rated reactor core thermal power output, MWt 3,565 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-2

SUMMARY

OF INITIAL CONDITIONS AND COMPUTER CODES REACTIVITY COEFFICIENTS COMPUTER MODERATOR MODERATOR REVISED INITIAL CORE CODES DENSITY TEMPERATURE DNB THERMAL DESIGN THERMAL EVENT USED (k/gm/cc) (PCM/°F) DOPPLER CORRELATION PROCEDURE POWER (% RTP) 15.1 Increase in heat removal by the secondary system Decrease in feedwater RETRAN 0.43 NA Upper curve of WRB-2 Yes 100 temperature Figure 15.0-2 Increase in feedwater flow RETRAN 0.43 NA Upper curve of WRB-2 Yes 100 (HFP Cases) Figure 15.0-2 Increase in feedwater flow RETRAN, VIPRE Function of NA See Figure 15.1-14 WLOP No 0 (HZP Case) moderator density Excessive increase in See Section 15.1.3 for all assumptions secondary steam flow Inadvertent opening of S/G See Section 15.1.4 for all assumptions relief or safety valve Steam system piping failure RETRAN Function of NA See Figure 15.1-14 WLOP No 0 ANC moderator density (Subcritical)

VIPRE 15.2 Decrease in heat removal by the secondary system Loss of external electrical load RETRAN NA 0 Upper curve of WRB-2/NA Yes/No 100/102 and/or turbine trip Figure 15.0-2 DNB Case/ Pressure Case Loss of non-emergency ac to RETRAN NA 0 Lower curve of NA No 102 station auxiliaries Figure 15.0-2 Loss of normal feedwater flow RETRAN NA 0 Lower curve of NA NA 102 Figure 15.0-2 Feedwater system pipe break RETRAN NA 0 Lower curve of NA NA 102 Figure 15.0-2 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-2 (Sheet 2)

REACTOR REACTOR EQUIVALENT COOLANT VESSEL VESSEL PRESSURIZER S/G TUBE FULL POWER PUMP HEAT COOLANT T-AVG PRESSURIZER WATER FEEDWATER PLUGGING STEADY EVENT (MWt) FLOW (gpm) (°F) PRESSURE (PSIA) LEVEL % span TEMP (°F) LEVEL STATE FH FQ 15.1 Increase in heat removal by the secondary system Decrease in feedwater 14 382,630 588.4 2250 60 446 0% NA NA temperature Increase in feedwater flow 14 382,630 588.4 2250 60 446 0% NA NA (HFP Cases)

Increase in feedwater flow 14 374,400 557 2250 25 100 0% NA NA (HZP Case)

Excessive increase in See Section 15.1.3 for all assumptions secondary steam flow Inadvertent opening of S/G See Section 15.1.4 for all assumptions relief or safety valve Steam system piping failure 14 374,400 557 2250 25 100 0% NA NA 15.2 Decrease in heat removal by the secondary system Loss of external electrical load and/or turbine trip DNB Case 14 382,630 588.4 2250 65 390 5% NA NA Pressure Case 14 374,400 585.4 2190 65 390 5% NA NA Loss of non-emergency ac to 20 374,400 567.2 2190 43 446 0% NA NA station auxiliaries Loss of normal feedwater flow 20 374,400 567.2 2190 43 446 0% NA NA Feedwater system pipe break 20 374,400 592.7 2190 65 446 5% NA NA Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-2 (Sheet 3)

REACTIVITY COEFFICIENTS REVISED MODERATOR MODERATOR THERMAL INITIAL CORE COMPUTER DENSITY TEMPERATURE DNB DESIGN THERMAL EVENT CODES USED (k/gm/cc) (PCM/°F) DOPPLER CORRELATION PROCEDURE POWER (%RTP) 15.3 Decrease in RCS flow rate Partial/Complete loss of RETRAN NA 0 Lower curve of WRB-2 YES 100 forced flow VIPRE Figure 15.0-2 Reactor coolant pump locked RETRAN NA 0 Lower curve of WRB-2 YES 100 rotor (DNB evaluation) VIPRE Figure 15.0-2 Reactor coolant pump locked RETRAN NA 0 Lower Curve of NA NO 102 rotor (peak pressure) VIPRE Figure 15.0-2 15.4 Reactivity and power distribution anomalies Uncontrolled RCCA bank TWINKLE See Section 15.4.1.2 See Section See Section WRB-2, ABB-NV NO 0 withdrawal from subcritical FACTRAN VIPRE 15.4.1.2 15.4.1.2 Uncontrolled RCCA bank RETRAN NA NA/0 Upper & lower WRB-2 YES 100 withdrawal at power NA/+5 curves of Figure 60 NA/+5 15.0-2 10 RCCA misoperation (dropped LOFTRAN NA NA NA WRB-2 YES 100 rod) VIPRE Startup of an inactive loop at See Section 15.4.4 for all assumptions an incorrect temperature RCCA ejection TWINKLE See Section See Section See Section NA NA 102 FACTRAN THINC 15.4.8.2 15.4.8.2 15.4.8.2 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-2 (Sheet 4)

REACTOR REACTOR PRESSURIZER EQUIVALENT FULL COOLANT VESSEL PRESSURIZER WATER S/G TUBE POWER PUMP HEAT COOLANT VESSEL PRESSURE LEVEL FEEDWATER PLUGGING STEADY EVENT (MWt) FLOW (gpm) T-AVG (°F) (PSIA) (1% span) TEMP (°F) LEVEL STATE FH FQ 15.3 Decrease in RCS flow rate Partial/Complete loss 14 382,630 588.4 2250 60 446 5% 1.59 NA of forced flow Reactor coolant pump 14 382,630 588.4 2250 60 446 5% NA 2.6 locked rotor (DNB evaluation)

Reactor coolant pump 14 374,400 592.7 2280 60 446 5% NA 2.6 locked rotor (peak pressure) 15.4 Reactivity and power distribution anomalies Uncontrolled RCCA NA 172,224 557 2190 NA NA 15% NA NA bank withdrawal from subcritical Uncontrolled RCCA 14 382,630 588.4/ 2250 60/ 390/ 5% NA NA bank withdrawal at 575.84/ 46/ 360/

power 560.14 28.5 280 RCCA misoperation NA 382.630 588.4 2250 NA NA 5% 1.59 NA (dropped rod)

Startup of an inactive See Section 15.4.4 for all assumptions.

loop at an incorrect temperature RCCA ejection NA 172,224 557/ 2190 NA NA 15% NA 2.6 374,400 595.9 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-2 (Sheet 5)

REACTIVITY COEFFICIENTS REVISED MODERATOR MODERATOR THERMAL INITIAL CORE COMPUTER DENSITY TEMPERATURE DESIGN THERMAL EVENT CODES USED (k/gm/cc) (PCM/°F) DOPPLER DNB CORRELATION PROCEDURE POWER (% RTP) 15.5 Increase in coolant inventory Inadvertent ECCS operation RETRAN NA 0 Upper curve of WRB-2 Yes 100 at power (DNB Case) Figure 15.0-2 (Pzr. Filling Case) RETRAN 0.43 NA Lower curve of NA No 102 Figure 15.0-2 CVCS malfunction See Section 15.5.2 for all assumptions 15.6 Decrease in coolant inventory Inadvertent RCS RETRAN NA 0 Upper curve of WRB-2 Yes 100 depressurization Figure 15.0-2 S/G tube rupture ASD failure RETRAN 0.0 NA Lower curve of NA NA 102 case Figure 15.0-2 S/G tube rupture overfill case RETRAN 0.0 NA Lower curve of NA NA 100 Figure 15.0-2 Loss of coolant accidents See Section Section 15.6.5 Section 15.6.5 Section 15.6.5 Section 15.6.5 Section 15.6.5 Section 15.6.5 15.6.5 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-2 (Sheet 6)

REACTOR REACTOR PRESSURIZER EQUIVALENT FULL COOLANT VESSEL PRESSURIZER WATER S/G TUBE POWER PUMP HEAT COOLANT VESSEL PRESSURE LEVEL FEEDWATER PLUGGING STEADY EVENT (MWt) FLOW (gpm) T-AVG (°F) (PSIA) (% span) TEMP (°F) LEVEL STATE FH FQ 15.5 Increase in coolant inventory Inadvertent ECCS 20 382,630 588.4 2250 65 446 5% NA NA operation at power (DNB Case)

(Pzr. Filling Case) 20 374,400 567.2 2190 43 446 5% NA NA CVCS malfunction See Section 15.5.2 for all asumptions 15.6 Decrease in coolant inventory Inadvertent RCS 14 382,630 588.4 2250 60 446 5% NA NA depressurization S/G tube rupture ASD faillure case 14 374,400 592.7 2280 60 446 0% NA NA Overall case 14 374,400 567.7 2280 38 390 5% NA NA Loss of coolant accidents See Section 15.6.5 for all asumptions

++++RETRAN Option 1 Film Boiling Correlation NOTES: 1. Deleted

2. 2250 psia used in offsite dose evaluation Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.0-3 NOMINAL VALUES OF PERTINENT PLANT PARAMETERS UTILIZED IN THE ACCIDENT ANALYSES Equivalent Steam Generator Tube Plugging Level (all loops) 0% 5%

NSSS Thermal Power (MWt) 3579 3579 3579 3579 HFP Vessel Average Temperature (°F) 588.4 570.7 588.4 570.7 Pressurizer Pressure (psia) 2250 2250 2250 2250 Total Reactor Coolant Flow Thermal Design Flow (gpm) 374,400 374,400 374,400 374,400 Minimum Measured Flow (gpm) 382,630 382,630 382,630 382,630 Total Reactor Coolant Flow Thermal Design Flow (106 lb/hr) 139.4 142.9 139.4 142.9 Minimum Measured Flow (106 lb/hr) 142.5 146.0 142.5 146.0 Assumed HFP Feedwater Temperature Maximum (°F) 446 446 446 446 Minimum (°F) 390 390 390 390 Steam Flow from NSSS (106 lb/hr)

At Maximum Feedwater Temperature 15.96 15.85 15.95 15.84 At Minimum Feedwater Temperature 14.78 14.69 14.78 14.68 Steam Pressure at SG Outlet (psia) 1022 872 1016 867 Maximum Steam Moisture Content (%) 0.1 0.1 0.1 0.1 Average Core Heat Flux (Btu/hr-ft2) 206090 206090 206090 206090 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-4 TRIP POINTS AND TIME DELAYS TO TRIP ASSUMED IN ACCIDENT ANALYSES Limiting Trip Trip Point Assumed Time Delays Function In Analyses (Seconds)

Power range high neutron 118% RTP 0.5(k) flux, high setting Power range high neutron 35% RTP 0.5(k) flux, low setting Power range neutron flux,

• 0.65(k) high positive rate Overtemperature T(a) Variable see Figure 15.0-1; **(k) k1= 1.355 Overpower T(a) Variable see Figure 15.0-1; **(k) k4= 1.1665(b)

High pressurizer pressure 2,420(c) psig 1.0(k)

Low pressurizer pressure, 1,845 psig 2.0(k) reactor trip High neutron flux, P-8*** 84% RTP 0.5 Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.0-4 (Sheet 2)

Limiting Trip Trip Point Assumed Time Delays Function In Analyses (Seconds)

Low reactor coolant flow (from 87% loop minimum measured 1.0(k) loop flow detectors) flow Undervoltage trip NA (d) 1.5(k)

High - high steam generator 100% of narrow 2.0 level [trip of the main feedwater range level span(e) pumps and closure of feedwater system valves, (isolation, control, and pump discharge valves) ]

Low-Low steam generator level 0% of narrow 2.0(k) range level span Underfrequency trip 57.0 Hz 0.6(k)

Containment pressure High-1 6.0 psig 2.0(k)

Containment pressure High-2 20.0 psig 2.0 Containment pressure High-3 30.0 psig 2.0 Low pressurizer pressure, SI 1700 psig 2.0(k)

Low steam line pressure, SI 458 psig 2.0(k)

(and reactor trip) and steam line isolation RWST low-low 1 level 32.6% span 40.0 Steam line pressure, high -100 psi with a time 2.0 negative rate constant t 50 sec.(f)

Turbine-driven AFW pump start (g) 60.0 on loss of offsite power AFW suction transfer from CST (h) 60.0 to ESW on low suction pressure Source range flux multiplication 2.14(i) (j)

Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.0-4 (Sheet 3)

• See Sections 15.4.2.1 and 15.4.8.

• • Due to dynamic compensation, the total time delay is dependent on the accident/

transient being analyzed. The accident analysis model explicitly accounts for the following:

1. A lag of 6 seconds for thermal lag effects, transport delays, and RTD/thermowell time response.

2. Dynamic Tavg/DT signal compensation (filter, lead-lag, and rate-lag compensa-tors) with the time constants specified in the core operating limits report (COLR).

3. A delay of 2 seconds for the channel electronics delay and the trip logic circuitry delay, plus the time for the reactor trip breakers to open and the time for the con-trol rod drive mechanism stationary grippers to disengage (gripper release time).

• • • The P-8 permissive is interlocked with reactor coolant flow such that low flow in any loop will cause a reactor trip when above P-8. The setpoint and delay time shown above correspond to historical analyses. Refer to Section 15.4.4 for additional in-formation (a) Cycle-specific evaluations confirm that applicable DNBR and fuel centerline tem-perature limits are not exceeded for power levels as high as 120% RTP.

(b) The value presented above for the K4 setpoint coefficient in the OPT reactor trip setpoint equation conservatively bounds the actual plant configuration. Specifical-ly, the value presented above as the safety analysis limit, in combination with a K5 value (see the COLR) of 0.0/°F for increasing T-avg and a K6 value (see the COLR) of 0.00153/°F, conservatively bound the OPT reactor trip setpoint equation as currently configured in the plant (K4 value of 1.165 in combination with a K5 value of 0.02/°F for increasing T-avg and a K6 value of 0.0015/°F).

(c) 2410 psig used in setpoint calculations; 2420 psig used in transient analyses. Mar-gin of 10 psi exists in the setpoint calculations.

(d) The analysis does not explicitly model the undervoltage setpoint. Instead, the undervoltage delay assumed in the complete loss of flow (CLOF) analysis includes an allowance for the time delay between the loss of voltage to the RCP bus and the time at which the loss of voltage is detected. Therefore, the definition of the reac-tor trip delay time for the CLOF event is unique in that the assumed delay begins when the event begins (loss of power to the RCP busses), and not when the RCP Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.0-4 (Sheet 4) bus undervoltage condition is detected.

(e) The high-high level signal would also trip the turbine; however, no direct credit is taken for that trip function in the accident analyses described in Section 15.1.2.

Additionally, the success of these analyses is not predicated on the operation of the main feedwater pumps or the pump discharge valves.

(f) The Mode 3 steamline break sensitivities described in Sections 6.2.1.4.1.1 and 15.1.5 assume the nominal high negative steamline pressure rate of -100 psi (no setpoint uncertainties are included). When these uncertainties are considered, the safety analysis limit may be as high as -139 psi. This does not change the conclu-sions of the study which demonstrates that adequate protection against a steam-line break event is provided by the RPS below P-11. Furthermore, plant-specific procedures require that the RCS be borated to Mode 5 conditions (or Mode 4, if more limiting at end of life) prior to blocking SI. This further reduces, if not elimi-nates altogether, the chance of reaching criticality due to the break.

(g) The safety analysis limit of 73.0 VAC at the 0-120 VAC potential transformer is not used in the SBLOCA analysis, which assumes the loss of offsite power occurs co-incident with the reactor trip signal.

(h) The safety analysis limit of 19.6 psia is not used in the analyses which credit AFW initiation, which assume the low suction pressure transfer occurs coincident with AFAS initiation.

(i) The BDMS safety analysis limit corresponds to a nominal flux multiplication value of 1.70 with an error term of 25.5%.

(j) The BDMS response time is discussed in Section 15.4.6 and is measured per Technical Specification Surveillance Requirement 3.3.9.5.

(k) See the Technical Specification Bases for SR 3.3.1.16. In addition to sensor, process, and logic time delays, the values listed include reactor trip breaker response time and gripper release time.

Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.0-5 DELETED Table 15.0-5 (Sheets 1 through 2) is Deleted.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.0-6 PLANT SYSTEMS AND EQUIPMENT AVAILABLE FOR TRANSIENT AND ACCIDENT CONDITIONS Incident Reactor Trip Functions ESF Actuation Functions Other Equipment/Alarms ESF Equipment 15.1 Increase in heat removal by the secondary system Feedwater system Power range high flux, SIS on low pressurizer pressure Feedwater ---

malfunctions that result in OTT, OPT (1), low- (1) or high-high steam generator isolation a decrease in feedwater low steam generator level-produced feedwater isolation valves temperature level, manual Feedwater system Power range high flux, High-high steam generator Feedwater ---

malfunctions that result in OTT, OPT, low-low steam level-produced feedwater isolation isolation an increase in feedwater generator level (1), manual (1), (2) valves flow Excessive increase in Power range high flux, --- --- ---

secondary steam flow (3) overtemperature T, overpower T, manual Inadvertent opening of a Low pressurizer pressure, manual, SIS on low pressurizer pressure or Feedwater Auxiliary feedwater steam generator relief or SIS, power range high flux, OTT, low compensated steam line isolation system, ECCS safety valve OPT pressure, steam line isolation valves, signal (SLIS) on low compensated steam line steam line pressure above P-11 or isolation high negative steam pressure rate valves below P-11, auxiliary feedwater actuation signal (AFAS) and feedwater isolation signal (FWIS) on SIS (1)

Steam system piping Low pressurizer pressure, manual, SIS on low compensated steam Feedwater isolation valves, Auxiliary feedwater system, failure SIS (1), power range high flux, line pressure (1), low pressurizer steam line isolation valves ECCS OTT, OPT pressure, or high-1 containment (See also Table 15.1-2) pressure; SLIS on low compensated steam line pressure above P-11 (1), high negative steam pressure rate below P-11, or high-2 containment pressure; AFAS and FWIS on SIS (1) 15.2 Decrease in heat removal by the secondary system Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-6 (Sheet 2)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment/Alarms ESF Equipment Loss of external load/ High pressurizer pressure (1), --- Pressurizer safety valves, steam ---

turbine trip overtemperature T (1), manual, generator safety valves steam generator low-low level, high pressurizer water level, turbine trip above P-9 (4)

Loss of nonemergency ac Steam generator low-low level (1), AFAS and FWIS on steam Steam generator safety valves Auxiliary feedwater system power to the station manual, low flow, turbine trip generator low-low level (1) auxiliaries above P-9 (4)

Loss of normal feedwater Steam generator low-low level (1), AFAS and FWIS on steam Steam generator safety valves Auxiliary feedwater system flow manual, OTT generator low-low level (1)

Feedwater system pipe Steam generator low-low level (1), SIS on low compensated steam Steam line isolation valves, Auxiliary feedwater system, break high pressurizer pressure (4), SIS, line pressure (1) or high-1 feedline isolation, pressurizer safety injection system (7) manual, high pressurizer water containment pressure (4), SLIS on safety valves, steam generator level (4), OTT (4) low compensated steam line safety valves pressure (1) or high-2 containment pressure (4), AFAS and FWIS on low-low steam generator water level (1) 15.3 Decrease in reactor coolant system flow rate Partial and complete loss Low flow (1), undervoltage (1), --- Steam generator safety valves ---

of forced reactor coolant underfrequency, manual flow Reactor coolant pump Low flow (1), high pressurizer --- Pressurizer safety valves, steam ---

shaft seizure (locked rotor) pressure, manual generator safety valves 15.4 Reactivity and power distribution anomalies Uncontrolled rod cluster Source range high flux, --- --- ---

control assembly bank intermediate range high flux, withdrawal from a power range high positive neutron subcritical or low power flux rate, power range high flux startup condition (low setpoint) (1), manual Uncontrolled rod cluster Power range high flux (high --- Pressurizer safety valves, steam ---

control assembly bank setpoint) (1), overtemperature T generator safety valves withdrawal at power (1), high positive flux rate (1), high pressurizer pressure, manual, OPT, high pressurizer water level Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-6 (Sheet 3)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment/Alarms ESF Equipment Rod cluster control Overtemperature T (1), manual --- --- ---

assembly mis-operation (single RCCA withdrawal)

Startup of an inactive Power range high flux with low flow --- Low-Low rod insertion limit ---

reactor coolant loop at an above P-8 (1), manual annunciators for emergency incorrect temperature boration, SDM verification, restoration of control bank insertion Chemical and volume Source range high flux (1-Mode 2), --- BDMS-activated CCP suction ---

control system malfunction power range high flux, valve swapover from VCT to that results in a decrease overtemperature T (1-Mode 1) RWST in Modes 3-5, at least one in the boron concentration RCP in operation in Modes 3-5, in the reactor coolant (see Section 15.4.6.1 for complete list of status and annunciator indications)

Spectrum of rod cluster Power range high flux (high and SIS on low pressurizer pressure --- Safety injection system control assembly (RCCA) low setpoints) (1), high positive flux ejection accidents rate (1), manual 15.5 Increase in reactor coolant inventory Inadvertent operation of Low pressurizer pressure (1-DNB --- --- Safety injection system the ECCS during power Case), manual, safety injection trip (transient initiator) operation (6-Pressurizer Filling Case)

CVCS malfunction that High pressure water level (4) --- High pressurizer pressure and ---

increases reactor coolant water level annunciators, inventory (3) pressurizer PORVs 15.6 Decrease in reactor coolant inventory Inadvertent opening of a Low pressurizer pressure, --- --- ---

pressurizer safety or relief overtemperature T (1), manual valve Steam generator tube Low pressurizer pressure (1), SIS, SIS on low pressurizer pressure Essential service water system, Emergency core cooling system, failure manual, OTT (4) (1), AFAS and FWIS on SIS (1) component cooling water system, auxiliary feedwater system, steam generator safety and/or emergency power system relief valves, steam line isolation valves, feedwater isolation valves Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-6 (Sheet 4)

Incident Reactor Trip Functions ESF Actuation Functions Other Equipment/Alarms ESF Equipment Loss of coolant accidents Low pressurizer pressure (1), SIS, SIS on Hi-1 containment pressure Essential service water system, Emergency core cooling system, resulting from a spectrum OTT, manual or low pressurizer pressure (1), component cooling water system, TD auxiliary feedwater pump of postulated piping AFAS on loss of offsite power (1) steam generator safety and/or (modeled for SBLOCA only),

breaks within the reactor and FWIS on reactor trip assumed relief valves, feedwater isolation containment heat removal coolant pressure boundary coincident with loss of offsite valves (modeled for SBLOCA only) system, emergency power power (modeled only in SBLOCA system analysis) (5)

Notes:

(1) Trip function credited in the safety analysis. Some analyses credit different trip functions depending on different analysis cases presented.

(2) Turbine trip on high-high steam generator water level not directly credited in the Section 15.1.2 analysis.

(3) No automatic protection action typically required.

(4) Trip function specifically excluded from potentially available functions to drive analysis in a given direction.

(5) With respect to actual plant operation, the main feedwater isolation signal (MFIS) would actually be generated by the safety injection signal (see FSAR Table 7.3-14 item 3.a and 3.e) for this accident. A sensitivity study has concluded that changing the signal source for the MFIS from the reactor trip (P-4) signal to the safety injection signal has a negligible impact on the small break LOCA transient.

(6) Reactor trip on SIS is modeled at the start of the transient to minimize time to pressurizer filling.

(7) Safety analysis conservatively assumes no SI flow.

Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.0-7 SINGLE FAILURES ASSUMED IN ACCIDENT ANALYSES Event Description Worst Failure Assumed Feedwater temperature reduction One protection train Excessive feedwater flow One protection train Excessive steam flow (1)(3)

Inadvertent secondary depressurization (3)

Steam system piping failure One safety injection train Steam pressure regulator malfunction (2)

Loss of external load One protection train Turbine trip One protection train Inadvertent closure of MSIV One protection train Loss of condenser vacuum One protection train Loss of ac power Turbine driven auxiliary feedwater pump Loss of normal feedwater Turbine driven auxiliary feedwater pump Feedwater system pipe break Turbine driven auxiliary feedwater pump Partial loss of forced reactor coolant flow One protection train Complete loss of forced reactor coolant flow One protection train RCP locked rotor One protection train RCP shaft break One protection train RCCA bank withdrawal from subcritical One protection train RCCA bank withdrawal at power One protection train Dropped RCCA, dropped RCCA bank (1)

Statically misaligned RCCA (3)

Single RCCA withdrawal One protection train Inactive RC pump startup (3)

Flow controller malfunction (2)

Uncontrolled boron dilution Standby ECCS charging pump is operating (Modes 1 and 2), one source range NIS channel (Modes 3-5)

Improper fuel loading (3)

RCCA ejection One protection train Inadvertent ECCS operation at power One protection train Increase in RCS inventory One pressurizer level channel BWR transients (2)

Inadvertent RCS depressurization One protection train Failure of small lines carrying primary (3) coolant outside containment SGTR One SG atmospheric steam dump valve BWR piping failures (2)

Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.0-7 (Sheet 2)

Event Description Worst Failure Assumed Spectrum of LOCA Small breaks One safety injection train Large breaks One safety injection train NOTES: (1) No protection action required (2) Not applicable to Callaway (3) No transient analysis involved Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.0-8 OPERATOR ACTIONS (1) REQUIRED FOR SMALL AND LARGE LOCAS Time Operator Action Reactor trip signal is actuated (2) None Safety injection signal is actuated (2) None Generation of RWST Lo-Lo 1 level signal Verify completion of automatic switchover to ensure components have been properly realigned. Perform the additional valve alignments required for switchover to recirculation (3).

Switchover to cold leg recirculation plus 13 Perform operations necessary to switch to hours hot leg recirculation.

To final stabilized condition Monitor system pressure and temperature.

Control pressurizer water level with safety injection system.

(1) Actions associated with primary system protection.

(2) These times can be found in the sequence of events tables in Section 15.6.5. The generic thermal-hydraulic analysis for the limiting MODE 4 SBLOCA in WCAP-12476, Revision 1, is supplemented by a plant-specific evaluation (Westnghouse letter SCP-10-31 dated May 11, 2010) which demonstrates that the minimum safeguards ECCS flow from one centrifugal charging pump (CCP) and one residual heat removal (RHR) pump can satisfy the MODE 4 small break LOCA ECCS flow requirements given in Table 4-7 of the topical report provided that:

(1) ECCS flow from one centrifugal charging subsystem can be established within 10 minutes of recognition of the event; (2) Flow from one RHR subsystem into two or more cold leg injection nozzles (i.e., RHR cross-tie valves EJHV8716A/B either open or closed) can be established within 30 minutes of recognition of the event; and (3) Decay heat loads are not exceeded at MODE 4 entry (per FSAR Section 16.5.3).

(3) See Section 6.3.2.8 for the manual actions required for completion of switchover.

Operator actions associated with containment protection is discussed in Section 6.2.

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.0-9 SHORT TERM OPERATOR ACTIONS REQUIRED FOR STEAM GENERATOR TUBE RUPTURE Time System Operator Action Reactor trip signal actuated Reactor trip system None Safety injection signal actuated Safety injection system None Post SI signal generation to plant stabilization Safety injection system, auxiliary feedwater system, steam Perform operations necessary to isolate affected steam dump system, steam generator atmospheric steam dump generator. Observe pressurizer water level controlling with valves, pressurizer PORVs SI system.

Reduce reactor coolant system temperature and pressure by using the steam dump to the condenser, if available or the intact steam generators' atmospheric steam dump valves to cooldown the RCS temperature below the faulted steam generator saturation temperature and then by using the pressurizer PORVs to depressurize the RCS until primary and secondary pressures equalize.

Terminate safety injection and again equalize primary and secondary pressures using the pressurizer PORV(s) in order to terminate break flow.

Proceed with normal plant cooldown, while monitoring reactor coolant system pressure, temperature, and boron concentration.

Rev. OL-13 5/03

CALLAWAY - SP 15.1 INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of events have been postulated which could result in an increase in heat removal from the reactor coolant system (RCS) by the secondary system. Detailed analyses are presented for several such events which have been identified as limiting cases:

Discussions of the following RCS cooldown events are presented in this section:

a. Feedwater system malfunctions that result in a decrease in feedwater temperature

b. Feedwater system malfunctions that result in an increase in feedwater flow

c. Excessive increase in secondary steam flow

d. Inadvertent opening of a steam generator relief or safety valve

e. Steam system piping failure The above are considered to be ANS Condition II events, with the exception of steam system pipe breaks, which are considered to be ANS Condition III (minor) and Condition IV (major) events. Section 15.0.1 provides a discussion of ANS classifications and applicable acceptance criteria.

15.1.1 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN A DECREASE IN FEEDWATER TEMPERATURE 15.1.1.1 Identification of Causes and Accident Description Reductions in feedwater temperature will cause an increase in core power by decreasing the reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and the RCS. The overpower/overtemperature protection (high nuclear flux, overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the safety analyses limit value.

A reduction in feedwater temperature may be caused by spurious opening of the low pressure feedwater heater bypass valve. Following this event, there is a sudden reduction in feedwater temperature to the inlet of the high pressure heaters. This would increase extraction steam flow to the heaters and could lead to isolation of the heater string followed by a heater drain pump trip. At power, this scenario results in a reduction in feedwater temperature to the steam generators and creates a greater load demand on the RCS.

With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in RCS temperature, and thus a reactivity insertion due to the effects of the 15.1-1 Rev. OL-22 11/16

CALLAWAY - SP negative moderator coefficient of reactivity. However, the rate of energy change is reduced as load and feedwater flow decrease, so the no-load transient is less severe than the full power case.

The net effect on the RCS due to a reduction in feedwater temperature is similar to the effect of increasing secondary steam flow, i.e., the reactor will reach a new equilibrium condition at a power level corresponding to the new steam generator T unless terminated by a reactor trip.

A decrease in normal feedwater temperature is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

The protection available to mitigate the consequences of a decrease in feedwater temperature is discussed in Section 15.0.8 and listed in Table 15.0-6.

15.1.1.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed by computing feedwater conditions at the steam generator inlets following spurious opening of the low pressure heater bypass valve (more limiting than a failure of the high pressure feedwater heater bypass valve). The following assumptions are made:

a. Plant initial conditions corresponding to those designated in Table 15.0-2.

b. Low pressure feedwater heater bypass valve opens, resulting in a reduction in feedwater temperature at the inlet to the high pressure feedwater heaters.

c. High pressure heater level controls do not respond to increasing levels caused by increased extraction steam flow. High pressure heaters isolate.

d. Heater drain tank level control system does not respond to reduced flow to heater drain tank, resulting in heater drain pump trip.

e. A step change in feedwater temperature at the inlet to the steam generators is conservatively assumed.

Other initial conditions are discussed in Section 15.0.3.

The excessive heat removal transient that results from a sudden reduction in feedwater temperature is analyzed by using the detailed digital computer code RETRAN (Reference 8). This code simulates a multiloop system, neutron kinetics, reactor coolant system, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam 15.1-2 Rev. OL-22 11/16

CALLAWAY - SP generators, steam generator safety valves, and feedwater system. The code computes pertinent plant variables, including temperatures, pressures, and power level.

The system is analyzed to demonstrate plant behavior in the event that a reduction in feedwater temperature occurs. This transient is analyzed at full power conditions (with auto and manual rod control). Automatic rod control is normally used; automatic rod withdrawal is no longer available. It is analyzed with the RTDP as described in Reference 4. Other analysis assumptions are as follows:

a. Plant characteristics and initial conditions are discussed in Section 15.0.3.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 4.

b. Feedwater temperature control is assumed to malfunction resulting in a step decrease to 280°F from the nominal feedwater temperature value of 446.°F.

c. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.

d. The feedwater flow into the steam generators is terminated by actuation of a safety injection signal, from low pressurizer pressure, which closes all feedwater isolation valves. The main feedwater pumps would also be tripped and their discharge valves would be closed (see results below).

Normal reactor control systems are not required to function. The overpower T protection function will trip the reactor in the cases analyzed. No single active failure will prevent operation of the reactor protection system.

Results The inadvertent opening of the low pressure feedwater heater bypass valve causes a reduction in feedwater temperature that increases the thermal load on the primary system. The maximum calculated reduction in feedwater temperature is 166°F, resulting in a significant increase in heat load on the primary system.

The full power case with maximum reactivity feedback coefficients and manual rod control results in the lowest DNBR. The case performed assuming automatic rod control results in a similar transient (automatic rod control is normally used).

The reactor is tripped by an overpower T signal. This causes a turbine trip 2 seconds after P-4. Minimum DNBR occurs at about this time. The addition of the cooler feedwater is terminated once a safety injection signal occurs from a low pressurizer pressure signal which causes all feedwater isolation valves to be automatically closed.

The main feedwater pumps would also be tripped and their discharge valves would be 15.1-3 Rev. OL-22 11/16

CALLAWAY - SP closed; however, the success of this analysis is not predicated on the operation of this non-safety related equipment (see Section 7.1.2.5.2 and Figure 7.2-1 Sheets 13 and 14).

Transient results presented in Figures 15.1-1A and 15.1-2A for the manual rod control case show the increase in nuclear power and T associated with the increased thermal load on the reactor. The DNBR does not drop below the DNBR limit values. Following the reactor trip, the plant approaches a stabilized condition. Standard plant shutdown procedures may then be followed to further cool down the plant.

Since the power level rises during this incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant. Hence, the peak value does not exceed limits established to ensure that peak fuel temperatures remain below the fuel melting temperature.

The calculated sequence of events for this accident is presented in Table 15.1-1.

15.1.1.3 Conclusions The results of the analysis show that the DNBRs encountered for a feedwater malfunction that results in a sudden decrease in feedwater temperature while at full power are above the DNBR limit values, hence, no fuel or clad damage is predicted.

A safety evaluation was performed to determine the impact of a potential increase in the stroke time of the feedwater isolation valves beyond the value assumed in the analyses (15 seconds) due to the installation of new valve actuators. It was concluded that the results presented in this section for the feedwater system malfunction transients are not adversely affected by this plant modification. As such, the reported results and conclusions remain valid.

15.1.2 FEEDWATER SYSTEM MALFUNCTIONS THAT RESULT IN AN INCREASE IN FEEDWATER FLOW 15.1.2.1 Identification of Causes and Accident Description Addition of excessive feedwater will cause an increase in core power by decreasing the reactor coolant temperature. Such transients are attenuated by the thermal capacity of the secondary plant and of the RCS. The overpower/overtemperature protection (high nuclear flux, overtemperature and overpower T trips) prevents any power increase which could lead to a DNBR less than the safety analysis limit value.

Due to a postulated common mode software failure (CMSF) associated with the digital feedwater control system (DFWCS), this event has been analyzed for a hypothetical CMSF that causes all of the main feedwater regulating valves (MFRVs) to be fully open at full power and both main feedwater pumps to go to maximum speed. Adequate DNB margin is provided to also accommodate all MFRV bypass valves to be fully open as 15.1-4 Rev. OL-22 11/16

CALLAWAY - SP well. A more realistic approach to the DFWCS software failure modes and effects analysis indicates tha the analysis assumptions used in Section 15.1.2.2 and the sequence of events in Table 15.1-1 are not credible.

An example of excessive feedwater flow would be a full opening of one or more feedwater control valves due to a feedwater control system malfunction or an operator error. At power, this excess flow causes a greater load demand on the RCS due to increased subcooling in the steam generator. With the plant at no-load conditions, the addition of cold feedwater may cause a decrease in the RCS temperature and thus a reactivity insertion due to the effects of a negative moderator coefficient of reactivity.

Continuous addition of excessive feedwater is prevented by the steam generator high-high level trip, which closes the feedwater isolation valves. This signal will also close the operable feedwater control valves and feedwater pump discharge valves and trip the main feedwater pumps; however, of this equipment, only the feedwater control valves are part of the primary success path for accident mitigation. Turbine trip on steam generator high-high level is not directly credited in this analysis. An increase in normal feedwater flow is classified as an ANS Condition II event, fault of moderate frequency.

See Section 15.0.1 for a discussion of ANS Condition II events.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6.

15.1.2.2 Analysis of Effects and Consequences Method of Analysis The excessive heat removal due to a feedwater system malfunction transient is analyzed by using the detailed digital computer code RETRAN (Ref. 8). This code simulates a multiloop system, neutron kinetics, reactor coolant system, the pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, steam generator safety valves, and feedwater system. The code computes pertinent plant variables, including temperatures, pressures, and power level. For the HFP cases, RETRAN is used to conservatively estimate DNBR based on the core thermal limits. For the HZP case analyzed, transient statepoints are first generated with RETRAN. A detailed thermal and hydraulic digital computer code, VIPRE (Ref. 11), is then used to determine whether the DNBR limit is met for the core conditions computed by RETRAN.

The system is analyzed to demonstrate plant behavior in the event that excessive feedwater addition occurs due to a control system malfunction or operator error that allows one or more feedwater control valves to open fully. Two conditions are typically analyzed (with auto and manual rod control) as follows:

a. Accidental opening of one or more feedwater control valves with the reactor just critical at zero load conditions assuming a conservatively large negative moderator temperature coefficient 15.1-5 Rev. OL-22 11/16

CALLAWAY - SP

b. Accidental opening of one or more feedwater control valves at full power Full-power cases are analyzed assuming both automatic and manual rod control to ensure that the worst case is presented. However, automatic rod withdrawal is no longer available. This accident is analyzed with the RTDP as described in Reference 4.

The reactivity insertion rate following a feedwater system malfunction is calculated with the following assumptions:

a. Plant characteristics and initial conditions are discussed in Section 15.0.3.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 4.

b. The feedwater temperature window of 390°F to 446°F is consistent with normal plant conditions. Cases with the lowest and the highest temperatures are considered.

c. For the full power cases, one feedwater control valve is assumed to malfunction resulting in a step increase to 190 percent of nominal feedwater flow to one steam generator. An additional case with all feedwater control valves assumed to malfunction resulting in a step increase to 162.9 percent of nominal feedwater flow to each of the 4 steam generators is also analyzed.

d. For the zero load cases, one feedwater control valve malfunction occurs which results in an increase in flow to one steam generator from zero to 143 percent of the nominal full load value for one steam generator.

However, increases in feedwater flow of up to 150% of nominal at HZP conditions were generically determined to be less limiting than that caused by an occurrence at full power conditions; such as, this case is not explicitly analyzed. An additional HZP case with all feedwater control valves assumed to malfunction resulting in a step increase from zero to 161.3 percent of nominal feedwater flow to each of the 4 steam generators is explicitly analyzed.

e. For the zero load case analyzed, feedwater temperature is at a temperature of 100°F.

f. No credit is taken for the heat capacity of the RCS and steam generator thick metal in attenuating the resulting plant cooldown.

g. The feedwater flow resulting from a fully open control valve is terminated by a steam generator high-high level trip signal, which closes all feedwater isolation valves. This signal would also trip the main feedwater pumps, close the pump discharge valves, and close the feedwater control valves.

The success of this analysis is not predicated on the operation of the main 15.1-6 Rev. OL-22 11/16

CALLAWAY - SP feedwater pumps nor the pump discharge valves (see Section 7.1.2.5.2 and Figure 7.2-1 sheets 13 and 14). The feedwater control valves are primary success path equipment for secondary side pipe ruptures analyzed in Section 6.2. The high-high level signal would also trip the turbine; however, no direct credit for that trip function is taken in this analysis. This trip function is indirectly credited in terminating the ensuing loss of feedwater transient such that the analysis in Section 15.2.7 remains bounding.

Normal reactor control systems and engineered safety systems are not required to function. The reactor protection system may function to trip the reactor due to either steam generator low-low level or an overpower condition. No single active failure will prevent operation of the reactor protection system.

Results The case of an accidental full opening of one feedwater control valve with the reactor at zero power and a feedwater flow increase of less than 150% (143% for Callaway), has been generically shown to be less limiting than the one caused by the occurrence of a feedwater malfunction event from full power conditions. Therefore, the feedwater flow increase event at HZP in a single steam generator is bounded by the full power event and has not been explicitly analyzed. Transient results for the zero power case in which all feedwater control valves are assumed to malfunction resulting in a step increase from zero to 161.3 percent of nominal feedwater flow to each of the 4 steam generators are presented in Figures 15.1-1B and 15.1-2B. These results indicate that the DNBR does not drop below the safety analysis limit value.

The multi-loop, full power case with maximum reactivity feedback coefficients, automatic rod control, and the lowest feedwater temperature condition results in the lowest DNBR.

Automatic rod control is conservatively assumed even though automatic rod withdrawal is no longer available. Assuming manual rod control, the full power case results in a similar transient.

When the steam generator water level in the faulted loop reaches the high-high level setpoint (100% of narrow range span was used in this analysis as discussed in Table 15.0-4), feedwater is isolated. This prevents continuous addition of the feedwater.

Following feedwater isolation, the reactor will be automatically tripped when the low-low steam generator level trip setpoint (0 percent of narrow range span) is reached.

Transient results presented in Figures 15.1-1 and 15.1-2 for the full power cases show the increase in nuclear power and T associated with the increased thermal load on the reactor. The DNBR does not drop below the safety analysis limit values. Following the reactor trip, the plant approaches a stabilized condition. Standard plant shutdown procedures may then be followed to further cool down the plant.

15.1-7 Rev. OL-22 11/16

CALLAWAY - SP Since the power level rises during the excessive feedwater flow incident, the fuel temperatures will also rise until after reactor trip occurs. The core heat flux lags behind the neutron flux response due to the fuel rod thermal time constant. Hence, the peak value does not exceed 118 percent of its nominal value (i.e., the assumed high neutron flux trip setpoint; see Table 15.0-4 ). The peak fuel temperature will thus remain well below the fuel melting temperature.

The transient results show that DNB does not occur at any time during the excessive feedwater flow incident; thus, the ability of the primary coolant to remove heat from the fuel rod is not reduced. The fuel cladding temperature, therefore, does not rise significantly above its initial value during the transient.

The calculated sequence of events for this accident is presented in Table 15.1-1.

A safety evaluation was performed to determine the impact of a potential increase in the stroke time of the feedwater isolation valves beyond the value assumed in the analyses (15 seconds) due to the installation of new valve actuators. It was concluded that the results presented in this section for the feedwater system malfunction transients are not adversely affected by this plant modification. As such, the reported results and conclusions remain valid.

15.1.2.3 Conclusions The results of the analysis show that the DNBRs encountered for an excessive feedwater addition at power are above the safety analysis limit values, hence, no fuel or clad damage is predicted. The results of the zero power case in which all feedwater control valves are assumed to malfunction resulting in a step increase to 161.3 percent of nominal feedwater flow to each of the 4 steam generators also indicate that the DNBR remains above the safety analysis limit value. Additionally, it has been generically evaluated that a step increase of zero to 143 percent of nominal feedwater flow at zero power conditions affecting a single steam generator is less than limiting than the malfunction event from full power conditions.

15.1.3 EXCESSIVE INCREASE IN SECONDARY STEAM FLOW 15.1.3.1 Identification of Causes and Accident Description An excessive increase in secondary system steam flow (excessive load increase incident) is defined as a rapid increase in steam flow that causes a power mismatch between the reactor core power and the steam generator load demand. Any increase in load may cause a reactor trip actuated by the reactor protection system if manual action is not taken to stabilize the reactor. Steam flow increases greater than 10 percent are analyzed in Section 15.1.5.

15.1-8 Rev. OL-22 11/16

CALLAWAY - SP This accident could result from either an administrative violation, such as excessive loading by the operator, or an equipment malfunction in the turbine bypass control or turbine speed control.

During power operation, steam dump to the condenser is controlled by reactor coolant condition signals, i.e., high reactor coolant temperature indicates a need for steam dump.

A single controller malfunction does not cause steam dump; an interlock is provided which blocks the opening of the valves unless a large turbine load decrease or a turbine trip has occurred.

Protection against an excessive load increase accident is provided by the following reactor protection system signals:

a. Overpower T

b. Overtemperature T

c. Power range high neutron flux An excessive load increase incident is considered to be an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

15.1.3.2 Analysis of Effects and Consequences Based on historical precedence, this event does not lead to a serious challenge to the acceptance criteria and a reactor trip is not typically generated. As such, a detailed reanalysis of this event has not been performed to support the installation of replacement steam generators at Callaway. Instead, a simplified statepoint evaluation was performed. Its results confirm that the safety analysis DNBR limit is not challenged during this event.

The simplified statepoint evaluation performed consists of evaluating the effect of this transient on the DNBR by applying conservatively large deviations on the initial conditions for power, average coolant temperature, and pressurizer pressure at the normal full-power operating conditions, in order to generate a limiting set of statepoints.

Each of these deviations bounds the expected variation that could occur as a result of an excessive load increase incident and is only applied in the direction that has the most adverse impact on DNBR (increased power and coolant temperature, and decreased pressure). The reactor condition statepoints (power, temperature, and pressure) are then compared to the conditions corresponding to operation at the DNBR safety analysis limit (shown in Figure 15.0-1).

The method of analysis discussion presented below corresponds to the analysis previously performed for this event and it is retained for historical purposes.

Method of Analysis 15.1-9 Rev. OL-22 11/16

CALLAWAY - SP This accident has historically been analyzed using the LOFTRAN code (Ref. 1). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and feedwater system. The code computes pertinent plant variables, including temperatures, pressures, and power level.

Four cases are analyzed to demonstrate the plant behavior following a 10-percent step load increase from rated load. These cases are as follows:

a. Reactor control in manual with minimum moderator reactivity feedback

b. Reactor control in manual with maximum moderator reactivity feedback

c. Reactor control in automatic with minimum moderator reactivity feedback

d. Reactor control in automatic with maximum moderator reactivity feedback Cases c and d are analyzed to ensure that the worst case is presented. Automatic rod withdrawal is no longer available.

For the minimum moderator feedback cases, the core has the least negative moderator temperature coefficient of reactivity, therefore, reductions in coolant temperature will have the least impact on core power. For the maximum moderator feedback cases, the moderator temperature coefficient of reactivity has its highest absolute value. This results in the largest amount of reactivity feedback due to changes in coolant temperature.

A 10 percent step increase in steam demand is assumed.

All cases are studied without credit being taken for pressurizer heaters.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 4.

Normal reactor control systems and engineered safety systems are not required to function. The reactor protection system is assumed to be operable; however, reactor trip is not encountered for most cases due to the error allowances assumed in the setpoints.

No single active failure will prevent the reactor protection system from performing its intended function.

The cases which assume automatic rod control are analyzed to ensure that the worst case is presented. Automatic rod withdrawal is no longer available. No credit was taken for overtemperature or overpower T trips in order to demonstrate the inherent transient capability of the plant. Under actual operating conditions such trips may occur after which the plant would stabilize quickly.

15.1-10 Rev. OL-22 11/16

CALLAWAY - SP Results The results of the analysis of the limiting transient statepoints show that the minimum DNBR remains above the safety analysis limit value. Based on this simplified statepoint analysis, a more detailed analysis using the RETRAN code (Reference 8) was determined not to be necessary.

The figures and sequence of events discussed below correspond to the analysis previously performed for this event. They are retained for historical purposes as they are representative of the expected response to this transient.

Figures 15.1-3 through 15.1-6 illustrate the typical transient response with the reactor in the manual control mode. As expected, for the minimum moderator feedback case there is a slight power increase, and the average core temperature shows a large decrease.

This results in a DNBR which increases above its initial value. For the maximum moderator feedback manually controlled case there is a much larger increase in reactor power, due to the moderator feedback. A reduction in DNBR is experienced, but DNBR remains above the safety analysis limit values.

Figures 15.1-7 through 15.1-10 illustrate the typical transient response, assuming that the reactor is in the automatic control mode and no reactor trip signals occur. Both the minimum and maximum moderator feedback cases show that core power increases, thereby reducing the rate of decrease in coolant average temperature and pressurizer pressure. For both of these cases, the minimum DNBR remains above the safety analysis limit values.

For all cases (except the minimum feedback automatic rod control case), the plant rapidly reaches a stabilized condition at the higher power level. For the case with minimum reactivity feedback and automatic rod control, the reactor oscillates

~+/-2.5 percent, above and below 105 percent of initial power. This is caused by the interaction between the minimum feedback and the rod control system.

The excessive load increase incident is an overpower transient for which the fuel temperatures will rise. Reactor trip may not occur for some of the cases analyzed, and the plant reaches a new equilibrium condition at a higher power level corresponding to the increase in steam flow.

Since DNB does not occur at any time during the excessive load increase transients, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for the excessive load increase incident is shown in Table 15.1-1.

15.1-11 Rev. OL-22 11/16

CALLAWAY - SP 15.1.3.3 Conclusions The results presented above show that for a 10-percent step load increase the DNB design basis continues to be met, thereby precluding fuel or clad damage. The plant reaches a stabilized condition rapidly following the load increase.

15.1.4 INADVERTENT OPENING OF A STEAM GENERATOR RELIEF OR SAFETY VALVE 15.1.4.1 Identification of Causes and Accident Description The most severe core conditions resulting from an accidental depressurization of the main steam system are associated with an inadvertent opening of a single steam dump, relief, or safety valve. The analyses performed assuming a rupture of a main steamline, are given in Section 15.1.5.

The steam release, as a consequence of this accident, results in an initial increase in steam flow which decreases during the accident as the steam pressure falls. The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity.

The analysis is performed to demonstrate that the following criterion is satisfied:

Assuming a stuck rod cluster control assembly with offsite power available, and assuming a single failure in the engineered safety features system, there will be no consequential damage to the core or the reactor coolant system after reactor trip for a steam release equivalent to the spurious opening, with failure to close, of the largest of any single steam dump, relief, or safety valve.

Accidental depressurization of the secondary system is classified as an ANS Condition II event. See Section 15.0.1 for a discussion of Condition II events.

The following systems provide the necessary protection against an accidental depressurization of the main steam system:

a. Safety injection system actuation from any of the following:

1. Two out of three low steamline pressure signals in any one loop

2. Two out of four low pressurizer pressure signals

b. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the safety injection signal (SIS)

c. Redundant isolation of the main feedwater lines 15.1-12 Rev. OL-22 11/16

CALLAWAY - SP Sustained high feedwater flow would cause additional cooldown.

Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, an SIS will rapidly close all feedwater isolation valves. This signal would also trip the main feedwater pumps, close the pump discharge valves, and close the feedwater control valves. The success of this analysis is not predicated on the operation of the main feedwater pumps nor the pump discharge valves (see Section 7.1.2.5.2 and Figure 7.2-1 sheets 13 and 14). The feedwater control valves are primary success path equipment for secondary side pipe ruptures analyzed in Section 6.2.

d. Trip of the main steam line isolation valves (MSIVs) on:

1. Safety injection system actuation derived from two out of three low steamline pressure signals in any one loop (above Permissive P-11)

2. Two out of three high negative steam pressure rate signals in any loop (used only during cooldown and heatup operations: below Permissive P-11)

Plant systems and equipment which are available to mitigate the effects of the accident are also discussed in Section 15.0.8 and listed in Table 15.0-6.

15.1.4.2 Analysis of Effects and Consequences Method of Analysis The inadvertent depressurization of a steam generator (i.e., the credible steamline break event) is analyzed in a similar manner and to the same acceptance criteria as the hypothetical steamline break event discussed in Section 15.1.5. The break size typically modeled in the credible break is much smaller than that considered in the hypothetical case. As such, no explicit analysis of the inadvertent steam generator depressurization case is needed to demonstrate that all applicable criteria are met, as this case is bounded by that presented in Section 15.1.5.

15.1.4.3 Conclusions This case is less limiting than the steamline rupture case described in Section 15.1.5. As such, no explicit analysis is performed.

15.1-13 Rev. OL-22 11/16

CALLAWAY - SP 15.1.5 STEAM SYSTEM PIPING FAILURE 15.1.5.1 Identification of Causes and Accident Description The steam release arising from a rupture of a main steamline would result in an initial increase in steam flow that decreases during the accident as the steam pressure falls.

The energy removal from the RCS causes a reduction of coolant temperature and pressure. In the presence of a negative moderator temperature coefficient, the cooldown results in an insertion of positive reactivity. If the most reactive RCCA is assumed stuck in its fully withdrawn position after reactor trip, there is possibility that the core will become critical and return to power. A return to power following a steamline rupture is a potential problem mainly because of the high power peaking factors which exist, assuming the most reactive RCCA to be stuck in its fully withdrawn position. The core is ultimately shut down by the boric acid solution delivered by the ECCS.

The analysis of a main steamline rupture is performed to demonstrate that the following criteria are satisfied:

Assuming a stuck RCCA with or without offsite power, and assuming a single failure in the engineered safety features, the core remains in place and intact.

Radiation doses do not exceed the guidelines of 10 CFR 100.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable, the following analysis, in fact, shows that no DNB occurs for any rupture, assuming the most reactive RCCA stuck in its fully withdrawn position. The DNBR design basis is discussed in Section 4.4.

A major steamline rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a discussion of Condition IV events.

Effects of minor secondary system pipe breaks are bounded by the analysis presented in this section. Minor secondary system pipe breaks are classified as Condition III events, as described in Section 15.0.1.3.

The major rupture of a steamline is the most limiting cooldown transient, and is analyzed at zero power with no decay heat. Decay heat would retard the cooldown, thereby reducing the return to power. A detailed analysis of this transient with the most limiting break size, a double ended rupture, is presented here. The assumptions used in this analysis are discussed in Reference 3. Reference 3 also contains a discussion of the spectrum of break sizes and power levels analyzed.

During startup or shutdown evolutions when safety injection on low pressurizer pressure or low steamline pressure is blocked and steamline isolation on low steamline pressure is blocked below P-11 (pressurizer pressure less than 1970 psig), the high negative steamline pressure rate (HNPR) signal is enabled by P-11 to provide steamline isolation. A series of steamline break sensitivities in Mode 3 conditions has been 15.1-14 Rev. OL-22 11/16

CALLAWAY - SP performed using the LOFTRAN code (Ref. 1) to investigate the response of the HNPR function below P-11. Specifically, a spectrum of break sizes over a wide range of Mode 3 temperatures has been considered. The results of this study demonstrate that automatic steamline isolation is provided by the HNPR function for all but the smallest breaks for RCS temperatures from approximately the middle to the high end of the Mode 3 range.

As the RCS temperatures is decreased below these values, the smaller break sizes are no longer automatically protected by the HNPR function. Finally, as the RCS temperature is reduced further, the HNPR function does not provide protection for any break size. This is consistent with the expected response of the protection function since, as the assumed RCS temperature is decreased, the initial steam generator pressure decreases as well, making it less likely that the HNPR setpoint would be reached. It should be noted that steamline isolation can also be provided by a containment pressure High-2 signal for breaks inside containment or by manual actions performed in accordance with established procedures. Furthermore, more restrictive boration requirements for conditions below P-11 make the Mode 3 steamline break scenario less limiting than the case analyzed from HZP conditions. More information on this sensitivity study can be found in Reference 9. The analyses documented in Reference 3 cover a spectrum of breaks, from HZP, partial power, and full power, including cases where the MSIVs do not close until either a containment pressure signal is generated or they are manually isolated. Reference 3, which was approved by the NRC in Reference 6, concludes that the HZP double-ended steamline break at EOL conditions discussed in Section 15.1.5.2 is a limiting case that conservatively demonstrates the compliance of Westinghouse PWRs with all applicable steamline break acceptance criteria.

The following functions provide the protection for a steamline rupture:

a. Safety injection system actuation from any of the following:

1. Two out of three low steamline pressure signals in any one loop

2. Two out of four low pressurizer pressure signals

3. Two out of three high-l containment pressure signals

b. The overpower reactor trips (neutron flux and T) and the reactor trip occurring in conjunction with receipt of the SIS.

c. Redundant isolation of the main feedwater lines Sustained high feedwater flow would cause additional cooldown.

Therefore, in addition to the normal control action which will close the main feedwater valves following reactor trip, an SIS will rapidly close all feedwater isolation valves. This signal would also trip the main feedwater pumps, close the pump discharge valves, and close the feedwater control valves. The success of this analysis is not predicated on the operation of 15.1-15 Rev. OL-22 11/16

CALLAWAY - SP the main feedwater pumps nor the pump discharge valves (see Section 7.1.2.5.2 and Figure 7.2-1 sheets 13 and 14). The feedwater control valves are primary success path equipment for secondary side pipe ruptures analyzed in Section 6.2.

d. Trip of the main steam isolation valves on:

1. Safety injection system actuation derived from two out of three low steamline pressure signals in any one loop (above Permissive-11)

2. Two out of three high-2 containment pressure signals

3. Two out of three high negative steamline pressure rate signals in any one loop (used only during cooldown and heatup operations, below Permissive-11 with Tavg greater than 400°F)

Isolation valves are provided in each steamline. For breaks down-stream of the isolation valves, closure of all valves would completely terminate the blowdown. For any break, in any location, no more than one steam generator would experience an uncontrolled blowdown, even if one of the isolation valves fails to close. A description of steamline isolation is included in Section 10.3. In the analysis, these valves are assumed to fully close within 17 seconds upon receipt of a steamline isolation signal following a large break in a steamline. The 17 seconds includes a 2 second signal processing delay assumption. Additionally an engineering evaluation was completed to support an increase in the main steam isolation valve stroke delay up to 60 seconds for steam generator pressures below that which corresponds to the P-11 permissive set point. This evaluation demonstrated that the acceptance criteria continue to be met for this scenario.

More information on this engineering evaluation can be found in Reference 10.

Steam flow is measured by monitoring dynamic head in nozzles located in the steam generator outlet. The effective throat area of the nozzles is 1.39 square feet, which is considerably less than the main steam pipe area; thus, the nozzles also serve to limit the maximum steam flow for a break at any location.

Table 15.1-2 lists the equipment required in the recovery from a steamline rupture. Not all equipment is required for any one particular break, since the requirements will vary, depending upon postulated break size and location. Design criteria and methods of protection of safety-related equipment from the dynamic effects of postulated piping ruptures are provided in Section 3.6.

15.1.5.2 Analysis of Effects and Consequences Method of Analysis The analysis of the steam pipe rupture has been performed to determine:

15.1-16 Rev. OL-22 11/16

CALLAWAY - SP

a. The core heat flux and RCS temperature and pressure resulting from the cooldown following the steamline break. The RETRAN code (Ref. 8) has been used.

b. The thermal and hydraulic behavior of the core following a steam line break. A detailed thermal and hydraulic digital-computer code, VIPRE, has been used to determine if DNB occurs for the core conditions computed in item a above.

The following conditions were assumed to exist at the time of a main steamline break accident:

a. End-of-life shutdown margin at no-load, equilibrium xenon conditions, and the most reactive RCCA stuck in its fully withdrawn position. Operation of the control rod banks during each burnup is restricted by the insertion limits such that addition of positive reactivity in a steamline break accident will not lead to a more adverse condition than the case analyzed.

b. A negative moderator coefficient corresponding to the end-of-life rodded core with the most reactive RCCA in the fully withdrawn position. As discussed below, this event initiates from MODE 3 (hot standby) conditions. All control and shutdown banks are on the bottom (except for the most reactive, stuck rod) since the analysis acceptance criteria are more difficult to satisfy if the shutdown banks are initially assumed to be inserted. The variation of the coefficient with temperature and pressure has been included. The keff versus temperature at 1,140 psia, corresponding to the negative moderator temperature coefficient used, is shown in Figure 15.1-11. The effect of power generation in the core on overall reactivity (due to Doppler feedback) is shown in Figure 15.1-14.

The core properties associated with the sector nearest the affected steam generator and those associated with the remaining sector were conservatively combined to obtain average core properties for reactivity feedback calculations. Further, it was conservatively assumed that the core power distribution was uniform. These two conditions cause underprediction of the reactivity feedback in the high power region near the stuck rod. The stuck rod is assumed in the region of the core of lowest temperature. To verify the conservatism of this method, the reactivity, as well as the power distribution, was checked for the limiting conditions during the transient for the cases analyzed.

This core analysis, performed with the ANC code, considered the Doppler reactivity from the high fuel temperature near the stuck RCCA, moderator feedback from the high water enthalpy near the stuck RCCA, power redistribution, and nonuniform core inlet temperature effects. For cases in which steam generation occurs in the high flux regions of the core, the 15.1-17 Rev. OL-22 11/16

CALLAWAY - SP effect of void formation was also included. It was determined that the reactivity employed in the kinetics analysis was always larger than the reactivity calculated, including the above local effects for the state points.

These results verify conservatism, i.e., underprediction of negative reactivity feedback from power generation.

c. Minimum capability for injection of boric acid solution corresponding to the most restrictive single failure in the ECCS. The ECCS consists of four subsystems: 1) the passive SI accumulators, 2) the residual heat removal system, and 3) the safety injection system, and 4) the high head injection system (centrifugal charging pumps). Only the high head injection system (one CCP) and the passive SI accumulators are modeled for the steamline break accident analysis. See Table 15.1-5.

The actual modeling of the ECCS in RETRAN is described in Reference 8.

No credit has been taken for the low concentration (0 ppm) borated water, which must be swept from the lines prior to the delivery of boric acid solution to the reactor coolant loops.

For the cases where offsite power is assumed, the following sequence of events occurs. After the generation of the safety injection signal (appropriate delays for instrumentation, logic, and signal transport included), the appropriate valves begin to operate, and the high head safety injection pump starts. In 27 seconds (2 seconds for SIS generation (sensor) delay, 15 seconds to open RWST suction isolation valves BN-LCV-112D and E, and 10 seconds to close VCT outlet isolation valves BG-LCV-112B and C after the RWST valves are fully open), the valves are assumed to be in their final position, and the pump is assumed to be at full speed. The volume containing the low concentration (0 ppm) borated water is swept away before the boric acid solution reaches the core. This delay is included in the modeling (See Reference 7).

In cases where offsite power is not available, an additional 12-second delay is assumed to start the diesels.

d. Design value of the steam generator heat transfer coefficient, including allowance for steam generator tube fouling.

e. Since the steam generators are provided with integral flow restrictors with a 1.39-square-foot throat area, any rupture with a break area greater than 1.39 square feet, regardless of location, would have the same effect on the NSSS as the 1.39-square-foot break. The following cases have been considered in determining the core power and RCS transients:

1. Complete severance of a pipe, with the plant initially at hot standby conditions, full reactor coolant flow with offsite power available.

15.1-18 Rev. OL-22 11/16

CALLAWAY - SP

2. Case (1) with loss of offsite power simultaneous with the steamline break and initiation of the safety injection signal. Loss of offsite power results in reactor coolant pump coastdown.

f. Power peaking factors corresponding to one stuck RCCA and nonuniform core inlet coolant temperatures are determined at end of core life. The coldest core inlet temperatures are assumed to occur in the sector with the stuck rod. The power peaking factors account for the effect of the local void in the region of the stuck control assembly during the return to power phase following the steamline break. This void in conjunction with the large negative moderator coefficient partially offsets the effect of the stuck assembly. The power peaking factors depend upon the core power, temperature, pressure, and flow, and, thus, are different for each case studied.

The core parameters used for each of the two cases correspond to values determined from the respective transient analysis.

Both cases above assume initial hot zero power (HZP) conditions (Tavg =

557°F) at time zero since this represents the worst initial condition (as discussed in Section 15.1.5.1). Should the reactor be just critical or operating at power at the time of a steamline break, the reactor will be tripped by the normal overpower protection system when power level reaches a trip point. Following a trip at power, the RCS contains more stored energy than at HZP, the average coolant temperature is higher than at HZP, and there is appreciable energy stored in the fuel. Thus, the additional stored energy is removed via the cooldown caused by the steamline break before the HZP conditions of RCS temperature and shutdown margin assumed in the analyses are reached. After the additional stored energy has been removed, the cooldown and reactivity insertions proceed in the same manner as in the analysis, which assumes no-load condition at time zero. A spectrum of steamline breaks at various power levels has been analyzed in Reference 3.

g. In computing the steam flow during a steamline break, the Moody Curve (Ref. 2) for f(L/D) = 0 is used.

Results The calculated sequence of events for both cases analyzed is shown in Table 15.1-1.

The results presented are a conservative indication of the events which would occur, assuming a steamline rupture, since it is postulated that all of the conditions described above occur simultaneously.

Core Power and Reactor Coolant System Transient 15.1-19 Rev. OL-22 11/16

CALLAWAY - SP Figures 15.1-15A through 15.1-17B show the RCS transient and core heat flux following a main steamline rupture (complete severance of a pipe) at initial HZP conditions (case a).

Offsite power is assumed to be available so that full reactor coolant flow exists. The transient shown assumes an uncontrolled steam release from only one steam generator.

Should the core be critical at near zero power when the rupture occurs, the initiation of safety injection by low steamline pressure will trip the reactor. Steam release from more than one steam generator will be prevented by automatic trip of the isolation valves in the steamlines by low steamline pressure signals, high-high containment pressure signals, or by high negative steamline pressure rate signals. Even with the failure of one valve, release is limited by main steam isolation valve closure for the other steam generators while the one generator blows down.

As shown in Figure 15.1-16B, the core attains criticality with the RCCAs inserted (with the design shutdown assuming one stuck RCCA) shortly before boron solution enters the RCS. The continued addition of boron results in a peak core power significantly lower than the nominal full power value.

The calculation assumes that the boric acid is mixed with, and diluted by, the water flowing in the RCS prior to entering the reactor core. The concentration after mixing depends upon the relative flow rates in the RCS and from the ECCS centrifugal charging pump (CCP). The variation of mass flow rate in the RCS due to water density changes is included in the calculation, as is the variation of flow rate from the CCP due to changes in the RCS pressure. The CCP flow calculation includes the line losses in the system as well as the pump head curve.

Figures 15.1-18A through 15.1-20B show the salient parameters for case b, which corresponds to the case discussed above with the additional loss of offsite power at the time the safety injection signal is generated. The CCP delay time includes 12 seconds to start the diesel in addition to 27 seconds to start the ECCS centrifugal charging pump and open the valves. Criticality is achieved later, and the core power increase is slower than in the similar case with offsite power available. The ability of the emptying steam generator to extract heat from the RCS is reduced by the decreased flow in the RCS.

The peak power remains well below the nominal full power value. See also Reference 7.

It should be noted that following a steamline break only one steam generator blows down completely. Thus, the remaining steam generators are still available for the dissipation of decay heat after the initial transient is over. In the case of loss of offsite power, this heat is removed to the atmosphere via the steamline atmospheric relief and safety valves.

Margin to Critical Heat Flux A DNB analysis was performed for both of these cases. It was found that both cases had a minimum DNBR greater than the safety analysis limit value as discussed in Section 4.4.1.1. The WLOP DNB correlation was used in this analysis (Reference 12).

15.1-20 Rev. OL-22 11/16

CALLAWAY - SP Historically, the W-3 DNB correlation had been used; see Reference 5 for the justification discussing the use of the W-3 correlation for low pressure applications, accepted by the NRC in Reference 6.

15.1.5.3 Radiological Consequences 15.1.5.3.1 Method Of Analysis 15.1.5.3.1.1 Physical Model The radiological consequences of a MSLB inside the containment are less severe than the one outside the containment because the radioactivity released will be held up inside the containment, allowing decay and plateout of the radionuclides. To evaluate the radiological consequences due to a postulated MSLB (outside the containment), it is assumed that there is a complete severance of a main steamline outside the containment.

It is also assumed that there is a simultaneous loss of offsite power, resulting in reactor coolant pump coastdown. The ECCS is actuated and the reactor trips.

The main steam isolation valves, their bypass valves, and the steamline drain valves isolate the steam generators and the main steamlines upon a signal initiated by the engineered safety features actuation system under the conditions of high negative steamline pressure rates, low steamline pressure, or high containment pressures. The main steam isolation valves are installed in the main steamlines from each steam generator downstream from the safety and atmospheric relief valves outside the containment. The break in the main steamline is assumed to occur outside of the containment. The affected steam generator (steam generator connected to a broken steamline) blows down completely. The steam is vented directly to the atmosphere.

Each of the steam generators incorporates integral flow restrictors, which are designed to limit the rate of steam blowdown from the steam generators following a rupture of the main steamline. This, in turn, reduces the cooling rate of the reactor coolant system thereby reducing the return to power.

In case of loss of offsite power, the remaining steam generators are available for dissipation of core decay heat by venting steam to the atmosphere via the atmospheric relief and safety valves. Venting continues until the reactor coolant temperature and pressure have decreased sufficiently so that the RHR system can be utilized to cool the reactor.

15.1.5.3.1.2 Assumptions and Conditions The major assumptions and parameters assumed in the analysis are itemized in Tables 15.1-3 and 15A-1.

15.1-21 Rev. OL-22 11/16

CALLAWAY - SP The assumptions used to determine the concentrations of radioactive isotopes within the secondary system for this accident are as follows:

a. The initial secondary side radio-iodine concentrations are assumed to be 10% of the initial Case 1 primary side concentrations.

b. A primary-to-secondary leakage rate of 1 gpm is assumed to exist and is assumed to be in the affected steam generator.

c. The reactor coolant initial iodine activity is determined by two methods, and both cases are analyzed. These are:

Case 1 - The Case 1 initial radio-iodine concentrations are the same as the Case 1 concentrations used for the Steam Generator Tube Rupture accident sequence. Refer to Table 15.6-4.

Case 2 - The Case 2 initial radio-iodine concentrations are the same as the Case 2 concentrations used for the Steam Generator Tube Rupture accident sequence. Refer to Table 15.6-4.

d. The initial reactor coolant concentrations of noble gas correspond to 1-percent fuel defects. 225 Ci/gm DOSE EQUIVALENT XE-133).

e. Partition factors used to determine the secondary system activities are given in Table 15.1-3.

The following specific assumptions and parameters are used to calculate the activity release:

a. Offsite power is lost, resulting in reactor coolant pump coastdown.

b. No condenser air removal system release and no normal operating steam generator blowdown is assumed to occur during the course of the accident.

c. Eight hours after the occurrence of the accident, the residual heat-removal system (RHRS) starts operation to cool down the plant.

d. After the accident, the primary-to-secondary leakage continues for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, at which time the reactor coolant system is depressurized.

e. The affected steam generator (steam generator connected to the broken steamline) is allowed to blow down completely.

f. Steam release to the atmosphere and the associated activity release from the safety and relief valves and the broken steamline is terminated 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident, when the RHRS is activated to complete cooldown.

15.1-22 Rev. OL-22 11/16

CALLAWAY - SP

g. The amount of noble gas activity released is equal to the amount present in the reactor coolant, which leaks to the secondary during the accident. The amount of iodine activity released is based on the activity present in the secondary system and the amount of leaked reactor coolant which is entrained in the steam that is discharged to the environment via the safety and relief valves and the broken steamline. Partition factors used for the unaffected steam generators after the accident occurs are given in Table 15.1-3. An iodine partition factor of 1 is used for the affected steam generator.

h. The activity released from the broken steamline and the safety and relief valves during the 8-hour duration of the accident is immediately vented to the atmosphere.

15.1.5.3.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are based on the assumptions listed above.

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum.

c. The thyroid inhalation dose and total-body gamma immersion doses to a receptor at the exclusion area boundary and outer boundary of the low-population zone were analyzed, using the models described in Appendix 15A.

15.1.5.3.1.4 Identification of Leakage Pathways and Resultant Leakage Activity For evaluating the radiological consequences due to a postulated MSLB, the activity released from the affected steam generator (steam generator connected to the broken steamline) is released directly to the environment. The unaffected steam generators are assumed to continually discharge steam and entrained activity via the safety and relief valves up to the time initiation of the RHRS can be accomplished.

Since the activity is released directly to the environment with no credit for plateout or retention, the results of the analysis are based on the most direct leakage pathway available. Therefore, the resultant radiological consequences represent the most conservative estimate of the potential integrated dose due to the postulated MSLB.

15.1-23 Rev. OL-22 11/16

CALLAWAY - SP 15.1.5.3.2 Identification of Uncertainties and Conservatisms in the Analysis

a. Reactor coolant activities are based on an initial radio-iodine spectrum that would conservatively bound those found in either open or tight type fuel defects. Tight fuel defects tend to produce limiting results for thyroid does, while open fuel defects tend to produce limiting results for whole body dose. The assumed concentrations of longer-lived isotopes represent the values that would be reached in the presence of tight fuel defects. The assumed concentractions of shorter-lived isotopes represent the values that would be reached in the presence of open fuel defects. Since the assumed iodine spectrum represents bounding values for different types of fuel defects, the initial radio-iodine inventory would exceed the Technical Specification limit of 1.0 Ci/gm. Additionally, large spiking factors are assumed in the analysis.

b. A 1-gpm steam generator primary-to-secondary leakage is assumed, which is significantly greater than that anticipated during normal operation.

Furthermore, it was conservatively assumed that all leakage is to the affected steam generator only.

c. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that the assumed meteorological conditions would be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, are conservative.

15.1.5.3.3 Conclusions 15.1.5.3.3.1 Filter Loadings The only ESF filtration system considered in the analysis which limits the consequences of the MSLB is the control room filtration system. Activity loadings on the control room charcoal filter are based on flow rate through the filter, the concentration of activity at the filter inlet, and the filter efficiency.

Activity in the control room filter as a function of time has been evaluated for the more limiting LOCA analysis, as discussed in Section 15.6.5.4.3.1. Since the control room filters are capable of accommodating the potential design basis LOCA fission product iodine loadings, more than adequate design margin is available with respect to postulated MSLB releases.

15.1-24 Rev. OL-22 11/16

CALLAWAY - SP 15.1.5.3.3.2 Dose to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of a postulated MSLB have been conservatively analyzed, using asusmptions and models described.

The total-body gamma doses due to immersion from direct radiation and the thyroid dose due to inhalation have been analyzed for the 0-2 hour dose at the exclusion area boundary and for the duration of the accident (0 to 8 hrs) at the low-population zone outer boundary. The results are listed in Table 15.1-4. The resultant doses are well within the guideline values of 10 CFR 100.

15.1.5.4 Conclusions The analysis has shown that the criteria stated earlier in Section 15.1.5.1 are satisfied.

Although DNB and possible clad perforation following a steam pipe rupture are not necessarily unacceptable and not precluded by the criteria, the above analysis shows that the DNB design basis is met for any rupture, assuming the most reactive RCCA stuck in its fully withdrawn position.

A safety evaluation was performed to determine the impact of a potential increase in the stroke time of the feedwater isolation valves beyond the value assumed in the analyses (15 seconds) due to the installation of new valve actuators. It was concluded that the results presented in this section for the zero power steamline break event are not adversely affected by this plant modification. As such, the reported results and conclusions remain valid.

15.1.5.5 Steam Line Break with Coincident Control Rod Withdrawal This accident is no longer applicable to Callaway since automatic rod withdrawal is no longer available.

15.1.5.6 Steam System Piping Failure at Full Power 15.1.5.6.1 Identification of Causes and Accident Description A Steamline Rupture - Full Power Core Response transient is defined as a break that results in an increase in steam flow from one or more steam generators. A Steamline Rupture can result from:

• An inadvertent opening of a steam generator dump, safety or relief valve

• A rupture of the main steam piping Increased steam flow from the steam generators causes an increase in the heat extraction rate from the reactor coolant system, resulting in a reduction of primary 15.1-25 Rev. OL-22 11/16

CALLAWAY - SP coolant temperature and pressure. Because negative moderator temperature and Doppler fuel temperature reactivity coefficients are a characteristic of Westinghouse core designs, the core power will inherently seek a level bounded by the steam load demand, assuming no intervention of control, protection, or engineered safeguards systems. The rate at which the PWR approaches equilibrium power with the secondary load is greatest when the reactivity coefficients are the most negative, which corresponds to end-of-life in a fuel cycle. Thus, in the absence of any protective actions, a reactor power level dictated by steam flow rate could be established.

The analysis of the Steamline Rupture - Core Response transient typically found in Safety Analysis Reports assumes zero-power (Mode 2) conditions. The greatest cooldown, and therefore the greatest reactivity excursion, would occur from a Mode 2 condition, where the decay heat level is low and the steam generator shell-side inventory and pressure is high. For a number of years, this was the only steamline rupture - core response event analyzed by Westinghouse. In the mid-70s, Westinghouse generated WCAP-9226 for the steamline rupture event which examined the effects of power level, break size, plant variations and single failures. This WCAP concluded that ... the largest double-ended steamline rupture at end of life, hot shutdown conditions with the most reactive RCCA in the fully withdrawn position is a limiting and sufficiently conservative licensing basis to demonstrate that the Westinghouse PWR is in compliance with 10CFR100 criteria for Condition II, III and IV steamline break transients. However, plant modifications may have been made over the years which challenge the applicability of the assumptions that went into the original WCAP, such as the Overtemperature and Overpower response times, lead/lag time constants, etc. As a result, the full power steamline break event has been analyzed to demonstrate that the applicable acceptance criteria continue to be satisfied.

15.1.5.6.2 Analysis of Effects and Consequences 15.1.5.6.2.1 Method of Analysis The Steamline Rupture - Full Power Core Response event is analyzed with a Westinghouse version of the RETRAN code (Reference 8).

The RETRAN computer code is a digital computer code, developed to simulate transient behavior in light water reactor systems. The main features of the program include a point kinetics and one-dimensional kinetics model, one-dimensional homogeneous equilibrium mixture thermal-hydraulic model, control system models, two-phase natural convection heat transfer correlations, a non-equilibrium pressurizer model, etc. The results from the RETRAN computer code are used to determine if the applicable criteria defined previously are satisfied for the steamline rupture event.

Several different break sizes are analyzed for the Steamline Rupture - Full Power Core Response transient. The following provides the applicable criteria for the steamline break event. Note that, depending upon the break size, the event is considered to be a 15.1-26 Rev. OL-22 11/16

CALLAWAY - SP Condition III or IV event. However, Condition II criteria are conservatively applied for all break sizes analyzed.

The Main Steamline Rupture accident is classified as a Condition IV event. The design criteria for Condition IV events are as follows:

Condition IV faults shall not cause a release of radiactive material that results in an undue risk to public health and safety exceeding applicable offsite dose requirements.

A single Condition IV fault shall not cause a consequential loss of required functions of systems needed to cope with the fault including those of the reactor coolant system and the reactor containment system.

The applicable subset of design criteria for Condition II steamline breaks, per ANSI N18.2-1973, are as follows:

Any release of radioactive materials in effluents to unrestricted areas shall be in conformance with paragraph 20.1 of 10 CFR Part 20, Standards of Protection Against Radiation.

A single Condition II incident shall not cause consequential loss of function of any barrier to the escape of radioactive products.

The specific criteria for a Condition II Steamline Rupture event applied in the analysis performed are as follows:

1. The pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values, is applied. Since this event results in a decrease in both the primary and secondary side pressures, these criteria are not challenged by a steamline break event and will therefore not be considered here.

2. Westinghouse applies the stringent criterion of meeting the DNB design basis for this Condition III/IV event, which requires that DNB will not occur on the lead rod with at least a 95% probability at a 95% confidence level. It has also been traditional practice to assume that failure will occur if centerline melting takes place. Therefore, the fuel damage criteria also includes demonstrating that the peak linear heat generation rate (expressed in kW/ft) does not exceed a value which would cause fuel centerline melt.

The Steamline Rupture - Full Power Core Response transient is primarily analyzed for DNBR and overpower concerns. Pressurizer overfill (due to continued SI flow) and RCS overpressurization concerns are not addressed through this analysis.

The aim of the analysis is to demonstrate that a reactor trip occurs in adequate time to ensure fuel and cladding damage is precluded. Breaks of various sizes are postulated to 15.1-27 Rev. OL-22 11/16

CALLAWAY - SP occur in the steam line before the Main Steam Isolation Valve (MSIV). For the RSG design, each steam line has an effective flow area of 4.6 ft2, with a flow restrictor having an affective flow area of 1.39 ft2. This flow restrictor is an integral part of the steam generator.

A range of break sizes are analyzed, ranging from breaks smaller than or equivalent to the inadvertent opening of a steam system valve to the hypothetical double-ended rupture of a main steam line. The larger break sizes generate reactor trips on the low steamline pressure - safety injection - reactor trip function while smaller breaks trip on the Overpower reactor trip function. The most limiting break size is the largest break case that results in a reactor trip on the Overpower reactor trip function.

The reanalysis of this event performed to support the Callaway Overtemperature (O ) and Overpower (OP) Margin Recovery Program incorporates the improved setpoints.

15.1.5.6.2.2 Assumptions The analysis assumptions are as follows:

a. Initial Operating Conditions The initial condition assumptions for DNBR concerns are consistent with the application of the Revised Thermal Design Procedure (RTDP, Reference 4). Initial reactor power, RCS pressure and temperature are assumed to be at the nominal full power values.

The overpower evaluation is essentially dependent upon the Overpower setpoints which are a set of predefined combinations of power and temperature. These setpoints do not change with the initial conditions used. As a result, the initial conditions assumed for the DNBR case are adequate for use in evaluating the potential for core overpower.

b. Moderator and Doppler Power Coefficients of Reactivity.

The reactivity feedback model used includes a most-positive moderator density coefficient and least-negative Doppler power coefficient.

c. Reactor Control The reactor is assumed to be in manual rod control (no rod control modeled).

d. Pressurizer Pressure Control Pressurizer heaters are assumed to be inoperable. Pressurizer sprays and PORVs are assumed to be available, in order to minimize the RCS pressure.

15.1-28 Rev. OL-22 11/16

CALLAWAY - SP

e. Reactor Trip Reactor Trip is initiated on one of the following signals, depending on the break size:

• Safety Injection following a Low Steam Pressure in any steam line, or

• OPDT in any two loops.

f. Turbine Trip Turbine trip is initiated following reactor trip.

15.1.5.6.2.3 Results The transient response for the Steamline Rupture - Full Power Core Response analysis is shown in Figures 15.1-21 through 15.1-26. Table 15.1-1a gives the time sequence of events for the limiting break size of 0.87 ft2.

15.1.5.6.3 Conclusions The analysis shows that the acceptance criteria stated above are satisfied with the improved setpoints proposed as a result of the Callaway OTDT and OPDT Margin Recovery Program. The DNBR safety analysis limit is met, and there is no fuel centerline melt.

15.

1.6 REFERENCES

1. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A, April 1984.

2. Moody, F. S., "Transactions of the ASME, Journal of Heat Transfer," Figure 3, page 134, February 1965.

3. Hollingsworth, S. D. and Wood, D. C., "Reactor Core Response to Excessive Secondary Steam Releases," WCAP-9226, Revision 1, (Proprietary), February, 1988, and WCAP-9227, Revision 1, (Non-Proprietary), February 1998.

4. WCAP-11397-P-A (Proprietary), WCAP-11397-A (Non-proprietary), Revised Thermal Design Procedure, A. J. Friedland and S. Ray, April 1989.

5. Union Electric Letter to NRC, ULNRC-1258, dated 2-18-86.

6. Letter from A. C. Thadani (NRC) to W. J. Johnson (Westinghouse), January 31, 1989,

Subject:

"Acceptance for Referencing of Licensing Topical Report, WCAP-9226-P (Proprietary) and WCAP-9227 (Non-Proprietary), Reactor Core Response to Excessive Secondary Steam Releases."

15.1-29 Rev. OL-22 11/16

CALLAWAY - SP

7. Union Electric Letter to NRC, ULNRC-1493, dated 4-16-87, approved by OL Amendment No. 22 dated May 4, 1987.

8. WCAP-14882-P-A, Revision 0, RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, April 1999.

9. SCP-94-162, Callaway (SCP) Mode 3 SLB Evaluation, January 4, 1995.

10. SCP-07-19, Main Steam Isolation Valve (MSIV) Stroke Time Evaluation Phase 2 Report Revision 0, February 16, 2007.

11. WCAP-14565-P-A (Proprietary), WCAP-15306-A (Non-Proprietary), VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, Y. X. Sung, October 1999.

12. WCAP-14565-P-A Addendum 2 P-A (Proprietary), Extended Application of ABB-NV Correlation and Modified ABB-NV Correlation WLOP for PWR Low Pressure Applications, A. Leidich, et. al., April 2008.

15.1-30 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.1-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS THAT RESULT IN AN INCREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Time Accident Event (sec)

Excessive feedwater flow at full One main feedwater control valve 0.0 power - Single-loop case fails fully open High-high steam generator water 45.1 level setpoint reached Feedwater isolation complete 62.1 Minimum DNBR occurs 67.6 Low-low steam generator water level 149.4 setpoint reached Rods begin to drop 151.4 Turbine trip occurs due to reactor trip 153.4 Excessive feedwater flow at full All main and bypass feedwater power - Multi-loop case control valves fail fully open 0.0 High-high steam generator water level setpoint reached 61.2 Feedwater isolation complete 78.2 Minimum DNBR occurs 81.6 Low-low steam generator water level setpoint reached 210.3 Rods begin to drop 212.3 Turbine trip occurs due to reactor trip 214.3 Excessive feedwater flow at zero All bypass feedwater control valves power - Multi -loop case fail fully open 0.0 Safety Injection Signal on Low Pressurizer Pressure 25.5 High-high steam generator water level setpoint reached 29.5 Feedwater isolation complete 42.5 Minimum DNBR occurs 72.2 Reduction in feedwater temperature at full power Delivery of cooler feedwater begins 0.0 Overpower T setpoint reached 41.6 Rods begin to drop 43.6 Minimum DNBR occurs 44.0 Turbine trip occurs due to reactor trip 45.6 Safety injection on low pressurizer 89.7 pressure reached Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.1-1 (Sheet 2)

Time Accident Event (sec)

Feedwater isolation valves close 106.7 automatically Excessive increase in secondary steam flow

1. Manual reactor control 10-percent step load increase 0.0 (minimum moderator feedback)

Equilibrium conditions reached* 100

2. Manual reactor control 10-percent step load increase 0.0 (maximum moderator feedback)

Equilibrium conditions reached* 50

3. Automatic reactor control 10-percent step load increase 0.0 (minimum moderator feedback)

Equilibrium conditions reached* 150

4. Automatic reactor 10-percent step load 0.0 control (maximum increase moderator feedback)

Equilibrium conditions reached* 50 Steam system piping failure

1. Case 1 (offsite power Steamline ruptures 0 available) Low steamline pressure setpoint 0.510 reached in faulted loop Low steamline pressure setpoint 2.059 reached in intact loops Steamline isolation occurs 17.510 Criticality attained ~23 SI actuation 28 Boron reaches core 100

2. Case 2 (concurrent loss of Steamline ruptures 0 offsite power) Low steamline pressure setpoint 0.510 reached in faulted loop Low steamline pressure setpoint 2.059 reached in intact loops Steamline isolation occurs 17.510 Criticality attained ~30 SI actuation 40 Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.1-1 (Sheet 3)

Time Accident Event (sec)

Boron reaches core 112

• Approximate time only Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.1-1a TIME SEQUENCE OF EVENTS FOR THE STEAMLINE RUPTURE -

FULL POWER CORE RESPONSE LIMITING BREAK SIZE (0.87 FT2)

Event Time (seconds)

Break initiation with reactor at full power 0.0 OPT condition reached in Loop 4 20.4 OPT condition reached in Loops 1-2-3 23.1 Rods start to move on OPT Reactor Trip 25.1 Minimum DNBR reached 25.5 Maximum core heat flux reached 25.5 Turbine trip following reactor trip 27.1 Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.1-2 EQUIPMENT REQUIRED FOLLOWING A RUPTURE OF A MAIN STEAN LINE Short-Term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Reactor trip and safeguard actuation channels, including Auxiliary feedwater system, including pumps, water Steam generator power-operated relief valves sensors, circuitry, and processing equipment (the supply, steam generator atmospheric relief valves and protection circuits used to trip the reactor on undervoltage, system valves and piping (this system must be placed in Control for defeating automatic safety injection actuation underfrequency, and turbine trip may be excluded) service to supply water to operable steam generators after during a cooldown and depressurization (i.e., SIS is reset) the incident)

Safety injection system, including the pumps, the refueling Containment air coolers Residual heat removal system, including pumps, heat water storage tank, and the system valves and piping exchanger, and system valves and piping necessary to Capability for obtaining reactor coolant system sample cool and maintain the reactor coolant system in a cold shutdown condition Containment spray system Capability for boration to required hot standby Capability to depressurize the reactor coolant system to concentration allow residual heat removal system operation Diesel generators and emergency power distribution equipment Essential service water system Containment air coolers Auxiliary feedwater system, including pumps, water supplies, piping and valves Main feedwater control valves (trip closed feature)

Bypass feedwater control valves (trip closed feature)

Primary and secondary safety valves Capability to borate to cold shutdown concentration Associated pump room coolers Circuits and/or equipment required to trip the main feedwater pumps*

Main feedwater isolation valves (trip closed feature)

Main steam isolation valves (trip closed feature)

Main steam isolation bypass valves (trip closed feature)

Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.1-2 (Sheet 2)

Short-Term (Required for Mitigation of Accident) Hot Standby Required for Cooldown Steam generator blowdown isolation valves (automatic closure feature)

BBatteries (Class 1E)

Control room ventilation Control room equipment must not be damaged to an extent where any equipment will be spuriously actuated or any of the equipment contained elsewhere in this list cannot be operated.

Emergency lighting Post-accident monitoring system**

• Not part of primary success path for accident mitigation.

• • See Section 7.5 for a discussion of the post-accident monitoring systems.

Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.1-3 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A MAIN STEAM LINE BREAK I. Source Data:

a. Core power level, Mwt 3636

b. Steam generator tube 1 leakage, gpm

c. Reactor coolant initial iodine activity:

1) Case1 The MSLB Case 1 initial radio-iodine inventory is the same as the Case 1 SGTR initial radio-iodine inventory. Refer to Table 15.6-4.

2) Case 2 The MSLB Case 2 initial radio-iodine inventory is the same as the Case 2 SGTR initial radio-iodine inventory. Refer to Table 15.6-4.

d. Reactor coolant initial noble gas activity:

1) Case1 Based on 1-percent fuel defects as provided in Table 15A-5 (225 Ci/gm DOSE EQUIVALENT XE-133)

2) Case 2 Based on 1-percent fuel defects as provided in Table 15A-5 (225 Ci/gm DOSE EQUIVALENT XE-133)

e. Secondary system initial 10% of Case 1 primary side activity iodine activity

f. Iodine partition factors

1) Affected steam generator 1.0

2) Unaffected steam 0.01 generator

g. Reactor coolant mass, lbs 5.50E+5

h. Steam generator mass

1) Affected steam generator, 1.555E+5 lbs

2) Each unaffected steam 1.555E+5 generator, lbs II. Atmospheric Dispersion Factors See Table 15A-2 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.1-4 RADIOLOGICAL CONSEQUENCES OF A MAIN STEAM LINE BREAK Doses (rem)

CASE 1, accident initiated iodine spike Exclusion area boundary (0-2 hr)

Thyroid 4.9E00 Whole body 1.3E-01 Low-population zone outer boundary (duration)

Thyroid 6.1E00 Whole body 8.8E-02 CASE 2, pre-accident iodine spike Exclusion area boundary (0-2 hr)

Thyroid 4.0E00 Whole body 2.5E-02 Low population zone outer boundary (duration)

Thyroid 1.3E00 Whole body 1.3E-02 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.1-5 SAFETY INJECTION FLOW FOR STEAM LINE BREAK ANALYSES Minimum Pump Curve: One CCP Operated, All Lines Injecting RCS CCP Injected Pressure (psig) Flow (gpm) 0 380.5 100 372.3 200 363.9 300 355.4 400 347.2 500 338.9 600 330.4 700 321.9 800 312.9 900 303.3 1000 293.6 1100 283.8 1200 253.2 1300 241.9 1400 229.4 1500 216.5 1600 203.4 1700 190.2 1800 176.9 1900 163.2 2000 146.9 2100 129.8 2200 110.6 2300 88.5 2400 42.5 2500 0.0 Rev. OL-15 5/06

CALLAWAY - SP 15.2 DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM A number of transients and accidents have been postulated which could result in a reduction of the capacity of the secondary system to remove heat generated in the reactor coolant system (RCS). These events are discussed in this section. Detailed analyses are presented for several such events which have been identified as more limiting than the others.

Discussions of the following RCS coolant heatup events are presented in Section 15.2:

a. Steam pressure regulator malfunction or failure that results in decreasing steam flow

b. Loss of external electrical load

c. Turbine trip

d. Inadvertent closure of main steam isolation valves

e. Loss of condenser vacuum and other events resulting in turbine trip

f. Loss of nonemergency ac power to the station auxiliaries

g. Loss of normal feedwater flow

h. Feedwater system pipe break The above items are considered to be ANS Condition II events, with the exception of a feedwater system pipe break, which is considered to be an ANS Condition IV event.

Section 15.0.1 contains a discussion of ANS classifications and applicable acceptance criteria.

For any increases made to core differential pressure or pressurization rates from core reload or plant modifications, the loop seal purge time for the pressurizer safety valves will be re-examined. A complete discussion of the loop seal purge time can be found in Reference 10.

15.2.1 STEAM PRESSURE REGULATOR MALFUNCTION OR FAILURE THAT RESULTS IN DECREASING STEAM FLOW There are no steam pressure regulators whose failure or malfunction could cause a steam flow transient.

15.2-1 Rev. OL-21 5/15

CALLAWAY - SP 15.2.2 LOSS OF EXTERNAL ELECTRICAL LOAD 15.2.2.1 Identification of Causes and Accident Description A major load loss on the plant can result from loss of external electrical load due to some electrical system disturbance. Offsite ac power remains available to operate plant components, such as the reactor coolant pumps; as a result, the onsite emergency diesel generators are not required to function for this event. Following the loss of generator load, an immediate fast closure of the turbine control valves will occur. This will cause a sudden reduction in steam flow, resulting in an increase in pressure and temperature in the steam generator shell. As a result, the heat transfer rate in the steam generator is reduced, causing the reactor coolant temperature to rise, which in turn causes coolant expansion, pressurizer insurge, and RCS pressure rise. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the condenser were not available, the excess steam would be relieved to the atmosphere. Additionally, main feedwater flow would be lost if the condenser were not available. For this situation, feedwater flow would be maintained by the auxiliary feedwater system.

For a loss of external electrical load without subsequent turbine trip, no direct reactor trip signal would be generated. The plant would trip from the reactor protection system if a safety limit were approached. With full load rejection capability, plant operation would be expected to continue without a reactor trip. A continued steam load of approximately 5 percent would exist after total loss of external electrical load, because of the steam demand of plant auxiliaries.

In the event that a safety limit is approached, protection would be provided by the high pressurizer pressure, high pressurizer water level, and overtemperature T trips.

Voltage and frequency relays associated with the reactor coolant pump provide no additional safety function for this event. Following a complete loss of load, the maximum turbine overspeed would be approximately 8 to 9 percent, resulting in an overfrequency of less than 6 Hz. This resulting overfrequency is not expected to damage the sensors in any way. However, it is noted that testing of the RCP underfrequency channels is required by the Technical Specifications. Any degradation in their performance could be ascertained at that time. Any increased frequency to the reactor coolant pump motors will result in slightly increased flow rate and subsequent additional margin to safety limits.

For postulated loss of load and subsequent turbine generator overspeed, any overfrequency condition is not seen by safety-related pump motors, reactor protection system equipment, or other safeguards loads. Safety-related loads are supplied from offsite power or, alternatively, from emergency diesels. Reactor protection system equipment is supplied from the 118-Volt ac instrument power supply system which, in turn, is supplied from the inverters; the inverters are supplied from a dc bus energized from batteries or by a rectified ac voltage from safeguards busses.

In the event that the steam dump valves and steam generator/ PORVs fail to open following a large loss of load, the steam generator safety valves may lift, and the reactor 15.2-2 Rev. OL-21 5/15

CALLAWAY - SP may be tripped by the high pressurizer pressure signal, the high pressurizer water level signal, or the overtemperature T signal. The steam generator shell side pressure and reactor coolant temperature will increase rapidly. The pressurizer safety valves and steam generator safety valves are, however, sized to protect the RCS and steam generator against overpressure for all load losses without assuming the operation of the steam dump system, steam/generator PORVs, pressurizer spray, pressurizer power-operated relief valves, automatic rod control (control banks), or direct reactor trip on turbine trip.

The steam generator safety valve capacity is sized to remove the steam flow at 100 percent of rated thermal power from the steam generator without exceeding 110 percent of the steam system design pressure. The pressurizer safety valve capacity is sized based on a complete loss of heat sink with the plant initially operating at the maximum calculated turbine load along with operation of the steam generator safety valves. The pressurizer safety valves are then able to relieve sufficient steam to maintain the RCS pressure within 110 percent of the RCS design pressure.

More complete discussions of overpressure protection can be found in Reference 1 and Reference 1a.

A loss of external load is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

A loss of external load event results in a NSSS transient that is less severe than a turbine trip event (see Section 15.2.3). Therefore, a detailed transient analysis is not presented for the loss of external load event.

The primary side transient is caused by a decrease in heat transfer capability from primary to secondary, due to a rapid termination of steam flow to the turbine, accompanied by an automatic reduction of feedwater flow. Should feedwater flow not be reduced, a larger heat sink would be available and the transient would be less severe.

Termination of steam flow to the turbine following a loss of external load occurs due to automatic fast closure of the turbine control valves in approximately 0.2 seconds.

Following a turbine trip event, termination of steam flow occurs via turbine stop valve closure, which occurs in approximately 0.19 seconds. Therefore, the transient in primary pressure, temperature, and water volume will be less severe for the loss of external load than for the turbine trip due to a slightly slower loss of heat transfer capability.

The protection available to mitigate the consequences of a loss of external load is the same as that for a turbine trip, as listed in Table 15.0-6.

15.2.2.2 Analysis of Effects and Consequences Refer to Section 15.2.3.2 for the method used to analyze the limiting transient (turbine trip) in this grouping of events. The results of the turbine trip event analysis are more 15.2-3 Rev. OL-21 5/15

CALLAWAY - SP severe than those expected for the loss of external load, as discussed in Section 15.2.2.1.

Plant systems and equipment which may be required to function to mitigate the effects of a complete loss of load are discussed in Section 15.0.8 and listed in Table 15.0-6.

The reactor protection system may be required to function following a complete loss of external load to terminate core heat input and to prevent departure from nucleate boiling (DNB). Depending on the magnitude of the load loss, pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function. Normal reactor control systems and engineered safety features are not required to function. The auxiliary feedwater system may, however, be automatically actuated following a loss of main feedwater; this will further mitigate the effects of the transient.

15.2.2.3 Conclusions Based on results obtained for the turbine trip event (see Section 15.2.3) and considerations described in Section 15.2.2.1, the applicable acceptance criteria for a loss of external load event are met.

15.2.3 TURBINE TRIP 15.2.3.1 Identification of Causes and Accident Description For a turbine trip event, the reactor would be tripped directly (unless below approximately 50-percent power) from a signal derived from the turbine emergency trip fluid pressure transmitters and turbine stop valve limit switches. The turbine stop valves close rapidly (typically 0.19 second) on loss of trip fluid pressure actuated by one of a number of possible turbine trip signals. Turbine trip initiation signals include:

a. Generator trip

b. Low condenser vacuum

c. Loss of lubricating oil

d. Turbine thrust bearing failure

e. Turbine overspeed

f. Manual trip Upon initiation of stop valve closure, steam flow to the turbine stops abruptly. Limit switches on the stop valves detect the turbine trip and initiate a reactor trip if above 15.2-4 Rev. OL-21 5/15

CALLAWAY - SP 50-percent power. The loss of steam flow results in an almost immediate rise in secondary system temperature and pressure, with a resultant primary system transient as described in Section 15.2.2.1 for the loss of external load event. A more severe transient occurs for the turbine trip event, due to the more rapid loss of steam flow caused by the more rapid valve closure.

The automatic steam dump system would normally accommodate the excess steam generation. Reactor coolant temperatures and pressure do not significantly increase if the steam dump system and pressurizer pressure control system are functioning properly. If the turbine condenser was not available, the excess steam generation would be dumped to the atmosphere and main feedwater flow would be lost. For this situation, feedwater flow would be maintained by the auxiliary feedwater system to ensure adequate residual and decay heat removal capability. Should the steam dump system fail to operate, the steam generator safety valves may lift to provide pressure control.

See Section 15.2.2.1 for a further discussion of the transient.

A turbine trip is classified as an ANS Condition II event, fault of moderate frequency.

See Section 15.0.1 for a discussion of Condition II events.

A turbine trip event is more limiting than loss of external load, loss of condenser vacuum, and other turbine trip events. As such, this event has been analyzed in detail. Results and discussion of the analysis are presented in Section 15.2.3.2.

15.2.3.2 Analysis of Effects and Consequences Method of Analysis In this analysis, the behavior of the plant is evaluated for a complete loss of steam load from full power without direct reactor trip. This is done to show the adequacy of the pressure relieving devices, and also to demonstrate core protection margins. The reactor is not tripped until conditions in the RCS result in a trip. The turbine is assumed to trip without actuating all the turbine stop valve limit switches. This assumption delays reactor trip until conditions in the RCS result in a trip due to other signals. Thus, the analysis assumes a worst-case transient. In addition, no credit is taken for steam dump.

Main feedwater flow is terminated at the time of turbine trip, with no credit taken for auxiliary feedwater (except for long-term recovery) to mitigate the consequences of the transient.

The turbine trip transients are analyzed by employing the detailed digital computer code RETRAN (Ref. 11). RETRAN simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generators, and steam generator safety valves. It also computes pertinent plant variables, including temperatures, pressures, and power level.

Plant characteristics and initial conditions are discussed in Section 15.0.3.

15.2-5 Rev. OL-21 5/15

CALLAWAY - SP Major assumptions are summarized below:

a. Initial Operating Conditions The initial core power, reactor coolant temperature, and reactor coolant pressure are assumed to be at the most limiting nominal values. The DNBR calculations are performed using the Revised Thermal Design Procedure (RTDP), in which the uncertainties in the initial conditions are included in the DNBR limit value, as described in Reference 4. For the peak RCS pressure calculations, uncertainties of 2% and -60 psi are applied to the initial core power and reactor coolant pressure, respectively.

A temperature uncertainty ranging between +4.3°F and -3.5°F is also accounted for in the analysis.

b. Moderator and Doppler Coefficients of Reactivity The turbine trip is analyzed assuming minimum reactivity feedback. These cases assume a moderator temperature coefficient of 0 pcm/°F and the least negative Doppler coefficient. Maximum reactivity feedback cases have been determined to be non-limiting with respect to both DNB and peak pressure concerns. These cases are no longer analyzed.

c. Reactor control From the standpoint of the maximum pressures attained, it is conservative to assume that the reactor is in manual control. If the reactor were in automatic control, the control rod banks would move prior to trip and reduce the severity of the transient.

d. Steam release No credit is taken for the operation of the steam dump system or steam generator power-operated relief valves. The steam generator pressure rises to the point where steam release through safety valves occurs thus limiting the secondary steam pressure increase.

e. Pressurizer spray and power-operated relief valves Two cases are analyzed:

1. For the DNB case, full credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or limiting the coolant pressure. Safety valves are also available.

2. For the overpressure case, no credit is taken for the effect of pressurizer spray and power-operated relief valves in reducing or 15.2-6 Rev. OL-21 5/15

CALLAWAY - SP limiting the coolant pressure. Safety valves are operable. This case conservatively accounts for the effects of the pressurizer safety valve loop seals, as discussed in Reference 10.

f. Feedwater flow Main feedwater flow to the steam generators is assumed to be lost at the time of turbine trip. No credit is taken for auxiliary feedwater flow since a stabilized plant condition will be reached before auxiliary feedwater initiation is normally assumed to occur; however, the auxiliary feedwater pumps would be expected to start on a trip of the main feedwater pumps.

The auxiliary feedwater flow would remove core decay heat following plant stabilization.

g. Reactor trip is actuated by the first reactor protection system trip setpoint reached, with no credit taken for the direct reactor trip on the turbine trip.

Trip signals are expected due to high pressurizer pressure, overtemperature T, high pressurizer water level, and low-low steam generator water level.

Plant systems and equipment which may be required to function to mitigate the effects of a turbine trip event are discussed in Section 15.0.8 and listed in Table 15.0-6.

Except as discussed, normal reactor control systems and engineered safety features are not required to function. Cases are presented in which pressurizer spray and power-operated relief valves are assumed, but the more limiting cases where those functions are not assumed are also presented.

The reactor protection system may be required to function following a turbine trip.

Pressurizer safety valves and/or steam generator safety valves may be required to open to maintain system pressures below allowable limits. No single active failure will prevent operation of any system required to function.

Results The transient responses for a turbine trip from full power operation are shown for two cases that assume minimum reactivity feedback with and without automatic pressure control (Figures 15.2-1 through 15.2-8). The calculated sequence of events for the accident is shown in Table 15.2-1.

Figures 15.2-1 through 15.2-4 show the transient responses for the total loss of steam load with minimum reactivity feedback, assuming full credit for the pressurizer spray and pressurizer power-operated relief valves. No credit is taken for the steam dump. The reactor is tripped by overtemperature T trip channels. The minimum DNBR remains well above the safety analysis limit values. The pressurizer safety valves are actuated 15.2-7 Rev. OL-21 5/15

CALLAWAY - SP for this case and maintain system pressure below 110 percent of the design value. The steam generator safety valves open and limit the secondary steam pressure increase.

The turbine trip accident was also studied assuming the plant to be initially operating at full power with no credit taken for the pressurizer spray, pressurizer power-operated relief valves, or steam dump. The reactor is tripped on the high pressurizer pressure signal. Figures 15.2-5 through 15.2-8 show the transient responses for this case. The reactor power remains essentially constant at full power, until the reactor is tripped. In this case, the pressurizer safety valves are actuated, and maintain system pressure below 110 percent of the design value.

Reference 1a presents additional results of analysis for a complete loss of heat sink, including loss of main feedwater. This analysis shows the overpressure protection that is afforded by the pressurizer and steam generator safety valves.

15.2.3.3 Conclusions Results of the analyses, including those in Reference 1a, show that the plant design is such that a turbine trip without a direct or immediate reactor trip presents no hazard to the integrity of the RCS or the main steam system. Pressure-relieving devices incorporated in the two systems are adequate to limit the maximum pressures to within the design limits.

The integrity of the core is maintained by operation of the reactor protection system, i.e.,

the DNBR will be maintained above the safety analysis limit values. The applicable acceptance criteria as listed in Section 15.0.1 have been met. The above analysis demonstrates the ability of the NSSS to safely withstand a full load rejection.

15.2.4 INADVERTENT CLOSURE OF MAIN STEAM ISOLATION VALVES Inadvertent closure of the main steam isolation valves would result in a turbine trip with no credit taken for the steam dump system. Turbine trips are discussed in Section 15.2.3.

15.2.5 LOSS OF CONDENSER VACUUM AND OTHER EVENTS RESULTING IN TURBINE TRIP Loss of condenser vacuum is one of the events that can cause a turbine trip. Turbine trip initiating events are described in Section 15.2.3. A loss of condenser vacuum would preclude the use of steam dump to the condenser; however, since steam dump is assumed not to be available in the turbine trip analysis, no additional adverse effects would result if the turbine trip were caused by loss of condenser vacuum. Therefore, the analysis results and conclusions contained in Section 15.2.3 apply to the loss of the condenser vacuum. In addition, analyses for the other possible causes of a turbine trip, as listed in Section 15.2.3.1, are covered by Section 15.2.3. Possible overfrequency 15.2-8 Rev. OL-21 5/15

CALLAWAY - SP effects due to a turbine overspeed condition are discussed in Section 15.2.2.1, and are not a concern for this type of event.

15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES 15.2.6.1 Identification of Causes and Accident Description A complete loss of nonemergency ac power may result in the loss of all power to the plant auxiliaries, i.e., the reactor coolant pumps, condensate pumps, etc. The loss of power may be caused by a complete loss of the offsite grid accompanied by a turbine generator trip at the station, or by a loss of the onsite ac distribution system.

With respect to DNB, this transient is more severe than the turbine trip event analyzed in Section 15.2.3 because, for this case, the decrease in heat removal by the secondary system is accompanied by a flow coastdown which further reduces the capacity of the primary coolant to remove heat from the core. The reactor will trip: 1) due to turbine trip,

2) upon reaching one of the trip setpoints in the primary and secondary systems as a result of the flow coastdown and decrease in secondary heat removal, or 3) due to the loss of power to the control rod drive mechanisms as a result of the loss of power to the plant.

Following a loss of ac power with turbine and reactor trips, the sequence described below will occur:

a. Plant vital instruments are supplied from emergency dc power sources.

b. As the steam system pressure rises following the trip, the steam generator power-operated relief valves may be automatically opened to the atmosphere. The condenser is assumed not to be available for steam dump. If the steam flow rate through the power-operated relief valves is not available, the steam generator safety valves may lift to dissipate the stored thermal energy of the reactor coolant system and fuel plus the residual decay heat produced in the reactor.

c. As the no-load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

d. The standby diesel generators, started on loss of voltage on the plant emergency busses, begin to supply plant vital loads.

The auxiliary feedwater system is started automatically, as follows:

15.2-9 Rev. OL-21 5/15

CALLAWAY - SP

a. Two motor-driven auxiliary feedwater pumps are started on any of the following:

1. Low-low level in one or more steam generators

2. Any safety injection signal

3. Loss of offsite power

4. Trip of both main feedwater pumps

5. Manual actuation

b. One turbine-driven auxiliary feedwater pump is started on any of the following:

1. Low-low level in any two steam generators

2. Loss of offsite power

3. Manual actuation The motor-driven auxiliary feedwater pumps are supplied power by the diesels, and the turbine-driven pump utilizes steam from the secondary system. Both types of pump are designed to supply rated flow within 1 minute of the initiating signal, even if a loss of all nonemergency ac power occurs simultaneously with loss of normal feedwater. The turbine exhausts the secondary steam to the atmosphere. It is conservatively assumed that auxiliary feedwater reaches the steam generators 90 seconds following the initiating signal to account for full closure of the feedwater isolation valves.

The auxiliary feedwater pumps take suction from the nonsafety-related condensate storage tank (CST); however, this tank is not seismic Category I and in the case of an SSE or tornado hazard, the unprotected CST may be unavailable and is not credited for accident mitigation. In this case, they take suction from the essential service water system, which is credited for accident mitigation.

Upon the loss of power to the reactor coolant pumps, coolant flow necessary for core cooling and the removal of residual heat is maintained by natural circulation in the reactor coolant loops.

A loss of nonemergency ac power to the station auxiliaries is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events. With respect to DNB, a loss of ac power event is a more limiting event than the turbine-trip initiated decrease in secondary heat removal without loss of ac power, which is analyzed in Section 15.2.3. However, a loss of ac power to the plant 15.2-10 Rev. OL-21 5/15

CALLAWAY - SP auxiliaries, as postulated above, could also result in a loss of normal feedwater if the condensate pumps lose their power supply.

Following the reactor coolant pump coastdown caused by the loss of ac power, the natural circulation capability of the RCS will remove residual and decay heat from the core, aided by auxiliary feedwater in the secondary system. The DNB transient for this event is bounded by the complete loss of flow event. An analysis is presented here to show that the natural circulation flow in the RCS following a loss of ac power event is sufficient to remove residual heat from the core.

15.2.6.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis, using the RETRAN code (Ref. 11), is performed to obtain the plant transient following a loss of ac power. The simulation describes the plant neutron kinetics, RCS including natural circulation, pressurizer, steam generators, and feedwater system. The digital program computes pertinent variables, including the steam generator level, pressurizer water level, pressurizer pressure, and reactor coolant average temperature.

Assumptions made in the analysis are:

a. The plant is initially operating at 102 percent of NSSS power.

b. The initial Tavg is set at the low nominal Tavg (570.7°F) minus 3.5°F. This results in a higher RCS coolant mass, which causes a larger transient pressurizer water volume.

c. A conservative core residual heat generation based upon the ANS 1979 Decay Heat Model (Reference 5) and assuming long-term operation at the initial power level preceding the trip.

d. A heat transfer coefficient in the steam generator associated with RCS natural circulation, following the reactor coolant pump coastdown.

e. Reactor trip occurs on steam generator low-low water level (0 percent of narrow range span). No credit is taken for immediate release of the control rod drive mechanisms caused by a loss of offsite power.

f. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The worst single failure in the auxiliary feedwater system is the failure of the turbine-driven pump. Both motor-driven auxiliary feedwater pumps are assumed to supply a total of 800 gpm equally split among the four steam generators. Auxiliary feedwater 15.2-11 Rev. OL-21 5/15

CALLAWAY - SP reaches the steam generators 90 seconds following the initiating signal to account for full feedwater isolation valve closure.

g. The pressurizer spray valves are assumed operable. This assumption maximizes the transient pressurizer water volume.

h. Separate cases assuming operable and inoperable pressurizer PORVs have been considered.

i. Secondary system steam relief is achieved through the steam generator safety valves.

j. The high head ECCS charging pumps, which are initiated on a loss of offsite power signal through the LSELS shutdown sequencer are not assumed to function for this event as their operation is a benefit with respect to long term core decay heat removal.

k. Pressurizer backup and proportional heaters are conservatively assumed to be operable. Actuation of the heaters contributes to the thermal expansion of the liquid within the pressurizer, thus maximizing the transient water volume.

l. Assumption (j) above states that the analysis does not take credit for the operation of the high head ECCS charging pumps. However, their continued operation following a loss of offsite power will increase the reactor coolant inventory if the letdown isolation valve fails closed due to a subsequent loss of instrument air. Although this is a benefit with respect to long term core decay heat removal, it may lead to pressurizer filling, similar to the inadvertent ECCS Actuation at Power event described in Section 15.5.1. For this reason, an additional scenario was examined, using the LOFTRAN code (Reference 2), to determine if the operators have sufficient time to unblock the pressurizer power-operated relief valves to preclude water relief through the pressurizer safety valves, as currently assumed in Section 15.5.1.

All assumptions made are consistent with those listed above, with the exception that maximum CVCS flow is modeled and that proportional heaters are assumed to become inoperable upon the loss of offsite power.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

The loss of nonemergency ac power analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing long term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization and subsequent loss of RCS water (see assumption (l) above).

15.2-12 Rev. OL-21 5/15

CALLAWAY - SP As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

The assumptions used in the analysis are essentially identical to the loss of normal feedwater flow incident (Section 15.2.7), except that power is assumed to be lost to the reactor coolant pumps at the time of reactor trip.

Results The transient response of the RCS following a loss of ac power with pressurizer PORVs unavailable is shown in Figures 15.2-9 through 15.2-11. The calculated sequence of events for this transient is listed in Table 15.2-1. The first few seconds after the loss of power to the reactor coolant pumps will closely resemble a simulation of the complete loss of flow incident (see Section 15.3.2); i.e., core damage due to rapidly increasing core temperatures is prevented by promptly tripping the reactor. After the reactor trip, stored and residual decay heat must be removed to prevent damage to either the RCS or the core.

The RETRAN code results show that the natural circulation flow available is sufficient to provide adequate core decay heat removal following reactor trip and RCP coast-down.

A separate case was run with high head ECCS charging pumps initiated on a loss of offsite power signal (see assumption (l) above). This case did result in the filling of the pressurizer. However, this occurred sufficiently late in the transient such that operator action to unblock both pressurizer power-operated relief valves could be credited to preclude water relief through the pressurizer safety valves. This action was assumed to occur 9 minutes following the loss of offsite power while pressurizer filling occurred well after this time. This case is analyzed similar to the Inadvertent ECCS at Power event, discussed in Section 15.5.1, where operator action is required to unblock the pressurizer power-operated relief valves thereby precluding water relief through the pressurizer safety valves.

15.2.6.3 Radiological Consequences 15.2.6.3.1 Method of Analysis 15.2.6.3.1.1 Physical Model The dose calculation for loss of ac power is based on the sequence of events described in Table 15.2-1. It is assumed that heat removal from the nuclear steam supply system is achieved by venting the steam for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

The reactor coolant is assumed to be contaminated by radioactive fission products introduced through fuel cladding defects. The secondary system is contaminated by the inleakage of reactor coolant through postulated steam generator tube leaks.

15.2-13 Rev. OL-21 5/15

CALLAWAY - SP The radioactivity in the vented steam is dispersed in the atmosphere without any reduction due to plateout, fallout, filtering, etc.

15.2.6.3.1.2 Assumptions and Conditions The major assumptions and parameters assumed in the analysis are found in Tables 15.2-2 and 15.A-1. The assumptions used to determine the activity released are as follows:

a. The reactor coolant initial iodine activity assumed is the Technical Specification limit of 1.0 Ci/gm I-131 dose equivalent (adjusted consistent with Table 15.6-4 item I.c.1).

b. The initial secondary system iodine activity assumed is 1/10 of the initial reactor coolant iodine activity.

c. A 1-gpm steam generator primary-to-secondary leakage is assumed for the duration of steam venting.

d. For noble gases, the activity released is taken to be the activity introduced by reactor coolant inleakage without holdup in the steam system.

e. The partition factor for iodine in the steam generators is taken as 0.01 for secondary side releases and 1.0 for iodine in primary-to-secondary leakage. This assumption is conservatively based on a leak in the upper tubes which are assumed to be uncovered for the accident duration.

f. The atmospheric dispersion factors are given in Table 15A-2.

15.2.6.3.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

b. The atmospheric dispersion factors used in the analysis were calculated using the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum.

c. The thyroid inhalation and total-body immersion doses to a receptor at the exclusion area boundary or outer boundary of the low population zone were analyzed using the models described in Appendix 15A.

15.2-14 Rev. OL-21 5/15

CALLAWAY - SP 15.2.6.3.1.4 Identification of Leakage Pathways and Resultant Leakage Activities Normal activity paths from the secondary system, such as the condenser air removal system and steam generator blowdown, cease during loss of ac power. The steam is released to the atmosphere through the:

a. Power-operated atmospheric relief valves

b. Main steam safety valves Since all these paths are taken as direct to the atmosphere without any form of decontamination, they are all radiologically equivalent and need not be distinguished.

15.2.6.3.2 Identification of Uncertainties in, and Conservative Aspects of, the Analysis The principal uncertainties in the dose calculation arise from the uncertainties in the accident circumstances, particularly the extent of steam contamination, the weather at the time, and delay before preferred ac power is restored. Each of these uncertainties is handled by making very conservative or worst-case assumptions.

a. Reactor coolant activities are based on the Technical Specification limit, which is significantly higher than the activities associated with normal operating conditions, based on 0.12-percent failed fuel.

b. A 1-gpm steam generator primary-to-secondary leakage is assumed, which is significantly greater than that anticipated during normal operation.

c. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that the assumed meteorological conditions would be present during the course of the accident for any extended period of time. Therefore, the evaluated radiological consequences, based on the meteorological conditions assumed, will be conservative.

15.2.6.3.3 Conclusions 15.2.6.3.3.1 Filter Loadings No filter serves to limit the release of radioactivity in this accident. There is no significant activity buildup on any filters as a consequence of loss of ac power.

15.2.6.3.3.2 Doses to Receptor at Exclusion Area Boundary and Low Population Zone Outer Boundary The maximum doses to an individual who spends the first 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> after loss of ac power at the exclusion area boundary, and the maximum doses for a long-term exposure (8 15.2-15 Rev. OL-21 5/15

CALLAWAY - SP hours or longer) at the outer boundary of the low-population zone, are given in Table 15.2-3. These doses are very small compared with the guideline values of 10 CFR 100.

15.2.6.4 Conclusions Results of the analysis show that, for the loss of non-emergency ac power to plant auxiliaries event, all safety criteria are met. Auxiliary feedwater capacity is sufficient to prevent water relief through the pressurizer relief and safety valves; this assures that the RCS is not overpressurized.

Analysis of the natural circulation capability of the RCS demonstrates that sufficient long term heat removal capability exists following reactor coolant pump coastdown to prevent fuel or clad damage.

15.2.7 LOSS OF NORMAL FEEDWATER FLOW 15.2.7.1 Identification of Causes and Accident Description A loss of normal feedwater, from pump failures, valve malfunctions, or loss of offsite ac power, or feedwater control system failure, results in a reduction in the capability of the secondary system to remove the heat generated in the reactor core. If an alternative supply of feedwater were not supplied to the plant, core residual heat following reactor trip would heat the primary system water to the point where water relief from the pressurizer would occur, resulting in a substantial loss of water from the RCS. Since the plant is tripped well before the steam generator heat transfer capability is reduced, the primary system variables never approach a DNB condition.

The reactor trip on low-low water level in one or more steam generators provides the necessary protection against a loss of normal feedwater.

The following occur upon loss of normal feedwater (assuming main feedwater pump failures or valve malfunctions):

a. As the steam system pressure rises following the trip, the steam generator power-operated relief valves are automatically opened to the atmosphere.

Steam dump to the condenser is assumed not to be available. If the steam flow through the power-operated relief valves is not available, the steam generator safety valves may lift to dissipate the stored thermal energy of the reactor coolant system and fuel plus the residual decay heat produced in the reactor.

b. As the no-load temperature is approached, the steam generator power-operated relief valves (or safety valves, if the power-operated relief valves are not available) are used to dissipate the residual decay heat and to maintain the plant at the hot shutdown condition.

15.2-16 Rev. OL-21 5/15

CALLAWAY - SP A loss of normal feedwater is classified as an ANS Condition II event, fault of moderate frequency. See Section 15.0.1 for a discussion of Condition II events.

The auxiliary feedwater system is started automatically, as discussed in Section 15.2.6.1.

The turbine-driven auxiliary feedwater pump utilizes steam from the secondary system and exhausts to the atmosphere. The motor-driven auxiliary feedwater pumps are supplied by power from the diesel generators. The pumps take suction directly from the nonsafety-related CST for delivery to the steam generators. However, this tank is not seismic Category I, and in the case of an SSE or tornado hazard, the unprotected CST may not be available and is not credited for accident mitigation. In this case, they will take suction from the essential service water system, which is credited for accident mitigation. An analysis of the system transient is presented below to show that, following a loss of normal feedwater, the auxiliary feedwater system is capable of removing the stored and residual heat, thus preventing either overpressurization of the RCS or loss of water from the reactor core, and returning the plant to a safe condition.

15.2.7.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN code (Ref. 11) is performed to obtain the plant transient following a loss of normal feedwater. The simulation describes the plant neutron kinetics, RCS, pressurizer, steam generators, and feedwater system. The digital program computes pertinent variables, including the steam generator level, pressurizer water level, and reactor coolant average temperature.

Assumptions made in the analysis are:

a. The plant is initially operating at 102 percent of NSSS power.

b. A conservative core residual heat generation, based upon the ANS 1979 Decay Heat Model (Reference 5) and assuming long-term operation at the initial power level preceding the trip.

c. Reactor trip occurs on steam generator low-low water level at 0 percent of narrow range span.

d. The auxiliary feedwater system is actuated by the low-low steam generator water level signal.

e. The worst single failure in the auxiliary feedwater system is the failure of the turbine-driven pump. The auxiliary feedwater system is assumed to supply a total of 800 gpm equally split among the four steam generators from both motor-driven pumps. Auxiliary feedwater reaches the steam generators 90 seconds following the initiating signal to account for full feedwater isolation valve closure.

15.2-17 Rev. OL-21 5/15

CALLAWAY - SP

f. The pressurizer sprays are assumed operable. This maximizes the peak transient pressurizer water volume.

g. Separate cases assuming operable and inoperable pressurizer PORVs have been considered.

h. Secondary system steam relief is achieved through the steam generator safety valves.

i. The pressurizer proportional and backup heaters are assumed operable.

Actuation of the heaters contributes to the thermal expansion of the liquid within the pressurizer, thus maximizing the transient water volume.

The loss of normal feedwater analysis is performed to demonstrate the adequacy of the reactor protection and engineered safeguards systems (e.g., the auxiliary feedwater system) in removing long-term decay heat and preventing excessive heatup of the RCS with possible resultant RCS overpressurization and subsequent loss of RCS water.

As such, the assumptions used in this analysis are designed to minimize the energy removal capability of the system and to maximize the possibility of water relief from the coolant system by maximizing the coolant system expansion, as noted in the assumptions listed above.

For the loss of normal feedwater transient, the reactor coolant volumetric flow remains at its normal value, and the reactor trips via the low-low steam generator level trip. The reactor coolant pumps may be manually tripped at some later time to reduce heat addition to the RCS.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

Normal reactor control systems are not assumed to function if they will mitigate the effects of the accident. The reactor protection system is required to function following a loss of normal feedwater, as analyzed here. The auxiliary feedwater system is required to deliver a minimum auxiliary feedwater flow rate. No single active failure will prevent operation of any system required to function.

Results Figures 15.2-12 through 15.2-14 show the significant plant parameters following a loss of normal feedwater with pressurizer PORVs unavailable.

Following the reactor and turbine trip from full load, the water level in the steam generators will fall. This is due to the reduction of steam generator void fraction and because steam flow through the safety valves continues to dissipate the stored and generated heat. Within ninety (90) seconds of the receipt of the low-low level trip signal, both motor-driven auxiliary feedwater pumps are automatically started and feedwater 15.2-18 Rev. OL-21 5/15

CALLAWAY - SP isolation valves are fully closed such that auxiliary feedwater reaches the steam generators, reducing the rate of water level decrease. The auxiliary feedwater pumps are automatically started within sixty (60) seconds, but flow delivery doesnt occur until 90 seconds due to the feedwater isolation valve stroke time.

The capacity of the auxiliary feedwater pumps is such that the water level in the steam generators does not recede below the lowest level at which sufficient heat transfer area is available to dissipate core residual heat without water relief from the RCS relief or safety valves. Figure 15.2-14 shows that at no time is there water relief from the pressurizer.

The calculated sequence of events for this accident is listed in Table 15.2-1. As shown in Figures 15.2-12 through 15.2-14, the plant approaches a stabilized condition following reactor trip and auxiliary feedwater initiation. Plant procedures may be followed to further cool down the plant.

15.2.7.3 Conclusions Results of the analysis show that a loss of normal feedwater does not adversely affect the core, the RCS, or the steam system, since the auxiliary feedwater capacity is such that reactor coolant water is not relieved from the pressurizer relief or safety valves.

15.2.8 FEEDWATER SYSTEM PIPE BREAK 15.2.8.1 Identification of Causes and Accident Description A major feedwater line rupture is defined as a break in a feedwater line large enough to prevent the addition of sufficient feedwater to the steam generators to maintain shell side fluid inventory in the steam generators. If the break is postulated in a feedwater line between the check valve and the steam generator, fluid from the steam generator may also be discharged through the break. Further, a break in this location could preclude the subsequent addition of auxiliary feedwater to the affected steam generator. A break upstream of the feedwater line check valve would affect the NSSS only as a loss of feedwater. This case is covered by the evaluations in Sections 15.2.6 and 15.2.7.

A break inside containment can produce adverse environmental conditions which can induce an error in the steam generator level indication, which is used for initiation of protective functions (reactor trip, auxiliary feedwater actuation and feedwater line isolation). The EAM automatically enables a higher S/G low-low level trip setpoint, which accounts for this environmental error, and guarantees that the low-low level trip signal is generated before the level assumed in this analysis (0% of narrow range span) is reached.

Depending upon the size of the break and the plant operating conditions at the time of the break, the break could cause either an RCS cooldown (by excessive energy discharge through the break) or an RCS heatup. Potential RCS cooldown resulting from 15.2-19 Rev. OL-21 5/15

CALLAWAY - SP a secondary pipe rupture is evaluated in Section 15.1.5. Therefore, only the RCS heatup effects are evaluated for a feedwater line rupture.

A feedwater line rupture reduces the ability to remove heat generated by the core from the RCS for the following reasons:

a. Feedwater flow to the steam generators is reduced. Since feedwater is subcooled, its loss may cause reactor coolant temperatures to increase prior to reactor trip.

b. Fluid in the steam generator may be discharged through the break, and would then not be available for decay heat removal after trip.

c. The break may be large enough to prevent the addition of any main feedwater after trip.

An auxiliary feedwater system is provided to ensure that adequate feedwater will be available such that:

a. No substantial overpressurization of the RCS and main steam system shall occur (less than 110 percent of design pressures).

b. Sufficient liquid in the RCS is maintained so that the core remains inplace and geometrically intact with no loss of core cooling capability. This criterion is met by ensuring that hot leg saturation does not occur.

A major feedwater line rupture is classified as an ANS Condition IV event. See Section 15.0.1 for a discussion of Condition IV events.

The severity of the feedwater line rupture transient depends on a number of system parameters, including break size, initial reactor power, and credit taken for the functioning of various control and safety systems. Sensitivity studies presented in Reference 3 illustrate many of the limiting assumptions for the feedwater line rupture. In addition, the major assumptions pertinent to this analysis are defined below.

The main feedwater control system is assumed to fail to conservatively account for control and protection system interaction in an adverse environment. The water levels in all steam generators are assumed to decrease equally until the low-low steam generator level reactor trip setpoint is reached. After reactor trip, a double-ended rupture of a feedwater line is assumed. These assumptions conservatively bound the most limiting feedwater line rupture that can occur. Analyses have been performed at full power, with and without loss of offsite power, with the operation of the pressurizer power-operated relief valves, assuming no SI actuation. For the cases without offsite power available, the power is assumed to be lost at the time of reactor trip. This is more conservative than the case where power is lost at the initiation of the event.

15.2-20 Rev. OL-21 5/15

CALLAWAY - SP The following provides the necessary protection for a main feedwater line rupture:

a. A reactor trip on any of the following conditions:

1. High pressurizer pressure

2. Overtemperature T

3. Low-low steam generator water level in one or more steam generators

4. Safety injection signals from any of the following (see Item p in Section 15.2.8.2):

1) 2/3 low steam line pressure in any one loop or

2) 2/3 high containment pressure (Hi-1)

b. An auxiliary feedwater system provides an assured source of feedwater to the steam generators for decay heat removal. Refer to Section 10.4.9 for a description of the auxiliary feedwater system.

15.2.8.2 Analysis of Effects and Consequences Method of Analysis A detailed analysis using the RETRAN code (Ref. 11) is performed in order to determine the plant transient following a feedwater line rupture. The code models the neutron kinetics, RCS, pressurizer safety valves, steam generators, steam generator safety valves, and feedwater system, and computes pertinent variables, including the pressurizer pressure, pressurizer water volume, and reactor coolant average temperature.

The cases analyzed assume a double-ended rupture of the largest feedwater pipe at full power.

Major assumptions made in the analysis are as follows:

a. The plant is initially operating at 102 percent of NSSS power.

b. Initial reactor coolant average temperature is 4.3°F above the nominal value, and the initial pressurizer pressure is 60 psi below its nominal value.

Plant characteristics and initial conditions are further discussed in Section 15.0.3.

c. Normal reactor control systems are not assumed to function unless their operation results in more severe consequences. Therefore, the 15.2-21 Rev. OL-21 5/15

CALLAWAY - SP pressurizer PORVs are assumed to operate to minimize RCS pressure, which results in a lower saturation temperature. Pressurizer spray and heaters are assumed to be inoperable.

d. Initial pressurizer level is at the nominal programmed value plus 5 percent of narrow range span; initial steam generator water mass is at the nominal value plus 6.2 percent in all steam generators.

e. No credit is taken for the high pressurizer pressure reactor trip.

f. Main feedwater flow to all steam generators is assumed to be lost at the time the break occurs (all main feedwater spills out through the break).

g. The worst possible break area is assumed. This maximizes the blowdown discharge rate following the time of trip, which maximizes the resultant heatup of the reactor coolant.

h. Choked flow at the break is assumed.

i. Reactor trip is assumed to be initiated when the low-low level trip setpoint (0 percent of narrow range span) in all four steam generators is reached.

The analysis assumes the water level in all four steam generators decreases equally, at the same rate. The reactor trip coincidence logic is satisfied by two out of four steam generator water level channels in any steam generator sensing a low-low level condition.

j. The auxiliary feedwater system is actuated by the low-low steam generator water level signal. The auxiliary feedwater system is assumed to supply a total of 543.2 gpm at a steam generator pressure of 1200 psia to three unaffected steam generators, including allowance for possible spillage through the main feedwater line break. A bounding 90-second delay was assumed following the low-low level signal to allow time for startup of the emergency diesel generators and the auxiliary feedwater pumps and complete closure of the feedwater isolation valves (stroke time of 90-seconds). An additional 332.4 seconds was assumed for the voided, unaffected feedwater lines to fill.

k. No credit is taken for heat energy deposited in RCS metal during the RCS heatup.

l. No credit is taken for charging or letdown.

m. Steam generator heat transfer area is assumed to decrease as the shell side liquid inventory decreases.

15.2-22 Rev. OL-21 5/15

CALLAWAY - SP

n. Conservative core residual heat generation is based on the 1979 version of ANS-5.1 (Reference 5). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates.

o. No credit is taken for the following potential protection logic signals to mitigate the consequences of the accident:

1. High pressurizer pressure

2. Overtemperature T

3. High pressurizer level

4. High containment pressure

p. Although it is expected that the actuation of the safety injection system would occur during this event, the analysis conservatively does not model safety injection flow.

Receipt of a low-low steam generator water level trip signal from one or more steam generators starts the motor-driven auxiliary feedwater pumps, which then deliver feedwater flow to the steam generators. The turbine-driven auxiliary feedwater pump is initiated if the low-low steam generator level signal is reached in at least two steam generators. Similarly, receipt of a low steam line pressure signal in at least one steam line initiates a steam line isolation signal which closes the main steam isolation valves in all steam lines. This signal also gives a safety injection signal which initiates flow of cold borated water into the RCS (not credited in this analysis). The amount of safety injection flow is a function of RCS pressure.

Emergency operating procedures following a feedwater system pipe rupture typically require the following actions to be taken by the reactor operator:

a. Isolate feedwater flow spilling from the ruptured feedwater line and align the system so that the level in the intact steam generators is recovered.

b. Safety injection via the ECCS centrifugal charging pumps (CCPs) should be terminated in accordance with the emergency operating procedures.

Subsequent to terminating safety injection, plant operating procedures will be followed in cooling the plant to a safe shutdown condition. However, these actions are taken during the reactor recovery phase and are not modeled in the safety analysis.

The reactor protection system is required to function following a feedwater line rupture as described above. No single active failure will prevent operation of this system.

15.2-23 Rev. OL-21 5/15

CALLAWAY - SP The engineered safety features assumed to function are the auxiliary feedwater system and the emergency core cooling system. For the auxiliary feedwater system, the worst case configuration has been used, i.e., only three intact steam generators receive auxiliary feedwater following the break. Auxiliary feedwater flow is modeled as a function of steam generator pressure. A discharge flow control device, located on the auxiliary feedwater line to each steam generator, is assumed to regulate the flow from the motor-driven auxiliary feedwater (AFW) pump associated with the affected steam generator. This ensures that, at a steam generator pressure of 1200 psia, a minimum flow of 158.8 gpm is delivered from one motor-driven AFW pump to the intact steam generator fed by the same motor-driven AFW pump that is feeding the affected steam generator. Without the flow control device, all the flow from this motor-driven AFW pump would go out the break. The turbine-driven AFW pump has been assumed to fail. The second motor-driven AFW pump is assumed to deliver 384.4 gpm equally split to the two remaining intact steam generators (192.2 gpm per steam generator at a pressure of 1200 psia). This, a total flow of 543.2 gpm is delivered to the intact steam generators at a pressure of 1200 psia (158.8 gpm delivered to the intact steam generator fed by the motor-driven AFW pump feeding the affected loop and 192.2 gpm to each of the other two intact steam generators).

For the feedline rupture without offsite power, there will be a flow coastdown following RCP trip until flow in the loops reaches the natural circulation value. The natural circulation capability of the RCS has been shown in Section 15.2.6 to be sufficient to remove core decay heat following reactor trip. Pump coastdown characteristics are demonstrated in Sections 15.3.1 and 15.3.2 for single and multiple reactor coolant pump trips, respectively.

A detailed description and analysis of the emergency core cooling system is provided in Section 6.3. The auxiliary feedwater system is described in Section 10.4.9.

Results Calculated plant parameters following a major feedwater line rupture are shown in Figures 15.2-15 through 15.2-26 Results for the case with offsite power available are presented in Figures 15.2-15 through 15.2-20. Results for the case where offsite power is lost are presented in Figures 15.2-21 through 15.2-26. The calculated sequences of events for both cases analyzed are listed in Table 15.2-1.

The system response following the feedwater line rupture is similar for both cases analyzed. Figures 15.2-15 and 15.2-21 show that following reactor trip the plant remains subcritical. Results presented in Figures 15.2-16 and 15.2-20 (with offsite power available) and Figures 15.2-22 and 15.2-26 (without offsite power) show that pressures in the RCS and main steam system remain below 110 percent of the respective design pressures. Pressurizer pressure increases until reactor trip occurs on low-low steam generator level. Pressure then decreases due to the relative loss of heat input. Coolant expansion then occurs due to reduced heat transfer capability in the steam generators.

This in turn causes the pressurizer pressure to increase once again and remain at the 15.2-24 Rev. OL-21 5/15

CALLAWAY - SP PORV setpoint until the heatup portion of the transient is over. The pressurizer does not empty, thus the reactor remains covered with water throughout the transient.

All applicable acceptance criteria are met.

15.2.8.3 Conclusions Results of the analyses show that for the postulated feedwater line rupture, the assumed auxiliary feedwater system capacity is adequate to remove decay heat, to prevent overpressurizing the RCS, and to prevent uncovering the reactor core. Radioactivity doses from the postulated feedwater lines rupture are less than those previously presented for the postulated steam line break. All applicable acceptance criteria are therefore met.

A safety evaluation, Reference 12, was performed to determine the impact of a potential increase in the stroke time of the main steamline isolation valves (MSIVs) beyond the value assumed in the analysis (15 seconds) due to the installation of new system-medium valve actuators. It was concluded that the results presented in this section for the feedwater system pipe break are not adversely affected by the system-medium MSIV actuator stroke time. As such, the reported results and conclusions remain valid.

15.

2.9 REFERENCES

1. Cooper, L., Miselis, V. and Starek, R. M., "Overpressure Protection for Westinghouse Pressurized Water Reactors," WCAP-7769, Revision 1, June, 1972 (also letter NS-CE-622, dated April 16, 1975, C. Eicheldinger (Westinghouse) to D. B. Vassallo (NRC), additional information on WCAP-7769, Revision 1).

1a. J. E. Fontes, "Overpressure Protection Report for the Union Electric Co. Callaway Plant," Revision 3, dated 8/94. (SCP 94-143) Prepared for Amendment 128 (OL-1186) MSSV Setpoint Tolerance Change.

2. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A, April 1984.

3. Lang, G. E. and Cunningham, J. P., "Report on the Consequences of a Postulated Main Feedline Rupture," WCAP-9230 (Proprietary) and WCAP-9231 (Non-Proprietary), January 1978.

4. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure,"

WCAP-11397-P-A, April 1989.

5. ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors", August 1979.

15.2-25 Rev. OL-21 5/15

CALLAWAY - SP

6. Leach, C. E., Gongaware, B. L., Tuley, C. R., Erin, L. E., Miranda, S.,

"Implementation of the Steam Generator Low-Low Level Reactor Trip Time Delay and Environmental Allowance Modifier in the Callaway Plant", WCAP-11883 (Proprietary) and WCAP-11884 (Non-Proprietary), August 1988, submitted via ULNRC-1822 dated 8-30-88 and approved via Amendment 43 to Facility Operating License NPF-30 dated 4-14-89.

The following exceptions are taken to the surveillance test methodology defined in Section 3.6.2 of WCAP 11883:

1) Each level channel is tested one-at-a-time during the level channel testing with zero time delay as described in the WCAP.

2) The TTD function and timers discussed in Reference 6 are no longer applicable to Callaway.

3) Section 3.6.2.2 is titled OUTAGE TESTING. The PROM logic modules and the EAM testing described under this section may be performed on-line and not restricted to performance during outages.

7. Catullo, W. J. Jr., et. al., "Modifications of the Steam Generator Low-Low Level Trip Setpoint to Reduce Feedwater-Related Trips", WCAP-11342-P-A, Rev. 1, April 1988.

8. Miranda, S., et. al., "Steam Generator Low Water Level Protection System Modifications to Reduce Feedwater-Related Trips", WCAP-11325-P-A, Rev. 1, February 1988.

9. Union Electric letters ULNRC-1863 dated 11-18-88, ULNRC-1884 dated 12-28-88, and ULNRC-1913 dated 2-15-89.

10. Barrett, G.O., et.al, "Pressurizer Safety Valve Set Pressure Shift," WCAP-12910, Rev. 1-A, May 1993.

11. Huegel, D. S., et. al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.

12. SCP-07-19, Main Steam Isolation Valve (MSIV) Stroke Time Evaluation Phase 2 Report Revision 0, February 16, 2007.

15.2-26 Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.2-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN HEAT REMOVAL BY THE SECONDARY SYSTEM Time Accident Event (sec)

Turbine Trip

1. With pressurizer pressure control Turbine trip; loss of main 0.0 feedwater flow Initiation of steam release from 6.6 steam generator safety valves Peak RCS pressure occurs 12.3 Overtemperature T reactor trip 17.3 setpoint reached Minimum DNBR occurs 17.8 Rods begin to drop 19.3

2. Without pressurizer pressure control Turbine trip; loss of main 0.0 feedwater flow High pressurizer pressure reactor 6.1 trip setpoint reached Rods begin to drop 7.1 Initiation of steam release from 7.8 steam generator safety valves Peak RCS pressure occurs 9.1 Loss of nonemergency ac power Main feedwater flow stops 0.0 Low-low level setpoint reached in 40.1 all SGs Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.2-1 (Sheet 2)

Time Accident Event (sec)

Rods begin to drop 42.1 AC power is lost and reactor 44.1 coolant pumps begin to coast down First peak water mixture level in 44.1 pressurizer occurs Both motor-driven auxiliary 132.1 feedwater (AFW) pumps reach full speed and begin to deliver AFW to the steam generators with feedwater isolation valves fully closed.

Second peak water mixture level 3,202.5 in pressurizer occurs Loss of normal feedwater flow Main feedwater flow stops 0.0 Low-low level setpoint reached 40.1 Rods begin to drop 42.1 First peak water mixture level in 44.6 pressurizer occurs Both motor-driven auxiliary 132.1 feedwater (AFW) pumps reach full speed and begin to deliver AFW to the steam generators with feedwater isolation valves fully closed.

Second peak water mixture level 1,081.5 in pressurizer occurs Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.2-1 (Sheet 3)

Time Accident Event (sec)

Feedwater system pipe break

1. With offsite power available EAM enables harsh environment 0.0 low-low level trip setpoint Feedwater control system 0.0 malfunction occurs due to harsh environment Low-low steam generator water 44.4 level reactor trip setpoint reached in all steam generators Rods begin to drop and faulted 46.4 steam generator begins discharging fluid directly out of the break Steam generator safety valve 47.8 setpoint reached (first occurrence)

Low steam line pressure setpoint 118.5 reached in ruptured steam generator Main steam line isolation valves 135.5 closed Main feedwater isolation valves 136.4 closed Auxiliary feedwater is delivered to 468.8 intact steam generators Steam generator safety valve 714.9 setpoint reached in intact steam generators (second occurrence)

Core decay heat plus pump heat ~2,810 decreases to auxiliary feedwater heat removal capacity Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.2-1 (Sheet 4)

Time Accident Event (sec)

2. Without offsite power available EAM enables harsh environment 0.0 low-low level trip setpoint Feedwater control system 0.0 malfunction occurs due to harsh environment Low-low steam generator water 44.4 level reactor trip setpoint reached in all steam generators Low-low steam generator water 46.4 level trip signal is generated Rods begin to drop and feedwater 46.4 line rupture occurs Steam generator safety valve 47.8 setpoint reached (first occurrence)

Power lost to reactor coolant 48.4 pumps Low steam line pressure setpoint 97.0 reached in ruptured steam generator Main steam line isolation valves 114.0 closed Main feedwater isolation valves 136.4 closed Steam generator safety valve 366.2 setpoint reached in intact steam generators (second occurrence)

Auxiliary feedwater is delivered to 468.8 intact steam generators Core decay heat decreases to ~1,220 auxiliary feedwater heat removal capacity Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.2-2 PARAMETERS USED IN EVALUATING RADIOLOGICAL CONSEQUENCES OF LOSS OF NONEMERGENCY AC POWER I. Source Data

a. Steam generator tube leakage, gpm 1

b. Reactor coolant initial iodine activity 1.0 Ci/gm of I-131 dose equivalent (adjusted consistent with Table 15.6-4 item I.c.1)

c. Secondary system initial iodine activity Equivalent to 1/10 of the dose equivalent initial RCS iodine activity

d. Reactor coolant initial noble gas activity Based on 1 percent fuel defects, as provided in Table 11.1-5

e. Iodine partition factor in the steam 0.01 generators for secondary side releases

f. Iodine partition factor in the steam 1.0 generators for primary-to-secondary leakage

g. Each steam generator water mass, lb 1.032E+5 II. Atmospheric Dispersion Factors See Table 15A-2 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.2-3 RADIOLOGICAL CONSEQUENCES OF LOSS OF NONEMERGENCY AC POWER Doses (rem)

Exclusion area boundary (0-2 hr)

Thyroid 6.2E-02 Whole body 4.9E-04 Low-population zone, outer boundary (duration)

Thyroid 2.9E-02 Whole body 1.4E-04 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.2-4 DELETED Table 15.2-4 is Deleted.

Rev. OL-13 5/03

CALLAWAY - SP 15.3 DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE A number of faults are postulated which could result in a decrease in reactor coolant system (RCS) flow rate. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.

Discussions of the following flow decrease events are presented in Section 15.3:

a. Partial loss of forced reactor coolant flow

b. Complete loss of forced reactor coolant flow

c. Reactor coolant pump shaft seizure (locked rotor)

d. Reactor coolant pump shaft break Item a above is considered to be an ANS Condition II event, item b an ANS Condition III event, and items c and d ANS Condition IV events. Section 15.0.1 contains a discussion of ANS classifications.

15.3.1 PARTIAL LOSS OF FORCED REACTOR COOLANT FLOW 15.3.1.1 Identification of Causes and Accident Description A partial loss-of-coolant flow accident can result from a mechanical or electrical failure in a reactor coolant pump, or from a fault in the power supply to the pump or pumps supplied by a reactor coolant pump bus. If the reactor is at power at the time of the accident, the immediate effect of the loss of coolant flow is a rapid increase in the coolant temperature. This increase could result in DNB with subsequent fuel damage if the reactor is not tripped promptly.

Normal power for the pumps is supplied through individual busses connected to the generator and the offsite power system. When a generator trip occurs, the busses continue to be supplied from external power lines, and the pumps continue to supply coolant to the core. Following most turbine trips where there are no electrical faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the generator, thus ensuring full flow for approximately 30 seconds after the reactor trip before any transfer is made. The exception to this are turbine trips actuated by the turbine protection system for low bearing oil pressure, thrust bearing wear, turbine high vibration, high condenser backpressure, and manual trip pushbutton. These turbine trips have no time delay added to the trip circuit. In the cases where a turbine trip results in an immediate generator trip or a generator trip due to an electrical fault de-energizes the pump busses, the reactor coolant pump motors will be transferred to offsite power within 6 to 10 cycles.

15.3-1 Rev. OL-18 12/10

CALLAWAY - SP This event is classified as an ANS Condition II incident (a fault of moderate frequency),

as defined in Section 15.0.1.

The necessary protection against a partial loss-of-coolant accident is provided by the low primary coolant flow reactor trip signal, which is actuated in any reactor coolant loop by two out of three low flow signals. Above Permissive P-8, low flow in any loop will actuate a reactor trip. Between 10-percent power (Permissive P-7) and the power level corresponding to Permissive P-8 (48 percent power), low flow in any two loops will actuate a reactor trip. Above Permissive P-7, undervoltage at one out of two RCP motors on both PA system (13.8 kV AC) buses will also result in a reactor trip which serves as a backup to the low flow trip.

15.3.1.2 Analysis of Effects and Consequences Method of Analysis The loss of two reactor coolant pumps with four loops in operation have been analyzed.

The loss of an RCP event is analyzed with two computer codes. First, the RETRAN (Ref. 1) computer code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, and the primary system pressure and temperature transients. The VIPRE (Ref. 2) computer code is then used to calculate the hot-channel heat flux transient and DNBR, based on the nuclear power and RCS temperature (enthalpy), pressure, and flow from RETRAN.

The DNBR transients presented represent the minimum of the typical or thimble cell.

This accident is analyzed with the RTDP as described in Reference 3. Plant characteristics and initial conditions are discussed in Section 15.0.3.

Initial Conditions Initial pressure and RCS temperature are assumed to be at their nominal values. Plant characteristics and initial conditions are discussed in Section 15.0.3. Uncertainties in initial operating conditions are included in the DNBR limits as described in Reference 3.

Reactivity Coefficients A conservatively large absolute value of the Doppler-only power coefficient is used (see Figure 15.0-2). This is equivalent to a total integrated Doppler reactivity from 0- to 100-percent power of 0.016 k.

A moderator temperature coefficient of 0 pcm/°F is assumed. This results in the maximum core power during the initial part of the transient, when the minimum DNBR is reached.

15.3-2 Rev. OL-18 12/10

CALLAWAY - SP For these analyses, the curve of trip reactivity insertion versus time (Figure 15.0-5) was used.

Flow Coastdown The flow coastdown analysis is based on a momentum balance around each reactor coolant loop and across the reactor core. This momentum balance is combined with the continuity equation, a pump momentum balance, and the pump characteristics, and is based on high estimates of system pressure losses.

Plant systems and equipment which are necessary to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

Results Figures 15.3-1 through 15.3-4 show the transient response for the loss of two reactor coolant pumps with four loops in operation. Figure 15.3-4 shows the DNBR to be always greater than the safety analysis limit values.

Since the DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events for the case analyzed are shown in Table 15.3-1.

The affected reactor coolant pumps will continue to coast down, and the core flow will reach a new equilibrium value corresponding to the number of pumps still in operation.

With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.1.3 Conclusions The analysis shows that the DNBR will not decrease below the safety analysis limit values at any time during the transient. Thus no fuel or clad damage is predicted, and all applicable acceptance criteria are met.

15.3.2 COMPLETE LOSS OF FORCED REACTOR COOLANT FLOW 15.3.2.1 Identification of Causes and Accident Description A complete loss of forced reactor coolant flow may result from a simultaneous loss of electrical supplies to all reactor coolant pumps. If the reactor is at power at the time of the accident, the immediate effect of loss-of-coolant flow is a rapid increase in the coolant temperature. This increase could result in a DNB with subsequent fuel damage if the reactor were not tripped promptly.

15.3-3 Rev. OL-18 12/10

CALLAWAY - SP Normal power for the reactor coolant pumps is supplied through busses from a transformer connected to the generator and the offsite power system. There are two pumps per bus. When a generator trip occurs, the busses continue to be supplied from external power lines, and the pumps continue to supply coolant flow to the core.

Following most turbine trips where there are no electrical faults which require tripping the generator from the network, the generator remains connected to the network for approximately 30 seconds. The reactor coolant pumps remain connected to the generator, thus ensuring full flow for 30 seconds after the reactor trip before any transfer is made. The exception to this are turbine trips actuated by the turbine protection system for low bearing oil pressure, thrust bearing wear, turbine high vibration, high condenser backpressure, and manual trip pushbutton. These turbine trips have no time delay added to the trip circuit. In the cases where a turbine trip results in an immediate generator trip or a generator trip due to an electrical fault de-energizes the pump busses, the reactor coolant pump motors will be transferred to offsite power within 6 to 10 cycles.

This event is classified as an ANS Condition III event (an infrequent fault), as defined in Section 15.0.1.

The following signals provide the necessary protection against a complete loss of flow accident:

a. Reactor coolant pump power supply undervoltage or underfrequency

b. Low reactor coolant loop flow The reactor trip on reactor coolant pump undervoltage is provided to protect against conditions which can cause a loss of voltage to all reactor coolant pumps, i.e., loss of ac power to plant auxiliaries. This function is blocked below 10-percent power (Permissive P-7).

The reactor trip on reactor coolant pump underfrequency is provided to trip the reactor for an underfrequency condition resulting from frequency disturbances on the power grid.

Reference 4 provides analyses of grid frequency disturbances and the resulting NSSS protection requirements which are applicable to Callaway.

Reference 4 shows that the underfrequency trip of the reactor coolant pump breakers is not required for grid decay rates up to 5 Hz/sec. Grid stability and transient analyses for Callaway Plant show maximum grid decay rates of less than 5 Hz/sec. Therefore, the reactor coolant pump breaker trip on underfrequency (Figure 7.2-1) is not a safety function for the Callaway design.

The reactor trip on low primary coolant loop flow is provided to protect against loss of flow conditions which affect only one reactor coolant loop. This function is generated by two out of three low flow signals per reactor coolant loop. Above Permissive P-8, low flow in any loop will actuate a reactor trip. Between 10-percent power (Permissive P-7) and the power level corresponding to Permissive P-8 (48 percent power), low flow in any 15.3-4 Rev. OL-18 12/10

CALLAWAY - SP two loops will actuate a reactor trip. If the maximum grid frequency decay rate is less than approximately 2.5 Hertz per second, the low flow trip function will protect the core from underfrequency events. This effect is fully described in Reference 4.

15.3.2.2 Analysis of Effects and Consequences Method of Analysis The complete loss of flow transient has been analyzed for a loss of all four reactor coolant pumps with four loops in operation.

The method of analysis and the assumptions made regarding initial operating conditions and reactivity coefficients are identical to those discussed in Section 15.3.1, except that, following the loss of power supply to all pumps at power, a reactor trip is actuated by either reactor coolant pump power supply undervoltage or underfrequency.

Results Figures 15.3-5 through 15.3-8 show the transient response for the loss of power to all reactor coolant pumps with four loops in operation. The reactor is assumed to be tripped on an undervoltage signal. Figure 15.3-8 shows the DNBR to be always greater than the safety analysis limit values.

Since DNB does not occur, the ability of the primary coolant to remove heat from the fuel rod is not greatly reduced. Thus, the average fuel and clad temperatures do not increase significantly above their respective initial values.

The calculated sequence of events for the case analyzed is shown in Table 15.3-1. The reactor coolant pumps will continue to coast down, and natural circulation flow will eventually be established, as demonstrated in Section 15.2.6. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.2.3 Conclusions The analysis performed has demonstrated that, for the complete loss of forced reactor coolant flow, the DNBR does not decrease below the safety analysis limit value at any time during the transient. Thus, no fuel or clad damage is predicted, and all applicable acceptance criteria are met. The design basis for the DNBR is described in Section 4.4.

All applicable acceptance criteria are met.

15.3-5 Rev. OL-18 12/10

CALLAWAY - SP 15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR) 15.3.3.1 Identification of Causes and Accident Description The accident postulated is an instantaneous seizure of a reactor coolant pump rotor, as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, leading to an initiation of a reactor trip on a low flow signal.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced - first, because the reduced flow results in a decreased tube side film coefficient, and then, because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation, and would be expected to function properly during the accident. However, for conservatism, their pressure-reducing effect, as well as the pressure-reducing effect of the spray, are not included in the analysis.

This event is classified as an ANS Condition IV incident (a limiting fault), as defined in Section 15.0.1.

15.3.3.2 Analysis of Effects and Consequences Method of Analysis The locked rotor event is analyzed with two computer codes. First, the RETRAN (Ref. 1) computer code is used to calculate the loop and core flow during the transient, the time of reactor trip based on the calculated flows, the nuclear power transient, an the primary system pressure and temperature transients. The VIPRE (Ref. 2) computer code is then used to calculate the hot-channel heat flux transient and DNBR, based on the nuclear power and RCS temperature (enthalpy), pressure, and flow from RETRAN. The DNBR transients presented represent the minimum of the typical or thimble cell.

At the beginning of the postulated locked rotor accident, done in support of the dose evaluation, the plant is assumed to be operating at 102 percent of the core rated thermal power. Parameters used in evaluating the radiological consequences of a locked rotor accident can be found in Table 15.3-3. Plant characteristics and initial conditions are further discussed in Section 15.0.3.

For the case without offsite power available, power is lost to the unaffected pumps simultaneously with reactor trip. Grid stability analyses show that the grid will remain 15.3-6 Rev. OL-18 12/10

CALLAWAY - SP stable and that offsite power will not be lost because of a plant trip from 100 percent power. Previous analyses used a 2 second delay (based on a grid stability analysis) to a loss of power to the unaffected pumps. Assuming a 0 second delay to the loss of power to the unaffected pumps is conservative in the current analysis of the event.

For the peak pressure evaluation, the initial pressure is conservatively estimated as 30 psi above nominal pressure (2,250 psia) to allow for errors in the pressurizer pressure measurement and control channels. This is done to obtain the highest possible rise in the coolant pressure during the transient. The pressure response shown in Figure 15.3-10 is at the point in the RCS having the maximum pressure. The maximum RCS pressure following a locked rotor accident shall not exceed 2735 psig. This analysis acceptance criterion is equal to 110% of the RCS design pressure.

In response to NSAL-09-2 (Reference 6), forty five (45) psi is added to the peak RCS pressure calculated for the locked rotor accident. This penalty is used to account for an event in which the initial pressurizer water level is at a maximum value rather than the nominal value.

Evaluation of the Pressure Transient After pump seizure, the neutron flux is rapidly reduced by control and shutdown bank insertion. Rod motion is assumed to begin 1 second after the flow in the affected loop reaches 87 percent of nominal flow. No credit is taken for the pressure-reducing effect of the pressurizer relief valves, pressurizer spray, steam dump, or controlled feedwater flow after plant trip.

Although these operations are expected to occur and would result in a lower peak pressure, an additional degree of conservatism is provided by ignoring their effect.

The pressurizer safety valves are modeled such that the effects of loop seals are conservatively accounted for, per the description provided in Reference 5. Their capacity for steam relief is described in Section 5.4.

Evaluation of DNB in the Core During the Accident For this accident, DNB is assumed to occur in the core at the beginning of the accident and, therefore, an evaluation of the consequences with respect to fuel rod thermal transients is performed. Results obtained from analysis of this "hot spot" condition represent the upper limit with respect to clad temperature and zirconium water reaction.

In the evaluation, the rod power at the hot spot is assumed to be 2.60 times the average rod power at the initial core power level.

Film Boiling Coefficient The film boiling coefficient is calculated in the VIPRE code using the Bishop-Sandberg-Tong film boiling correlation. The fluid properties are evaluated at film temperature. The 15.3-7 Rev. OL-18 12/10

CALLAWAY - SP program calculates the film coefficient at evey time step based upon the actual heat transfer conditions at the time. The nuclear power, system pressure, bulk density, and RCS flow rate as a function of time are based on the RETRAN results.

Fuel Clad Gap Coefficient The magnitude and time dependence of the heat transfer coefficient between fuel and cladding (gap coefficient) has a pronounced influence on the thermal results. The larger the value of the gap coefficient, the more heat is transferred between the pellet and cladding. Based on investigations on the effect of the gap coefficient upon the maximum cladding temperature during the transient, the gap coefficient was assumed to increase from a steady-state value consistent with initial fuel temperature to 10,000 BTU/hr-ft2-°F at the initiation of the transient. Therefore, the large amount of energy stored in the fuel because of the small initial value is released to the cladding at the initiation of the transient.

Zirconium-Steam Reaction The zirconium-steam reaction can become significant above 1,800°F (clad temperature).

The Baker-Just parabolic rate equation shown below is used to define the rate of the zirconium-steam reaction.

2

( w -) 45, 500

= 33.3 x 10 exp - -------------------

d 6 dt 1.986T where:

w = amount reacted, mg/cm2 t = time, sec T = temperature,°K The reaction heat is 1,510 cal/gm.

The effect of zirconium-steam reaction is included in the calculation of the "hot spot" clad temperature transient.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

Results 15.3-8 Rev. OL-18 12/10

CALLAWAY - SP The transient results with and without offsite power available are shown in Figures 15.3-9 through 15.3-12. The results of these calculations are also summarized in Table 15.3-2.

The peak RCS pressure reached during the transient is less than that which would cause stresses to exceed the faulted condition stress limits. Also, the peak clad temperature is considerably less than 2,700°F. The clad temperature was conservatively calculated, assuming that DNB occurs at the initiation of the transient.

The calculated sequence of events is shown on Table 15.3-1. Figure 15.3-9 shows that the core flow rapidly reaches a new equilibrium value. With the reactor tripped, a stable plant condition will eventually be attained. Normal plant shutdown may then proceed.

15.3.3.3 Radiological Consequences 15.3.3.3.1 Method of Analysis 15.3.3.3.1.1 Physical Model The instantaneous seizure of a reactor coolant pump rotor results in a reactor trip on a low coolant flow signal. With the coincident loss of offsite power, the condensers are not available, so the excess heat is removed from the secondary system by steam relief through the steam generator safety and relief valves. Steam generator tube leakage is assumed to continue until the pressures in the reactor coolant and secondary systems are equalized. The reactor coolant will contain the gap activities of the fraction of the fuel which undergoes DNB in addition to its assumed equilibrium activity.

15.3.3.3.1.2 Assumptions and Conditions The major assumptions and parameters used in the analysis are itemized in Tables 15.3-3 and 15A-1 and summarized below.

The assumption used to determine the initial concentrations of isotopes in the reactor coolant and secondary coolant prior to the accident are as follows:

a. The reactor coolant iodine activity is based on the dose equivalent of 1.0 Ci/gm of I-131 (adjusted consistent with Table 15.6-4 item I.c.1).

b. The noble gas activity in the reactor coolant is based on 1-percent fuel defects.

c. The initial secondary system iodine activity assumed is 1/10 of the initial reactor coolant iodine activity.

The following conditions are used to calculate the activity released.

a. 5 percent of the core gap activity is released to the reactor coolant at the beginning of the accident.

15.3-9 Rev. OL-18 12/10

CALLAWAY - SP

b. Offsite power is lost.

c. Following the incident, steam is released to the environment for heat removal.

d. Primary-to-secondary leakage continues after the accident for a period of 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. At that time, reactor coolant and secondary system pressures are equalized. Until the pressure equalizes, the leakage rate is assumed to be constant and equal to the rate existing prior to the incident of 1 gpm (500 lbs/hr).

e. Fission products released from the fuel-cladding gap of the damaged fuel rods are assumed to be instantaneously and homogeneously mixed with the reactor coolant.

f. The noble gas activity released is equal to the amount present in the reactor coolant which leaks into the secondary system after the accident.

g. The partition factor for iodine in the steam generators is taken as 0.01 for secondary side releases and 0.161 for iodine in primary-to-secondary leakage. This assumption is conservatively based on a leak in the upper tubes which are assumed to be uncovered for the accident duration.

h. The activity released from the steam generators is immediately vented to the environment.

i. No credit is taken for radioactive decay or ground deposition during radioactivity transport to offsite locations.

j. Breathing rates, short-term accident atmospheric dispersion factors corresponding to ground level releases, and dose conversion factors are given in Tables 15A-1, 15A-2, and 15A-4.

15.3.3.3.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

15.3-10 Rev. OL-18 12/10

CALLAWAY - SP

c. The thyroid inhalation and total-body immersion doses to a receptor at the exclusion area boundary or outer boundary of the low-population zone were analyzed using the models described in Appendix 15A.

15.3.3.3.1.4 Identification of Leakage Pathways and Resultant Leakage Activity The leakage pathways are:

a. Direct steam relief to the atmosphere through the S/G PORVs.

b. Primary-to-secondary steam generator tube leakage and subsequent steam relief to the atmosphere through the S/G PORVs.

15.3.3.3.2 Identification of Uncertainties and Conservative Elements in the Analysis

a. The initial reactor coolant and secondary coolant iodine activities are based on the assumptions stated in Section 15.3.3.3.1.2.

b. A 1-gpm steam generator primary-to-secondary leakage, which is significantly greater than that anticipated during normal operation, is assumed.

c. The coincident loss of offsite power with the occurrence of a reactor coolant pump locked rotor is a highly conservative assumption. In the event of the availability of offsite power, the condenser steam dump valves will open, permitting steam dump to the condenser. Thus there is no direct release to the environment.

d. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that the meteorological conditions assumed will be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, are conservative.

15.3.3.3.3 Conclusions 15.3.3.3.3.1 Filter Loadings The only ESF filtration system considered in the analysis which limits the consequences of the reactor coolant pump locked rotor accident is the control room filtration system.

Activity loadings on the control room charcoal filter are based on the flow rate through the filter, the concentration of activity at the filter inlet, and the filter efficiency.

The activity in the control room filter as a function of time has been evaluated for the loss-of-coolant accident, Section 15.6.5. Since the control room filters are capable of 15.3-11 Rev. OL-18 12/10

CALLAWAY - SP accommodating the potential design-basis loss-of-coolant accident fission product iodine loadings, more than adequate design margin is available with respect to postulated reactor coolant pump locked rotor accident releases.

15.3.3.3.3.2 Doses to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of a postulated reactor coolant pump locked rotor have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body doses due to immersion from direct radiation and the thyroid dose due to inhalation have been analyzed for the 0-2 hour dose at the exclusion area boundary and for the duration of the accident (0 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) at the low-population zone outer boundary.

The results are listed in Table 15.3-4. The resultant doses are well within the guideline values of 10 CFR 100.

15.3.3.4 Conclusions

a. Since the peak RCS pressure reached during this transient is less than that which would cause stresses to exceed the faulted condition stress limits, the integrity of the primary coolant system is not endangered.

b. Since the peak clad surface temperature calculated for the hot spot during the transient remains considerably less than 2,700°F, the core will remain in place and intact with no loss of core cooling capability.

15.3.4 REACTOR COOLANT PUMP SHAFT BREAK 15.3.4.1 Identification of Causes and Accident Description The accident is postulated as an instantaneous failure of a reactor coolant pump shaft, as discussed in Section 5.4. Flow through the affected reactor coolant loop is rapidly reduced, though the initial rate of reduction of coolant flow is greater for the reactor coolant pump rotor seizure event. Reactor trip is initiated on a low flow signal in the affected loop.

Following initiation of the reactor trip, heat stored in the fuel rods continues to be transferred to the coolant, causing the coolant to expand. At the same time, heat transfer to the shell side of the steam generators is reduced - first, because the reduced flow results in a decreased tube side film coefficient and then because the reactor coolant in the tubes cools down while the shell side temperature increases (turbine steam flow is reduced to zero upon plant trip). The rapid expansion of the coolant in the reactor core, combined with reduced heat transfer in the steam generators, causes an insurge into the pressurizer and a pressure increase throughout the RCS. The insurge into the pressurizer compresses the steam volume, actuates the automatic spray 15.3-12 Rev. OL-18 12/10

CALLAWAY - SP system, opens the power-operated relief valves, and opens the pressurizer safety valves, in that sequence. The two power-operated relief valves are designed for reliable operation and would be expected to function properly during the accident. However, for conservatism, their pressure reducing effect, as well as the pressure reducing effect of the spray, is not included in the analysis.

This event is classified as an ANS Condition IV incident (a limiting fault), as defined in Section 15.0.1.

15.3.4.2 Conclusions The consequences of a reactor coolant pump shaft break are no worse than those calculated for the locked rotor incident (see Section 15.3.3). With a failed shaft, the impeller could conceivably be free to spin in a reverse direction as opposed to being fixed in position as assumed in the locked rotor analysis. However, the net effect on core flow is negligible, resulting in only a slight decrease in the end point (steady state) core flow. For both the shaft break and locked rotor incidents, reactor trip occurs very early in the transient. In addition, the locked rotor analysis conservatively assumes that DNB occurs at the beginning of the transient.

15.

3.5 REFERENCES

1. D. S. Heuel et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.

2. Y. X. Sung et al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-1465-P-A, October 1999.

3. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

4. Baldwin, M. S., Merrian, M. M., Schenkel, H. S. and VanDeWalle, D. J., "An Evaluation of Loss of Flow Accidents Caused by Power System Frequency Transients in Westinghouse PWRs," WCAP-8424, Revision 1, May 1975.

5. Barrett, G.O., et.al., "Pressurizer Safety Valve Set Pressure Shift," WCAP-12910, Rev. 1-A, May 1993.

6. Westinghouse Nuclear Safety Advisory Letter NSAL-09-2, Locked Rotor Analysis for Reactor Coolant System Overpressure, dated May 7, 2009.

15.3-13 Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.3-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT SYSTEM FLOW RATE Time Accident Event (sec)

Partial loss of forced Coastdown begins 0.0 reactor coolant flow Low flow reactor trip 1.55 Rods begin to drop 2.55 Minimum DNBR occurs 3.65 Complete loss of All operating pumps 0.0 forced reactor coolant lose power and begin flow coasting down Reactor coolant pump 0.0 undervoltage trip setpoint reached Rods begin to drop 1.5 Minimum DNBR occurs 3.2 With Offsite Without Offsite Power Available Power Available Reactor coolant pump Rotor on one pump 0.0 0.0 shaft seizure (locked locks rotor)

Low flow trip setpoint 0.05 0.05 reached Rods begin to drop 1.05 1.05 Remaining pumps -- 1.05 begin to coast down Maximum RCS 3.40 5.10 pressure occurs Maximum clad 3.45 3.65 temperature occurs Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.3-2

SUMMARY

OF RESULTS FOR LOCKED ROTOR TRANSIENTS With Offsite Without Offsite Power Available Power Available Maximum reactor coolant system pressure, psia* 2,543 2,604 Maximum clad temperature, °F, core hot spot 1,730 1,790 Zr-H2O reaction at core hot spot, percent by weight 0.20 0.30

• Per NSAL-09-2, a 45 psi penalty has been added to the results of this analysis. See Section 15.3.3.2.

Rev. OL-18 12/10

CALLAWAY - SP TABLE 15.3-3 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A LOCKED ROTOR ACCIDENT I. Source Data

a. Power level, MWt 3,636

b. Steam generator tube leakage, gpm 1

c. Reactor coolant initial iodine activity Dose equivalent of 1.0 Ci/gm of I-131 (adjusted consistent with Table 15.6-4 item I.c.1)

d. Reactor coolant initial noble gas activity Based on 1-percent fuel defects, as provided in Table 15A-5

e. Secondary system initial iodine activity Equivalent to 1/10 of the initial RCS activity

f. Activity released to reactor coolant from failed fuel

1. Noble gas, percent of gap inventory 5

2. Iodine, percent of gap inventory 5

3. Gap inventory Table 15A-3

g. Iodine partition factor in the steam 0.01 generators for secondary side releases

h. Iodine partition factor in the steam 0.161 generators for primary-to-secondary leakage

i. Reactor coolant mass, lbs 5.5E+5

j. Steam generator mass, per generator 9.25E+5 II. Atmospheric Dispersion Factors See Table 15A-2 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.3-4 RADIOLOGICAL CONSEQUENCES OF A LOCKED ROTOR ACCIDENT Doses (rem)

Exclusion Area Boundary (0-2 hr)

Thyroid 2.0E01 Whole body 3.8E-01 Low Population Zone Outer Boundary (duration)

Thyroid 8.1E00 Whole body 8.8E-02 Rev. OL-15 5/06

CALLAWAY - SP 15.4 REACTIVITY AND POWER DISTRIBUTION ANOMALIES A number of faults have been postulated which could result in reactivity and power distribution anomalies. Reactivity changes could be caused by rod motion or ejection, boron concentration changes, or addition of cold water to the reactor coolant system (RCS). Power distribution changes could be caused by control rod motion, misalignment, or ejection, or by static means such as fuel assembly mislocation. These events are discussed in this section. Detailed analyses are presented for the most limiting of these events.

Throughout Chapter 15, and Section 15.4 in particular on reactivity transients and accidents, several terms are used interchangeably. Whenever the terms rod cluster control assembly (RCCA), control rod drive mechanism (CRDM), or rod(s) are used, reference is typically being made to both the control and shutdown banks discussed in further detail in Sections 4.3.2.4.12 and 7.7.1.2. If clarification is not provided, the application should be considered to be generic to both. Whenever there is a discussion of automatic rod motion, sequential banks moving with overlap, rod stops, rod insertion or deviation alarms, that discussion is referring to the control banks.

Most of the transients and accidents analyzed in Chapter 15 are initiated from MODE 1 or MODE 2, as indicated in Table 15.0-2 (with the exception of the inadvertent opening of a secondary relief/safety valve, steam line break, or inadvertent RCCA bank withdrawal from subcritical). Any discussion of rod motion in Chapter 15, other than that occurring after a reactor trip, typically refers to the control banks since the shutdown banks are fully withdrawn prior to MODE 2 entry. For those events initiated from MODE 3, RCCA impact on the analysis is specifically discussed in that section.

Discussions of the following events are presented in this section:

a. Uncontrolled rod cluster control assembly bank withdrawal from a subcritical or low power startup condition

b. Uncontrolled rod cluster control assembly bank withdrawal at power

c. Rod cluster control assembly misoperation

d. Startup of an inactive reactor coolant pump at an incorrect temperature

e. A malfunction or failure of the flow controller in a BWR recirculation loop that results in an increased reactor coolant flow rate (not applicable to Callaway)

f. Chemical and volume control system malfunction that results in a decrease in the boron concentration in the reactor coolant 15.4-1 Rev. OL-22 11/16

CALLAWAY - SP

g. Inadvertent loading and operation of a fuel assembly in an improper position

h. Spectrum of rod cluster control assembly ejection accidents Items a, b, d, e, and f are considered to be ANS Condition II events. Item h is an ANS Condition IV event. Item c entails both Conditions II and III events. Item g is considered to be an ANS Condition III event. Section 15.0.1 contains a discussion of ANS classifications.

15.4.1 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL FROM A SUBCRITICAL OR LOW POWER STARTUP CONDITION 15.4.1.1 Identification of Causes and Accident Description A rod cluster control assembly (RCCA) withdrawal accident is defined as an uncontrolled addition of reactivity to the reactor core caused by withdrawal of RCCAs, resulting in a power excursion. Such a transient could be caused by a malfunction of the rod control system (automatic rod withdrawal is no longer available) or operator error. This could occur with the reactor subcritical, at hot zero power or at power. The "at power" case is discussed in Section 15.4.2.

Although the reactor is normally brought to power from a subcritical condition by means of RCCA withdrawal, initial startup procedures with a clean core call for boron dilution.

The maximum rate of reactivity increase in the case of boron dilution is less than that assumed in this analysis (see Section 15.4.6).

The RCCA drive mechanisms are wired into preselected bank configurations which are not altered during reactor life. These circuits prevent the RCCAs from being automatically withdrawn in other than their respective banks. Power supplied to the banks is controlled such that no more than two banks can be withdrawn at the same time and in their proper withdrawal sequence. The RCCA drive mechanisms are of the magnetic latch type, and coil actuation is sequenced to provide variable speed travel.

The maximum reactivity insertion rate analyzed in the detailed plant analysis is that occurring with the simultaneous withdrawal of the combination of two sequential control banks having the maximum combined worth, moving together with 100% overlap at hot zero power at maximum speed (85 pcm/sec). Although the analysis results presented here reflect the inadvertent withdrawal of overlapping control banks from a low power condition, this event could be initiated by the inadvertent withdrawal of a shutdown bank from a subcritical condition (MODE 3). As such, operability requirements are imposed on the power range high neutron flux (low setting) reactor trip function whenever all RCS cold leg temperatures are > 500oF, subject to the limitations and requirements of Technical Specification LCO 3.3.1. If not met, all control and shutdown banks are fully inserted and rod control is prevented or the RCS is borated per the Technical Specifications.

15.4-2 Rev. OL-22 11/16

CALLAWAY - SP This event is classified as an ANS Condition II incident (an incident of moderate frequency), as defined in Section 15.0.1.

The neutron flux response to a continuous reactivity insertion is characterized by a very fast rise terminated by the reactivity feedback effect of the negative Doppler coefficient.

This self-limitation of the power excursion is of primary importance, since it limits the power to a tolerable level during the delay time for protective action. Should a continuous RCCA withdrawal accident occur, the transient will be terminated by the following automatic features of the reactor protection system:

a. Source range high neutron flux reactor trip This is actuated when either of two independent source range channels indicates a neutron flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after an intermediate range flux channel indicates a flux level above a specified level. It is automatically reinstated when both intermediate range channels indicate a flux level below a specified level.

b. Intermediate range high neutron flux reactor trip This is actuated when either of two independent intermediate range channels indicates a flux level above a preselected manually adjustable setpoint. This trip function may be manually bypassed only after two out of the four power range channels are reading above approximately 10 percent of full power, and is automatically reinstated when three out of the four channels indicate a power level below this value.

c. Power range high neutron flux reactor trip (low setting)

This is actuated when two out of the four power range channels indicate a power level above approximately 25 percent of full power. This trip function may be manually bypassed when two out of the four power range channels indicate a power level above approximately 10 percent of full power, and is automatically reinstated only after three out of the four channels indicate a power level below this value. This trip function is required whenever all RCS cold leg temperatures are >500oF in MODE 3 and ascending MODES, subject to the limitations and requirements of Technical Specification LCO 3.3.1.

d. Power range high neutron flux reactor trip (high setting)

This is actuated when two out of the four power range channels indicate a power level above a preset setpoint. This trip function is always active.

e. High nuclear flux rate reactor trip 15.4-3 Rev. OL-22 11/16

CALLAWAY - SP This is actuated when the positive rate of change of neutron flux on two out of four power range channels indicates a rate above the preset setpoint.

This trip function is always active.

In addition, control rod stops on high intermediate range flux level (one out of two) and high power range flux level (one out of four) serve to discontinue manual rod withdrawal and prevent the need to actuate the intermediate range flux level trip and the power range flux level trip, respectively.

15.4.1.2 Analysis of Effects and Consequences Method of Analysis The analysis of the uncontrolled RCCA bank withdrawal from subcritical or low power startup accident is performed in three stages: first an average core nuclear power transient calculation, then, an average core heat transfer calculation, and finally, the DNBR calculation. The average core nuclear power calculation is performed using spatial neutron kinetics methods, TWINKLE (Ref. 1), to determine the average power generation with time, including the various total core feedback effects, i.e., Doppler reactivity and moderator reactivity. The average heat flux and temperature transients are determined by performing a fuel rod transient heat transfer calculation in FACTRAN (Ref.

2). The average heat flux is next used in VIPRE (described in Section 4.4) for the transient DNBR calculation.

Plant characteristics and initial conditions are discussed in Section 15.0.3. In order to give conservative results for a startup accident, the following assumptions are made:

a. Since the magnitude of the power peak reached during the initial part of the transient for any given rate of reactivity insertion is strongly dependent on the Doppler coefficient, conservatively low values are used. This coefficient does not directly correlate to Figure 15.0-2 because the TWINKLE code, on which the neutronics analysis is based, is a thermal diffusion theory code rather than a point-kinetics approximation. The Doppler defect, used as an initial condition, is (-1007) pcm.

b. Contribution of the moderator reactivity coefficient is negligible during the initial part of the transient because the heat transfer time between the fuel and the moderator is much longer than the neutron flux response time.

However, after the initial neutron flux peak, the succeeding rate of power increase is affected by the moderator reactivity coefficient. A conservative value is used in the analysis to yield the maximum peak heat flux.

c. The reactor is assumed to be at hot zero power (Tavg = 557°F). This assumption is more conservative than that of a lower initial system temperature. The higher initial system temperature yields a large fuel-water heat transfer coefficient, larger specific heats, and a less 15.4-4 Rev. OL-22 11/16

CALLAWAY - SP negative (smaller absolute magnitude) Doppler coefficient, all of which tend to reduce the Doppler feedback effect, thereby increasing the neutron flux peak. The initial effective multiplication factor (keff) is assumed to be 1.0, since this results in the worst nuclear power transient.

d. Reactor trip is assumed to be initiated by power range high neutron flux (low setting). The most adverse combination of instrument and setpoint errors, as well as delays for trip signal actuation and RCCA release, is taken into account. A 10-percent error increase is assumed for the power range flux trip setpoint, raising it from the nominal value of 25 percent to 35 percent. Since the rise in the neutron flux is so rapid, the effect of errors in the trip setpoint on the actual time at which the rods are released is negligible. In addition, the reactor trip insertion characteristic is based on the assumption that the highest worth RCCA is stuck in its fully withdrawn position. See Section 15.0.5 for RCCA insertion characteristics.

e. The maximum positive reactivity insertion rate assumed is equal to the simultaneous withdrawal of the combination of the two sequential control banks having the greatest combined worth moving together with 100%

overlap at maximum speed (45 inches/minute). At hot zero power this insertion rate is 85 pcm/sec.

f. The most limiting axial and radial power shapes, associated with having the two highest combined worth banks in their high worth position, are assumed in the DNB analysis.

g. The initial power level was assumed to be below the power level expected for any shutdown condition (10-9 of nominal power). This combination of highest reactivity insertion rate and lowest initial power produces the highest peak heat flux.

h. Two reactor coolant pumps are assumed to be in operation. This is conservative with respect to DNB.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or components will adversely affect the consequences of the accident.

Results Figures 15.4-1 through 15.4-3 show the transient behavior for the uncontrolled RCCA bank withdrawal incident, with the accident terminated by reactor trip at 35 percent of nominal power.

15.4-5 Rev. OL-22 11/16

CALLAWAY - SP The reactivity insertion rate used is equal to that calculated for the two highest worth sequential control banks, both assumed to be in their highest incremental worth region.

Figure 15.4-1 shows the average nuclear power transient.

The energy release and the fuel temperature increases are relatively small. The thermal flux response, of interest for DNB considerations, is shown on Figure 15.4-2. The beneficial effect of the inherent thermal lag in the fuel is shown by a peak heat flux much less than the full power nominal value. There is a large margin to DNB during the transient, since the rod surface heat flux remains below the design value, and there is a high degree of subcooling at all times in the core. Figure 15.4-3 shows the response of the hot spot average fuel and cladding temperature. The hot spot average fuel temperature increases to a value lower than the nominal full power value. The minimum DNBR at all times remains above the limit values.

The calculated sequence of events for this accident is shown in Table 15.4-1. With the reactor tripped, the plant returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.1.3 Conclusions In the event of an RCCA withdrawal accident from a subcritical or low power startup condition, the core and the RCS are not adversely affected, since the combination of thermal power and the coolant temperature result in a DNBR greater than the safety analysis limit values. Thus, no fuel or clad damage is predicted as a result of DNB.

15.4.2 UNCONTROLLED ROD CLUSTER CONTROL ASSEMBLY BANK WITHDRAWAL AT POWER 15.4.2.1 Identification of Causes and Accident Description Uncontrolled RCCA bank withdrawal at power results in an increase in the core heat flux.

Since the heat extraction from the steam generator lags behind the core power generation until the steam generator pressure reaches the relief or safety valve setpoint, there is a net increase in the reactor coolant temperature. Unless terminated by manual or automatic action, the power mismatch and resultant coolant temperature rise could eventually result in DNB. Therefore, in order to avert damage to the fuel clad, the reactor protection system is designed to terminate any such transient before the DNBR falls below the safety analysis limit values. If the analysis assumptions are chosen to maximize primary pressure rather than DNB, the power range neutron flux, high positive rate trip is credited to preclude an overpressurization of the RCS.

This event is classified as an ANS Condition II incident (an incident of moderate frequency), as defined in Section 15.0.1.

The automatic features of the reactor protection system which prevent core damage following the postulated accident include the following:

15.4-6 Rev. OL-22 11/16

CALLAWAY - SP

a. Power range neutron flux instrumentation actuates a reactor trip if two out of four channels exceed an overpower setpoint.

b. A reactor trip is actuated if any two out of four T channels exceed the overtemperature T setpoint. This setpoint is automatically varied with axial power imbalance, coolant temperature, and pressure to protect against DNB.

c. A reactor trip is actuated if any two out of four T channels exceed the overpower T setpoint. This setpoint is automatically varied with coolant temperature to ensure that the allowable heat generation rate (kW/ft) is not exceeded.

d. A high pressurizer pressure reactor trip actuated from any two out of four pressure channels which are set at a fixed point. This set pressure is less than the set pressure for the pressurizer safety valves.

e. A high pressurizer water level reactor trip actuated from any two out of three level channels when the reactor power is above 10 percent (Permissive P-7).

f. The power range neutron flux, high positive rate trip is credited if the control bank withdrawal event assumptions are chosen to maximize the primary pressure. This trip function was credited in a generic evaluation performed to address primary-side pressure concerns. The results of the generic evaluation are not included here, nor are the evaluations initial condition assumptions reflected in Table 15.0-2; however, this evaluation credited a positive flux rate trip setpoint of 9% RTP, with a time constant of 2 seconds and a delay time of 0.65 seconds.

In addition to the above listed reactor trips, there are the following control rod withdrawal blocks that discontinue manual control rod withdrawal:

a. High neutron flux (one out of four power range or one out of two intermediate range)

b. Overpower T (two out of four)

c. Overtemperature T (two out of four)

The manner in which the combination of overpower and overtemperature T trips provide protection over the full range of RCS conditions is described in Section 7.2.

Figure 15.0-1 presents allowable reactor coolant loop average temperature and T for the design power distribution and flow as a function of primary coolant pressure. The boundaries of operation defined by the overpower T trip and the overtemperature T trip are represented as "protection lines" on this diagram. The protection lines are drawn 15.4-7 Rev. OL-22 11/16

CALLAWAY - SP to include all adverse instrumentation and setpoint errors so that under nominal conditions, trip would occur well within the area bounded by these lines. The utility of this diagram is in the fact that the limit imposed by given DNBR can be represented as a line.

The DNB lines represent the locus of conditions for which the DNBR equals the safety analysis limit value. All points below and to the left of a DNB line for a given pressure have a DNBR greater than the limit value. The diagram shows that DNB is prevented for all cases if the area enclosed with the maximum protection lines is not traversed by the applicable DNBR line at any point.

The area of permissible operation (power, pressure, and temperature) is bounded by the combination of reactor trips: high neutron flux (fixed setpoint); high pressurizer pressure (fixed setpoint); low pressurizer pressure (fixed setpoint); and overpower and overtemperature T (variable setpoints).

15.4.2.2 Analysis of Effects and Consequences Method of Analysis This transient is analyzed using the RETRAN code (Ref. 14). This code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables, including temperature, pressures, and power level. The core limits, as illustrated in Figure 15.0-1, are used as input to RETRAN to determine the minimum DNBR during the transient.

This accident is analyzed with the RTDP as described in Reference 4. To obtain conservative results, the following assumptions are made:

a. Plant characteristics and initial conditions are discussed in Section 15.0.3.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 4.

b. Reactivity coefficients - two cases are analyzed:

1. Minimum reactivity feedback A positive moderator temperature coefficient of +5 pcm/°F is assumed for cases initiated at less than full power. A zero moderator temperature coefficient is assumed for cases initiated at full power. A variable Doppler power coefficient with core power is used in the analysis. A conservatively small (in absolute magnitude) value is assumed.

2. Maximum reactivity feedback 15.4-8 Rev. OL-22 11/16

CALLAWAY - SP A conservatively large positive moderator density coefficient and a large (in absolute magnitude) negative Doppler power coefficient are assumed.

c. The reactor trip on high neutron flux is assumed to be actuated at a conservative value of 118 percent of nominal full power (See Table 15.0-4).

The T trips include all adverse instrumentation and setpoint errors; the delays for trip actuation are assumed to be the maximum values.

d. The RCCA trip insertion characteristic is based on the assumption that the highest worth assembly is stuck in its fully withdrawn position.

e. A range of reactivity insertion rates is examined. The maximum positive reactivity insertion rate examined is 110 pcm/sec.

The effect of control rod movement on the axial core power distribution is accounted for by causing a decrease in the overtemperature T trip setpoint proportional to a decrease in margin to DNB.

Results Figures 15.4-4 through 15.4-6 show the transient response for a rapid (110 pcm/sec)

RCCA withdrawal incident starting from full power. Reactor trip on high neutron flux occurs shortly after the start of the accident. Since this is rapid with respect to the thermal time constants of the plant, small changes in Tavg and pressure result, and margin to DNB is maintained.

The transient response for a slow (1 pcm/sec) RCCA withdrawal from full power is shown in Figures 15.4-7 through 15.4-9. Reactor trip on overtemperature T occurs after a longer period, and the rise in temperature and pressure is consequently larger than for rapid RCCA withdrawal. Again, the minimum DNBR is greater than the safety analysis limit values.

Figure 15.4-10 shows the minimum DNBR as a function of reactivity insertion rate (up to 110 pcm/sec) from initial full power operation for minimum and maximum reactivity feedback. It can be seen that two reactor trip channels provide protection over the whole range of reactivity insertion rates. These are the high neutron flux and overtemperature T channels. The minimum DNBR is never less than the safety analysis limit values.

Figures 15.4-11 and 15.4-12 show the minimum DNBR as a function of reactivity insertion rate (up to 110 pcm/sec) for RCCA withdrawal incidents starting at 60- and 10-percent power, respectively, for minimum and maximum reactivity feedback. The results are similar to the 100-percent power case, except as the initial power is decreased, the range over which the overtemperature T trip is effective is increased. In neither case does the DNBR fall below the safety analysis limit values.

15.4-9 Rev. OL-22 11/16

CALLAWAY - SP The shape of the curves of minimum DNBR versus reactivity insertion rate in the reference figures is due both to reactor core and coolant system transient response and to protection system action in initiating a reactor trip.

Referring to Figure 15.4-12, for example, it is noted that:

a. For reactivity insertion rates above approximately 9 pcm/sec reactor trip is initiated by the high neutron flux trip for the minimum reactivity feedback cases. The neutron flux level in the core rises rapidly for these insertion rates while core heat flux and coolant system temperature lag behind due to the thermal capacity of the fuel and coolant system fluid. Thus, the reactor is tripped prior to significant increase in heat flux or water temperature with resultant high minimum DNBRs during the transient. As reactivity insertion rate decreases, core heat flux and coolant temperatures can remain more nearly in equilibrium with the neutron flux. Minimum DNBR during the transient thus decreases with decreasing insertion rate.

b. The overtemperature T reactor trip circuit initiates a reactor trip when measured coolant loop T exceeds a setpoint based on measured RCS average temperature, pressure, T, and I. It is important to note that the average temperature contribution to the circuit is lead-lag compensated to decrease the effect of the thermal capacity of the RCS in response to power increases.

c. For reactivity insertion rates below approximately 9 pcm/sec the overtemperature T trip terminates the transient.

For reactivity insertion rates between approximately 9 pcm/sec and 1 pcm/

sec, the effectiveness of the overtemperature T trip increases (in terms of increased minimum DNBR) due to the fact that with lower insertion rates the power increase rate is slower, the rate of rise of average coolant temperature is slower, and the system lags and delays become less significant.

Figures 15.4-10, 15.4-11, and 15.4-12 illustrate minimum DNBR's calculated for minimum and maximum reactivity feedback.

Since the RCCA withdrawal at power incident is an overpower transient, the fuel temperatures rise during the transient until after reactor trip occurs. For high reactivity insertion rates, the overpower transient is fast with respect to the fuel rod thermal time constant, and the core heat flux lags behind the neutron flux response. Due to this lag, the peak core heat flux does not exceed 118 percent of its nominal value (i.e., the high neutron flux trip setpoint assumed in the analysis). Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel centerline temperature will still remain below the fuel melting temperature.

15.4-10 Rev. OL-22 11/16

CALLAWAY - SP For slow reactivity insertion rates, the core heat flux remains more nearly in equilibrium with the neutron flux. The overpower transient is terminated by the overtemperature T reactor trip before a DNB condition is reached. The peak heat flux again is maintained below 118 percent of its nominal value. Taking into account the effect of the RCCA withdrawal on the axial core power distribution, the peak fuel centerline temperature will remain below the fuel melting temperature.

Since DNB does not occur at any time during the RCCA withdrawal at power transient, the ability of the primary coolant to remove heat from the fuel rod is not reduced. Thus, the fuel cladding temperature does not rise significantly above its initial value during the transient.

The calculated sequence of events for this accident is shown on Table 15.4-1. With the reactor tripped, the plant eventually returns to a stable condition. The plant may subsequently be cooled down further by following normal plant shutdown procedures.

15.4.2.3 Conclusions The high neutron flux (high setting, low setting, and high positive rate) and overtemperature T trip channels provide adequate protection over the entire range of possible reactivity insertion rates, i.e., the minimum value of DNBR is always larger than the safety analysis limit values and the RCS is not overpressurized.

15.4.3 ROD CLUSTER CONTROL ASSEMBLY MISOPERATION (System Malfunction or Operator Error) 15.4.3.1 Identification of Causes and Accident Description Rod cluster control assembly (RCCA) misoperation accidents include:

a. One or more dropped RCCAs within the same group

b. A dropped RCCA bank

c. Statically misaligned RCCA

d. Withdrawal of a single RCCA Each RCCA has a position indicator channel which displays the position of the assembly.

The displays of assembly positions are grouped for the operator's convenience. Fully inserted assemblies are further indicated by a rod at bottom signal, which actuates a local alarm and a control room annunciator. Group demand position is also indicated.

RCCAs are always moved in preselected banks, and the banks are always moved in the same preselected sequence. Each control bank is divided into two groups. Shutdown banks A and B contain two groups whereas shutdown banks C, D, and E contain one 15.4-11 Rev. OL-22 11/16

CALLAWAY - SP group. The rods comprising a group operate in parallel through multiplexing thyristors.

The two groups in a bank move sequentially such that the first group is always within one step of the second group in the bank. A definite schedule of actuation (or deactuation of the stationary gripper, movable gripper, and lift coils of a mechanism) is required to withdraw the RCCA attached to the mechanism. Since the stationary gripper, movable gripper, and lift coils associated with the RCCAs of a rod group are driven in parallel, any single failure which would cause rod withdrawal would affect a minimum of one group.

Mechanical failures are in the direction of insertion or immobility.

The dropped RCCA, dropped RCCA bank, and statically misaligned RCCA events are classified as ANS Condition II incidents (incidents of moderate frequency), as defined in Section 15.0.1. However, the single RCCA withdrawal incident is classified as an ANS Condition III event, as discussed below.

No single electrical or mechanical failure in the rod control system could cause the accidental withdrawal of a single RCCA from the inserted bank at full power operation.

Automatic control rod withdrawal is no longer available. The operator could withdraw a single RCCA in the control bank since this feature is necessary in order to retrieve an assembly should one be accidentally dropped. The event analyzed must result from multiple wiring failures (probability for single random failure is on the order of 10-4/year; refer to Section 7.7.2.2) or multiple serious operator errors and subsequent and repeated operator disregard of event indication. The probability of such a combination of conditions is considered low. The limiting consequences of such errors or failures may include slight fuel damage.

Thus, consistent with the philosophy and format of ANSI N18.2, the event is classified as a Condition III event. By definition "Condition III occurrences include incidents, any one of which may occur during the lifetime of a particular plant," and "shall not cause more than a small fraction of fuel elements in the reactor to be damaged . . ."

This selection of criterion is in accordance with GDC-25 which states, "The protection system shall be designed to assure that specified acceptable fuel design limits are not exceeded for any single malfunction of the reactivity control systems, such as accidental withdrawal (not ejection or dropout) of control rods." (Emphasis has been added). It has been shown that single failures resulting in RCCA bank withdrawals do not violate specified fuel design limits. Moreover, no single malfunction can result in the withdrawal of a single RCCA. Thus, it is concluded that the criterion established for the single rod withdrawal at power is appropriate and in accordance with GDC-25.

A dropped RCCA or RCCA bank is detected by:

a. Sudden drop in the core power level as seen by the nuclear instrumentation system

b. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples 15.4-12 Rev. OL-22 11/16

CALLAWAY - SP

c. Rod at bottom signal

d. Rod deviation alarm (control rods only)

e. Rod position indication Misaligned RCCAs are detected by:

a. Asymmetric power distribution as seen on out-of-core neutron detectors or core exit thermocouples

b. Rod deviation alarm (control rods only)

c. Rod position indication The resolution of the rod position indicator channel is +/-12 percent of span (+/-7.5 inches).

Deviation of any RCCA from its group by twice this distance (+/-24 steps or +/-15.0 inches) will not cause power distributions worse than the design limits. The control rod deviation alarm alerts the operator to control rod deviation with respect to the group position in excess of 5 percent of span. If the control rod deviation alarm is not operable, the operator is required to take action as required by Section 16.1.3.3.

If one or more rod position indicator channels should be out of service, detailed operating instructions shall be followed to assure the alignment of the nonindicated RCCA. The operator is also required to take action, as required by the Technical Specifications.

In the extremely unlikely event of simultaneous electrical failures which could result in single RCCA withdrawal (automatic rod withdrawal is no longer available), rod deviation and rod control failure would both be displayed on the plant annunciator, and the rod position indicators would indicate the relative positions of the assemblies in the bank.

The urgent failure alarm also inhibits automatic control rod motion in the group in which it occurs. Withdrawal of a single RCCA by operator action, whether deliberate or by a combination of errors, would result in activation of the same alarm and the same visual indications. Withdrawal of a single RCCA results in both positive reactivity insertion tending to increase core power and an increase in local power density in the core area associated with the RCCA. Automatic protection for this event is provided by the overtemperature T reactor trip. Due to the increase in local power density, it is not possible in all cases to provide assurance that the core safety limits will not be violated.

Plant systems and equipment which are available to mitigate the effects of the various RCCA misoperations are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

15.4-13 Rev. OL-22 11/16

CALLAWAY - SP 15.4.3.2 Analysis of Effects and Consequences 15.4.3.2.1 Dropped RCCAs, Dropped RCCA Bank, and Statically Misaligned RCCA Method of Analysis

a. One or more dropped RCCA from the same group For evaluation of the dropped RCCA event, the transient system response is calculated using the LOFTRAN (Ref. 3) code. The code simulates the neutron kinetics, reactor coolant system, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures, and power level.

Statepoints are calculated and nuclear models are used to obtain a hot channel factor consistent with the primary system conditions and reactor power. By incorporating the primary conditions from the transient and the hot channel factor from the nuclear analysis, the DNB design basis is shown to be met using the VIPRE code (Ref. 15). The transient response, nuclear peaking factor analysis, and DNB design basis confirmation are performed in accordance with the methodology described in Reference 5.

b. Statically misaligned RCCA Steady-state power distributions are analyzed using the TURTLE and LEOPARD computer codes as described in Table 4.1-2. The peaking factors are then used as input to the VIPRE code to calculate the DNBR.

Results

a. One or more dropped RCCAs Single or multiple RCCAs within the same group result in a negative reactivity insertion (maximum absolute value for RCCA worth used in the analysis is - 800 pcm). The core is not adversely affected during this period, since power is decreasing rapidly. Power may be re-established either by reactivity feedback or control bank withdrawal. Following a dropped rod event in manual rod control, the plant will establish a new equilibrium condition. The equilibrium process without control system interaction is monotonic, thus removing power overshoot as a concern, and establishing the automatic rod control mode of operation as the limiting case.

For a dropped RCCA event in the automatic rod control mode, the rod control system detects the drop in power and initiates control bank 15.4-14 Rev. OL-22 11/16

CALLAWAY - SP withdrawal (automatic control rod withdrawal is no longer available).

Power overshoot may occur due to this action by the automatic rod controller after which the control system will insert the control bank to restore nominal power. Figures 15.4-12a and 15.4-12b show a typical transient response to a dropped RCCA (or RCCAs) in automatic control. In all cases, the minimum DNBR remains above the limit values. Since automatic control rod withdrawal is no longer available, the minimum DNBR resulting from a dropped RCCA event will be higher than that calculated for this case.

Following plant stabilization, normal rod retrieval or shutdown procedures are followed. The operator may manually retrieve the RCCA by following approved operating procedures.

b. Dropped RCCA bank A dropped RCCA bank typically results in a reactivity insertion with an absolute value greater than-500 pcm. The core is not adversely affected during the insertion period, since power is decreasing rapidly. The transient will proceed as described in part a; however, the return to power will be less due to the greater worth of the entire bank (automatic control rod withdrawal is no longer available). Following plant stabilization, normal shutdown procedures may subsequently be followed to further cool down the plant.

c. Statically misaligned RCCA The most severe misalignment situations with respect to DNBR at significant power levels arise from cases in which one RCCA is fully inserted, or where control bank D is fully inserted with one RCCA fully withdrawn. Multiple independent alarms, including a control bank insertion limit alarm, alert the operator well before the postulated conditions are approached. The bank can be inserted to its insertion limit with any one assembly fully withdrawn without the DNBR falling below the safety analysis limit values.

The insertion limits in the Technical Specifications may vary from time to time, depending on a number of limiting criteria. It is preferable, therefore, to analyze the misaligned RCCA case at full power for position of the control bank as deeply inserted as the criteria on minimum DNBR and power peaking factor will allow. The full power insertion limits on control bank D must then be chosen to be above that position and will usually be dictated by other criteria. Detailed results will vary from cycle to cycle, depending on fuel arrangements.

15.4-15 Rev. OL-22 11/16

CALLAWAY - SP For this RCCA misalignment, with control bank D inserted to its full power insertion limit and one RCCA fully withdrawn, DNBR does not fall below the safety analysis limit values. This case is analyzed assuming the initial reactor pressure and RCS temperature are at their nominal values, as given in Section 15.0, and core power at 3565 MWt, but with the increased radial peaking factor associated with the misaligned RCCA.

DNB calculations have not been performed specifically for RCCAs missing from other banks; however, power shape calculations have been performed as required for the RCCA ejection analysis. Inspection of the power shapes shows that the DNB and peak kW/ft situation is less severe than the control bank D case discussed above, assuming insertion limits on the other banks are equivalent to a control bank D full-in insertion limit.

For RCCA misalignments with one RCCA fully inserted, the DNBR does not fall below the safety analysis limit values. This case is analyzed assuming that the initial pressure and RCS temperatures are at their nominal values, as given in Section 15.0.3.2, and core power at 3565 MWT, but with the increased radial peaking factor associated with the misaligned RCCA.

DNB does not occur for the RCCA misalignment incident, and thus, the ability of the primary coolant to remove heat from the fuel is not reduced.

The peak fuel temperature corresponds to a linear heat generation rate based on the radial peaking factor penalty associated with the misaligned RCCA and the design axial power distribution. The resulting linear heat generation is well below that which would cause fuel melting.

Following the identification of a RCCA misalignment condition by the operator, the operator is required to take action as required by the plant Technical Specifications and operating instructions.

15.4.3.2.2 Single RCCA Withdrawal Method of Analysis Power distributions within the core are calculated using the computer codes as discussed in Table 4.1-2. The peaking factors are then used by VIPRE to calculate the minimum DNBR for the event. The case of the worst rod withdrawn from control bank D inserted at the insertion limit, with the reactor initially at full power, was analyzed. This incident is assumed to occur at beginning-of-life, since this results in the minimum value of moderator temperature coefficient. This assumption maximizes the power rise and minimizes the tendency of increased moderator temperature to flatten the power distribution.

Results 15.4-16 Rev. OL-22 11/16

CALLAWAY - SP For the single rod withdrawal event, one case has been considered. With the reactor in the manual control mode, continuous withdrawal of a single RCCA results in both an increase in core power and coolant temperature and an increase in the local hot channel factor in the area of the withdrawing RCCA. In terms of the overall system response, this case is similar to those presented in Section 15.4.2; however, the increased local power peaking in the area of the withdrawn RCCA results in lower minimum DNBRs than for the withdrawn bank cases. Depending on initial bank insertion and location of the withdrawn RCCA, automatic reactor trip may not occur sufficiently fast to prevent the minimum core DNBR from falling below the safety analysis limit values. Evaluation of this case at the power and coolant conditions at which the overtemperature T trip would be expected to trip the plant shows that an upper limit for the number of rods with a DNBR less than the limit value is 5 percent.

For the case described above, a reactor trip will ultimately ensue, although not sufficiently fast in all cases to prevent a minimum DNBR in the core of less than the safety analysis limit values. Following reactor trip, normal shutdown procedures may be followed.

15.4.3.3 Conclusions For cases of dropped RCCAs or dropped banks, the DNBR remains greater than the safety analysis limit values and, therefore, the DNB design basis is met.

For all cases of any RCCA fully inserted, or control bank D inserted to its rod insertion limits with any single RCCA in that bank fully withdrawn (static misalignment), the DNBR remains greater than the safety analysis limit values.

For the case of the accidental withdrawal of a single RCCA, with the reactor in the automatic or manual control mode and initially operating at full power with control bank D at the insertion limit, an upper bound of the number of fuel rods experiencing DNB is 5 percent of the total fuel rods in the core.

15.4.4 STARTUP OF AN INACTIVE REACTOR COOLANT PUMP AT AN INCORRECT TEMPERATURE 15.4.4.1 Identification of Causes and Accident Description If the plant is operating with one pump out of service, there is reverse flow through the inactive loop due to the pressure difference across the reactor vessel. The cold leg temperature in an inactive loop is identical to the cold leg temperature of the active loops (the reactor core inlet temperature). If the reactor is operated at power, and assuming the secondary side of the steam generator in the inactive loop is not isolated, there is a temperature drop across the steam generator in the inactive loop and, with the reverse flow, the hot leg temperature of the inactive loop is lower than the reactor core inlet temperature.

15.4-17 Rev. OL-22 11/16

CALLAWAY - SP Administrative procedures require that the plant be brought to a load of less than 10 percent of full power prior to starting the pump in an inactive loop in order to bring the inactive loop hot leg temperature closer to the core inlet temperature. Starting of an idle reactor coolant pump without bringing the inactive loop hot leg temperature close to the core inlet temperature would result in the injection of cold water into the core, which would cause a reactivity insertion and subsequent power increase.

This event is classified as an ANS Condition II incident (an incident of moderate frequency) as defined in Section 15.0.1.

Should the startup of an inactive reactor coolant pump at an incorrect temperature occur, the transient will be terminated automatically by a reactor trip on low coolant loop flow when the power range neutron flux (two out of four channels) exceeds the P-8 setpoint, which has been previously reset for three-loop operation. Callaway is not licensed for three-loop operation.

15.4.4.2 Analysis of Effects and Consequences The Callaway Technical Specifications do not permit operations in Modes 1 and 2 with less than four reactor coolant loops operating. Historically, an analysis has been performed for this event assuming an initial power level of 72% to bound Mode 3 conditions where the Technical Specifications do permit operation with less than four reactor coolant loops operating. This transient, initiated form Mode 3 conditions, is not limiting with respect to DNB. As such, an explicit analysis of this event is deemed not necessary.

The method of analysis discussion presented below corresponds to the analysis previously performed for this event and it is retained for historical purposes.

Method of Analysis This transient has historically been analyzed using three digital computer codes. The LOFTRAN code (Ref. 3) is used to calculate the loop and core flow, nuclear power and core pressure, and temperature transients following the startup of an idle pump.

FACTRAN (Ref. 2) is used to calculate the core heat flux transient based on core flow and nuclear power from LOFTRAN. The THINC code is then used to calculate the DNBR during the transient based on system conditions (pressure, temperature, and flow) calculated by LOFTRAN and heat flux as calculated by FACTRAN.

In order to obtain conservative results for the startup of an inactive pump accident, the following assumptions are made:

a. Plant characteristics and initial conditions are discussed in Section 15.0.3.

b. Following initiation of startup of the idle pump, the inactive loop flow reverses and accelerates to its nominal full flow value in approximately 30 15.4-18 Rev. OL-22 11/16

CALLAWAY - SP seconds. This value is faster than the expected startup time and is conservative for the analysis.

c. A conservatively large negative moderator density coefficient.

d. A conservatively small (absolute value) negative Doppler only power coefficient (see Figure 15.0-2).

e. The initial reactor coolant loop flows are at the appropriate values for one pump out of service.

f. The reactor trip is assumed to occur on low coolant flow when the power range neutron flux exceeds the P-8 setpoint. The P-8 setpoint is conservatively assumed to be 84 percent of rated power which corresponds to the nominal setpoint plus 9 percent for nuclear instrumentation errors.

Initially the core is operating at 72% of rated thermal power (as listed in Table 15.0-2) and the RCS flow transmitters in the inactive loop have satisfied the two-out-of-three conincidence logic for low flow shown on Figure 7.2-1, sheet 5. Following startup of the idle RCS pump, the core power increases as shown on Figure 15.4-13. When core power reaches 84% of rated thermal power (RTP), within 0.5 second the power range neutron flux bistables satisfy the two-out-of-four P-8 permissive coincidence logic shown on Figure 7.2-1, sheet 4, and the presence of the P-8 permissive satisfies the logic for a reactor trip on low flow in any RCS loop shown on Figure 7.2-1, sheet 5. This safety analysis limit and time delay are listed in Table 15.0-4. The time delay of 0.5 second is also reflected in the sequence of events contained in Table 15.4-1; however, there is no directly associated response time testing limit listed in Table 16.3-1. As stated in Section 15.4.4.1, Callaway is not licensed for three-loop operation. Therefore, there is no requirement to have administrative controls on raising the P-8 setpoint from a nominal value of 48% RTP to 75% RTP for three-loop operation nor is there a response time testing requirement for measuring 0.5 second time delay associated with satisfying the P-8 coincidence logic.

Plant systems and equipment which are available to mitigate the effects of the accident are discussed in Section 15.0.8 and listed in Table 15.0-6. No single active failure in any of these systems or equipment will adversely affect the consequences of the accident.

Results As stated above, the credible scenario of starting an inactive reactor coolant pump at an incorrect temperature from Mode 3 conditions has minimal potential for challenging the DNB design basis. As such, no explicit analysis of this event has been performed.

15.4-19 Rev. OL-22 11/16

CALLAWAY - SP The figures and sequence of events discussed below correspond to the analysis previously performed for this event. They are retained for historical purposes as they are representative of the expected response to this transient if operation in Modes 1 and 2 with less than four loops operating were permitted.

The results following the startup of an idle pump with the above listed assumptions are shown in Figures 15.4-13 through 15.4-17. As shown in these curves, during the first part of the transient, the increase in core flow with cooler water results in an increase in nuclear power and a decrease in core average temperature. The minimum DNBR during the transient is considerably greater than the safety analysis limit values.

Reactivity addition for the inactive loop startup accident is due to the decrease in core water temperature. During the transient, this decrease is due both to the increase in reactor coolant flow and, as the inactive loop flow reverses, to the colder water entering the core from the hot leg side (colder temperature side prior to the start of the transient) of the steam generator in the inactive loop. Thus, the reactivity insertion rate for this transient changes with time. The resultant core nuclear power transient, computed with consideration of both moderator and Doppler reactivity feedback effects, is shown on Figure 15.4-13.

The calculated sequence of events for this accident is shown on Table 15.4-1. The transient results illustrated in Figures 15.4-13 through 15.4-17 indicate that a stabilized plant condition, with the reactor tripped, is approached rapidly. Plant cooldown may subsequently be achieved by following normal shutdown procedures.

15.4.4.3 Conclusions This event, initiated from Mode 3 conditions, does not challenge the DNB design basis.

The transient results obtained for the analysis performed from hypothetical Mode 1 conditions (not permitted by Callaway Technical Specification), show that the core is not adversely affected. There is considerable margin to the safety analysis DNBR limit values; thus, no fuel or clad damage is predicted.

15.4.5 A MALFUNCTION OR FAILURE OF THE FLOW CONTROLLER IN A BWR LOOP THAT RESULTS IN AN INCREASED REACTOR COOLANT FLOW RATE This section is not applicable to Callaway.

15.4-20 Rev. OL-22 11/16

CALLAWAY - SP 15.4.6 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT RESULTS IN A DECREASE IN THE BORON CONCENTRATION IN THE REACTOR COOLANT 15.4.6.1 Identification of Causes and Accident Description Control rod withdrawal and diluting the RCS boron concentration are two principle means of inserting positive reactivity into the core. Boron dilution can be accomplished by two methods: (1) Adding unborated, primary grade water from the reactor makeup water system (RWMS) into the RCS through the reactor makeup portion of the chemical and volume control system (CVCS) or, (2) Removing boron from the CVCS stream prior to RCS return using the ion exchange capability of the CVCS resin vessels. The CVCS resin vessels include the resin vessels of its subsystem, the Boron Thermal Regeneration system. Note that planned boron dilution evolutions are permitted in MODE 6 under administrative controls. Boron dilution with these systems is a manually initiated operation under strict administrative controls requiring close operator surveillance with procedures limiting the rate and duration of the dilution. A boric acid blend system is available to allow the operator to match the makeup's boron concentration to that of the RCS during normal charging.

The means of causing an inadvertent boron dilution from the addition of unborated water are the opening of the primary water makeup control valve and failure of the blend system, either by controller or mechanical failure. Another means of causing an inadvertent boron dilution derives from operation of CVCS resin vessels. CVCS resin vessels include the resin vessels of its subsystem, the Boron Thermal Regeneration system. The means of causing an inadvertent boron dilution from CVCS resin vessel ion exchange are opening the inlet isolation valve to a CVCS resin vessel containing resin for dilution, either by controller or mechanical failure (including valve seat leakage). The CVCS and RMWS are designed to limit, even under various postulated failure modes, the potential rate of dilution to values which, with indication by alarms and instrumentation, will allow sufficient time for automatic or operator response (depending on the mode of operation) to terminate the dilution. An inadvertent dilution from the RMWS may be terminated by closing the primary water makeup control valve. All expected sources of dilution may be terminated by closing isolation valves in the CVCS, BG-LCV-112B and C. The lost shutdown margin (SDM) may be regained by the opening of isolation valves from the RWST, BN-LCV-112D and E, thus allowing the addition of borated water to the RCS.

Generally, to dilute, the operator must perform the following actions:

a. Switch control of the makeup from the automatic makeup mode to the dilute or alternate dilute mode and turn the makeup control handswitch to the run position; or

b. Place the HANDSWITCH, BG-HIS-27, BTRS CTRL, in the dilute position.

15.4-21 Rev. OL-22 11/16

CALLAWAY - SP Not performing the above actions prevents initiation of dilution. Also, during normal operation the operator may add borated water to the RCS by blending boric acid from the boric acid storage tanks with primary grade water. This requires the operator to determine the concentration of the addition and to set the blended flow rate and the boric acid flow rate. The makeup controller will then limit the sum of the boric acid flow rate and primary grade water flow rate to the blended flow rate, i.e., the controller determines the primary grade water flow rate after the start button is depressed.

The status of the RCS makeup is continuously available to the operator by:

a. Indication and recording of the boric acid and blended flow rates as well as the audible clicks from the boric acid and blended flow totalizers (flow integrators)

b. CVCS and RMWS pump status lights

c. Deviation alarms, if the boric acid or blended flow rates deviate by more than 10 percent from the preset values

d. High charging flow alarm, VCT high pressure alarm, VCT high level alarm, VCT high-high level/full divert to RHT alarm

e. Source range neutron flux - when reactor is subcritical

1. High flux at shutdown alarm

2. Indicated and recorded source range neutron flux count rate and indicated startup rate

3. Audible source range neutron flux count rate

4. Source range neutron flux - multiplication alarm

f. When the reactor is critical

1. Axial flux difference alarm (reactor power 50 percent RTP)

2. Control rod insertion limit low and low-low alarms

3. Overtemperature T alarm (at power)

4. Overtemperature T turbine runback (at power)

5. Overtemperature T reactor trip 15.4-22 Rev. OL-22 11/16

CALLAWAY - SP

6. Power range neutron flux - high, both high and low setpoint reactor trips.

In the shutdown modes, Modes 3, 4, and 5, the boron dilution mitigation system (BDMS) utilizes a microprocessor to monitor and detect a flux-multiplication condition. This microprocessor monitors the core flux in discrete 1-minute intervals and retains the average, monitored flux data for up to 10 of these intervals. The microprocessor compares the flux data for up to 10 of these intervals. The microprocessor compares the flux value in the most recent interval to each of the prior 9 intervals and actuates an alarm and automatic mitigation functions (i.e., valve movement to terminate the dilution and start boration) when the flux-multiplication condition is reached.

As the assumed dilution flow rate decreases from its maximum value, the time necessary for a flux-multiplication signal to be generated indicating that dilution is in progress increases. As a result, the automatic valve realignment to isolate the dilution source and initiate reboration occurs later in the transient at conditions that may be closer to criticality. Plant-specific analyses have shown that a wide range of dilution flow rates is automatically covered by the BDMS installed at Callaway. For cases where even lower dilution flow rates are assumed, analysis results indicate that the transient extends long enough (i.e., longer than 30 minutes) such that operator action to manually terminate it can be credited.

A limiting case with respect to the time available for automatic mitigation at the maximum nominal dilution flow rate in each of the shutdown modes (Modes 3, 4 and 5) is presented based on its potential consequences. The latter refers to potential fuel damage resulting from a return to power following loss of available plant shutdown margin. For an inadvertent dilution event mitigated by the BDMS or operator action prior to complete loss of shutdown margin, the associated consequences are minimal. If left unmitigated, an inadvertent dilution would cause an increase in power in response to a continuous reactivity insertion. Following loss of plant shutdown margin, the power increases at a lower rate for the slow dilution than for a maximum dilution. The potential consequences resulting from the slow dilution transients tend to be bounded by those generated from the maximum dilution flow. Thus, an inadvertent boron dilution event having the maximum dilution flow rate would be the limiting case which potentially yields the worst consequences.

This event is classified as an ANS Condition II incident (a fault of moderate frequency) as defined in Section 15.0.1.

15.4.6.2 Analysis of Effects and Consequences To cover all phases of plant operation, boron dilution during Refueling, Cold Shutdown, Hot Shutdown, Hot Standby, Start-up, and Power modes of operation is considered in this analysis. Conservative values for necessary parameters were used, i.e., high RCS critical boron concentrations, high boron worths, minimum shutdown margins, and lower than actual RCS volumes. These assumptions result in conservative determinations of 15.4-23 Rev. OL-22 11/16

CALLAWAY - SP the time available for operator or system response after detection of a dilution transient in progress. Dilution flow rates listed for each mode are based on the dilution source fluid conditions for reactor makeup water at 37°F and 14.7 psia. The dilution flow is discharged to the RCS via the operating charging pump(s), including the normal charging pump which operates in Modes 1, 2, and 3. The normal charging pump may operate in Modes 4 and 5 if necessary. The analysis results presented are based on calculations which account for density compensation between these dilution source conditions and the mode-specific RCS conditions listed.

Dilution During Refueling (Mode 6)

An uncontrolled boron dilution transient will not occur during this mode of operation.

Inadvertent dilution via the CVCS blending tee is prevented by administrative controls which isolate the RCS from potential sources of unborated water. Valves BG-V-178 and BG-V-601 in the CVCS are locked closed during refueling operations. These valves block all automatic flow paths that could allow unborated makeup water to reach the RCS. Inadvertent dilution from CVCS resin vessel operation is prevented during this mode by administrative controls directing the manual closure of each outlet isolation valve for CVCS resin vessels containing resin for dilution. Inadvertent dilution from flushing the CVCS letdown gamma radiation detector SJRE0001 with unborated reactor makeup water is prevented during this mode by administrative controls directing closure of valve SJV0703 and prohibiting the flushing activity.

As allowed by the Technical Specification LCO 3.9.2, during MODE 6 operation, unborated water sources may be unisolated under administrative controls for planned boron dilution evolutions. This is acceptable during this mode of operation because an inadvertent boron dilution event is precluded by administrative controls. For example, administrative controls limit the volume of unborated water added to the refueling pool in order to prevent diluting the refueling pool below the limits specified in the Technical Specification LCO 3.9.1 and as discussed in OL Amendment Number 97. In summary, administrative controls include calculations for the impact of boron concentrations prior to evolutions and provide prompt verification that unborated water source isolation valves are closed and secured after completion of planned dilution evolutions.

Any makeup which is required during refueling will be borated water.

Dilution During Cold Shutdown (Mode 5)

The following conditions are assumed for the most limiting inadvertent boron dilution with respect to a return to power while in this operating mode:

a. Dilution flow is limited by a flow orifice at the RMWS-CVCS system interface to a maximum of 150 gpm of unborated water. BG-V-0178 is closed during Mode 5.

15.4-24 Rev. OL-22 11/16

CALLAWAY - SP

b. A minimum mixing volume of 8995 ft3 in the RCS is used. This volume corresponds to the active volume of the RCS with one reactor coolant pump in operation, and does not include any volume in the pressurizer or its surge or spray lines, the vessel head, the CVCS, or the RHR system.

The volume specified here is conservative in that no consideration is given to mixing in the upper head region. One reactor coolant pump can provide sufficient driving force to ensure adequate mixing of all four reactor coolant loops. This water volume is at 68°F and 14.7 psia which are the conservative Mode 5 conditions for this analysis. The analysis results for these conditions, combined with Assumptions c and d, bound the results for conditions at 200°F and 14.7 psia as well as for all conditions between these extremes.

c. All control and shutdown rods (RCCAs) fully inserted, except for the most reactive rod which is fully withdrawn, and a critical boron concentration (CB) of 1390 ppm.

d. The shutdown margin equal to 1 percent k/k, the minimum value as specified in the COLR for the cold shutdown mode. Combined with Assumption c, this gives a shutdown CB of 1476 ppm.

In the event of an inadvertent boron dilution transient while in this mode of operation, the source range nuclear instrumentation will detect a multiplication of the neutron flux.

When the flux multiplication setpoint is reached, the BDMS actuates an alarm and automatic mitigation functions (i.e., valve movement to terminate the dilution and start boration).

The shutdown mode analyses account for the following delay times:

Delay from the microprocessor to mitigation actuation (signal delay) - 10 seconds Opening of CVCS isolation valves from the RWST (BN-LCV-112D and E) - 15 seconds Closure of CVCS outlet isolation valves from the VCT (BG-LCV-112B and C) - 10 seconds Purge of the CVCS piping from the RWST to the RCS (conservative value of 100 ft3 was used) dependent on the assumed density-compensated dilution flow rate - 299 seconds in Mode 5 (68°F), 166 seconds in Mode 4 (200°F), and 154 seconds in Mode 3 (350°F).

The delay time from when the core flux reaches the flux multiplication setpoint till the BDMS indicates the setpoint has been reached is accounted for by the algorithm built into the solution technique used to analyze the boron dilution transient for plants that 15.4-25 Rev. OL-22 11/16

CALLAWAY - SP detect a positive reactivity insertion via a flux multiplication signal. This algorithm conservatively models the cycling of the circuitry of the Westinghouse Source Range Flux-Multiplication Boron Dilution Mitigation System.

The total delay time from when the actual flux reaches the flux-multiplication condition until reboration defines the most restrictive acceptance criterion for the analyses corresponding to the above limiting Mode conditions dilution flow rate, i.e. 334 seconds for Mode 5, 201 seconds for Mode 4, and 189 seconds for Mode 3.

Under the conditions defined above for Mode 5, the flux-multiplication condition will be reached approximately 20.22 minutes after the start of dilution.

Valves BN-LCV-112D and E are opened to supply borated water to the suction of the ECCS charging pumps, and valves BG-LCV-112B and C are closed to terminate the dilution within 5.56 minutes after reaching the flux-multiplication condition, prior to the loss of shutdown margin at 6.66 minutes after reaching the condition had the event gone unmitigated. These automatic actions are carried out to minimize the approach to criticality and regain the lost shutdown margin. No operator action is required to terminate this transient. Eventual recovery actions taken by the operator are to terminate boration after regaining the required shutdown margin and determine and correct the cause of the dilution transient.

When the water level is drained down from the filled and vented condition in cold shutdown, an uncontrolled boron dilution is prevented by administrative controls which isolate the RCS from the potential source of unborated water.

Dilution During Hot Shutdown (Mode 4)

The following conditions are assumed for the most limiting inadvertent boron dilution with respect to a return to power while in this mode:

a. The dilution flow rate is limited by piping system friction losses and the capacity of two makeup water pumps to supply a maximum of 260 gpm of unborated water.

b. A minimum mixing volume of 8995 ft3 in the RCS is used. This volume corresponds to the active volume of the RCS with one reactor coolant pump in operation, and does not include any volume in the pressurizer or its surge or spray lines, the vessel head, the CVCS, or the RHR system.

The volume specified here is conservative in that no consideration is given to mixing in the upper head region. One reactor coolant pump can provide sufficient driving force to ensure adequate mixing of all four reactor coolant loops. This water volume is at 200°F and 14.7 psia which are the conservative Mode 4 conditions for this analysis. The analysis results for these conditions, combined with Assumptions c and d, bound the results 15.4-26 Rev. OL-22 11/16

CALLAWAY - SP for conditions at 350°F saturation as well as for all conditions between these extremes.

c. All control and shutdown rods fully inserted, except for the most reactive rod which is fully withdrawn, and a boron concentration of 1412 ppm when shutdown margin is lost.

d. The shutdown margin equal to 1.3 percent k/k, the minimum value as specified in the COLR for the hot shutdown mode. Combined with Assumption c, this gives a shutdown CB of 1528 ppm.

In the event of an inadvertent boron dilution transient while in this mode of operation, the source range nuclear instrumentation will detect a multiplication of the neutron flux, automatically initiate valve movement to begin boration and terminate the dilution, and sound an alarm for the operator via the BDMS. Under the conditions defined above for Mode 4, the flux-multiplication condition will be reached approximately 13.30 minutes after start of dilution. Reboration occurs within 3.34 minutes after reaching the flux-multiplication condition, prior to the loss of shutdown margin at 6.38 minutes after reaching the condition had the event gone unmitigated. No operator action is required to terminate this transient.

Dilution During Hot Standby (Mode 3)

The following conditions are assumed for the most limiting inadvertent boron dilution with respect to a return to power while in this mode:

a. The diluton flow is limited to a maximum of 260 gpm of unborated water (as in the previous case).

b. A minimum mixing volume of 8995 ft3 in the RCS is used. This volume corresponds to the active volume of the RCS with one reactor coolant pump in operation, and does not include any volume in the pressurizer or its surge or spray lines, the vessel head, the CVCS, or the RHR system.

The volume specified here is conservative in that no consideration is given to mixing in the upper head region. One reactor coolant pump can provide sufficient driving force to ensure adequate mixing of all four reactor coolant loops. This water volume is at 350°F saturation which are the conservative Mode 3 conditions for this analysis. The analysis results for these conditions, combined with Assumptions c and d, bound the results for conditions at 557°F and 2250 psia as well as for all conditions between these extremes.

c. A boron concentration of 1423 ppm when shutdown margin is lost assuming all control and shutdown rods are fully inserted, except for the most reactive rod which is fully withdrawn.

15.4-27 Rev. OL-22 11/16

CALLAWAY - SP

d. The shutdown margin equal to 1.3 percent k/k, the minimum value as specified in the COLR for the hot standby mode. Combined with Assumption c, this gives a shutdown CB of 1550 ppm.

In the event of an inadvertent boron dilution transient while in this mode of operation, the source range nuclear instrumentation will detect a multiplication of the neutron flux, automatically initiate valve movement to begin boration and terminate the dilution, and sound an alarm for the operator via the BDMS. Under the conditions defined above for Mode 3, the flux-multiplication condition will be reached approximately 13.48 minutes after start of dilution. Reboration occurs within 3.14 minutes after reaching the flux-multiplication condition prior to the loss of shutdown margin at 6.22 minutes after reaching the condition had the event gone unmitigated. No operator action is required to terminate this transient.

Dilution During Start-up (Mode 2)

In this mode, the plant is being taken from one long-term mode of operation, Hot Standby, to another, Power. The plant is maintained in the Start-up mode only for the purpose of start-up testing at the beginning of each cycle. During this mode of operation, rod control is in manual. All normal actions required to change power level, either up or down, require operator initiation. The COLR and the Technical Specifications require an available trip reactivity of 1.3 percent K/K (in MODE 2 with keff < 1.0) and four reactor coolant pumps operating. Other conditions assumed are:

a. Dilution flow is the maximum capacity of two ECCS centrifugal charging pumps with the RCS at 2250 psia: 245 gpm.

b. A minimum RCS water volume of 9700 ft3 at 558.6°F. This is a very conservative estimate of the active RCS volume, minus the pressurizer volume.

c. An initial maximum critical boron concentration, corresponding to the shutdown banks withdrawn and control banks inserted to the insertion limits, is assumed to be 1800 ppm. The minimum change in boron concentration from this initial condition to a hot zero power critical condition with all control and shutdown rods inserted is assumed to be 300 ppm. Full rod insertion, minus the most reactive stuck rod, is assumed to occur due to reactor trip.

This mode of operation is a transitory operational mode in which the operator intentionally dilutes and withdraws control rods to take the plant critical. During this mode, the plant is in manual control with the operator required to maintain a very high awareness of the plant status. For a normal approach to criticality, the operator must manually initiate a limited dilution and subsequently manually withdraw the control rods, a process that takes several hours. The Technical Specifications require that the operator determine the estimated critical position of the control rods prior to approaching 15.4-28 Rev. OL-22 11/16

CALLAWAY - SP criticality, thus assuring that the reactor does not go critical with the control rods below the insertion limits. Once critical, the power escalation must be sufficiently slow to allow the operator to manually block the source range reactor trip (nominally at 105 cps) after receiving P-6 from the intermediate range (nominally at 1 x 10-10 amps). Too fast a power escalation (due to an unknown dilution) would result in reaching P-6 unexpectedly, leaving insufficient time to manually block the source range reactor trip. Failure to perform this manual action results in a reactor trip and immediate shutdown of the reactor.

After reactor trip, there is approximately 40 minutes for operator action prior to return to criticality. The required operator action is the opening of valves BN-LCV-112D and E to initiate boration and the closing of valves BG-LCV-112B and C to terminate dilution.

Dilution During Full Power Operation (Mode 1)

The plant is operated at power with the rod control system typically in the automatic mode. The COLR specifies an available trip reactivity of 1.3 percent K/K and four reactor coolant pumps operating. With the plant at power and the RCS at pressure, the dilution rate is limited by the capacity of the ECCS centrifugal charging pumps. The analysis is performed assuming two ECCS charging pumps are in operation even though normal operation is with one pump. Conditions assumed for this mode are:

a. Dilution flow from two ECCS charging pumps is at the maximum at an RCS pressure of 2250 psia (247 gpm) when the reactor is in manual control.

When in automatic control, the dilution flow is the maximum letdown flow of 120 gpm.

b. A minimum RCS water volume of 9700 ft3 at 588.4°F. This is a very conservative estimate of the active RCS volume, minus the pressurizer volume.

c. An initial maximum critical boron concentration, corresponding to the shutdown banks withdrawn and the control banks inserted to the insertion limits, is assumed to be 1800 ppm. The minimum change in boron concentration from this initial condition to a hot zero power critical condition with all control and shutdown rods inserted is assumed to be 300 ppm. Full rod insertion, minus the most reactive stuck rod, is assumed to occur due to reactor trip.

With the reactor in manual control and no operator action taken to terminate the transient, the power and temperature rise will cause the reactor to reach the Overtemperature T trip setpoint resulting in a reactor trip. After reactor trip there is at least 34 minutes for operator action prior to return to criticality. The required operator action is the opening of valves BN-LCV-112D and E and the closing of valves BG-LCV-112B and C. The boron dilution transient in this case is essentially equivalent 15.4-29 Rev. OL-22 11/16

CALLAWAY - SP to an uncontrolled RCCA bank withdrawal at power. The maximum reactivity insertion rate for a boron dilution transient is conservatively estimated to be 1.6 pcm/sec and is within the range of insertion rates analyzed for uncontrolled RCCA bank withdrawal at power. It should be noted that prior to reaching the Overtemperature T reactor trip, the operator will have received an alarm on Overtemperature T and an Overtemperature T turbine runback and control rod stop.

With the reactor in automatic rod control, the pressurizer level controller will limit the dilution flow rate to the maximum letdown rate, approximately 120 gpm. If a dilution rate in excess of the letdown rate is present, the pressurizer level controller will throttle charging flow down to match the letdown rate.

Thus, with the reactor in automatic rod control, a boron dilution will result in a power and temperature increase such that the rod controller will attempt to compensate by slow insertion of the control rods. This action by the controller will result in at least three alarms to the operator:

a. Rod insertion limit - low level alarm

b. Rod insertion limit - low-low level alarm if insertion continued after item a

c. Axial flux difference alarm - (I outside of the target band).

Given the many alarms, indications, and the inherent slow process of dilution at power, the operator has sufficient time for action. For example, the operator has at least 69 minutes from the control rod insertion limit low-low alarm until shutdown margin is lost at beginning-of-life. The time would be significantly longer at end-of-life, due to the low initial boron concentration.

For the automatic reactor control case, a letdown flow of 150 gpm has been evaluated and found to be acceptable (greater than 62 minutes from the rod insertion limit low-low alarm until shutdown margin is lost).

The above results demonstrate that in all modes of operation, an inadvertent boron dilution is precluded or responded to by automatic functions, or sufficient time is available for operator action to terminate the transient. Following termination of the dilution flow and initiation of boration, the reactor is in a stable condition with the operator regaining the required shutdown margin.

15.4.6.3 Conclusions Administrative controls will limit the volume of unborated water added to the refueling pool during Mode 6 in order to prevent diluting the refueling pool below the limits specified in Technical Specification LCO 3.9.1 as discussed in OL Amendment Number 97.

15.4-30 Rev. OL-22 11/16

CALLAWAY - SP Inadvertent boron dilution events which would cause the highest return to power are automatically terminated during cold shutdown, hot shutdown, and hot standby modes.

Cases that would cause a comparatively lower return to power, and not terminated by the BDMS before reaching criticality, rely on operator action for termination. Inadvertent boron dilution events during start-up or power operation, if not detected and terminated by the operators, will result in reactor trip. Following reactor trip, there is ample time available for the operators to terminate the dilution prior to a return to criticality.

15.4.7 INADVERTENT LOADING AND OPERATION OF A FUEL ASSEMBLY IN IMPROPER POSITION 15.4.7.1 Identification of Causes and Accident Description Fuel and core loading errors that can arise from the inadvertent loading of one or more fuel assemblies into improper positions, loading a fuel rod during manufacture with one or more pellets of the wrong enrichment, or the loading of a full fuel assembly during manufacture with pellets of the wrong enrichment will lead to increased heat fluxes if the error results in placing fuel in core positions calling for fuel of lesser enrichment. Also included among possible core loading errors is the inadvertent loading of one or more fuel assemblies requiring burnable poison rods into a new core without burnable poison rods.

Any error in enrichment, beyond the normal manufacturing tolerances, can cause power shapes which are more peaked than those calculated with the correct enrichments.

There is a 5-percent uncertainty margin included in the design value of power peaking factor assumed in the analysis of Condition I and Condition II transients. The in-core system of moveable flux detectors, which is used to verify power shapes at the start of life, is capable of revealing any assembly enrichment error or loading error which causes power shapes to be peaked in excess of the design value.

To reduce the probability of core loading errors, each fuel assembly is marked with an identification number and loaded in accordance with a core loading diagram. Prior to core loading, the identification number of each assembly will be checked before it is moved into the core. Serial numbers read during or after fuel movement are subsequently recorded on the loading diagram as a further check on proper placing after the loading is completed.

The power distortion due to any combination of misplaced fuel assemblies would significantly raise peaking factors and would be readily observable with in-core flux monitors. In addition to the flux monitors, thermocouples are located at the outlet of about one-third of the fuel assemblies in the core. There is a high probability that these thermocouples would also indicate any abnormally high coolant enthalpy rise. In-core flux measurements are taken during the startup subsequent to every refueling operation.

This event is classified as an ANS Condition III incident (an infrequent fault), as defined in Section 15.0.1.

15.4-31 Rev. OL-22 11/16

CALLAWAY - SP 15.4.7.2 Analysis of Effects and Consequences Method of Analysis Steady state power distributions in the x-y plane of the core are calculated using the TURTLE code (Ref. 6) based on macroscopic cross sections calculated by the LEOPARD code (Ref. 7). A discrete representation is used wherein each individual fuel rod is described by a mesh interval. Representative power distributions in the x-y plane for a correctly loaded core assembly are given in Chapter 4.0.

For each core loading error case analyzed, the percent deviations from detector readings for a normally loaded core are shown at all in-core detector locations (see Figures 15.4-18 to 15.4-22, inclusive).

Results The following core loading error cases have been analyzed:

Case A:

Case in which a Region 1 assembly is interchanged with a Region 3 assembly. The particular case considered was the interchange to two adjacent assemblies near the periphery of the core (see Figure 15.4-18).

Case B:

Case in which a Region 1 assembly is interchanged with a neighboring Region 2 fuel assembly. Two analyses have been performed for this case (see Figures 15.4-19 and 15.4-20).

In Case B-1, the interchange is assumed to take place with the burnable poison rods transferred with the Region 2 assembly mistakenly loaded into Region 1.

In Case B-2, the interchange is assumed to take place closer to core center and with burnable poison rods located in the correct Region 2 position, but in a Region 1 assembly mistakenly loaded in the Region 2 position.

Case C:

Enrichment error: Case in which a Region 2 fuel assembly is loaded in the core central position (see Figure 15.4-21).

Case D:

Case in which a Region 2 fuel assembly instead of a Region 1 assembly is loaded near the core periphery (see Figure 15.4-22).

15.4-32 Rev. OL-22 11/16

CALLAWAY - SP 15.4.7.3 Conclusions Fuel assembly enrichment errors would be prevented by administrative procedures implemented in fabrication.

In the event that a single pin or pellet has a higher enrichment than the nominal value, the consequences in terms of reduced DNBR and increased fuel and clad temperatures will be limited to the incorrectly loaded pin or pins and perhaps the immediately adjacent pins.

Fuel assembly loading errors are prevented by adminstrative procedures implemented during core loading. In the unlikely event that a loading error occurs, analyses in this section confirm that resulting power distribution effects will either be readily detected by the in-core moveable detector system or will cause a sufficiently small perturbation to be acceptable within the uncertainties allowed between nominal and design power shapes.

15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS 15.4.8.1 Identification of Causes and Accident Description This accident is defined as the mechanical failure of a control rod mechanism pressure housing, resulting in the ejection of an RCCA and drive shaft. The consequence of this mechanical failure is a rapid positive reactivity insertion and system depressurization together with an adverse core power distribution, possibly leading to localized fuel rod damage.

15.4.8.1.1 Design Precautions and Protection Certain features are intended to preclude the possibility of the rod ejection accident, or to limit the consequences if the accident were to occur. These include a sound, conservative mechanical design of the rod housings, together with a thorough quality control (testing) program during assembly, and a nuclear design which lessens the potential ejection worth of RCCAs and minimizes the number of control rod assemblies inserted at high power levels.

Mechanical Design The mechanical design is discussed in Section 4.2. Mechanical design and quality control procedures intended to preclude the possibility of an RCCA drive mechanism housing failure are listed below:

a. Each control rod drive mechanism rod travel housing is individually shop tested at 3110 psig.

15.4-33 Rev. OL-22 11/16

CALLAWAY - SP

b. The control rod drive mechanism latch housings are hydrotested after they are attached to the head adapters and checked during the hydrotest of the completed closure head at 3107 psig.

c. Stress levels in the mechanism are not affected by anticipated system transients at power, or by the thermal movement of the coolant loops.

Moments induced by the design basis earthquake can be accepted within the allowable primary working stress range specified by the ASME Code,Section III, for Class 1 components.

d. The latch mechanism housing and rod travel housing are each a single length of forged Type 304 stainless steel. This material exhibits excellent notch toughness at all temperatures which will be encountered.

e. The CRDM housing plug is an integral part of the rod travel housing.

A significant margin of strength in the elastic range, together with the large energy absorption capability in the plastic range, gives additional assurance that gross failure of the housing will not occur. The joint between the latch mechanism housing and rod travel housing is a threaded joint reinforced by canopy-type welds which are subject to periodic inspections.

Nuclear Design Even if a rupture of an RCCA drive mechanism housing is postulated, the operation of a plant utilizing chemical shim is such that the severity of an ejected RCCA is inherently limited. In general, the reactor is operated with the control banks inserted only far enough to permit load follow. Reactivity changes caused by core depletion and xenon transients are compensated for by boron changes. Further, the location and grouping of control banks are selected during the nuclear design to lessen the severity of an RCCA ejection accident. Therefore, should an RCCA be ejected from its normal position during full power operation, only a minor reactivity excursion, at worst, could be expected to occur.

However, it may be occasionally desirable to operate with larger-than-normal insertions.

For this reason, a rod insertion limit is defined as a function of power level. Operation with the control banks above this limit guarantees adequate shutdown capability and acceptable power distribution. The position of all RCCAs is continuously indicated in the control room. An alarm will occur if the control banks approach their insertion limit or if one RCCA deviates from its bank. Operating instructions require the operator to clear the condition or to calculate shutdown margin at the low level alarm. Emergency boration is required at the low-low alarm if there is inadequate shutdown margin, as discussed in Section 7.7.1.3.3.

Reactor Protection 15.4-34 Rev. OL-22 11/16

CALLAWAY - SP The reactor protection in the event of a rod ejection accident has been described in Reference 8. The protection for this accident is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip (for certain partial power, low rod worth events). These protection functions are described in detail in Section 7.2.

Effects on Adjacent Housings Disregarding the remote possibility of the occurrence of an RCCA mechanism housing failure, investigations have shown that failure of a housing due to either longitudinal or circumferential cracking would not cause damage to adjacent housings.

The control rod drive mechanism is described in Section 3.9(N).4. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause the RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.

Effects of Rod Travel Housing Longitudinal Failures If a longitudinal failure of the rod travel housing should occur, the region of the position indicator assembly opposite the break would be stressed by the reactor coolant pressure of 2,250 psia. The most probable leakage path would be provided by the radial deformation of the position indicator coil assembly, resulting in the growth of axial flow passages between the rod travel housing and the hollow tube along which the coil assemblies are mounted.

If failure of the position indicator coil assembly should occur, the resulting free radial jet from the failed housing could cause it to bend and contact adjacent rod housings. If the adjacent housings were on the periphery, they might bend outward from their bases.

The housing material is quite ductile; plastic hinging without cracking would be expected.

Housings adjacent to a failed housing, in locations other than the periphery, would not be bent because of the rigidity of multiple adjacent housings.

Effect of Rod Travel Housing Circumferential Failures If circumferential failure of a rod travel housing should occur, the broken-off section of the housing would be ejected vertically because the driving force is vertical and the position indicator coil assembly and the drive shaft would tend to guide the broken-off piece upwards during its travel. Travel is limited by the missile shield, thereby limiting the projectile acceleration. When the projectile reached the missile shield, it would partially penetrate the shield and dissipate its kinetic energy. The water jet from the break would continue to push the broken-off piece against the missile shield.

15.4-35 Rev. OL-22 11/16

CALLAWAY - SP If the broken-off piece of the rod travel housing were short enough to clear the break when fully ejected, it would rebound after impact with the missile shield. The top end plates of the position indicator coil assemblies would prevent the broken piece from directly hitting the rod travel housing of a second drive mechanism. Even if a direct hit by the rebounding piece were to occur, the low kinetic energy of the rebounding projectile would not be expected to cause significant damage (sufficient to cause failure of a adjacent housing).

Possible Consequences From the above discussion, the probability of damage to an adjacent housing must be considered remote. However, even if damage is postulated, it would not be expected to lead to a more severe transient since RCCAs are inserted in the core in symmetric patterns, and control rods immediately adjacent to worst ejected rods are not in the core when the reactor is critical. Damage to an adjacent housing could, at worst, cause that RCCA not to fall on receiving a trip signal; however, this is already taken into account in the analysis by assuming a stuck rod adjacent to the ejected rod.

Summary The considerations given above lead to the conclusion that failure of a control rod housing, due either to longitudinal or circumferential cracking, would not cause damage to adjacent housings that would increase severity of the initial accident.

15.4.8.1.2 Limiting Criteria This event is classified as an ANS Condition IV incident. See Section 15.0.1 for a discussion of ANS classifications. Due to the extremely low probability of an RCCA ejection accident, some fuel damage would be considered an acceptable consequence.

Comprehensive studies of the threshold of fuel failure and of the threshold or significant conversion of the fuel thermal energy to mechanical energy have been carried out as part of the SPERT project by the Idaho Nuclear Corporation (Ref. 9).

Extensive tests of zirconium clad UO2 fuel rods representative of those in pressurized water reactor type cores have demonstrated failure thresholds in the range of 240 to 257 cal/gm. However, other rods of a slightly different design have exhibited failures as low as 225 cal/gm. These results differ significantly from the TREAT (Ref. 10) results, which indicated a failure threshold of 280 cal/gm. Limited results have indicated that this threshold decreases by about 10 percent with fuel burnup. The clad failure mechanism appears to be melting for zero burnup rods and brittle fracture for irradiated rods. Also important is the conversion ratio of thermal to mechanical energy. This ratio becomes marginally detectable above 300 cal/gm for unirradiated rods and 200 cal/gm for irradiated rods; catastrophic failure (large fuel dispersal, large pressure rise), even for irradiated rods, did not occur below 300 cal/gm.

15.4-36 Rev. OL-22 11/16

CALLAWAY - SP In view of the above experimental results, criteria are applied to ensure that there is little or no possibility of fuel dispersal in the coolant, gross lattice distortion, or severe shock waves. These criteria are:

a. Average fuel pellet enthalpy at the hot spot will be below 225 cal/gm for unirradiated fuel and 200 cal/gm for irradiated fuel.

b. Peak reactor coolant pressure less than that which could cause stresses to exceed the faulted condition stress limits.

c. Fuel melting will be limited to less than 10 percent of the fuel volume at the hot spot even if the average fuel pellet enthalpy is below the limits of criterion a above.

15.4.8.2 Analysis of Effects and Consequences 15.4.8.2.1 Method of Analysis The calculation of the RCCA ejection transient is performed in two stages, first an average core channel calculation and then a hot region calculation. The average core calculation is performed using spatial neutron kinetics methods to determine the average power generation with time, including the various total core feedback effects, i.e.,

Doppler reactivity and moderator reactivity. Enthalpy and temperature transients in the hot spot are then determined by multiplying the average core energy generation by the hot channel factor and performing a fuel rod transient heat transfer calculation. The power distribution calculated without feedback is pessimistically assumed to persist throughout the transient.

A detailed discussion of the method of analysis can be found in Reference 8.

Average Core Analysis The spatial kinetics computer code, TWINKLE (Ref. 1), is used for the average core transient analysis. This code uses cross sections generated by LEOPARD (Ref. 7) to solve the two group neutron diffusion theory kinetic equation in one, two, or three spatial dimensions (rectangular coordinates) for six delayed neutron groups and up to 2,000 spatial points. The computer code includes a detailed multiregion, transient fuel-clad coolant heat transfer model for calculation of pointwise Doppler and moderator feedback effects. In this analysis, the code is used as a one-dimensional axial kinetics code, since it allows a more realistic representation of the spatial effects of axial moderator feedback and RCCA movement. However, since the radial dimension is missing, it is still necessary to employ very conservative methods (described in the following) of calculating the ejected rod worth and hot channel factor. Further description of TWINKLE appears in Section 15.0.11.

Hot Spot Analysis 15.4-37 Rev. OL-22 11/16

CALLAWAY - SP In the hot spot analysis, the initial heat flux is equal to the nominal times the design hot channel factor. During the transient, the heat flux hot channel factor is linearly increased to the transient value in 0.1 second, the time for full ejection of the rod. Therefore, the assumption is made that the hot spot before and after ejection is coincident. This is very conservative since the peak after ejection will occur in or adjacent to the assembly with the ejected rod, and prior to ejection, the power in this region will necessarily be depressed.

The hot spot analysis is performed using the detailed fuel and clad transient heat transfer computer code, FACTRAN (Ref. 2). This computer code calculates the transient temperature distribution in a cross section of a metal clad UO2 fuel rod, and the heat flux at the surface of the rod, using as input the nuclear power versus time and the local coolant conditions. The zirconium-water reaction is explicitly represented, and all material properties are represented as functions of temperature. A conservative pellet radial power distribution is used within the fuel rod.

FACTRAN uses the Dittus-Boelter or Jens-Lottes correlation to determine the film heat transfer before DNB, and the Bishop-Sandburg-Tong correlation (Ref. 11) to determine the film boiling coefficient after DNB. The Bishop-Sandburg-Tong correlation is conservatively used, assuming zero bulk fluid quality. The DNBR is not calculated; instead the code is forced into DNB by specifying a conservative DNB heat flux. The gap heat transfer coefficient can be calculated by the code; however, it is adjusted in order to force the full power steady-state temperature distribution to agree with the fuel heat transfer design codes. Further description of FACTRAN appears in Section 15.0.11.

System Overpressure Analysis Because safety limits for fuel damage specified earlier are not exceeded, there is little likelihood of fuel dispersal into the coolant. The pressure surge may, therefore, be calculated on the basis of conventional heat transfer from the fuel and prompt heat generation in the coolant.

The pressure surge is calculated by first performing the fuel heat transfer calculation to determine the average and hot spot heat flux versus time. Using this heat flux data, a THINC calculation is conducted to determine the volume surge. Finally, the volume surge is simulated in a plant transient computer code. This code calculates the pressure transient, taking into account fluid transport in the RCS and heat transfer to the steam generators. No credit is taken for the possible pressure reduction caused by the assumed failure of the RCCA pressure housing.

15.4.8.2.2 Calculation of Basic Parameters Input parameters for the analysis are conservatively selected on the basis of values calculated for this type of core. The more important parameters are discussed below.

Table 15.4-2 presents the parameters used in this analysis.

15.4-38 Rev. OL-22 11/16

CALLAWAY - SP Ejected Rod Worths and Hot Channel Factors The values for ejected rod worths and hot channel factors are calculated using either three-dimensional static methods or by a synthesis method employing one-dimensional and two-dimensional calculations. Standard nuclear design codes are used in the analysis. No credit is taken for the flux flattening effects of reactivity feedback. The calculation is performed for the maximum allowed control bank insertion at a given power level, as determined by the rod insertion limits. Adverse xenon distributions are considered in the calculation.

Appropriate margins are added to the ejected rod worth and hot channel factors to account for any calculational uncertainties, including an allowance for nuclear power peaking due to densification.

Power distributions before and after ejection for a "worst case" can be found in Reference 8.

Reactivity Feedback Weighting Factors The largest temperature rises, and hence the largest reactivity feedbacks, occur in channels where the power is higher than average. Since the weight of a region is dependent on flux, these regions have high weights. This means that the reactivity feedback is larger than that indicated by a simple channel analysis. Physics calculations have been carried out for temperature changes with a flat temperature distribution and with a large number of axial and radial temperature distributions. Reactivity changes were compared and effective weighting factors determined. These weighting factors take the form of multipliers which, when applied to single-channel feedbacks, correct them to effective whole core feedbacks for the appropriate flux shape. In this analysis, since a one-dimensional (axial) spatial kinetics method is employed, axial weighting is not necessary if the initial condition is made to match the ejected rod configuration. In addition, no weighting is applied to the moderator feedback. A conservative radial weighting factor is applied to the transient fuel temperature to obtain an effective fuel temperature as a function of time, accounting for the missing spatial dimension. These weighting factors have also been shown to be conservative, compared to three-dimensional analysis (Ref. 8).

Moderator and Doppler Coefficient The critical boron concentrations at the beginning-of-life and end-of-life are adjusted in the nuclear code in order to obtain moderator density coefficient curves which are conservative, compared to actual design conditions for the plant. As discussed above, no weighting factor is applied to these results.

The Doppler reactivity defect is determined as a function of power level, using a one-dimensional steady state computer code with a Doppler weighting factor of 1.0. The Doppler coefficient used does not directly correlate with Figure 15.0-2 because the 15.4-39 Rev. OL-22 11/16

CALLAWAY - SP TWINKLE code, on which the neutronic analysis is based, is a diffusion-theory code rather than a point-kinetics approximation. The Doppler defect, used as an initial condition, is -925 pcm. The Doppler weighting factor will increase under accident conditions, as discussed above.

Delayed Neutron Fraction, Calculations of the effective delayed neutron fraction (eff) typically yield values no less than 0.70 percent at beginning-of-life and 0.50 percent at end-of-life for the first cycle.

The accident is sensitive to eff if the ejected rod worth is equal to or greater than eff as in zero power transients. In order to allow for future cycles, pessimistic estimates of eff of 0.50 percent at beginning-of-cycle and 0.44 percent at end-of-cycle were used in the analysis.

Trip Reactivity Insertion The trip reactivity insertion assumed is given in Table 15.4-2 and includes the effect of one stuck RCCA. These values are reduced by the ejected rod reactivity. The shutdown reactivity was simulated by dropping a rod of the required worth into the core. The start of rod motion occurred 0.5 second after the high neutron flux trip point was reached.

This delay is assumed to consist of 0.2 second for the instrument channel to produce a signal, 0.15 second for the trip breaker to open, and 0.15 second for the coil to release the rods. A curve of trip rod insertion versus time was used which assumed that insertion to the dashpot does not occur until 2.7 seconds after the start of fall. The choice of such a conservative insertion rate means that there is over 1 second after the trip point is reached before significant shutdown reactivity is inserted into the core. This is a particularly important conservatism for hot full power accidents.

The minimum design shutdown margin available for this plant at hot zero power (HZP) may be reached only at end-of-life in the equilibrium cycle. This value includes an allowance for the worst stuck rod, adverse xenon distribution, conservative Doppler and moderator defects, and an allowance for calculational uncertainties. Physics calculations for this plant have shown that the effect of two stuck RCCAs (one of which is the worst ejected rod) is to reduce the shutdown margin by about an additional 1 percent k/k. Therefore, following a reactor trip resulting from an RCCA ejection accident, the reactor will be subcritical when the core returns to HZP.

Depressurization calculations have been performed for a typical four-loop plant, assuming the maximum possible size break (2.75-inch diameter) located in the reactor pressure vessel head. The results show a rapid pressure drop and a decrease in system water mass due to the break. The ECCS is actuated on low pressurizer pressure within 1 minute after the break. The RCS pressure continues to drop and reaches saturation

(~1,200 psi depending on the system temperature) in about 2 to 3 minutes. Due to the large thermal inertia of the primary and secondary systems, there has been no significant decrease in the RCS temperature below no-load by this time, and the depressurization 15.4-40 Rev. OL-22 11/16

CALLAWAY - SP itself has caused an increase in shutdown margin by about 0.2 percent k/k due to the pressure coefficient. The cooldown transient could not absorb the available shutdown margin until more than 10 minutes after the break. The addition of borated ECCS flow starting 1 minute after the break is sufficient to ensure that the core remains subcritical during the cooldown.

Reactor Protection As discussed in Section 15.4.8.1.1, reactor protection for a rod ejection is provided by high neutron flux trip (high and low setting) and high rate of neutron flux increase trip.

These protection functions are part of the reactor trip system. No single failure of the reactor trip system will negate the protection functions required for the rod ejection accident, or adversely affect the consequences of the accident.

Results Cases are presented for both beginning- and end-of-life at zero and full power.

a. Beginning-of-cycle, full power Control bank D was assumed to be inserted to its insertion limit. The worst ejected rod worth and hot channel factor were conservatively calculated to be 0.20 percent k/k and 6.3, respectively. The peak hot spot clad average temperature was 2,420°F. The peak hot spot fuel center temperature reached melting, conservatively assumed at 4,900°F. However, melting was restricted to less than 10 percent of the pellet.

b. Beginning-of-cycle, zero power For this condition, control bank D was assumed to be fully inserted, and control banks B and C were at their insertion limits. The worst ejected rod is located in control bank D and has a worth of 0.77 percent k/k and a hot channel factor of 11.0. The peak hot spot average clad temperature reached 2,533°F; the fuel center temperature was 3,899°F.

c. End-of-cycle, full power Control bank D was assumed to be inserted to its insertion limit. The ejected rod worth and hot channel factors were conservatively calculated to be 0.25 percent k/k and 6.4, respectively. This resulted in a peak clad average temperature of 2,290°F. The peak hot spot fuel center temperature reached melting, conservatively assumed at 4,800°F.

However, melting was restricted to less than 10 percent of the pellet.

d. End-of-cycle, zero power 15.4-41 Rev. OL-22 11/16

CALLAWAY - SP The ejected rod worth and hot channel factor for this case were obtained, assuming control bank D to be fully inserted with control bank C and at its insertion limit. The results were 0.90 percent k/k and 20.0, respectively.

The peak clad average and fuel center temperatures were 2,399°F and 3,584°F, respectively. The Doppler weighting factor for this case is significantly higher than for the other cases due to the very large transient hot channel factor.

A summary of the cases presented above is given in Table 15.4-2. The nuclear power and hot spot fuel and clad temperature transients for the worst cases (beginning-of-life full power and end-of-life zero power) are presented in Figures 15.4-23 through 15.4-26.

The calculated sequence of events for the worst case rod ejection accidents, as shown in Figures 15.4-23 through 15.4-26, is presented in Table 15.4-1. For all cases, reactor trip occurs very early in the transient, after which the nuclear power excursion is terminated.

As discussed previously, the reactor will remain subcritical following reactor trip.

The ejection of an RCCA constitutes a break in the RCS, located in the reactor pressure vessel head. The effects and consequences of loss-of-coolant accidents are discussed in Section 15.6.5. Following the RCCA ejection, the operator would follow the same emergency instructions as for any other loss-of-coolant accident to recover from the event. The RCS integrated break flow to containment following a rod ejection is shown in Figure 15.4-27.

Fission Product Release It is assumed that fission products are released from the gaps of all rods entering the DNB. In all cases considered, less than 10 percent of the rods entered the DNB based on a detailed three-dimensional THINC analysis (Ref. 8).

Although limited fuel melting at the hot spot was predicted for the full power cases, in practice melting is not expected since the analysis conservatively assumed that the hot spots before and after ejection were coincident.

Pressure Surge A detailed calculation of the pressure surge for an ejection worth of one dollar at beginning-of-life, hot full power, indicates that the peak pressure does not exceed that which would cause stress to exceed the faulted condition stress limits (Ref. 8).

Lattice Deformations A large temperature gradient will exist in the region of the hot spot. Since the fuel rods are free to move in the vertical direction, differential expansion between separate rods cannot produce distortion. However, the temperature gradients across individual rods may produce a differential expansion tending to bow the midpoint of the rods toward the 15.4-42 Rev. OL-22 11/16

CALLAWAY - SP hotter side of the rod. Calculations have indicated that this bowing would result in a negative reactivity effect at the hot spot since Westinghouse cores are under-moderated, and bowing will tend to increase the under-moderation at the hot spot. Since the 17 x 17 fuel design is also under-moderated, the same effect would be observed. In practice, no significant bowing is anticipated, since the structural rigidity of the core is more than sufficient to withstand the forces produced. Boiling in the hot spot region would produce a net flow of coolant away from that region. However, the heat from the fuel is released to the water relatively slowly, and it is considered inconceivable that cross flow will be sufficient to produce significant lattice forces. Even if massive and rapid boiling, sufficient to distort the lattice, is hypothetically postulated, the large void fraction in the hot spot region would produce a reduction in the total core moderator to fuel ratio, and a large reduction in this ratio at the hot spot. The net effect would therefore be a negative feedback. It can be concluded that no conceivable mechanism exists for a net positive feedback resulting from lattice deformation. In fact, a small negative feedback may result. The effect is conservatively ignored in the analysis.

15.4.8.3 Radiological Consequences 15.4.8.3.1 Method of Analysis 15.4.8.3.1.1 Physical Model Prior to the accident, it is assumed that the plant has been operating with simultaneous fuel defects and steam generator tube leakage for a time sufficient to establish equilibrium levels of activity in the reactor coolant and secondary systems.

The RCCA ejection results in reactivity being inserted to the core which causes the local power to rise. In a conservative analysis, it is assumed that partial cladding failure and fuel melting occurs. The fuel pellet and gap activities are assumed to be immediately and uniformly released within the reactor coolant. Two release paths to the environment exist which are analyzed separately and conservatively, as if all the activity is available for release from each path.

The activity released to the containment from the reactor coolant through the ruptured control rod mechanism pressure housing is assumed to be mixed instantaneously throughout the containment and is available for leakage to the atmosphere. The only removal processes considered in the containment are iodine plateout, radioactive decay, and leakage from the containment.

The model for the activity available for release to the atmosphere from the S/G relief valves assumes that the release consists of the activity in the secondary system plus that fraction of the activity leaking from the reactor coolant through the steam generator tubes. The leakage of reactor coolant to the secondary side of the steam generator continues until the pressures in the reactor coolant and secondary systems equalize.

15.4-43 Rev. OL-22 11/16

CALLAWAY - SP Thereafter, no mass transfer from the reactor coolant system to the secondary system due to the steam generator tube leakage is assumed. Thus, in the case of coincident loss of offsite power, activity is released to the atmosphere from steam relief through the S/G PORVs.

15.4.8.3.1.2 Assumptions and Conditions The major assumptions and parameters used in the analysis are itemized in Tables 15.4-3 and 15A-1 and summarized below. The assumptions are consistent with Regulatory Guide 1.77.

The assumption used to determine the initial concentrations of isotopes in the reactor coolant and secondary coolant prior to the accident are as follows:

a. The initial reactor coolant iodine activity corresponds to an isotope mixture that bounds Technical Specification allowable conditions for both tight and open fuel defects. The initial isotopic mix is based on the relative concentrations from Table 11.1-5. The concentrations are then changed to achieve a Dose Equivalent I-131 (DEI) of 1.0 Ci/gm, while maintaining the isotopic ratios from Table 11.1-5. This provides conservative values for the longer lived iodines which contribute the majority of the calculated thyroid dose. The initial concentration of the shorter lived iodines are then increased to bound the concentrations which would be observed in the presence of open fuel defects. The shorter lived iodine isotopes are not major contributors of thyroid dose, but may provide a noticeable contribution to calculated whole body dose. The initial reactor coolant iodine activity assumed for this sequence, as provided in Table 15A-5, bounds allowable plant conditions for open or tight fuel defects, and the contributions of the longer and shorter lived isotopes to whole body and thyroid consequences.

b. The noble gas activity in the reactor coolant and secondary system is based on 1-percent fuel defects.

c. The initial secondary side iodine activity to 1/10th of the initial assumed primary side iodine activity.

The following conditions are used to calculate the activity released and the offsite doses following a RCCA ejection accident.

a. 10 percent of the fuel rod gap activity, except for Kr-85 which is 30 percent, is additionally released to the reactor coolant.

b. 0.25 percent of the fuel is assumed to melt.

15.4-44 Rev. OL-22 11/16

CALLAWAY - SP

c. Following the incident until primary and secondary side pressures equalize, steam is released to the environment.

d. The 1-gpm primary-to-secondary leak to the steam generators is assumed.

e. All noble gas activity in the reactor coolant which is transported to the secondary system via the primary-to-secondary leakage is assumed to be immediately released to the environment.

f. Fission products released from the fuel-cladding gap of the damaged fuel rods are assumed to be instantaneously and homogeneously mixed with the reactor coolant.

g. A partition factor of 0.1 between the vapor and liquid phases for radioiodine in the steam generators is used for secondary side releases and 0.1 for iodine in primary-to-secondary leakage.

h. The activity released from the steam generators is immediately relieved to the environment.

i. The containment is assumed to leak at 0.2 volume percent/day during the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> immediately following the accident and 0.1 volume percent/

day thereafter.

j. No credit is taken for radioactive decay or ground deposition during radioactivity transport to offsite location.

k. Short-term accident atmospheric dispersion factors corresponding to ground level releases, breathing rates, and dose conversion factors are given in Tables 15A-2, 15A-1, and 15A-4, respectively.

l. Offsite power is assumed lost.

15.4.8.3.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

15.4-45 Rev. OL-22 11/16

CALLAWAY - SP

c. The thyroid inhalation and total-body immersion doses to a receptor at the exclusion area boundary or outer boundary of the low-population zone were analyzed, using the models described in Appendix 15A.

15.4.8.3.1.4 Identification of Leakage Pathways and Resultant Leakage Activity The leakage pathways are:

a. Direct steam relief to the atmosphere through the S/G PORVs

b. Primary-to-secondary steam generator tube leakage and subsequent steam relief to the atmosphere through the S/G PORVs.

c. The resultant activity released to the containment is assumed available for leakage directly to the environment.

15.4.8.3.2 Identification of Uncertainties and Conservative Elements in the Analysis

a. Reactor coolant and secondary coolant activities are many times greater than assumed for normal operation conditions.

b. A 1-gpm steam generator primary-to-secondary leakage, which is significantly greater than that anticipated during normal operation and greater than the Technical Specification limit of 600 gallons per day, is assumed.

c. The coincident loss of offsite power with the occurrence of a RCCA ejection accident is a highly conservative assumption. In the event of the availability of offsite power, the condenser steam dump valves will open, permitting steam dump to the condenser. Thus there is no direct release via that path to the environment.

d. It is assumed that 50 percent of the iodines released to the containment atmosphere is adsorbed (i.e. plate out) onto the internal surfaces of the containment or adheres to internal components. However, it is estimated that the removal of airborne iodines by various physical phenomena such as adsorption, adherence, and settling could reduce the resultant doses by a factor of 3 to 10.

e. The activity released to the containment atmosphere is assumed to leak to the environment at the containment leakage rate of 0.2-volume percent/

day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 0.1-volume percent/day thereafter. The initial containment leakage rate is based on the peak calculated internal containment pressure anticipated after a LOCA. The pressures associated with a RCCA ejection accident are considerably lower than that calculated for a LOCA. The pressure inside the containment also decreases 15.4-46 Rev. OL-22 11/16

CALLAWAY - SP considerably with time, with an expected decrease in leakage rates.

Taking into account that the containment leak rate is a function of pressure, the resultant doses could be reduced by a factor of 5 to 10 (Ref. 12).

f. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that the meteorological conditions assumed will be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, are conservative.

15.4.8.3.3 Conclusions 15.4.8.3.3.1 Filter Loadings The only ESF filtration system considered in the analysis which limits the consequences of the RCCA ejection accident is the control room filtration system. Activity loadings on the control room charcoal filter are based on the flow rate through the filter, the concentration of activity at the filter inlet, and the filter efficiency.

The activity in the control room filter as a function of time has been evaluated for the loss-of-coolant accident, Section 15.6.5. Since the control room filters are capable of accommodating the potential design-basis loss-of-coolant accident fission product iodine loadings, more than adequate design margin is available with respect to postulated RCCA ejection accident releases.

15.4.8.3.3.2 Doses to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of a postulated RCCA ejection accident have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body doses due to immersion from direct radiation and the thyroid dose due to inhalation have been analyzed for the 0-2 hour dose at the exclusion area boundary and for the duration of the accident at the low-population zone outer boundary. The results are listed in Table 15.4-4. The resultant doses are well within the guideline values of 10 CFR 100.

15.4.8.4 Conclusions Even on a conservative basis, the analyses indicate that the described fuel and clad limits are not exceeded. It is concluded that there is no danger of sudden fuel dispersal into the coolant. Since the peak pressure does not exceed that which would cause stresses to exceed the faulted condition stress limits, it is concluded that there is no danger of further consequential damage to the RCS. The analyses have demonstrated 15.4-47 Rev. OL-22 11/16

CALLAWAY - SP that the upper limit in fission product release as a result of a number of fuel rods entering DNB amounts to 10 percent.

15.

4.9 REFERENCES

1. Risher, D. H., Jr. and Barry, R. F., "TWINKLE - A Multi-Dimensional Neutron Kinetics Computer Code," WCAP-7979-A (Proprietary) and WCAP-8028-A (Non-Proprietary), January 1975.

2. Hargrove, H. G., "FACTRAN - A FORTRAN-IV Code for Thermal Transients in a UO2 Fuel Rod," WCAP-7908, June 1972.

3. Burnett, T. W. T., et al., "LOFTRAN Code Description," WCAP-7907-P-A, April 1984.

4. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure,"

WCAP-11397-P-A, April 1989.

5. Haessler, R. L., et. al., "Methodology for the Analysis of the Dropped Rod Event,"

WCAP-11394-P-A (Proprietary) and WCAP-11395-A (Non-Proprietary), January 1990.

6. Barry, R. F. and Altomare, S., "The TURTLE 24.0 Diffusion Depletion Code,"

WCAP-7213-P-A (Proprietary) and WCAP-7758-A (Non-Proprietary), February 1975.

7. Barry, R. F., "LEOPARD - A Spectrum Dependent Non-Spatial Depletion Code for the IBM-7094," WCAP-3269-26, September 1963.

8. Risher, D. H., Jr., "An Evaluation of the Rod Ejection Accident in Westinghouse Pressurized Water Reactors Using Spatial Kinetics Methods," WCAP-7588, Revision 1-A, January 1975.

9. Taxelius, T. G. (Ed), "Annual Report - Spert Project, October 1968, September 1969," Idaho Nuclear Corporation IN-1370, June 1970.

10. Liimataninen, R. C. and Testa, F. J., "Studies in TREAT of Zircaloy-2-Clad, UO2

-Core Simulated Fuel Elements," ANL-7225, January - June 1966, p. 177, November 1966.

11. Bishop, A. A., Sandburg, R. O., and Tong, L. S., "Forced Convection Heat Transfer at High Pressure After the Critical Heat Flux," ASME 65-HT-31, August 1965.

15.4-48 Rev. OL-22 11/16

CALLAWAY - SP

12. Di Nunno, J. J., et al., "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, Division of Licensing and Regulation, AEC, Washington, D.C., 1962.

13. WCAP-13247, "Report on the Methodology for the Resolution of the Steam Generator Tube Uncovery Issue," March 1992.

14. Huegel, D. S., et al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, WCAP -14882-P-A, April 1999

15. Sung, Y. X., et. al., VIPRE-01 Modeling and Qualification for Pressurized Water Reactor Non-LOCA Thermal-Hydraulic Safety Analysis, WCAP-14565-P-A, October 1999.

15.4-49 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.4-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN REACTIVITY AND POWER DISTRIBUTION ANOMALIES Accident Event Time (sec)

Uncontrolled RCCA bank withdrawal from a subcritical or low power startup condition Initiation of uncontrolled rod withdrawal 0.0 from 10-9 of nominal power Power range high neutron flux low 8.74 setpoint reached Peak nuclear power occurs 8.86 Rods begin to fall into core 9.24 Minimum DNBR occurs 11.0 Peak heat flux occurs 11.0 Peak average clad temperature occurs 11.3 Peak average fuel temperature occurs 11.5 Uncontrolled RCCA bank withdrawal at power

1. Case A Initiation of uncontrolled RCCA withdrawal 0 at a high reactivity insertion rate (110 pcm/

sec)

Power range high neutron flux high trip 1.18 point reached Rods begin to fall into core 1.68 Minimum DNBR occurs 2.8

2. Case B Initiation of uncontrolled RCCA withdrawal 0 at a small reactivity insertion rate (1 pcm/

sec)

Overtemperature DT reactor trip signal 106.0 initiated Rods begin to fall into core 108.0 Minimum DNBR occurs 108.4 Startup of an inactive reactor coolant loop at an incorrect temperature Initiation of pump startup 0.0 Power reaches high neutron flux P-8 trip 6.1 setpoint Rods begin to drop 6.6 Minimum DNBR occurs 7.0 Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.4-1 (Sheet 2)

Accident Event Time (sec)

CVCS malfunction that results in a decrease in the boron concentration in the reactor coolant

1. Dilution during cold Dilution begins 0 shutdown Flux multiplication alarm sounded 1213 Time to criticality for unmitigated event 1613

2. Dilution during hot shutdown Dilution begins 0 Flux multiplication alarm sounded 798 Time to criticality for unmitigated event 1181

3. Dilution during hot standby Dilution begins 0 Flux multiplication alarm sounded 809 Time to criticality for unmitigated event 1182

4. Dilution during startup Reactor trip on source range high neutron 0 flux and operator initiates corrective action Time to criticality for unmitigated event 2400

5. Dilution during full power operation

a. Automatic reactor control Dilution begins 0 Rod insertion Limit Low-Low Alarm 425 Time to loss of shutdown margin 4620 unmitigated event

b. Manual reactor control Dilution begins 0 Reactor trip setpoint reached for 180 Overtemperature T and operator initiates corrective action Time to loss of shutdown margin 2272 unmitigated event Rod cluster control assembly ejection

1. Beginning-of-life, full power Initiation of rod ejection 0.0 Power range high neutron flux high 0.05 setpoint reached Peak nuclear power occurs 0.135 Rods begin to fall into core 0.55 Peak fuel average temperature occurs 2.21 Peak heat flux occurs 2.28 Peak clad temperature occurs 2.30 Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.4-1 (Sheet 3)

Accident Event Time (sec)

Peak fuel center temperature occurs 3.61

2. End-of-life, zero power Initiation of rod ejection 0.0 Power range high neutron flux low 0.176 setpoint reached Peak nuclear power occurs 0.208 Rods begin to fall into core 0.676 Peak clad temperature occurs 1.56 Peak heat flux occurs 1.56 Peak fuel temperature occurs 1.82 Peak fuel center temperature occurs 2.71 Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.4-2 PARAMETERS USED IN THE ANALYSIS OF THE ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENT HFP HZP HFP HZP Beginning Beginning End End Time in life of Cycle of Cycle of Cycle of Cycle Power level, % 102 0 102 0 Initial average coolant temperature,°F 595.9 557 595.9 557 Ejected rod worth, % k/k 0.20 0.77 0.25 0.90 Delayed neutron fraction, % 0.50 0.50 0.44 0.44 Feedback reactivity weighting 1.30 2.071 1.30 3.55 Trip reactivity, % k/k 4.0 2.0 4.0 2.0 Fq before rod ejection 2.60* - 2.60* -

Fq after rod ejection 6.3 11.0 6.4 20.0 Number of operational pumps 4 2 4 2 Maximum fuel pellet average temperature, °F 4163 3381 3976 3147**

Maximum fuel center temperature,°F 4972 3899 4870 4107**

Maximum clad average temperature,°F 2420 2533 2290 2399**

Maximum fuel stored energy, cal/gm 183 143 173 131**

Percent fuel melt <10 0 <10 0

• Includes fuel densification spike factor.

• • Values listed are for thimble plugs removed which is more conservative in this case.

Reinstallation of thimble plugs does not effect this conservatism.

Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.4-3 PARAMETERS USED IN EVALUATING THE RCCA EJECTION ACCIDENT I. Source Data

a. Core power level, MWT 3636

b. Core inventories Table 15A-3

c. Steam generator tube leakage, gpm 1

d. Reactor coolant initial noble gas Based on 1-percent fuel activity defects, as provided in Table 15A-5

e. Reactor coolant initial iodine activity See Section 15.4.8.3.1.2.a.

f. Secondary system initial iodine activity See Section 15.4.8.3.1.2.c.

g. Extent of core damage 10 percent of fuel rods experience cladding failure; 0.25 percent of fuel experiences melting

h. Activity released to reactor coolant, percent

1. Cladding failure (a) Noble gas gap activity 100 (b) Iodine gap activity 100

2. Fuel melting (a) Noble gas gap activity 100 (b) Iodine fuel activity 50

i. Iodine partition factor in the steam 0.1 generators for secondary side releases

j. Iodine partition factor in the steam 0.1 generators for primary-to-secondary leakage

k. Reactor coolant mass, lbs 5.50E + 5

l. Total secondary side fluid mass 4.24E + 5 released to the environment, lbs Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.4-3 (Sheet 2)

II. Atmospheric Dispersion Factors Table 15A-2 III. Activity Release Data

a. Containment volume, ft3 2.5E + 6

b. Containment leak rate, volume percent/day

1. 0-24 hours 0.20

2. 1-30 days 0.10

c. Percent of containment leakage that is 100 unfiltered

d. Plateout of iodine within containment, 50 percent

e. Offsite power Lost

f. Mass of primary fluid leaked to the 167 secondary lbs

g. Duration of primary-to-secondary 1200 leakage, sec Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.4-4 RADIOLOGICAL CONSEQUENCES OF A ROD-EJECTION ACCIDENT Doses (rem)

CASE 1, Containment Leakage Release Exclusion Area Boundary (0-2 hr)

Thyroid 1.3E01 Whole body 6.6E-02 Low Population Zone Outer Boundary (duration)

Thyroid 1.3E01 Whole body 2.3E-02 CASE 2, Steam Generator Atmospheric Steam Dump Release Exclusion Area Boundary (0-2 hr)

Thyroid 4.9E00 Whole body 1.6E-01 Low Population Zone Outer Boundary (duration)

Thyroid 4.9E-01 Whole body 1.6E-02 Rev. OL-15 5/06

CALLAWAY - SP 15.5 INCREASE IN REACTOR COOLANT INVENTORY Discussion and analysis of the following events are presented in this section:

a. Inadvertent operation of the emergency core cooling system during power operation.

b. Chemical and volume control system malfunction that increases reactor coolant inventory.

c. A number of BWR transients. (Not applicable to Callaway.)

These events, considered to be ANS Condition II, cause an increase in reactor coolant inventory. Section 15.0.1 contains a discussion of ANS classifications.

15.5.1 INADVERTENT OPERATION OF THE EMERGENCY CORE COOLING SYSTEM DURING POWER OPERATION 15.5.1.1 Identification of Causes and Accident Description Spurious emergency core cooling system (ECCS) operation at power could be caused by operator error or a false electrical actuation signal. A spurious signal may originate from any of the safety injection actuation channels, as described in Section 7.3.

Following the actuation signal, the suction of the ECCS centrifugal charging pumps is diverted from the volume control tank to the refueling water storage tank. The valves isolating the boron injection header (BIH) from the ECCS centrifugal charging pumps and the valves isolating the BIH from the injection header then automatically open. The ECCS centrifugal charging pumps then inject boric acid solution into the cold leg of each loop. The safety injection pumps also start automatically but provide no flow when the reactor coolant system (RCS) is at normal pressure. The passive, accumulator safety injection system and the RHR system also provide no flow at normal RCS pressure.

A safety injection signal (SIS) normally results in a reactor trip followed by a turbine trip.

However, it cannot be assumed that any single fault that actuates ECCS will also produce a reactor trip. If a reactor trip is generated by the spurious SIS, the operator should determine if the spurious signal was transient or steady state in nature. The operator must also determine if the SIS should be blocked. For a spurious occurrence, the operator would, per procedure, terminate ECCS operation and maintain the plant in the hot shutdown condition after completing the actions described in Section 15.5.1.2 item J. If the ECCS actuation instrumentation must be repaired, subsequent plant operation would be in accordance with the Technical Specifications.

If the reactor protection system does not produce an immediate trip as a result of the spurious SI signal, the reactor experiences a negative reactivity excursion due to the injected boron, which causes a decrease in reactor power. The power mismatch causes 15.5-1 Rev. OL-21 5/15

CALLAWAY - SP a drop in Tavg and consequent coolant shrinkage. The pressurizer pressure and water level decrease. Load decreases due to the effect of reduced steam pressure on load after the turbine throttle valve is fully open. The transient is eventually terminated by the reactor protection system low pressurizer pressure trip or by manual trip.

The time to trip is affected by initial operating conditions. These initial conditions include the core burnup history which affects initial boron concentration, rate of change of boron concentration, and Doppler and moderator coefficients.

15.5.1.2 Analysis of Effects and Consequences Method of Analysis Inadvertent operation of the ECCS is analyzed using the RETRAN computer code (Ref.

1). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, feedwater system, steam generator, and steam generator safety valves. The code computes pertinent plant variables including temperatures, pressures and power level.

Inadvertent operation of the ECCS at power is classified as a Condition II event, a fault of moderate frequency. The criteria established for Condition II events include the following:

a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,

b. Fuel cladding integrity shall be maintained by ensuring that the minimum DNBR remains above the 95/95 DNBR limit for PWRs, and

c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

To address criterion (c), Westinghouse currently uses the more restrictive criterion that a water-solid pressurizer condition be precluded when the pressurizer is at or above the set pressure of the pressurizer safety valves. This addresses any concerns regarding subcooled water relief through the safety valves. Hence, for continued conservatism in the safety analysis methodology, it is assumed that the safety valves must not pass water in order to ensure their integrity and continued availability. With both pressurizer PORVs unblocked and available for automatic pressure relief, the safety valve setpoint will not be reached. Any water discharge from the RCS would be through the PORV(s).

Isolation of the RCS following operator action to terminate ECCS flow would then be obtainable via the PORV block valve(s). For the potential condition of the plant operating with all the PORVs blocked, actions to open both PORV block valves and ensure the PORVs are available for automatic pressure relief must be taken within 9 minutes after the transient begins.

15.5-2 Rev. OL-21 5/15

CALLAWAY - SP The Inadvertent ECCS Actuation at Power Event is analyzed to determine the minimum DNBR value and to demonstrate the adequacy of plant procedures to prevent water relief through the safety valves under a pressurizer water-solid condition. The most limiting case with respect to DNB is a minimum reactivity feedback condition with the plant assumed to be in manual rod control. Because of the power and temperature reduction during the transient, operating conditions do not approach the core limits.

For maximizing the potential for pressurizer filling, the most limiting case is a maximum reactivity feedback condition with an immediate reactor trip, and subsequent turbine trip, on the initiating SI signal. The transient results are presented for each case.

The analysis assumptions are as follows (see also Section 15.0.3 and Table 15.0-2):

A. Initial Operating Conditions The DNB case is analyzed with the Revised Thermal Design Procedure as described in Reference 2. Initial reactor power, RCS pressure and temperature are assumed to be at the nominal full power values. Uncertainties in initial conditions are included in the limit DNBR as described in Reference 2.

For the pressurizer filling case, a non-RTDP analysis, initial conditions with maximum uncertainties on power (+2%), vessel average temperature (-3.5°F),

and pressurizer pressure (-60 psi) are assumed. The lower initial temperature results in a higher RCS coolant mass which causes a more severe pressurizer water volume transient.

B. Moderator and Doppler Coefficients of Reactivity The minimum feedback case (DNB) assumes a moderator temperature coefficient of 0 pcm/°Fand a low absolute value Doppler power coefficient. The maximum feedback case (pressurizer filling) assumes a large (absolute value) negative moderator temperature coefficient (0.43k/gm/cc is the corresponding moderator density coefficient) and a most-negative Doppler power coefficient.

C. Reactor Control For the DNB case (without direct reactor trip on SI) the reactor is assumed to be in a manual rod control. In the case of the pressurizer filling scenario, the reactor is assumed to trip at the start of the transient, coincident with the SI signal (see assumption G below). Thus, the reactor control mode is of no consequence.

D. Pressurizer Pressure Control Pressurizer heaters are assumed to be inoperable for the DNB case. This assumption yields a higher rate of pressure decrease. Pressurizer sprays and 15.5-3 Rev. OL-21 5/15

CALLAWAY - SP PORVs are assumed to be available for this case in order to minimize RCS pressure.

Pressurizer sprays are assumed to be operable for the pressurizer filling case.

Since the PORVs are assumed as an automatic pressure control function for this case, operator action to assure their availability for automatic pressure relief is assumed. Timely operation of the PORVs results in the pressurizer pressure not reaching the pressurizer safety valve set pressure such that the potential for water relief through the safety valves is precluded. Proportional heaters are assumed to remain operable throughout the transient (backup heaters are load shed upon receipt of the SI signal) to contribute to the thermal expansion of the liquid in the pressurizer.

It should be noted that the analysis performed places no new requirements on the PORV opening setpoint. It simply assumes that at least one PORV will open prior to pressurizer pressure reaching the lowest PSV setpoint (accounting for negative uncertainty). As such, the analysis assumes the nominal PORV setpoint of 2335 psig. All applicable delays associated with the PORVs and block valves are accounted for in the assumed operator action time.

E. Boron Injection At the initiation of the event, two ECCS charging pumps inject borated water into the cold leg of each loop. In addition, flow is also modeled to conservatively account for possible operation of the normal charging pump. This latter assumption is conservative since the normal charging pump receives a non-Class 1E trip signal after an SIS which is backed up by explicit operation action as directed by EOP E-0. The analysis assumes zero injection line purge volume for calculational simplicity; thus the boration transient begins immediately in the analysis.

F. Turbine Load For the DNB case (without direct reactor trip/turbine trip on SI), the turbine load remains constant until the governor drives the throttle valve wide open. After the throttle valve is full open, turbine load decreases as steam pressure drops. In the case of pressurizer filling, the reactor and turbine both trip at the time of SI actuation with the turbine load dropping to zero simultaneously.

G. Reactor Trip Reactor trip is initiated by a low pressurizer pressure signal at 1860 psia for the DNB case. The pressurizer filling case assumes an immediate reactor trip on the initiating SI signal, thereby minimizing the time to fill the pressurizer.

H. Decay Heat 15.5-4 Rev. OL-21 5/15

CALLAWAY - SP Core residual heat generation is based on the 1979 version of ANS 5.1 (Reference 3). ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates. Long-term operation at the initial power level preceding the trip is assumed.

I. Pressurizer Safety Valves The pressurizer safety valve opening pressure is assumed to be 2425.8 psia, which accounts for a (-) 2% setpoint tolerance. Although the safety valves are not actuated during this transient, the assumed safety valve opening setpoint serves as a limit to demonstrate the acceptability of the assumptions made in item J below.

J. Operator Action Times It is assumed that operator action is taken from the main control room such that flow from the normal charging pump is terminated within 6 minutes after the start of the transient. The pressurizer safety valves must not be exposed to subcooled liquid discharge as a result of reaching a water solid pressurizer condition.

Consequently, PORV availability must be assured by operator actions from the main control room to assure at least one PORV will actuate on demand. The PORVs would be expected to be available unless they were blocked due to excessive seat leakage. Therefore, the assumed operator actions associated with assuring PORV availability consist of opening both block valves and assuring the PORV handswitches are in the automatic operation position from the main control room to allow the PORV(s) to actuate on demand. The analysis assumes that appropriate operator action is taken to assure that both PORVs are available for pressure relief within 9 minutes after the start of the transient. This time includes all process and instrumentation delays and these actions will assure pressure relief in the event of a single failure.

Results The transient responses for the DNB and pressurizer filling cases are shown in Figures 15.5-1 through 15.5-3. Table 15.5-1 shows the calculated sequence of events.

DNB Case:

Nuclear power starts decreasing immediately due to boron injection, but steam flow does not decrease until later in the transient when the turbine throttle valve is wide open. The mismatch between load and nuclear power causes Tavg, pressurizer water level, and pressurizer pressure to drop. The reactor trips and all control and shutdown rods start moving into the core when the pressurizer pressure reaches the low pressurizer pressure trip setpoint. The DNBR remains above its initial value throughout the transient.

15.5-5 Rev. OL-21 5/15

CALLAWAY - SP Pressurizer Filling Case:

Reactor trip occurs at event initiation followed by a rapid initial cooldown of the RCS.

Coolant contraction results in a short-term reduction in pressurizer pressure and water level. The combination of the RCS heatup, due to residual RCS heat generation, and ECCS injected flow causes the pressure and level transients to rapidly turn around.

Pressurizer water level then increases throughout the transient. At six (6) minutes into the transient, the analysis assumes that normal charging pump flow is terminated via operator action from the main control room. The pressurizer becomes water solid 8.3 minutes into the transient. At nine (9) minutes into the transient, it is assumed that appropriate operator actions have been taken from the main control room to assure that both PORVs are unblocked and available for automatic pressure relief. These operator action times include all process and instrumentation delays. At that time, the PORV(s) actuate and the RCS rapidly depressurizes. At no time is the safety valve setpoint challenged. Therefore, the analysis demonstrates that water relief through the pressurizer safety valves is precluded.

15.5.1.3 Conclusions Results of the analysis show that spurious ECCS operation without immediate reactor trip does not present any hazard to the integrity of the RCS with respect to DNBR. The minimum DNBR is never less than the initial value. Thus, there will be no cladding damage and no release of fission products to the RCS. If the reactor does not trip immediately, the low pressurizer pressure reactor trip will provide protection. This trips the turbine and prevents excessive cooldown, which expedites recovery from the incident.

With respect to pressurizer filling, although the pressurizer may reach a water-solid condition, operator actions taken from the main control room to isolate the normal charging pump and assure that both PORVs are unblocked and available for automatic pressure relief will prevent the safety valves from actuating with the pressurizer in a water-solid condition. Water relief through the pressurizer safety valves is, therefore, precluded.

15.5.2 CHEMICAL AND VOLUME CONTROL SYSTEM MALFUNCTION THAT INCREASES REACTOR COOLANT INVENTORY 15.5.2.1 Identification of Causes and Accident Description Increases in reactor coolant inventory caused by the chemical and volume control system may be postulated to result from operator error or a control signal malfunction.

Transients examined in this section are characterized by increasing pressurizer level, increasing pressurizer pressure, and constant boron concentration. The transients analyzed in this section are done to demonstrate that there is adequate time for the operator to take corrective action to prevent filling the pressurizer. An increase in reactor coolant inventory, which results from the addition of cold, unborated water to the RCS, is 15.5-6 Rev. OL-21 5/15

CALLAWAY - SP analyzed in Section 15.4.6. An increase in reactor coolant inventory which results from the injection of highly borated water into the RCS is analyzed in Section 15.5.1.

Transients postulated as a result of operator error or failure of the ECCS charging pump controller which increase primary side inventory will be automatically terminated by a high pressurizer level reactor trip before the pressurizer can be filled, thus these are not the worst cases.

The most limiting case would result if charging was in automatic control and the pressurizer level channel being used for charging control failed in a low direction. This would cause maximum charging flow to be delivered to the RCS and letdown flow would be isolated. The worst single failure for this event would be another pressurizer level channel failing in an as-is condition or a low condition. This will defeat the reactor trip on two-out-of-three high pressurizer level channels. To prevent filling the pressurizer, the operator must be relied upon to terminate charging.

15.5.2.2 Analysis of Effects and Consequences Method of Analysis The CVCS malfunction is analyzed by employing the detailed digital computer program LOFTRAN (Ref. 1). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, steam generator safety valves, and the effect of the SIS. The program computes pertinent plant variables, including temperatures, pressures, and power level.

Four cases were analyzed;

a. Minimum reactivity feedback with automatic pressurizer spray

b. Minimum reactivity feedback without automatic pressurizer spray

c. Maximum reactivity feedback with automatic pressurizer spray

d. Maximum reactivity feedback without automatic pressurizer spray The assumptions incorporated in the analyses were as follows;

a. Initial Operating Conditions Plant characteristics and initial conditions are discussed in Section 15.0.3.

b. Reactivity Coefficients

1. Minimum Reactivity Feedback Case 15.5-7 Rev. OL-21 5/15

CALLAWAY - SP A least-negative moderator temperature coefficient and a least-negative Doppler-only power coefficient.

2. Maximum Reactivity Feedback Case A conservatively large negative moderator temperature coefficient and a most-negative Doppler-only power coefficient.

c. Reactor Control The reactor was assumed to be in manual control. As shown in Figures 15.5-4 through 15.5-11, core power and average RCS temperature change very little. This is because the CVCS malfunction event is not a reactivity addition event. Because there is little or no change in core power and Tavg, the effects of automatic rod control would be negligible.

d. Charging System Maximum charging system flow based on RCS back pressure from one ECCS centrifugal charging pump is delivered to the RCS. The charging flow is assumed to have the same boron concentration as the RCS.

e. Reactor Trip The transient is initiated by the pressurizer level channel which is used for control purposes failing low. As a worst single failure, another pressurizer level channel fails low, defeating the two-out-of-three high pressurizer level trip. No reactor trips are used.

Results Figures 15.5-4 through 15.5-11 show the transient response due to the CVCS system malfunction. In all the cases analyzed, core power and RCS average temperature remain relatively constant.

Cases where the pressurizer spray is inoperable show the pressurizer level increases at a relatively constant rate. This is because the pressurizer pressure initially rises very quickly to the pressure at which the relief valves open and remains there.

Cases where the pressurizer spray is operable show the pressurizer level increases with varying rates. Spray actuation tends to keep the pressurizer pressure lower for several minutes, which allows the ECCS centrifugal charging pumps to deliver more flow.

Eventually, pressurizer pressure does increase enough to open the relief valves.

Times at which the operator would receive alarms are listed in Table 15.5-1.

15.5-8 Rev. OL-21 5/15

CALLAWAY - SP 15.5.2.3 Conclusions Results show none of the operating conditions during the transient approach core limits.

Because the high pressurizer level trip has been defeated by failures, the transient must be terminated by the operator. The sequence of events presented in Table 15.5-1 shows that operator has sufficient time to take corrective action.

15.5.3 A NUMBER OF BWR TRANSIENTS This section is not applicable to the Callaway Plant.

15.

5.4 REFERENCES

1. Huegel, D. S., et. al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analysis, WCAP-14882-P-A, April 1999.

2. Friedland, A. J., and Ray, S., Revised Thermal Design Procedure, WCAP-11397-P-A, April 1989.

3. ANSI/ANS-5.1-1979, "American National Standard for Decay Heat Power in Light Water Reactors," August 1979.

15.5-9 Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.5-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN AN INCREASE IN REACTOR COOLANT INVENTORY Time Accident Event (sec)

Inadvertent Operation of ECCS During Power Operation DNBR Case Charging pumps begin injecting borated 0.0 water Low pressurizer pressure reactor trip 67.6 setpoint reached Rods begin to drop 69.6 Minimum DNBR occurs (a)

Pressurizer Filling Case Charging pumps begin injecting borated 0.0 water; rods begin to drop NCP flow terminated 360 Pressurizer filling occurs 500 Both PORVs unblocked 540 Automatic pressure relief via at least one 540 PORV occurs Chemical and volume control Two pressurizer level channels fail low 0.0 system malfunction, minimum reactivity feedback, without - Maximum charging flow from one pressurizer spray ECCS centrifugal charging pump is begun

- Letdown is isolated

- Lo-lo-pressurizer level alarm Hi pressurizer pressure alarm 44 Pressurizer relief valve setpoint reached 69 Hi pressurizer level alarm from the one 158 working level channel Pressurizer fills 1069 Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.5-1 (Sheet 2)

(a) DNBR does not decrease below its initial value Time Accident Event (sec)

Chemical and volume control Two pressurizer level channels fail low 0.0 system malfunction, minimum reactivity feedback, with - Maximum charging flow from one pressurizer spray ECCS centrifugal charging pump is begun

- Letdown is isolated

- Lo-lo pressurizer level alarm Pressurizer spray actuated 0.0 Hi pressurizer level alarm from the one 102 working level channel Hi pressurizer pressure alarm 706 Pressurizer relief valve setpoint reached 739 Pressurizer fills 1032 Chemical and volume control Two pressurizer level channels fail low 0.0 system malfunction, maximum reactivity feedback, without - Maximum charging flow from one pressurizer spray ECCS centrifugal charging pump is begun

- Letdown is isolated

- Lo-lo pressurizer level alarm Hi pressurizer pressure alarm 23 Pressurizer relief valve setpoint reached 33 Hi pressurizer level alarm from the one 91 working level channel Pressurizer fills 912 Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.5-1 (Sheet 3)

Time Accident Event (sec)

Chemical and volume control Two pressurizer level channels fail low 0.0 system malfunction, maximum reactivity feedback, with - Maximum charging flow from one presssurizer spray ECCS centrifugal charging pump is begun

- Letdown is isolated

- Lo-lo pressurizer level alarm Pressurizer spray actuated 0.0 Hi pressurizer level alarm from the one 72 working level channel Hi pressurizer pressure alarm 592 Pressurizer relief valve setpoint reached 623 Pressurizer fills 937 Rev. OL-21 5/15

CALLAWAY - SP 15.6 DECREASE IN REACTOR COOLANT INVENTORY Events which result in a decrease in reactor coolant inventory, as discussed in this section, are as follows:

a. Inadvertent opening of a pressurizer safety or relief valve

b. Break in instrument line or other lines from the reactor coolant pressure boundary that penetrate the containment

c. Steam generator tube rupture (SGTR)

d. Spectrum of boiling water reactor (BWR) steam system piping failures outside of the containment (Not applicable to Callaway)

e. Loss-of-coolant accident (LOCA) resulting from a spectrum of postulated piping breaks within the reactor coolant pressure boundary

f. A number of BWR transients (Not applicable to Callaway) 15.6.1 INADVERTENT OPENING OF A PRESSURIZER SAFETY OR RELIEF VALVE 15.6.1.1 Identification of Causes and Accident Description An accidental depressurization of the reactor coolant system (RCS) could occur as a result of an inadvertent opening of a pressurizer relief or safety valve. Since a safety valve is sized to relieve approximately twice the steam flow rate of a relief valve, and will therefore allow a much more rapid depressurization upon opening, the most severe core conditions resulting from an accidental depressurization of the RCS are associated with an inadvertent opening of a pressurizer safety valve. Initially, the event results in a rapidly decreasing RCS pressure until this pressure reaches a value corresponding to the hot leg saturation pressure. At this time, the pressure decrease is slowed considerably. The pressure continues to decrease throughout the transient. The effect of the pressure decrease would be to decrease power via the moderator density feedback.

Pressurizer level increases initially due to expansion caused by depressurization and then decreases following reactor trip.

The reactor may be tripped by the following reactor protection system signals:

a. Overtemperature T

b. Low pressurizer pressure 15.6-1 Rev. OL-21 5/15

CALLAWAY - SP An inadvertent opening of a pressurizer relief valve is classified as an ANS Condition II event, a fault of moderate frequency. The failure of a pressurizer safety valve is classified as an ANS Condition III event. The analysis performed conservatively bounds the more limiting failure while still applying the more restrictive Condition II acceptance criterion of ensuring the DNB design basis is met. See Section 15.0.1 for a discussion of Condition II events.

15.6.1.2 Analysis of Effects and Consequences Method of Analysis The accidental depressurization transient is analyzed by employing the detailed digital computer code RETRAN (Ref. 1). The code simulates the neutron kinetics, RCS, pressurizer, pressurizer relief and safety valves, pressurizer spray, steam generator, and steam generator safety valves. The code computes pertinent plant variables, including temperatures, pressures, and power level.

This accident is analyzed with the Revised Thermal Design Procedure as described in Reference 2.

In order to give conservative results in calculating the DNBR during the transient, the following assumptions are made:

a. Plant characteristics and initial conditions are discussed in Section 15.0.3.

Uncertainties in initial conditions are included in the limit DNBR as described in Reference 2.

b. Minimum reactivity feedback is assumed to minimize the resulting DNBR, including a moderator temperature coefficient of 0 pcm/°F and the least-negative Doppler coefficient. The spatial effect of the voids due to local or subcooled boiling is not considered in the analysis with respect to reactivity feedback or core power shape. The voids would tend to flatten the core power distribution.

Plant systems and equipment which are necessary to mitigate the effects of RCS depressurization caused by an inadvertent safety valve opening are discussed in Section 15.0.8 and listed in Table 15.0-6.

Normal reactor control systems are not required to function; however, the rod control system is assumed to be in the automatic mode in order to hold the core at full power longer and thus delay the trip. This is a worst case assumption; if the reactor were in manual control, an earlier trip could occur. Automatic rod control is normally used, and automatic rod withdrawal is no longer available, yet it was assumed for this analysis.

The reactor protection system functions to trip the reactor on the appropriate signal. No single active failure will prevent the reactor protection system from functioning properly.

15.6-2 Rev. OL-21 5/15

CALLAWAY - SP Results The system response to an inadvertent opening of a pressurizer safety valve is shown on Figures 15.6-1 and 15.6-2. Figure 15.6-1 illustrates the nuclear power and DNBR transients following the depressurization. Nuclear power is maintained at the initial value until reactor trip occurs on low pressurizer pressure. The pressure decay transient and average temperature transient following the accident are given in Figure 15.6-2.

Pressure drops more rapidly while core heat generation is reduced via the trip, and would then slow once saturation temperature is reached in the hot leg. The DNBR decreases initially, but increases rapidly following the trip, as shown in Figure 15.6-1.

The DNBR remains above the safety analysis limit values throughout the transient.

The calculated sequence of events for the inadvertent opening of a pressurizer safety valve incident is shown on Table 15.6-1.

15.6.1.3 Conclusions The results of the analysis show that the low pressurizer pressure and the overtemperature T reactor protection system signals provide adequate protection against the RCS depressurization event. No fuel or clad damage is predicted for this accident.

15.6.2 BREAK IN INSTRUMENT LINE OR OTHER LINES FROM REACTOR COOLANT PRESSURE BOUNDARY THAT PENETRATE CONTAINMENT There are no instrument lines connected to the RCS that penetrate the containment.

There are, however, the grab sample lines from the hot legs of reactor coolant loops 1 and 3, from the steam and liquid space of the pressurizer, and from the 3-inch chemical and volume control system letdown line penetrating the containment. The grab sample lines are provided with normal closed isolation valves on both sides of the containment wall and are designed in accordance with the requirements of GDC-55.

The most severe pipe rupture with regard to radioactivity release during normal plant operation is rupture of the chemical and volume control system letdown line at a point outside of the containment. For such a break, the reactor coolant letdown flow would have passed sequentially from the cold leg and through the regenerative heat exchanger and letdown orifices. Increase in flow will occur due to a rupture of the letdown line downstream of the orifices. The letdown orifices and throttle valves reduce the letdown line pressure from 2,235 psig to less than 600 psig. The occurrence of a complete severance of the letdown line results in a loss of reactor coolant at the rate of 142.5 gpm if the original letdown rate is conservatively assumed to be 130 gpm. The nominal upper limit on letdown flow rate is 120 gpm. Since the release rate is within the capability of the reactor makeup system, it would not result in engineered safety features system actuation. Frequent operation of the automatic reactor makeup system will provide the operator some indication of the loss of reactor coolant.

15.6-3 Rev. OL-21 5/15

CALLAWAY - SP 15.6.2.1 Radiological Consequences 15.6.2.1.1 Method of Analysis 15.6.2.1.1.1 Physical Model The volatile fractions of the spilled reactor coolant are assumed to be available for immediate release to the environment.

15.6.2.1.1.2 Assumptions and Conditions The major assumptions and parameters used in the analysis are provided in Table 15.6-2 and summarized below:

a. The reactor coolant initial iodine activity is based on the dose equivalent of 1.0 Ci/gm of I-131 (adjusted consistent with Table 15.6-4 item I.c.1).

Although no reactor trip or primary side depressurization is expected, an accident-initiated iodine spiking factor of 500 is assumed in Table 15.6-2 to conservatively address scenarios including a reactor trip.

b. The initial noble gas activity in the reactor coolant is based on 1-percent fuel defects.

c. A total of 39,958 pounds of reactor coolant is spilled (based on a release for 30 minutes followed by a 10-second valve closure) onto the auxiliary building floor.

d. All of the noble gases in the spilled reactor coolant are released to the environment.

e. Ten percent of the spill is assumed to flash. All of the iodine activity in the flashed fraction of the spill is assumed to be released.

f. No credit is taken for mixing and holdup of the releases within the auxiliary building, nor are the auxiliary building normal exhaust filters credited with reducing the release. That is, the release is modeled as being direct to the environment.

15.6.2.1.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

15.6-4 Rev. OL-21 5/15

CALLAWAY - SP

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

c. The thyroid inhalation and total body immersion doses to a receptor at the exclusion area boundary or outer boundary of the low-population zone were analyzed, using the models described in Appendix 15A.

15.6.2.1.1.4 Identification of Leakage Pathways and Resultant Leakage Activity The reactor coolant spilled in the auxiliary building will collect in the floor drain sumps.

From there, it will be pumped to the radwaste treatment system. Therefore, the only release paths that present a radiological hazard involve the volatile fraction of spilled coolant.

Normally, gases released in the auxiliary building mix with the building atmosphere and are gradually exhausted through the filtered building ventilation system. The charcoal filters normally remove a very large fraction of the airborne iodine in the building atmosphere. However, the ventilation system is not designed to mitigate the consequences of an accident (e.g., it might not survive an earthquake more severe than the operating-basis earthquake), nor can the possibility of unplanned leakages from the auxiliary building be eliminated; hence, no credit is taken for these effects reducing the released activity.

The evaporated radionuclides are assumed to be available immediately to the outside atmosphere.

15.6.2.1.2 Identification of Uncertainties and Conservatisms in the Analysis The principal uncertainties in the calculation of doses following a letdown line rupture arise from the unknown extent of reactor coolant contamination by radionuclides, the quantity of coolant spilled, the fraction of the spilled activity that escapes the auxiliary building, and the environmental conditions at the time. Each of these uncertainties is treated by taking worst-case or extremely conservative assumptions.

The extent of coolant contamination assumed greatly exceeds the levels expected in practice. The rupture is postulated in a seismic Category I, ASME Section III, Class 2 piping system. It is assumed that the leak goes undetected for 30 minutes. It is expected that considerable holdup and filtration occurs in the auxiliary building, but no credit is assumed.

The purpose of all these conservatisms is to place an upper bound on doses.

15.6-5 Rev. OL-21 5/15

CALLAWAY - SP 15.6.2.1.3 Conclusions 15.6.2.1.3.1 Filter Loadings No filter is credited with the collection of radionuclides in this accident analysis. The buildup on these filters (auxiliary building and control building charcoal filters) that may be expected due to the adsorption of some of the iodine is very small compared with the design capacity of these filters.

15.6.2.1.3.2 Dose to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The radiological consequences resulting from the occurrence of a postulated letdown line rupture have been conservatively analyzed, using assumptions and models described in previous sections.

The thyroid inhalation total-body immersion doses have been analyzed for the 0-2 hour dose at the exclusion area boundary and for the duration of the accident at the low-population zone outer boundary. The results are listed in Table 15.6-3. The resultant doses are well within the guideline values of 10 CFR 100.

15.6.3 STEAM GENERATOR TUBE FAILURE The accident examined is the complete severance of a single steam generator tube. This event is considered an ANS Condition IV event, a limiting fault (see Section 15.0.1). The accident is assumed to take place at power with the reactor coolant contaminated with fission products corresponding to continuous operation with a limited amount of defective fuel rods. The accident leads to an increase in the contamination of the secondary system due to the leakage of radioactive coolant from the RCS. In the event of a coincident loss of offsite power or failure of the steam dump system, discharge of activity to the atmosphere takes place via the steam generator safety and/or power-operated atmospheric steam dump valves.

In view of the fact that the steam generator tube material is Inconel-600 and is a highly ductile material, it is considered that the assumption of a complete severance is somewhat conservative. The more probable mode of tube failure would be one or more minor leaks of undetermined origin. Activity in the steam and power conversion system is subject to continual surveillance, and an accumulation of minor leaks which exceed the limits established in the Technical Specifications is not permitted during plant operation.

In order to select the reference worst case, a spectrum of steam generator tube rupture (SGTR) events was anayzed. The letters of Reference 3 provide a detailed description of the selection process. Based on the selection process, two major SGTR accident scenarios are identified as the major concerns for radioactive releases to the environment.

15.6-6 Rev. OL-21 5/15

CALLAWAY - SP The events of major concern, associated with a SGTR, are : (1) failure of an ASD in the open position leading to continued release of steam generator fluid and contained radioactivity and (2) the potential for overfill of the ruptured steam generator with water entering the main steam line resulting in water relief through an atmospheric steam dump (ASD) valve and/or a main steam safety valve (MSSV). To examine these concerns, the SGTR Scoping Code (discussed in Appendix B of the SNUPPS report attached to SLNRC 86-01, see Reference 3), in conjunction with other analyses, was used to evaluate the sensitivity of offsite power; location of tube failures; availability of offsite power; location of the rupture; operator action times; power level; and iodine spiking.

The operator is expected to determine that a SGTR has occurred and to identify and isolate the affected steam generator on a restricted time scale to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the affected generator. Sufficient indications, controls, alarms and procedures are provided to enable the operator to carry out these functions satisfactorily.

Operator actions in response to an SGTR are assumed to follow plant-specific emergency procedures, which are based on procedure E-3 (SGTR response) and related procedures of the generic emergency response guidelines (ERGs) for Westinghouse plants.

As discussed above, two SGTR accident scenarios are identified as resultng in limiting radioactive releases to the environment. For the case of SGTR with postulated stuck-open Atmospheric Steam Dump (ASD) valve on the ruptured steam generator, the radioactive releases are maximized by assuming the ruptured steam generator ASD is stuck-open for 20 minutes (Reference 3). For the case of SGTR with postulated failure of the ruptured steam generator Auxiliary Feedwater (AFW) flow control valve, auxiliary feedwater flow is maximized in order to increase the probability for ruptured steam generator overfill and to maximize subsequent liquid relief from its safety valve. The radioactive releases are maximized by assuming that the safety valve is stuck-open following liquid relief with an effective flow area equal to 5% of the total safety valve flow area (Reference 3). Detailed analyses are presented for these two scenarios in Sections 15.6.3.1 and 15.6.3.2 respectively.

15.6.3.1 STEAM GENERATOR TUBE RUPTURE WITH POSTULATED STUCK-OPEN ATMOSPHERIC STEAM DUMP VALVE 15.6.3.1.1 Identification of Causes and Accident Description The letters listed under Reference 3 discuss the reanalysis of the SGTR accident. The licensing basis SGTR accident discussed in this section represents an update to the original SNUPPS generic analysis that assumes the failure of a steam generator atmospheric steam dump valve in the open position in order to maximize offsite doses.

This update reflects the following plant design, operation, and analysis parameters:

VANTAGE 5/VANTAGE+ fuel, uprated power, replacement steam generators, as documented in Reference 4.

15.6-7 Rev. OL-21 5/15

CALLAWAY - SP As discussed in Reference 3, the analysis presented in this section was originally selected as the worst case dose scenario for the SGTR accident.

The recovery sequence for a SGTR with a stuck-open ASD is discussed in Section 15.6.3.1.2.

The operator is expected to determine that a SGTR has occurred and to identify and isolate the affected steam generator on a restricted time scale to minimize contamination of the secondary system and ensure termination of radioactive release to the atmosphere from the affected generator.

Consideration of the indications provided at the control board, together with the magnitude of the break flow, leads to the conclusion that the accident diagnostics and isolation procedure can be completed such that pressure equalization between the primary and secondary can eventually be achieved and break flow terminated within 80 minutes of accident initiation.

The timing of operator actions utilized in the tube rupture analysis presented in this section has been estimated using data from the following sources: (1) plant simulator exercises; (2) SGTR events at the Ginna, Prairie Island, and North Anna plants; (3) draft standard ANS 58.8, Revision 2; and (4) Callaway operating experience in closing an atmospheric steam dump manual block valve. Heaviest weight has been placed on the simulator and experience data because it reflects what plant operators have done using plant-specific procedures.

Assuming normal operation of the various plant control systems, the following sequence of events is initiated by the tube rupture analyzed herein:

a. Pressurizer low pressure and low level alarms are actuated and charging pump flow increases in an attempt to maintain pressurizer level. On the secondary side, there is a steam flow/feedwater flow mismatch before trip as feedwater flow to the affected steam generator is reduced due to the additional break flow which is now being supplied to that generator.

b. Decrease in pressurizer pressure (Figure 15.6-3a) due to continued loss of reactor coolant inventory leads to a reactor trip signal generated by low pressurizer pressure. Resultant plant cooldown (Figures 15.6-3b and 15.6-3c) following reactor trip leads to a rapid reduction in pressurizer level (Figure 15.6-3n), and the safety injection signal, initiated by low pressurizer pressure, is assumed to occur coincident with reactor trip. The safety injection signal automatically terminates normal feedwater supply and initiates auxiliary feedwater addition.

c. The steam generator blowdown liquid monitor and/or the condenser air discharge radiation monitor will alarm, indicating a sharp increase in radioactivity in the secondary system. Steam generator blowdown will 15.6-8 Rev. OL-21 5/15

CALLAWAY - SP automatically be terminated by the SGBSIS (AFAS) signal which is initiated by the safety injection signal (see Figures 10.4-8 Sheet 1 and 7.3-1 Sheet 2).

d. The reactor trip automatically trips the turbine and, if offsite power is available, the condenser steam dump valves open, permitting steam dump to the condenser. In the event of a coincident loss of offsite power, as assumed in the transient presented in this section, the steam dump valves automatically close to protect the condenser. The steam generator pressure (Figure 15.6-3a) rapidly increases, resulting in steam discharge to the atmosphere through the steam generator atmospheric steam dump valves (Figures 15.6-3g and 15.6-3h). In Figures 15.6-3d and 15.6-3e, the steam flow is presented as a function of time. The flow is constant initially until reactor trip, followed by turbine trip, which results in a large decrease in flow, but a rapid increase in steam pressure to the atmospheric steam dump valve setpoint.

e. Following reactor trip, the continued action of auxiliary feedwater supply and borated safety injection flow (supplied from the refueling water storage tank) provide a heat sink which absorbs the decay heat.

f. Safety injection flow results in increasing the pressurizer water volume (Figure 15.6-3n); the rate of which depends upon the amount of operating auxiliary equipment.

g. The atmospheric steam dump (ASD) valve for the ruptured steam generator (SG) is assumed to fail open and steam release continues for 20 minutes until the ASD block valve is manually closed (Figure 15.6-3g).

During this time, pressure falls in all SGs and RCS temperature drops in response to the steam release.

h. Once the ASD is isolated, controlled cooldown is initiated and continues until RCS temperature is reduced to less than the ruptured SG saturation temperature.

i. Primary depressurization is then performed by opening pressurizer PORVs (Figure 15.6-3m) until primary and secondary pressures equalize. This terminates break flow (Figure 15.6-3i). Safety injection flow is terminated 5 minutes after RCS depressurization. However, in the interim, safety injection flow repressurizes the primary side.

j. Fifteen minutes after safety injection termination, it is assumed that the operators minimize the primary-secondary pressure difference by opening a pressurizer PORV (Figures 15.6-3a). Any primary side pressure rise after this second depressurization is moderate and a function of decay heat.

15.6-9 Rev. OL-21 5/15

CALLAWAY - SP 15.6.3.1.2 Analysis of Effects and Consequences Method of Analysis Mass and energy balance calculations are performed using RETRAN (Section 15.0.11.8) to determine primary-to-secondary mass release and to determine the amount of steam vented from each of the steam generators from the occurrence of the tube rupture until after the second primary-secondary pressure equalization. RETRAN provides time-dependent values of RCS mass, break flow, flashed fraction, steam generator liquid mass, and steam generator atmospheric steam dump valve flow for the calculation of radiological consequences. Conservatively high values of break flow rate and flashed fraction are assumed for the first hour of the transient to maximize radiological consequences. Supplementary mass and energy balance calculations, with conservative assumptions, are performed for the period from pressure equalization until 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the accident, beyond the time of RHR initiation.

In estimating the mass transfer from the RCS through the broken tube, the following assumptions are made:

a. Reactor trip and safety injection occur coincidentally as a result of low pressurizer pressure. Overtemperature T trip is not considered. This allows more break flow. Loss of offsite power occurs at reactor trip.

b. The tube rupture is a double-ended guillotine break of a single hot leg tube at the tube sheet of the steam generator. This break location maximizes the flashed fraction of the RCS break flow.

c. As listed on Table 15.0-4, the low pressurizer pressure safety analysis limit (SAL) for reactor trip is 1845 psig. This reactor trip SAL is lower than the actual setpoint of 1885 psig, which thereby delays the trip and results in increased break flow. Safety injection is assumed concurrent with reactor trip which decreases the time for initiation of safety injection, again resulting in increased break flow. Safety injection occurs 15 seconds after the SI signal. The actual SI setpoint is 1849 psig with a lower SAL in Table 15.0-4. This minimum expected delay results in an early rise in RCS pressure due to SI and results in increased break flow.

d. Break flow is characterized by resistance-limited flow. An additional 5%

uncertainty is added to the flow.

e. The assumption of a loss of offsite power at reactor trip prevents steam dump to the condenser and steam is discharged to the atmosphere via the ASDs. With the condenser unavailable for retention of any leaked radioactivity, offsite doses are maximized.

f. Pressurizer heaters and spray are not modelled.

15.6-10 Rev. OL-21 5/15

CALLAWAY - SP

g. MSIV isolation is modeled at reactor trip and the assumed loss of offsite power, although it could be significantly delayed based on the expected operator response. Early isolation of the MSIV causes the failed open ASD to have a greater impact on the ruptured steam generator pressure, which maximizes steam flow and break flow flashing. Steamline isolation also maximizes the mass transferred from the ruptured steam generator to the atmosphere.

h. Prior to reactor trip, the normal feedwater matches the steam flow in the intact steam generators. For the ruptured steam generator, the total feed flow (including the break flow) matches the steam flow. The feedwater isolation signal occurs 2.3 seconds after reactor trip causes rod motion and the feedwater isolation valves stroke closed within 2.0 seconds. These are the minimum expected delay and stroke time, respectively, which tend to decrease heat removal from the RCS resulting in higher RCS temperatures and pressures. This results in maximum flashed fraction and break flow.

i. The initial steam generator liquid level is 43.4% of the narrow range span.

This is the minimum expected level, minimizing the amount of secondary inventory available for decay heat removal. This increases the flashed fraction (the amount of leaked reactor coolant that is vaporized on the secondary side). Auxiliary feedwater (AFW) flow is maintained to achieve a narrow range level of at least 45% in all steam generators. AFW is initiated 60 seconds after reactor trip and attains a flow rate of 250 gpm to all steam generators. This maximum expected delay for AFW initiation maximizes break flow and maintains high RCS temperatures. This minimum expected AFW flow to the ruptured steam generator results in decreased RCS heat removal, maintains high RCS temperatures, and thereby maximizes the flashed fraction of leaked reactor coolant.

j. The ruptured steam generators's ASD is set at 1184.7 psia. This is 4%

higher than the nominal setpoint which delays the release of pressure from the ruptured steam generator, resulting in increased valve discharge flow and integrated break flow. The ASD on the ruptured steam generator fails open for 20 minutes, beginning on initial demand, shortly after reactor trip.

k. The initial reactor coolant average temperature is 4.3°F above the nominal value. This increases the flashed fraction of the RCS break flow.

l. Core residual heat generation is based on the 1979 version of ANS 5.1.

ANSI/ANS-5.1-1979 is a conservative representation of the decay energy release rates. Long-term operation at the initial power level preceding the trip is assumed.

m. The narrow range level in all steam generators must be greater than 4%

and the ruptured steam generator pressure must be greater than 430 psig 15.6-11 Rev. OL-21 5/15

CALLAWAY - SP prior to initiating RCS cooldown. The cooldown is initiated 10 minutes after the failed ASD is isolated.

n. RCS depressurization is assumed to begin 3 minutes after completion of cooldown. When the ruptured steam generator pressure is higher than the RCS pressure, the pressurizer PORVs are closed.

o. Safety injection is terminated 5 minutes after completion of RCS depressurization.

Other initial conditions, given in Table 15.0-2, are chosen to maximize RCS temperatures, decay heat, flashed fraction of RCS leakage, and break flow, thereby maximizing radioactivity transfer to the secondary and, consequently, offsite doses.

The above assumptions, suitably conservative for this case are made to maximize offsite doses.

Prior to reactor trip, steam is dumped to the condenser from both the ruptured and intact steam generators. After the condenser is lost, following assumed loss of offsite power at reactor trip, steam from all steam generators is released to the atmosphere.

Following isolation of the ruptured steam generator, one of the ASDs on the three intact steam generators is conservatively assumed to fail closed. This additional failure is beyond single failure criteria. The effect of this assumption is to conservatively increase the time it takes to reduce the RCS temperature to below the ruptured steam generator saturation temperature using atmospheric steam dump from the intact steam generators.

From 2 to 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, steam is assumed to be relieved from the intact steam generators to reduce the RCS temperature and pressure to RHRS conditions. The ruptured steam generator is depressurized to the RHRS cut-in pressure using the emergency recovery procedures. After 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />, further plant cooldown is carried out with the RHRS. The 0 to 2 hour2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br /> and 2 to 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> steam releases from the intact steam generators required to remove decay heat, metal heat, reactor coolant pump heat, and stored fluid energy in the RCS and steam generators are determined based on these assumptions.

Key Recovery Sequence The recovery sequence to be followed consists of the following major operator actions:

a. Identification of the ruptured steam generator;

b. Isolation of the ruptured steam generator including closure of the manual ASD block valve;

c. Assuring subcooling of the RCS fluid below saturation at the ruptured steam generator pressure; 15.6-12 Rev. OL-21 5/15

CALLAWAY - SP

d. Controlled depressurization of the RCS to a value equal to the ruptured steam generator pressure;

e. Subsequent termination of safety injection flow; and

f. Further cooldown and depressurization of the RCS to conditions suitable for RHR initiation.

Results In Table 15.6-1, the sequence of events is presented. These events include postulated operator action times. Loss of offsite power is assumed to occur at reactor trip.

The previously discussed assumptions lead to an estimate of 486,000 pounds for the total amount of reactor coolant transferred to the secondary side of the ruptured steam generator as a result of a tube rupture accident. The steam releases to the condenser and atmosphere from both the ruptured and intact steam generators are given in Table 15.6-4.

The following is a list of figures of pertinent time dependent parameters:

Number Title 15.6-3a Pressurizer and Steam Generator (Ruptured and Intact Generators)

Pressure Transients for Steam Generator Tube Rupture Event 15.6-3b Reactor Coolant System Temperature (Ruptured Loop) Transient for Steam Generator Tube Rupture Event 15.6-3c Reactor Coolant System Temperature (Intact Loops) Transient for Steam Generator Tube Rupture Event 15.6-3d Steam Flow Rate (Intact Generators) Transient for Steam Generator Tube Rupture Event 15.6-3e Steam Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3f Steam Generator Temperature (Ruptured and Intact Generators)

Transients for Steam Generator Tube Rupture Event 15.6-3g Steam Generator Atmospheric Relief Valve Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3h Steam Generator Atmospheric Relief Valve Flow Rate (Intact Generators)

Transient for Steam Generator Tube Rupture Event 15.6-13 Rev. OL-21 5/15

CALLAWAY - SP Number Title 15.6-3i Faulted Steam Generator Break Flow Rate Transient for Steam Generator Tube Rupture Event 15.6-3j Auxiliary Feedwater Flow Rate and Narrow Range Level (Ruptured Generator) Transients for Steam Generator Tube Rupture Event 15.6-3k Auxiliary Feedwater Flow Rate and Narrow Range Level (Intact Generators) Transients for Steam Generator Tube Rupture Event 15.6-3l Steam Generator Liquid Volume (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3m Pressurizer PORV Flow Rate Transient for Steam Generator Tube Rupture Event 15.6-3n Pressurizer Liquid Volume Transient for Steam Generator Tube Rupture Event 15.6-3o Feedwater Flow Rate (Ruptured Generator) Transient for Steam Generator Tube Rupture Event 15.6-3p Feedwater Flow Rate (Intact Generators) Transient for Steam Generator Tube Rupture Event 15.6.3.1.3 Radiological Consequences Method of Analysis The evaluation of the radiological consequences due to a postulated steam generator tube rupture (SGTR) with a stuck open atmospheric steam dump valve on the ruptured steam generator assumes a complete severance of a single steam generator tube while the reactor is operating at full rated power and a coincident loss of offsite power.

Occurrence of the accident leads to an increase in contamination of the secondary system due to reactor coolant leakage through the tube break. A reactor trip occurs automatically, as a result of low pressurizer pressure. The reactor trip will automatically trip the turbine.

Steam generator blowdown will automatically be terminated by the SGBSIS (AFAS) signal (refer to Section 10.4.8) which is initiated by the safety injection signal. The assumed coincident loss of offsite power will cause closure of the condenser steam dump valves to protect the condenser. The steam generator pressure will then increase rapidly, resulting in steam discharge as well as activity release through the steam generator atmospheric steam dump valves. An atmospheric steam dump valve on one of the unaffected steam generators is conservatively assumed not to open and will therefore be unavailable to support the RCS cooldown. This assumption has the effect of increasing the time it takes to reduce the RCS temperature to below the ruptured 15.6-14 Rev. OL-21 5/15

CALLAWAY - SP steam generator saturation temperature. This additional failure is beyond the required single failure criteria. Venting from the affected steam generator, i.e., the steam generator which experiences the tube rupture, will continue until the manual block valve is closed, isolating the stuck open atmospheric steam dump valve on the ruptured steam generator. At this time, the affected steam generator is effectively isolated. The remaining unaffected steam generators remove core decay heat by venting steam through the atmospheric steam dump valves until the controlled cooldown is terminated.

The analysis of the radiological consequences of an SGTR considers the most severe release of secondary activity, as well as reactor activity leaked from the tube break. The inventory of iodine and noble gas fission product activity available for release to the environment depends on the primary-to-secondary break flow and coolant leakage rates, the percentage of defective fuel in the core, flashed fraction of reactor coolant, and the mass of steam discharged to the environment. Conservative assumptions were made for all these parameters.

Assumptions and Conditions The major assumptions and parameters assumed in the analysis are itemized in Tables 15.6-4 and 15A-1 and are summarized below.

The assumptions used to determine the concentrations of isotopes in the reactor coolant and secondary systems prior to the accident are as follows:

a. The assumed reactor coolant iodine activity is determined for the following two cases:

Case 1 - The initial reactor coolant iodine activity corresponds to an isotope mixture that bounds Technical Specification allowable conditions for both tight and open fuel defects.

The isotopic mix is based on the initial RCS concentrations from Table 15A-5. This table provides conservative values for the iodine isotopic spectrum that bound the RCS concentrations which could be expected with either tight or open fuel defects. Case 1 then includes an accident initiated, spiked release rate that increases by a factor of 335 during the accident sequence.

Case 2 - The initial reator coolant iodine activity corresponds to an assumed pre-accident iodine spike which results in concentrations that are a factor of 60 higher than those used in Case 1.

b. The noble gas activity in the reactor coolant, as provided in Table 15A-5 (225 mCi/gm DOSE EQUIVALENT XE-133) .

15.6-15 Rev. OL-21 5/15

CALLAWAY - SP

c. The initial secondary side radio-iodine concentrations are assumed to be 10% of the initial Case 1 primary side concentrations.

The following assumptions and parameters are used to calculate the activity released and the offsite doses following an SGTR:

a. Break flow to the ruptured steam generator is conservatively assigned values that bound calculated break flow rate values. The assumed values bound the break flow rates calculated by the RETRAN code. Break flow rate values are discussed in Table 15.6-4 (225 Ci/gm DOSE EQUIVALENT XE-133).

b. The fraction of reactor coolant that flashes to steam after reaching the secondary side, as assumed in the accident analysis, varies over time.

Key events which trigger changes in the assumed flashed fraction are reactor trip and closure of the manual block valve to isolate the failed open SG atmospheric steam dump valve. Flashed fraction values assumed in the radiological analysis are described in Table 15.6-4.

c. A 1-gpm primary-to-secondary leak is assumed to occur to the unaffected steam generators.

d. All noble gas activity in the reactor coolant which is transported to the secondary system via the tube rupture and the primary-to-secondary leakage is assumed to be immediately released to the environment.

e. At 80 minutes after the accident, it is assumed that the RCS and steam generator pressures are equalized and below the steam generator atmospheric relief valve set pressure. Break flow to the ruptured steam generator and primary-to-secondary leakage to the intact steam generators are conservatively assumed to continue until 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> after the tube rupture.

f. The iodine partition faction between the liquid and steam in the steam generator is assumed to be 0.01.

g. The steam releases from the steam generators to the atmosphere are given in Table 15.6-4.

h. Offsite power is lost.

i. Five hours after the accident, the RHR system is assumed to be in operation to cool down the plant. Thus, no additional steam release is assumed.

j. Radioactive decay prior to the release of activity is considered. No decay during transit or ground deposition is considered.

15.6-16 Rev. OL-21 5/15

CALLAWAY - SP

k. Short-term accident atmospheric dispersion factor, breathing rates, and dose conversion factors are provided in Tables 15A-2, 15A-1, and 15A-4, respectively.

Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are based on the assumptions listed above.

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurements program, as described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

c. The thyroid inhalation immersion doses to a receptor at the exclusion area boundary and outer boundary of the low-population zone were analyzed, using the models described in Appendix 15A.

Identification of Leakage Pathways and Resultant Leakage Activity For the purposes of evaluating the radiological consequences due to a postulated SGTR, the activity released from the affected steam generator, prior to isolation, is released directly to the environment by the atmospheric steam dump valve. Two of the unaffected steam generators are assumed to continually discharge steam and entrained activity via the atmospheric steam dump valves up to the time initiation of the RHR system can be accomplished. Since the activity is released directly to the environment with no credit for plateout or retention, the results of the analysis are based on the most direct leakage pathway available. Therefore, the resultant radiological consequences represent the most conservative estimate of the potential integrated dose due to the postulated SGTR.

Identification of Uncertainties and Conservatisms in the Analysis

a. Reactor coolant activities based on extreme iodine spiking effects are orders of magnitude greater than that assumed for normal operating conditions.

b. A 1-gpm steam generator primary-to-secondary leakage, with a conservatively high density, is assumed which is significantly greater than that anticipated during normal operation. This leakage continues for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, even though RHR operation is assumed to begin at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

c. Tube rupture of the steam generator is assumed to be a double-ended severance of a single steam generator tube. This is a conservative assumption, since the steam generator tubes are constructed of highly ductile materials. The more probable mode of tube failure is one or more 15.6-17 Rev. OL-21 5/15

CALLAWAY - SP minor leaks of undetermined origin. Activity in the secondary steam system is subject to continual surveillance, and the accumulation of activity from minor leaks that exceeds the limits established in the technical specifications would lead to reactor shutdown. Therefore, it is highly unlikely that the total amount of activity considered available for release in this analysis would ever be realized.

d. The coincident loss of offsite power with the occurrence of an SGTR is a highly conservative assumption. In the event of the availability of offsite power, the condenser dump valves will open, permitting steam dump to the condenser. This will reduce the amount of steam and entrained activity discharged directly to the environment from the unaffected steam generators.

e. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that the meteorological conditions assumed will be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, are conservative.

f. The radiological consequences have been based on a single failure in the open position of the ruptured steam generator atmospheric steam dump (ASD) valve which isn't isolated until 30 minutes after tube rupture.

g. The flashed fraction of the break flow to the ruptured steam generator varies over time. The values assumed in the radiological consequence calculation conservatively bound the calculated values. Key events which trigger changes in the assumed flashed fraction include reactor trip and closure of the manual block valve to isolate the failed open SG atmospheric steam dump valve. Specific values for the flashed fraction are listed in Table 15.6-4.

h. The flashed fraction of the primary-to-secondary leakage to the intact steam generators is conservatively assumed to be the same as in the ruptured steam generator.

i. Break flow to the ruptured steam generator is conservatively assigned values that bound calculated break flow rate values. Break flow rate values are discussed in Table 15.6-4.

j. There are two steam release pathways from the ruptured steam generator that are addressed by the radiological consequence calculation. These pathways are the steaming and flash pathways. The steam pathway accounts for the boiling of the secondary side water inventory of the ruptured steam generator. The flash pathway accounts for the fraction of 15.6-18 Rev. OL-21 5/15

CALLAWAY - SP the leaked primary fluids which immediately flashes to steam after arriving in the secondary side. Release via the steaming pathway is terminated by the SG atmospheric steam dump block valve closure at 30 minutes.

Release via the flash pathway is conservatively continued following block valve closure. Release via this pathway is continued until the RETRAN results indicate that no further flashing will occur.

k. The steam release from the intact steam generator ASDs during the 5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> cooldown to RHR cut-in conditions is conservatively assumed to occur in its entirety during the 0-2 hour period of the transient.

l. Whole body doses from the intact steam generator ASDs during the cooldown to RHR cut-in conditions are calculated using conservative primary side activities.

Table 15.6-5 lists the offsite doses for the SGTR with a stuck-open ASD.

15.6.3.2 STEAM GENERATOR TUBE RUPTURE WITH FAILURE OF FAULTED STEAM GENERATOR AFW CONTROL VALVE 15.6.3.2.1 Identification of Causes and Accident Description As discussed in Reference 3, an SGTR case demonstrating the effects of steam generator overfill was performed. In this case the analysis assumes the failure of the AFW control valve on the discharge side of the motor-driven AFW pump feeding the ruptured steam generator. The ASD on the ruptured steam generator is not assumed to fail open. The ASD never opens and all liquid relief is considered through a main steam safety valve (MSSV). The AFW control valve is assumed failed in the wide-open position to maximize the flow to the ruptured steam generator. Failure of this valve coupled with the contribution from the turbine-driven AFW pump provides a greater potential for overfilling the ruptured steam generator. For this special overfill scenario, reactor trip and safety injection actuation were conservatively assumed at SGTR initiation (time zero) to maximize the AFW addition to the ruptured steam generator. Some of the assumptions which differ from the analysis described in Section 15.6.3.1.1 do so because the trip time sensitivity has been eliminated. The effect of these revised assumptions is an increase in break flow and ruptured steam generator AFW flow, which results in overfill and water relief.

The analysis scenario is outlined below. This analysis is consistent with the overfill scenario presented in Reference 3, but has been updated to match the current plant configuration. This includes revised (longer) operator action times that reflect recent simulator studies of this SGTR scenario.

An SGTR occurs while the plant is at 100% thermal power and while at steady state.

Concurrent with the SGTR a reactor trip occurs and a safety injection signal is generated. A loss of offsite power (LOOP) is assumed coincident with the reactor trip.

15.6-19 Rev. OL-21 5/15

CALLAWAY - SP Following reactor trip, safety injection actuation, and the loss of offsite power, the feedwater flow stops and the Main Steam Isolation Valves close. The secondary pressure rises and approaches the setpoints of the secondary ASDs and MSSVs. In response to the reactor trip and LOOP, auxiliary feedwater is delivered to the secondary.

It is assumed that the AFW control valve fails full open on the ruptured SG and delivers excessive AFW to the ruptured steam generator. The excessive AFW flow quickly rebounds the ruptured steam generator water level and drives the steam generator toward overfill.

In accordance with the emergency operating procedures (EOPs), the ruptured SG is isolated by ensuring that the MSIV, ASD, and blowdown isolation valves are closed on the ruptured loop. The final isolation step requires AFW termination to the SG. After isolation, the primary and ruptured secondary pressure rise in response to reduced heat removal. Following isolation of the ruptured steam generator, operators begin cooldown of the primary via the intact steam generators ASDs. An atmospheric steam dump valve on one of the unaffected steam generators is conservatively assumed not to open and will therefore be unavailable to support the RCS cooldown. This assumption has the effect of increasing the time it takes to reduce the RCS temperature to below the ruptured steam generator saturation temperture. This additional failure is beyond the required single failure criteria. Eventually proper subcooling limits are obtained and primary depressurization is initiated using a primary power operated relief valve (PORV).

Primary depressurization is performed until primary and secondary pressures equalize.

This stops break flow momentarily. In accordance with EOP procedures, the safety injection flow is terminated fairly soon after the depressurization step. Unfortunately, safety injection flow, in the interim, has re-pressurized the primary and a primary/

secondary pressure difference still exists. After SI termination, it is assumed that the operators minimize the primary/secondary pressure difference by opening a PORV. Any primary rise after this step is moderate and a function of decay heat.

Primary and secondary equilibrium does not occur before the ruptured steam generator overfills and water fills the steamline up to the MSIV. When the steam generator and steamline go water solid a pressure spike (on the secondary) occurs as the primary side (driven by SI) drives the secondary pressure toward equilibrium. Thus a safety valve opens and contaminated water is dumped to the atmosphere. Water continues to be relieved from the ruptured SG MSSV until equilibrium is reached between the primary and secondary pressures, effectively terminating flow into the ruptured steam generator.

To assure continued relief, an active failure of the SV is assumed to occur, i.e., after water relief the valve remains partially open (5%). Eventually, water relief depletes the secondary mass and creates a steam void. This steam void grows until water is no longer able to pass out the safety valve.

It is assumed that steam relief continues until RHR cut-in, since steam relief continues to shrink the ruptured SG mass via cooling and mass depletion. Following break flow termination it is assumed that the operators transition to the cooldown procedures and initiate cooldown via intact SG atmospheric steam dump. Cooldown to RHR cut-in 15.6-20 Rev. OL-21 5/15

CALLAWAY - SP conditions requires approximately 4 hours4.62963e-5 days <br />0.00111 hours <br />6.613757e-6 weeks <br />1.522e-6 months <br /> from initiation of intact SG atmospheric steam dump.

15.6.3.2.2 Analysis of Effects and Consequences Method of Analysis Mass and energy balance calculations are performed using RETRAN Section 15.0.11.8 to determine the plant response to the SGTR and calculate the break flow, break flow flashing, secondary releases, and system masses for the calculation of the radiological consequences.

In the calculation of the plant response for this scenario the following assumptions are made:

a. Single failure: The ruptured steam generators auxiliary feedwater control valve fails in the full open position.

b. Additional active failure: The ruptured steam generators safety valve fails partially open (5% effective area) after water relief.

c. The atmospheric steam dump (ASD) valve on the ruptured SG is assumed inoperable in the closed position for the duration of the accident sequence.

d. The tube rupture is modeled as a double-ended-guillotine break of a single tube at the cold leg tube sheet. An additional 5% uncertainty is added to the flow predicted for resistance limited flow.

e. Initial conditions

• Core power = 3565 MWt

• Pressurizer pressure = 2280 psia. This is the nominal pressure plus error allowance. The higher pressure maximizes the break flow.

• Pressurizer level = 38% of narrow range span (NRS)

• Vessel average temperature = 570.7oF - 3oF = 567.7oF. This is the minimum expected vessel average temperature. The lower temperature increases the density of the reactor coolant and thus increases the leakage.

• RCS flow = thermal design flow = 374,400 gpm

• Feedwater temperature = 390oF.

15.6-21 Rev. OL-21 5/15

CALLAWAY - SP

• Steam generator level = 57.5% NRS. This is the nominal level plus uncertainty to maximize the initial inventory.

• Steam generator tube plugging = 5%.

f. Reactor trip occurs at time zero.

g. Loss of offsite power (LOOP) occurs at reactor trip (i.e., at time zero)

h. MSIV isolation is modeled at reactor trip and the assumed loss of offsite power, although it could be significantly delayed based on the expected operator response. Early isolation of the MSIV allows the ruptured SG to depressurize due to the addition of the (maximum) AFW flow, while the intact SG pressure stays relatively high. This results in increased break flow to the ruptured SG, which is conservative. It also leads to higher AFW flow to the ruptured SG. If the MSIV would be left open, the ruptured and intact SGs would tend to be at the same pressure, which would be closer to that of the intact SGs (which are lumped together in the RETRAN model).

Also, with the MSIV open, overfilling the ruptured SG would not necessarily lead to water relief, since the water could go to the intact SGs. The secondary pressure would not spike and the safety valve would not lift.

i. The MSIV closes in 1.5 seconds. As noted above, early isolation is considered to be more limiting.

j. The main feedwater isolation valve (MFIV) closure is modeled as a step function after a 17 second delay. The SI signal generated at reactor trip initiates the isolation. A safety evaluation was performed to determine the impact of a potential increase in the stroke time of the feedwater isolation valves beyond the value assumed in the analyses (15 seconds) due to the isolation of new valve actuators. It was concluded that the results presented in this section for a steam generator tube rupture with a failed or faulted steam generator AFW control valve are not adversely affected by this plant modification. As such, the reported results and conclusions remain valid.

k. Decay heat = 0.8 x 1979 ANS 2 model

l. The following maximum AFW flow rates are modeled prior to partial/full isolation of AFW flow to the ruptured SG:

• The AFW flow to the ruptured SG before isolation of the turbine driven AFW pump flow to the ruptured steam generator, at the intact SG pressure of 1235.7 psia is used as a base. As the intact SG 15.6-22 Rev. OL-21 5/15

CALLAWAY - SP pressure drops the flow to the ruptured SG is reduced. This model is reflected in the table below:

Reduction in Ruptured AFW to Intact SG AFW to SG Pressure Ruptured SG Pressure Ruptured SG (psia) (gpm) (psia) (gpm) 414.7 1317.0 414.7 72.6 614.7 1214.0 614.7 55.4 814.7 1104.0 814.7 37.8 1014.7 982.0 1014.7 20.0 1139.7 895.0 1139.7 8.6 1235.7 823.0 1235.7 0.0

• The AFW flow to the intact SGs (total for the 3) before isolation of the turbine driven AFW pump flow to the ruptured steam generator is provided in the table below.

Intact SG Pressure AFW to Intact (psia) SGs (gpm) 214.7 1691.0 414.7 1576.0 614.7 1455.0 814.7 1326.0 1014.7 1186.0 1139.7 1091.0 1235.7 1013.0

m. The following maximum AFW flow rates are modeled after partial/full isolation of AFW flow to the ruptured SG:

15.6-23 Rev. OL-21 5/15

CALLAWAY - SP

• The AFW flow to the ruptured SG after isolation of the turbine driven AFW pump flow to the ruptured steam generator is provided in the table below:

Ruptured AFW to SG Pressure Ruptured SG (psia) (gpm) 414.7 770.0 614.7 712.0 814.7 651.0 1014.7 586.0 1139.7 537.0 1235.7 498.0

• The AFW flow to the intact SGs (total for the 3) after isolation of the turbine driven AFW pump flow to ruptured steam generator, and after complete isolation of AFW to the ruptured SG, is provided in the table below:

Intact AFW to Intact SG Pressure SGs (gpm)

(psia) 214.7 1760.0 414.7 1656.0 614.7 1546.0 814.7 1425.0 1014.7 1295.0 1139.7 1205.0 1235.7 1129.0

n. AFW flow is initiated 5 seconds after reactor trip, with a 30-second ramp up to full flow. Quicker initiation of AFW flow provides more limiting results for this accident sequence.

15.6-24 Rev. OL-21 5/15

CALLAWAY - SP

o. Safety Injection modeling: High and intermediate injection pumps assumed with maximum expected flow. Injection starts 15 seconds after the SI signal (which is generated at the start of the event). Quicker initiation of AFW flow provides more limiting results for this accident sequence.

p. Only two of the intact SG ASDs are credited in the RCS cooldown. This conservatively assumes an additional failure beyond single failure criteria.

q. Operator actions modeled:

• Isolation of turbine-driven AFW flow to the ruptured SG at 10 minutes from the start of the event.

• Isolation of all AFW flow to the ruptured SG at 20 minutes from the start of the event.

• Initiate cooldown by dumping steam from the lumped intact loop SG ASD after 30 minutes from reactor trip (which is at the start of the event).

• The cooldown is terminated when the core outlet temperature reaches the target temperature specified in the EOPs as a function of the ruptured SG pressure.

• Initiate RCS depressurization using the pressurizer power-operated relief valves 3 minutes after the end of the RCS cooldown.

• The depressurization is terminated when the pressurizer pressure and the faulted SG pressure are equal.

• SI flow is terminated 5 minutes after the depressurization is completed.

• Depressurize using pressurizer power-operated relief valve 15 minutes after SI termination to terminate break flow.

• Cooldown to RHR cut-in is initiated after break flow is terminated.

The RETRAN analysis does not include the complete cooldown to RHR conditions. The initial part of the cooldown is shown to demonstrate that once the cooldown is initiated the pressure differential (and break flow) is minimal.

r. The break flow flashing fraction is conservatively determined assuming all break flow is at the ruptured loop hot leg temperature.

15.6-25 Rev. OL-21 5/15

CALLAWAY - SP

s. Pressurizer heaters and sprays are not modeled (heaters are not energized at this point in the accident sequence).

t. Ruptured steam generator secondary side volume modeling: The secondary side volume of a single SG is ~5489 ft.3. The steam line volume up to the MSIV is ~733 ft3. The estimated volume in the horizontal section of the steam pipe up to the MSIV is 201 ft3. Only 100 ft3 of this volume (about half) is credited. Water relief is not started until the pressure spike, which occurs when the defined RETRAN volume becomes water solid, lifts the SV. Until that time water is filling the steamline up to the MSIV but does not force the SV open so no water is released. Once water release starts it continues until the water in the ruptured SG steamline drops below the 100 ft3 of horizontal steamline.

Results The sequence of events is presented in Table 15.6-1. These events include the postulated operator action times.

The single tube rupture leads to a slow depressurization of the reactor coolant system.

Reactor trip and safety injection (SI) actuation are assumed to occur coincident with the tube rupture and loss of offsite power is assumed to result from the trip. The SI signal initiates makeup flow and isolates main feedwater. AFW is initiated to provide cooling for decay heat removal. The secondary pressure rises, but no steam is released from the ruptured SG since the ASD is not credited and the pressure does not reach the MSSV setpoint.

Within 10 minutes the operators are assumed to isolate flow from the turbine driven AFW pump to the ruptured steam generator in response to the increase in level in that steam generator. Due to the assumed failure of the valve from the motor driven AFW pump, AFW flow to the ruptured steam generator continues until 20 minutes when the operators are assumed to have isolated all AFW flow to the ruptured SG.

Due to the assumed high initial secondary side water inventory, maximum AFW and conservatively high break flow modeling, the ruptured steam generator overfills before it is completely isolated. When the steamline volume up to the MSIV fills with water, a pressure spike occurs in that steam line, and the safety valve lifts. Initial flow out of the safety valve is high, matching the flow into the steam generator (AFW plus break flow).

After AFW isolation and as break flow is reduced, the flow out the MSSV drops. It is assumed that the valve sticks open at 5% effective area, leading to continued water relief at rates that exceed the flow into the steam generator. Eventually, water relief depletes the secondary mass and creates a steam void. This steam void grows until water is no longer able to pass out the safety valve.

15.6-26 Rev. OL-21 5/15

CALLAWAY - SP At 30 minutes the operators initiate RCS cooldown by opening two of the intact SG ASDs. This cooldown continues until the subcooling margin appropriate to allow the primary depressurization is reached. The cooldown is completed approximately 45 minutes into the event.

At approximately 48 minutes operators depressurize the primary using pressurizer power operated relief valves (PORVs) until primary-secondary pressure equilibrium is reached, at approximately 49 minutes. Safety injection flow is terminated 5 minutes later. A secondary RCS depressurization is initiated at approximately 69 minutes from the start of the event, leading to break flow termination. Cooldown to RHR conditions using two of the intact SG ASDs is assumed to be initiated at approximately 69 minutes from the start of the event.

Eventually, the steam void resulting from continued water relief from the assumed stuck open MSSV on the ruptured steam generator grows to the extent that the valve no longer passes water. This occurs at approximately 89 minutes from the start of the event.

The following is a list of figures of pertinent time dependent parameters:

Number Title 15.6-33a Pressurizer and Steam Generator (Ruptured and Intact Generators)

Pressure Transients for SGTR Event with Overfill 15.6-33b Reactor Coolant System Temperature (Ruptured Loop) Transient for SGTR Event with Overfill Number Title 15.6-33c Reactor Coolant System Temperature (Intact Loops) Transient for SGTR Event with Overfill 15.6-33d Reactor Coolant System and Steam Generator (Ruptured and Intact Generators) Water Mass Transient for SGTR Event with Overfill 15.6-33e Ruptured Steam Generator Break Flow Flashing Fraction Transient for SGTR Event with Overfill 15.6-33f Steam Generator Temperature (Ruptured and Intact Generators)

Transient for SGTR Event with Overfill 15.6-33g Steam Generator Atmospheric Release Flow Rate (Ruptured Generator)

Transient for SGTR Event with Overfill 15.6-33h Steam Generator Atmospheric Release Flow Rate (Intact Generators)

Transient for SGTR Event with Overfill 15.6-27 Rev. OL-21 5/15

CALLAWAY - SP 15.6-33i Ruptured Steam Generator Break Flow Rate Transient for SGTR Event with Overfill 15.6-33j Auxilary Feedwater Flow Rate and Narrow Range Level (Ruptured Generator) Transients for SGTR Event with Overfill 15.6-33k Auxiliary Feedwater Flow Rate and Narrow Range Level (Intact Generators) Transients for SGTR Event with Overfill 15.6-33l Ruptured Steam Generator Liquid Volume Transient for SGTR Event with Overfill 15.6-33m Pressurizer PORV Flow Rate Transient for SGTR Event with Overfill 15.6-33n Pressurizer Liquid Volume Transient for SGTR Event with Overfill 15.6.3.2.3 Radiological Consequences The analysis of the radiological consequences of the SGTR with overfill and water release is performed in a manner consistent with that presented in Section 15.6.3.1.3 for the SGTR with the postulated stuck open ARV. The assumptions are outlined below.

Unless otherwise noted, these assumptions are consistent with the Section 15.6.3.1.3 analysis assumptions.

a. Short-term accident atmospheric dispersion factors and breathing rates are provided in Tables 15A-2 and 15A-1, respectively.

b. Dose conversion factors are listed in Table 15A-4.

c. The initial reactor coolant system (RCS) iodine and noble gas concentrations are defined as in the Section 15.6.3.1.3 dose calculations.

d. Spike modeling

• The accident-initiated iodine spike is modeled as in the Section 15.6.3.1.3 dose calculations.

• The pre-accident iodine spike case spike is modeled as in the Section 15.6.3.1.3 dose calculations.

e. Initial secondary activity is 10% of the primary side activity modeled for the accident-initiated iodine spike.

f. Water/Steam Iodine Partitioning: Fluid released from the steam generators as steam retains a portion of the activity present in the fluid. The partition 15.6-28 Rev. OL-21 5/15

CALLAWAY - SP factor is 0.01. All activity contained in break flow that flashes to steam upon entering the SG is released without partitioning

g. Activity released with water from ruptured SG = 50%. Activity contained in water released from the ruptured SG after overfill is not subject to partitioning. However, only 50% of the activity contained in the water is assumed to become airborne. No additional activity release due to evaporation is modeled. These assumptions were made in the analysis approved in Reference 3.

h. Break flow rate for iodine doses:

• The Section 15.6.3.1.3 dose analysis conservatively modeled a constant break flow rate. For the analysis of doses for the overfill case the transient break flow rate from the RETRAN analysis presented in Figure 15.6-33i is used, up until the time when water relief stops. This is consistent with the analysis approved in Reference 3.

• The calculation of iodine doses until RHR conditions are reached conservatively assumes a break flow of 4 lbm/sec until 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> after break flow termination. This is consistent with the analysis approved in Reference 3. This portion of the analysis assumes that RHR conditions are achieved within 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> of break flow termination, even thought the intact SG releases and the noble gas releases assume 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />.

i. The noble gas doses are calculated in Section 15.6.3.1.3 assuming a constant break flow rate of 65 lbm/sec for the first hour of the transient and 10 lbm/sec thereafter for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />. For the analysis of the SGTR with overfill the duration of the 65 lbm/sec break flow is extended until 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

j. Break flow flashing fraction

• The Section 15.6.3.1.3 dose analysis modeled conservative bounding values for the flashing fraction. For the analysis of doses for the overfill case the transient flashing fraction from the RETRAN analysis presented in Figure 15.6-33e is used. This is consistent with the analysis approved in Reference 3. This analysis models the release of all the activity contained in the flashed break flow.

This conservative assumption is consistent with Section 15.6.3.1.3 which modeled the direct release of activity in flashed break flow even after the ruptured SGs failed open atmospheric steam dump (ASD) valve was isolated.

15.6-29 Rev. OL-21 5/15

CALLAWAY - SP

• Primary to secondary leakage flashing is not modeled. This is consistent with the analysis approved in Reference 3. The leak is small and it is assumed that any steam bubbles formed by flashing leakage would collapse before reaching the top of the water level.

k. The ruptured SG releases are modeled using the RETRAN analysis results presented in Figure 15.6-33g. In the calculation of doses for the cooldown to RHR conditions it is assumed that a steam flow rate of 8 lbm/sec is maintained due to the failed open safety valve. Thus, 144,000 lbm of steam is released from the ruptured SG in the 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> from break flow termination until RHR conditions are reached.

l. The intact SG releases are modeled using the RETRAN analysis results presented in Figure 15.6-33h. In the calculation of doses for the cooldown to RHR conditions it is assumed that 1.25E6 lbm of steam is released from the intact SGs from the time of break flow termination. This value was conservatively calculated for the case with the failed open ASD presented in Section 15.6.3.1.3 and remains conservative when applied to the analysis of the SGTR with overfill.

m. The reactor coolant system, ruptured steam generator and intact steam generators masses are modeled using the RETRAN analysis results from Figure 15.6-33d. This is consistent with the analysis approved in Reference 3. The analysis presented in the Section 15.6.3.1.3 modeled conservative bounding values for the RCS and secondary masses.

Table 15.6-5a lists the offsite doses for the SGTR with overfill and water release.

15.6.3.3 Conclusions 15.6.3.3.1 Filter Loadings The only ESF filtration system considered in the analysis which limits the consequences of the steam generator tube rupture is the control room filtration system. Activity loadings on the control room charcoal filter are based on flow rate through the filter, concentration of activity at the filter inlet, and filter efficiency.

Activity in the control room filter as a function of time has been evaluated for the LOCA, Section 15.6.5. Since the control room filters are capable of accommodating the potential design-basis LOCA fission product iodine loadings, more than adequate design margin is available with respect to postulated SGTR accident releases.

15.6-30 Rev. OL-21 5/15

CALLAWAY - SP 15.6.3.3.2 Doses to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of a postulated SGTR have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body dose due to immersion and the thyroid dose due to inhalation have been analyzed for the 0-2 hour period at the exclusion area boundary and for a time period effectively greater than the duration of the accident (0 to 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />) at the low-population zone outer boundary. Two potentially limiting failure scenarios have been analyzed.

Table 15.6-5 presents the offsite dose results for the case of an SGTR with a stuck-open ASD for the ruptured steam generator. Table 15.6-5a presents the offsite dose results for the case of an SGTR with the postulated failure of the ruptured steam generator AFW flow control valve. For both scenarios, the doses considering a pre-accident iodine spike are within the guideline values of 10 CFR 100. For both scenarios, the doses considering an accident-initiated iodine spike are within the 10% of the guideline values of 10 CFR 100.

15.6.3.4 Conclusions A steam generator tube rupture will cause no subsequent damage to the RCS or the reactor core. An orderly recovery from the accident can be completed, even assuming simultaneous loss of offsite power.

15.6.4 SPECTRUM OF BWR STEAM SYSTEM PIPING FAILURES OUTSIDE OF CONTAINMENT This section is not applicable to the Callaway Plant.

15.6.5 LOSS-OF-COOLANT ACCIDENTS RESULTING FROM A SPECTRUM OF POSTULATED PIPING BREAKS WITHIN THE REACTOR COOLANT PRESSURE BOUNDARY 15.6.5.1 Identification of Causes and Frequency Classification A loss-of-coolant accident (LOCA) is the result of a pipe rupture of the RCS pressure boundary. For the analyses reported here, a major pipe break (large break) is defined as a rupture with a total cross-sectional area equal to or greater than 1.0 ft2. This event is considered an ANS Condition IV event, a limiting fault, in that it is not expected to occur during the lifetime of the plant, but is postulated as a conservative design basis.

For large-break LOCAs, the most limiting single failure is the loss of one train of ECCS injection. The large-break LOCA analyses assume both maximum containment safeguards (to analyze lowest containment pressure conditions) and minimum ECCS safeguards (to analyze the loss of one complete train of emergency core cooling system 15.6-31 Rev. OL-21 5/15

CALLAWAY - SP (ECCS) components), which results in the minimum delivered ECCS flow available to the RCS.

A minor pipe break (small break), as considered in this section, is defined as a rupture of the reactor coolant pressure boundary with a total cross-sectional area less than 1.0 ft2, in which the normally operating charging system flow is not sufficient to sustain pressurizer level and pressure. This is considered a Condition III event in that it is an infrequent fault that may occur during the life of the plant.

For small-break LOCAs, the most limiting single active failure is loss of an emergency power train which results in loss of one complete train of ECCS components. The minimum delivered ECCS flow available to the RCS is based on this single failure.

The acceptance criteria for the LOCA described in 10 CFR 50.46 (Reference 5) are met as follows:

1. The calculated maximum fuel element cladding temperature is below the requirement of 2200°F.

2. The local oxidation of the cladding does not exceed 0.17 times the thickness before oxidation.

3. The calculated total amount of hydrogen generated from the chemical reaction of the cladding with water or steam does not exceed 0.01 times the hypothetical amount that would be generated if all the fuel cladding metal, excluding the cladding surrounding the plenum volume, were to react.

4. Calculated changes in core geometry are such that the core remains amenable to cooling.

5. The core temperature is reduced and decay heat is removed for an extended period of time, as required by the long-lived radioactivity remaining in the core.

These criteria were established to provide a significant margin in emergency core cooling system (ECCS) performance following a LOCA. Reference 6 presents a study in regards to the probability of occurrence of RCS pipe ruptures.

In all cases, small breaks (less than 1.0 ft2) yield results with more margin to the acceptance criteria limits than the limiting large break.

15.6.5.2 Sequence of Events and Systems Operations Should a major break occur, depressurization of the RCS results in a pressure decrease in the pressurizer. Loss-of-offsite power (LOOP) is assumed coincident with the occurrence of the break. The reactor trip signal subsequently occurs when the 15.6-32 Rev. OL-21 5/15

CALLAWAY - SP pressurizer low pressure trip setpoint is reached. A safety injection signal is generated when the low pressurizer pressure SI setpoint is reached. These countermeasures will limit the consequences of the accident in two ways:

1. Reactor trip and borated water injection complement void formation in causing rapid reduction of power to the residual level corresponding to fission product decay heat. No credit is taken in the LOCA ECCS thermal analysis for the boron content of the injection water. In addition, the insertion of control and shutdown rods to shut down the reactor is neglected in the large-break ECCS thermal analysis.

2. Injection of borated water provides for heat transfer from the core and prevents excessive cladding temperatures.

In the present Westinghouse design, the large-break single failure is the loss of an entire train of ECCS components (i.e., one high head charging pump, one safety injection pump, and one low head pump).

The small-break single failure is the loss of one ECCS train. This means that for a small break, credit could be taken for one high head charging pump, one safety injection pump, and one low head pump, though low head flow has been neglected in the small-break analysis for Callaway since the transient is terminated before the cut-in pressure is reached.

The current design for both small and large breaks assumes that at least one train is available for delivery of water to the RCS. This means that one pump in each subsystem delivers to the primary loop.

For the large-break analysis, one ECCS train starts and delivers flow through the injection lines (one for each loop) with one branch injection line spilling to the containment backpressure. To minimize delivery to the reactor, the branch line chosen to spill is selected as the one with the minimum resistance.

For the small-break analysis, one ECCS train starts and delivers flow through the injection lines (one for each loop) with one branch injection line spilling to the RCS backpressure. To minimize delivery to the reactor, the branch line chosen to spill is selected as the one with the minimum resistance.

Description of Large-Break LOCA Transient The sequence of events for a typical large-break LOCA transient is presented in Figure 15.6-4.

Before the break occurs, the unit is in an equilibrium condition; that is, the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred 15.6-33 Rev. OL-21 5/15

CALLAWAY - SP to the reactor coolant. At the beginning of the blowdown phase, the entire RCS contains sub-cooled liquid which transfers heat from the core by forced convection with some fully developed nucleate boiling. Thereafter, the core heat transfer is based on local conditions with transition boiling and forced convection to steam as the major heat transfer mechanisms.

The heat transfer between the RCS and the secondary system may be in either direction, depending on the relative temperatures. In the case of continued heat addition to the secondary system, the secondary system pressure increases and the main steam safety valves may actuate to limit the pressure. Makeup water to the secondary side is automatically provided by the auxiliary feedwater system. The safety injection signal actuates a feedwater isolation signal which isolates main feedwater flow by closing the main feedwater isolation valves and also initiates auxiliary feedwater flow by starting the auxiliary feedwater pumps. The secondary flow aids in the reduction of RCS pressure.

The large break LOCA analysis does not explicitly model either feedwater isolation or AFW delivery.

When the RCS depressurizes to 602 psia, the accumulators begin to inject borated water into the reactor coolant loops. Since loss of offsite power (LOOP) is assumed, the RCPs are assumed to trip at the inception of the accident. The effects of pump coastdown are included in the blowdown analysis.

The blowdown phase of the transient ends when the RCS pressure (initially assumed at 2280 psia) falls to a value approaching that of the containment atmosphere. Prior to or at the end of the blowdown, the mechanisms that are responsible for the emergency core cooling water bypassing the core are calculated not to be effective. At this time (called end-of-bypass) refill of the reactor vessel lower plenum begins. Refill is completed when emergency core cooling water has filled the lower plenum of the reactor vessel, which is bounded by the bottom of the fuel rods (called bottom-of-core recovery time).

The reflood phase of the transient is defined as the time period lasting from the bottom-of-core recovery until the reactor vessel has been filled with water to the extent that the core temperature rise has been terminated. From the latter stage of blowdown to early-reflood, the safety injection accumulator tanks rapidly discharge borated cooling water into the RCS, contributing to the filling of the reactor vessel downcomer. The downcomer water elevation head provides the driving force required for the reflooding of the reactor core. The RHR (low head), safety injection (intermediate head), and ECCS centrifugal charging (high head) pumps also aid in the filling of the downcomer and, subsequently, supply water to maintain a full downcomer and complete the reflooding process.

Continued operation of the ECCS pumps supplies water during long-term cooling. By this time, core temperatures have been reduced to long-term steady-state levels associated with the dissipation of residual heat generation. After the water level of the refueling water storage tank (RWST) reaches a minimum allowable value, coolant for long-term cooling of the core is obtained by switching to the cold leg recirculation mode of operation in which spilled borated water is drawn from the containment recirculation 15.6-34 Rev. OL-21 5/15

CALLAWAY - SP sumps and returned to the RCS cold legs. The containment spray pumps are manually aligned to the containment recirculation sumps and continue to operate to further reduce containment pressure.

Approximately 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> after initiation of the LOCA, the ECCS is realigned to supply water to the RCS hot legs to control the boric acid concentration in the reactor vessel.

Description of Small-Break LOCA Transient As contrasted with the large break, the blowdown phase of the small break occurs over a longer time period. Thus, for the small break LOCA there are only three characteristic stages; i.e., a gradual blowdown with a decrease in water level and a partial core uncovery, core recovery, and long-term recirculation.

Should a small break occur, depressurization of the reactor coolant system causes fluid to flow into the loops from the pressurizer resulting in a pressure and level decrease in the pressurizer. Reactor trip occurs when the low pressurizer pressure trip setpoint is reached. During the earlier part of the small break transient, the effect of the break flow is not strong enough to overcome the flow maintained by the reactor coolant pumps through the core as they are coasting down following reactor trip. Due to the loss of offsite power assumption, the reactor coolant pumps are assumed to be tripped coincident with reactor trip during the accident. Upward flow through the core is maintained. However, the core flow is not sufficient to prevent a partial core uncovery.

The ECCS is actuated when the appropriate setpoint is reached and provides sufficient core flow to recover the core.

Before the break occurs the plant is in an equilibrium condition; i.e., the heat generated in the core is being removed via the secondary system. During blowdown, heat from fission product decay, hot internals, and the vessel continues to be transferred to the reactor coolant system. The heat transfer between the reactor coolant system and the secondary system may be in either direction depending on the relative temperatures. In the case of continued heat addition to the secondary, the secondary system pressure increases and steam relief via the atmospheric steam dump and/or safety valves may occur. The turbine-driven auxiliary feedwater pump provides makeup to the secondary side. The safety injection signal isolates normal feedwater flow by closing the main feedwater isolation valves and initiates auxiliary feedwater flow by starting the turbine-driven auxiliary feedwater pump. The secondary flow aids in the reduction of reactor coolant system pressure.

When the RCS depressurizes to approximately 600 psia, the cold leg accumulators begin to inject borated water into the reactor coolant loops. For some breaks the vessel mixture level starts to increase with ECCS pumped injection before the accumulators come on. For the breaks that do reach the accumulator injection setpoint, the accumulator injection provides enough water to bring the mixture level up to the upper plenum region where it is maintained.

15.6-35 Rev. OL-21 5/15

CALLAWAY - SP 15.6.5.3 Analysis of Effects and Consequences 15.6.5.3.1 Method of Analysis The requirements of an acceptable ECCS evaluation model are presented in Appendix K of 10 CFR 50 (Reference 5).

Large Break LOCA Evaluation Model The large break analysis was performed with the 1981 Version of the Westinghouse ECCS Evaluation Model using BASH (Reference 7), including the changes in the methodology for execution of the model which are described in References 8 and 9 as well as various updates handled under the 10 CFR 50.46 reporting process. The BASH Evaluation Model for Dry Containment plants includes the following main computer codes:

SATAN: Blowdown thermal-hydraulics code; BASH: Refill and Reflood thermal-hydraulics code; COCO: Containment backpressure code; LOCBART: Rod temperature and blockage code.

A brief summary of each of these codes is presented in the following sections.

SATAN Code SATAN (Reference 10) is a one-dimensional nodal network code which models the thermal-hydraulic phenomena during the blowdown depressurization in the reactor core and RCS after a postulated large rupture of a primary coolant pipe. It was developed specifically as part of the evaluation model that meets 10 CFR 50 Appendix K requirements. The code provides blowdown thermal and hydraulic parameters that define the heat transfer boundary conditions in the LOCBART code, which is used to calculate the hot assembly and hot rod fuel cladding temperature transients during a LOCA. SATAN also provides mass and energy discharge rates from the RCS to containment for the COCO code, which is used for containment backpressure calculations.

Some specific features of the SATAN code include the use of a drift flux model and the use of a two-phase friction multiplier. In the core, a hot channel and an average channel flow calculation, effects of crossflow between channels, cladding swelling and rupture effects and metal-water reaction effects are considered. In the rest of the primary loop, accumulator bypass effects and a two-phase pump model are included.

15.6-36 Rev. OL-21 5/15

CALLAWAY - SP SATAN begins calculation of the transient at the time of the rupture. Calculations continue until the end of blowdown which is determined when the following two conditions are met: downflow of ECCS water into the reactor vessel lower plenum has been established, and the RCS pressure has equalized with the containment pressure.

When both of these conditions are met, SATAN will terminate and the refill phase calculations will begin.

BASH Code The BASH code (Reference 7) is used to calculate the refill and reflood portions of the large break LOCA transient. The REFILL module in the BASH code contains the thermal-hydraulic models that are used to describe the storage and transport of water from the ECCS injection points to the reactor vessel lower plenum. The only regions modeled in REFILL are the lumped intact loop cold legs, broken loop cold leg stub, reactor vessel downcomer, and lower plenum up to the bottom of the active fuel. The ECCS systems, including the accumulators, are also modeled. REFILL obtains the conditions from the SATAN tape at the end of blowdown which are used to initialize the refill portion of the transient. REFILL models the cold leg transit and fill, hot wall delay due to flashing of ECCS water in the downcomer, freefall of the water in the downcomer, and lower plenum fill. The refill stage of the LOCA ends when bottom of core recovery occurs. The time to bottom of core recovery is the total amount of time required for the ECCS to increase the water level in the reactor vessel lower plenum to the bottom of the active fuel.

When bottom of core recovery occurs, the reflood phase calculations in BASH begin.

The BASH code consists of the BART code (Reference 11) for core thermal-hydraulic and heat transfer calculations, and a modified version of the NOTRUMP code (Reference 12) for the RCS transient response calculations. The BART computer code was developed primarily as a best-estimate design code for application to the reflood stage of loss-of-coolant accident analysis, and the basic features are described in Reference 11. Some specific features of BART are as follows:

1. Conservation of mass and energy in liquid, vapor, and two-phase regions in the reactor core.

2. Radial conduction heat transfer within the fuel rod.

3. Heat exchange between rods and coolant in liquid, vapor, and two-phase regions in the core.

4. Quench-front propagation and heat release.

5. Thermal non-equilibrium and heat transfer between phases.

The loop models and equations are based on the equilibrium version of the NOTRUMP code, which has been used for a variety of applications. The main code components 15.6-37 Rev. OL-21 5/15

CALLAWAY - SP are: fluid nodes, metal nodes, flow links, and heat links. Physical problems are modeled by using the components to form a network of multiple fluid and metal nodes, appropriately interconnected by flow and heat links. The nodes provide for mass and energy storage; the links provide for mass, energy, and momentum transfer. Thermal-hydraulic effects in the RCS during core reflooding are modeled in the code. Flow correlations model the effects of pressure drop and phase separation. Heat transfer correlations represent all regimes from liquid convection, through nucleate and transition boiling, to stable film boiling or forced convection vaporization, and finally to steam forced convection.

BART, with numerical modifications and with changes to some of the physical models, was combined with the NOTRUMP code described above, creating BASH. BASH calculates the reflood rate which is input to LOCBART, which then calculates the hot assembly and hot rod thermal transient performance during reflood.

The BASH code is also used to provide the mass and energy discharge rates from the RCS to the containment during reflood, which are used in the COCO code for the containment backpressure calculations.

COCO Code The COCO code (Reference 13) models the containment behavior for dry containment plants during a large break LOCA transient. The code calculates the pressure and temperature transients inside the containment during the depressurization and post-blowdown phase following a LOCA.

A detailed examination is made of the non-linear physical phenomena occurring within the containment during the transient. Transient conditions are determined for both the containment steam-air atmosphere and the containment sump water. Temperature gradients in and heat absorption by the containment structures are also considered. The code has the flexibility to analyze various safeguards systems, including internal and external sprays, containment venting and pump back, ventilation fan coolers, and a sump water recirculation system. In the current version of the BASH Evaluation Model, the COCO code is run interactively in the BASH code, to provide direct feedback between the containment and RCS during the refill and reflood phases of the transient.

LOCBART Code The LOCBART code calculates fuel rod temperature profiles, cladding burst and cladding oxidation during the accident sequence. LOCBART is a combination of the LOCTA-IV code (Reference 14) and the BART code (Reference 11). The heat transfer regimes which are analyzed by the LOCTA-IV code include single-phase convective cooling, nucleate boiling, transition boiling, stable film boiling, and heat transfer to steam using laminar or turbulent heat transfer film coefficients. The effects of fuel rod to coolant radiation and rod to rod radiation are considered within the program. Heat transfer 15.6-38 Rev. OL-21 5/15

CALLAWAY - SP coefficients are computed for each axial increment on the basis of local coolant flows, qualities and temperatures.

After the blowdown phase of the accident, the Emergency Core Cooling System (ECCS) delivers water to the RCS which ultimately fills the reactor vessel lower plenum. During this refill phase of the accident, only rod to rod radiation heat transfer is considered in LOCTA-IV. When the lower plenum is full, water begins to enter the core region and the reflood phase of the accident begins. During the reflooding period, the core is cooled by a two-phase mixture that results from steam generation and droplets entrained leaving the flooded region of the core. In the two-phase period, the heat transfer coefficients are calculated by BART using rigorous mechanistic models. When the reflooding rate is less than one inch/sec, the heat transfer coefficient is calculated based on a steam cooling assumption.

During the blowdown and refill phases of a LOCA transient, the LOCTA-IV part of LOCBART is used to calculate the average fuel temperatures. The required mass flow, pressure and enthalpy information to the fuel rod code during blowdown is provided by SATAN output. During refill, the rod to fluid heat transfer coefficient is conservatively assumed to be zero, which results in essentially adiabatic conditions. LOCBART also calculates the thermal-hydraulic conditions in the hot assembly during reflood using the flooding rate obtained from the BASH code. The complete LOCBART code is used to calculate the hot rod temperature during the blowdown, refill, and reflood phases.

The large-break LOCA analysis also utilized the LOCBART Transient Extension Method (Reference 26). This method was developed to extend BASH-EM transients beyond the point at which downcomer boiling occurs in BASH, by correlating the boiling-induced reduction in downcomer driving head to a corresponding reduction in the core inlet flooding rate. The approach is used to ensure adequate termination of the fuel rod cladding temperature and oxidation transients, as required to demonstrate compliance with the acceptance criteria of 10 CFR 50.46.

Small-Break LOCA Evaluation Model The small break analysis was performed with the Westinghouse ECCS Evaluation Model using NOTRUMP WCAP-10079-P-A (Reference 12) and WCAP-10054-P-A (Reference 16), including changes to the model and methodology as described in WCAP-10054-P-A, Addendum 2, Revision 1 (Reference 17). The NOTRUMP Evaluation Model includes the following computer codes:

NOTRUMP: Calculates the thermal-hydraulic response of RCS during transient SBLOCTA: Calculates the fuel rod / cladding heat-up during transient A schematic representation of the computer code interface is given in Figure 15.6-16.

The small break analysis was performed with the Approved Westinghouse ECCS Small 15.6-39 Rev. OL-21 5/15

CALLAWAY - SP Break Evaluation model (References 12, 14, 16, and 17 ), as revised by Reference 19 and 20. A brief summary of each of these codes is presented in the following sections:

NOTRUMP Code The NOTRUMP computer code is a one-dimensional general thermal-hydraulic network code consisting of a number of features. Among these features are the calculation of thermal non-equilibrium in all fluid volumes, flow regime-dependent drift flux calculations with counter-current flooding limitations, mixture level tracking logic in multiple-stacked fluid nodes and regime-dependent heat transfer correlations. Heat transfer in the core is calculated based on LOCTA-IV code (WCAP 8301 - Reference 14) which considers heat transfer regimes including single phase convection to subcooled liquid, nucleate boiling, transition boiling, film boiling and convection to superheated vapor in both laminar and turbulent flows. In addition, the NOTRUMP Small Break Loss-of-Coolant Accident Emergency Core Cooling System Evaluation Model (NOTRUMP SBLOCA ECCS EM) was developed to determine the RCS response to design basis small break LOCAs and to address the NRC concerns expressed in NUREG-0611.

The NOTRUMP model is generally made up of nodes (control volumes) and links (mass and energy transport). This model determines the thermal-hydraulic response of the RCS during the SBLOCA transient based upon initial operating conditions, core nuclear design parameters, steam generator and reactor vessel characteristics as well as ECCS performance and other plant specific parameters. Select RCS response boundary conditions are extracted from the NOTRUMP calculations and are used in the SBLOCTA fuel rod heat-up code.

SBLOCTA Code SBLOCTA is a small-break specific version of the LOCTA-IV code (WCAP-8301 -

Reference 14). Peak cladding temperature calculations are performed with the LOCTA-IV code using the NOTRUMP calculated core pressure, fuel rod power history, uncovered core steam flow and mixture levels as boundary conditions. LOCTA-IV models the hot rod and the average hot assembly rod. As stated above, LOCTA-IV contains many heat transfer models, however, due to the relatively low velocities experienced in the core during the SBLOCA transient, heat transfer is basically limited to forced convection to super-heated vapor and rod-to-rod radiation. In addition to PCT, SBLOCTA also calculates maximum local and hot rod axial average ZrO2 reaction.

15.6.5.3.2 Input Parameters and Initial Conditions Large Break Input Parameters and Initial Conditions The large break LOCA analysis for Callaway was performed for plant operation at 3565 MWt with 5% SGTP. The analysis conditions are based on a total RCS thermal design flow of 93,600 gpm/loop which is consistent with 5% SGTP. The analysis was performed 15.6-40 Rev. OL-21 5/15

CALLAWAY - SP with the upper head fluid temperature equal to the RCS cold leg fluid temperature, achieved by increasing the upper head cooling flow.

The key parameters which were used in the large break LOCA analysis are summarized in Table 15.6-9. Table 15.6-10 lists the safety injection pumped flow vs. pressure.

The initial steady-state fuel pellet temperatures and the fuel rod internal pressures used in the LOCA analysis have been generated with the PAD 4.0 Fuel Rod Design Code (Reference 21), which has been approved by the Nuclear Regulatory Commission.

The bases used to select the numerical values that are input parameters to the analysis have been conservatively determined from extensive sensitivity studies (e.g.,

References 22, 23, and 24). In addition, the requirements of Appendix K to 10 CFR 50 (Reference 5) regarding specific model features were met by selecting models which provide a significant overall conservatism in the analysis. The assumptions made pertain to the conditions of the reactor and associated safety system equipment at the time that the LOCA occurs and include such items as the core peaking factors, the containment pressure, and the performance of the ECCS. Decay heat generated throughout the transient is also conservatively calculated.

Small Break Input Parameters and Initial Conditions The Callaway SBLOCA analysis applies to steam generator tube plugging (SGTP) values of up to 5%. The SBLOCA analysis is performed at maximum SGTP and used Tavg of 588.4°F. The specified Tavg range for Callaway in this analysis is 588.4°F to 570.7°F. The analysis is performed at 588.4°F but can be considered applicable over the range 588.4°F to 570.7°F.

Table 15.6-11 lists important input parameters and initial conditions used in the small break LOCA analyses and Table 15.6-12 lists the safety injection pumped flow vs.

pressure.

15.6.5.3.3 Results Large-Break Results Based on the results of the LOCA sensitivity studies, the limiting large break was found to be the double-ended cold leg guillotine (DECLG). Therefore, only the DECLG break is considered in the large break ECCS performance analysis. Calculations were performed for a range of Moody break discharge coefficients. The results of these calculations are documented in Reference 4 and summarized in Table 15.6-13. The time sequence of events for each case is summarized in Table 15.6-14.

Figure sets 15.6-5 through 15.6-15 present the parameters of principal interest from the large-break ECCS analyses. For all cases listed in Tables 15.6-13 and 15.6-14, transients of the following parameters are presented:

15.6-41 Rev. OL-21 5/15

CALLAWAY - SP Figure 15.6-5 Cladding temperature at PCT and burst elevations Figure 15.6-6 Core pressure during blowdown Figure 15.6-7 Vessel liquid levels during reflood Figure 15.6-8 Core inlet flooding rate during reflood Figure 15.6-9 Core inlet and outlet mass flow rate during blowdown Figure 15.6-10 Cladding surface heat transfer coefficient at PCT and burst elevations Figure 15.6-11 Vapor temperature at PCT and burst elevations Figure 15.6-12 Fluid quality at PCT and burst elevations Figure 15.6-13 Fluid mass velocity at PCT and burst elevations Figure 15.6-14 Intact loop accumulator mass flow rate during blowdown Figure 15.6-15 Intact leg accumulator and SI mass flow rate during reflood Note that Figures 15.6-5h, 15.6-10h, 15.6-11h, 15.6-12h, and 15.6-13h correspond to the maximum peak cladding temperature case from the initial large-break LOCA analysis performed for the replacement SGs. The final peak cladding temperature value was calculated from a subsequent LOCBART calculation performed with Reference 26 as part of a response to a Request for Additional Information (RAI) received from the NRC during the licensing process leading to License Amendment 168 (Reactor Systems Branch RAI #16 in letter ULNRC-05159 dated June 17, 2005). The figures were not updated since the impact on results was minor.

The peak cladding temperature calculated by LOCBART for a large break is 1938.9°F, which is conservatively rounded up to establish the analysis-of-record PCT of 1939°F, which is less than the acceptance limit of 2200°F. The maximum local metal-water reaction is below the embrittlement limit of 17 percent as required by 10 CFR 50.46. The total core metal-water reaction is less than the 1 percent criterion of 10 CFR 50.46. The cladding temperature transient is terminated at a time when the core geometry is still amenable to cooling. As a result, the core temperature will continue to drop, and the ability to remove decay heat generated in the fuel for an extended period of time will be provided.

Small Break Results The calculated peak clad temperature resulting from a small break LOCA is less than that calculated for a large break. A range of small break cases is presented which 15.6-42 Rev. OL-21 5/15

CALLAWAY - SP established the limiting small break. The results of these analyses are documented in Reference 4 and summarized in Table 15.6-15 and Table 15.6-16.

Figure 15.6-16 is the code interface description for Small Break Model. Figure 15.6-17 is the axial power distribution used in the analysis. Figures 15.6-18 through 15.6-28 present the principal parameters of interest for the small break ECCS analyses. For the 2-Inch break case, the hot spot clad temperature was not generated due to the lack of core uncovery. Additional transient parameters for the limiting break size analyzed (4-inch) are presented in Figures 15.6-29 through 15.6-32. For all cases analyzed, the following transient parameters are presented:

15.6-16 Code Interface Description For Small Break Model 15.6-17 Small Break Power Shape 15.6-18 2 Inch Cold Leg Break RCS Pressure Vs. Time 15.6-19 2 Inch Cold Leg Break Core Mixture Height Vs. Time 15.6-20 3 Inch Cold Leg Break RCS Pressure Vs. Time 15.6-21 3 Inch Cold Leg Break Core Mixture Height Vs. Time 15.6-22 3 Inch Cold Leg Break Hot Spot Clad Temperature Vs. Time 15.6-23 4 Inch Cold Leg Break RCS Pressure Vs. Time 15.6-24 4 Inch Cold Leg Break Core Mixture Height Vs. Time 15.6-25 4 Inch Cold Leg Break Hot Spot Clad Temperature Vs. Time 15.6-26 6 Inch Cold Leg Break RCS Pressure Vs. Time 15.6-27 6 Inch Cold Leg Break Core Mixture Height Vs. Time 15.6-28 6 Inch Cold Leg Break Hot Spot Clad Temperature Vs. Time 15.6-29 4 Inch Cold Leg Break Core Exit Steam Flow Rate Vs. Time 15.6-30 4 Inch Cold Leg Break Core Heat Transfer Coefficient Vs. Time 15.6-31 4 Inch Cold Leg Break Hot Spot Fluid Temperature Vs. Time 15.6-32 4 Inch broken loop (BL) & intact loop (IL) Pumped SI Flow Rate Vs.

Time 15.6-43 Rev. OL-21 5/15

CALLAWAY - SP The peak cladding temperature calculated for the limiting small break LOCA is 1043°F.

The maximum local metal-water reaction is 0.02 percent which is below the acceptance criteria limit of 17 percent. The total core metal-water reaction is less than 0.01 percent which is much less than the 1 percent acceptance criteria. These results are below all acceptance criteria limits of 10 CFR 50.46.

15.6.5.4 Radiological Consequences 15.6.5.4.1 Method of Analysis 15.6.5.4.1.1 Containment Leakage Contribution PHYSICAL MODEL - Following a postulated double-ended rupture of a reactor coolant pipe with subsequent blowdown, the ECCS limits the clad temperature to well below the melting point and ensures that the reactor core remains intact and in a coolable geometry, minimizing the release of fission products to the containment. However, to demonstrate that the operation of the Callaway Plant does not represent any undue radiological hazard to the general public, a hypothetical accident involving a significant release of fission products to the containment is evaluated.

It is assumed that 100 percent of the noble gases and 50 percent of the iodine equilibrium core saturation fission product inventory is immediately released to the containment atmosphere. Of the iodine released to the containment, 50 percent is assumed to plateout onto the internal surfaces of the containment or adhere to internal components. The remaining iodine and the noble gas activity are assumed to be immediately available for leakage from the containment.

Once the gaseous fission product activity is released to the containment atmosphere, it is subject to various mechanisms of removal which operate simultaneously to reduce the amount of activity in the containment. The removal mechanisms include radioactive decay, containment sprays, and containment leakage. For the noble gas fission products, the only removal processes considered in the containment are radioactive decay and containment leakage.

a. Radioactive Decay - Credit for radioactive decay for fission product concentrations located within the containment is assumed throughout the course of the accident. Once the activity is released to the environment, no credit for radioactive decay or deposition is taken.

b. Containment Sprays - The containment spray system is designed to absorb airborne iodine fission products within the containment atmosphere. To enhance the iodine-retention capability of the containment sprays, trisodium phosphate is added to the spray solution via baskets adjacent to the sumps. The spray effectiveness for the retention of iodine is dependent on maintaining a long-term sump pH greater than 7.0.

15.6-44 Rev. OL-21 5/15

CALLAWAY - SP

c. Containment Leakage - The containment leaks at a rate of 0.2 volume percent/day as incorporated as a Technical Specification requirement at peak calculated internal containment pressure for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and at 50 percent of this leak rate for the remaining duration of the accident. The containment leakage is assumed to be directly to the environment.

ASSUMPTIONS AND CONDITIONS - The major assumptions and parameters assumed in the analysis are itemized in Tables 15A-1 and 15.6-6 and discussed in Section 6.5A.3.

In the evaluation of a LOCA, all the fission product release assumptions of Regulatory Guide 1.4 have been followed. The following specific assumptions were used in the analysis. Table 15.6-7 provides a comparison of the analysis to the requirements of Regulatory Guide 1.4.

a. The reactor core equilibrium noble gas and iodine inventories are based on long-term operation at a core power level of 3,636 MWt.

b. One hundred percent of the core equilibrium radioactive noble gas inventory is immediately available for leakage from the containment.

c. Twenty-five percent of the core equilibrium radioactive iodine inventory is immediately available for leakage from the containment. The other 25%

released to the containment atmosphere instantaneously plates out.

d. Of the iodine fission product inventory released to the containment, 91 percent is in the form of elemental iodine, 5 percent is in the form of particulate iodine, and 4 percent is in the form of organic iodine.

e. Credit for iodine removal by the containment spray system is taken, starting at time zero and continuing until a decontamination factor of 28.7 for the elemental species and 50 for the particulate species has been achieved.

f. The following iodine removal constants for the containment spray system are assumed in the analysis:

Elemental iodine - 10.0 per hr Organic iodine - 0.0 per hr Particulate iodine - 0.45 per hr

g. The following parameters were used in the two-region spray model:

Fraction of containment sprayed - 0.85 Fraction of containment unsprayed - 0.15 Mixing rate (cfm) between sprayed and unsprayed regions - 85,000 15.6-45 Rev. OL-21 5/15

CALLAWAY - SP Section 6.5 contains a detailed analysis of the sprayed and unsprayed volumes and includes an explanation of the mixing rate between the sprayed and unsprayed regions.

h. The containment is assumed to leak at 0.2 volume percent/day during the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> immediately following the accident and 0.1 volume percent/

day thereafter.

i. The containment leakage is assumed to be direct unfiltered to the environment.

j. The control building and control room filters will be 95 percent efficient in the removal of all species of iodine. The emergency exhaust ESF filter efficiency is 90% in the assumptions listed in Table 15.6-6.

MATHEMATICAL MODELS USED IN THE ANALYSIS - Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Section 15A.2.

b. The atmospheric dispersion factors used in the analysis were calculated, based on the onsite meteorological measurements program described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

c. The thyroid inhalation and total-body immersion doses to a receptor exposed at the exclusion area boundary and the outer boundary of the low population zone were analyzed, using the models described in Sections 15A.2.4 and 15A.2.5, respectively.

d. Buildup of activity in the control room and the integrated doses to the control room personnel are analyzed, based on models described in Section 15A.3.

IDENTIFICATION OF LEAKAGE PATHWAYS AND RESULTANT LEAKAGE ACTIVITY -

For evaluating the radiological consequences of a postulated LOCA, the resultant activity released to the containment atmosphere is assumed to leak directly to the environment.

No credit is taken for ground deposition or radioactive decay during transit to the exclusion area boundary or LPZ outer boundary.

The offsite doses from all those pathways at the exclusion area boundary (EAB) and low population zone (LPZ) boundary and the doses to the control room personnel are included within the composite results reported in Table 15.6-8.

15.6-46 Rev. OL-21 5/15

CALLAWAY - SP 15.6.5.4.1.2 Radioactive Releases Due to Leakage from ECCS and Containment Spray Recirculation Lines Subsequent to the injection phase of ESF system operation, the water in the containment recirculation sumps is recirculated by the residual heat removal, ECCS centrifugal charging and safety injection pumps, and the containment spray pumps. Due to the operation of the ECCS and the containment spray system, most of the radioiodine released from the core would be contained in the containment sump. It is conservatively assumed that a leakage rate of 2 gpm from the ECCS and containment spray recirculation lines exists for the duration of the LOCA. This leakage would occur inside the containment as well as inside the auxiliary building. For this analysis, all the leakage is assumed to occur inside the auxiliary building. Only trace quantities of radioiodine are expected to be airborne within the auxiliary building due to the temperature and pH level of the recirculated water. However, 10 percent of the radioiodine in the leaked water is assumed to become airborne and exhausted from the unit vent to the environment through the auxiliary building emergency exhaust filters (90% efficient). No credit is taken for holdup (i.e. decay) or mixing in the auxiliary building; however, mixing and holdup in the sumps are factored into the release and decay removal constants for this pathway.

Radiological Consequences of ECCS/CS Recirculation Line Leakage - The assumptions used to calculate the amount of radioiodine released to the environment are given in Table 15.6-6. The dose models are presented in Section 15.A. The offsite doses from all dose pathways at the exclusion area boundary (EAB) and low population zone (LPZ) boundary and the doses to the control room personnel are included within the composite results reported in Table 15.6-8.

15.6.5.4.1.3 Releases Due to Leakage of Radioactive Iodine from the RWST An assessment was performed to calculate the thyroid doses at the exclusion area boundary (EAB), low population zone (LPZ) outer boundary, and to the control room personnel associated with an assumed 3 gpm leakage pathway from the containment recirculation sumps through ECCS isolation valves back to the RWST, which is vented to the atmosphere. This calculation was performed to address the scenario presented in Reference 25.

The calculation assumed that 10% of the radioiodine leaked to the RWST becomes airborne, mixes with the RWST volume, and is released to the environment. Credit is taken for decay in the RWST. The assumptions used to calculate the amount of radioiodine released to the environment are given in Table 15.6-6. The dose models are presented in Section 15.A. The doses at the EAB, LPZ outer boundary, and to control room personnel are less than the values reported in Table 15.6-8.

The offsite doses from all dose pathways at the exclusion area boundary (EAB) and low population zone (LPZ) boundary and the doses to the control room personnel are included within the composite results reported in Table 15.6-8.

15.6-47 Rev. OL-21 5/15

CALLAWAY - SP 15.6.5.4.1.4 Releases Prior to Containment Purge Isolation Operation of the containment mini-purge system is allowed during power operation.

Therefore, during the initial stage of the LOCA sequence, it is possible that the containment mini-purge system would not be isolated. Table 9.4-13 discusses NRC guidance regarding modeling of the potential contribution that this pathway would make to post-LOCA radiological consequences.

An assessment was performed to calculate the doses at the exclusion area boundary (EAB), low population zone (LPZ) outer boundary, and to the control room personnel associated with this pathway.

The calculation assumed that the initial radioiodine concentration in the reactor coolant system fluids is the same as used for the pre-accident spike cases analyzed for the SGTR and MSLB accidents. The blowdown rate of RCS fluids into the reactor building is taken from FSAR Table 6.2.1-32. The assumptions used to calculate the amount of radioactivity released to the environment are given in Table 15.6-6. The offsite doses from all dose pathways at the exclusion area boundary (EAB) and low population zone (LPZ) boundary and the doses to the control room personnel are included within the composite results reported in Table 15.6-8.

15.6.5.4.2 Identification of Uncertainties and Conservatisms in the Analysis The uncertainties and conservatisms in the assumptions used to evaluate the radiological consequences of a LOCA result principally from assumptions made involving the amount of the gaseous fission products available for release to the environment and the meteorology present at the site during the course of the accident. The most significant of these assumptions are:

a. The ECCS is designed to prevent fuel cladding damage that would allow the release of the fission products contained in the fuel to the reactor coolant. Severe degradation of the ECCS (i.e., to the unlikely extent of simultaneous failure of redundant components) would be necessary in order for the release of fission products to occur of the magnitude assumed in the analysis.

b. The release of fission products to the containment is assumed to occur instantaneously.

c. It is assumed that 50 percent of the iodines released to the containment atmosphere is adsorbed onto the internal surfaces of the containment or adheres to internal components; however, it is estimated that the removal of airborne iodines by various physical phenomena such as adsorption, adherence, and settling could reduce the resultant doses by a factor of 3 to 10 (Ref. 20).

15.6-48 Rev. OL-21 5/15

CALLAWAY - SP

d. The activity released to the containment atmosphere is assumed to leak to the environment at the containment leakage rate of 0.2-volume percent/

day for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> and 0.1-volume percent/day thereafter. The initial containment leakage rate is based on the peak calculated internal containment pressure anticipated after a LOCA. The pressure within the containment actually decreases with time. Taking into account that the containment leak rate is a function of pressure, the resultant doses could be reduced by a factor of 5 to 10 (Ref. 20).

e. The meteorological conditions assumed to be present at the site during the course of the accident are based on /Q values, which are expected to be exceeded 5 percent of the time. This condition results in the poorest values of atmospheric dispersion calculated for the exclusion area boundary and the LPZ outer boundary. Furthermore, no credit has been taken for the transit time required for activity to travel from the point of release to the exclusion area boundary and LPZ outer boundary. Hence, the radiological consequences evaluated under these conditions are conservative.

Limited credit has been taken for the transit time required for activity to travel from the point of release to the control room air intake ductwork. Since the safety injection signal will generate a Phase A containment isolation signal, which in turn will generate a control room ventilation isolation signal prior to activity reaching the control room air intake ductwork, there is no requirement to perform response time testing on the control room ventilation isolation functions for LOCA mitigation.

15.6.5.4.3 Conclusions 15.6.5.4.3.1 Filter Loadings No recirculating or single-pass filters are used for fission product cleanup and control within the containment following a postulated LOCA. The only ESF filtration systems expected to be operating under post-LOCA conditions are the control room HVAC system and the auxiliary building emergency exhaust filtration system.

Activity loadings on the control room charcoal adsorbers are based on the flowrate through the adsorber, the concentration of activity at the adsorber inlet, and the adsorber efficiency. Based on the radioactive iodine release assumptions previously described, the assumption that 25 percent of the core inventory of isotopes I-127 and I-129 is available for release from the containment atmosphere and the assumption that the charcoal adsorber is 100 percent efficient, the calculated filter loadings are in accordance with Regulatory Guide 1.52, which limits the maximum loading to 2.5 mg of iodine per gram of activated charcoal. The 100 percent efficiency assumption is conservative for the purpose of checking filter loading and is not to be confused with the 95% efficiency assumption used for radiological consequences as listed in Table 15.A-1.

15.6-49 Rev. OL-21 5/15

CALLAWAY - SP 15.6.5.4.3.2 Doses to a Receptor at the Exclusion Area Boundary and Low Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of the postulated LOCA have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body dose due to immersion and the thyroid dose due to inhalation have been analyzed for the 0-2 hour dose at the exclusion area boundary and for the duration of the accident at the LPZ outer boundary. The results, with margin, are listed in Table 15.6-8.

The resultant doses are within the guideline values of 10 CFR 100.

15.6.5.4.3.3 Doses to Control Room Personnel Radiation doses to control room personnel following a postulated LOCA are based on the ventilation, cavity dilution, and dose model discussed in Section 15A.3.

Control room personnel are subject to a total-body dose due to immersion and a thyroid dose due to inhalation. These doses have been analyzed, and are provided in Table 15.6-8. The listed doses, with margin, are within the limits established by GDC-19.

15.6.6 A NUMBER OF BWR TRANSIENTS This section is not applicable to the Callaway Plant.

15.

6.7 REFERENCES

1. Huegel, D. S., et. al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Water Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A, April 1999.

2. Friedland, A. J., and Ray, S., "Revised Thermal Design Procedure",

WCAP-11397-P-A, April 1989.

3. SGTR Analysis letters SLNRC 86-01 (1-8-86), SLNRC 86-03 (2-11-86) SLNRC 86-05 (4-1-86), SLNRC 86-08 (9-4-86), ULNRC-1442 (2-3-87), ULNRC-1518 (5-27-87), ULNRC-1849 (10-21-88), ULNRC-2145 (1-29-90), and the NRC SER dated 8-6-90.

4. WCAP-16140, Callaway Replacement Steam Generator Program NSSS Engineering Report, June 2004.

5. "Acceptance Criteria for Emergency Core Cooling Systems for Light Water Nuclear Power Reactors," 10 CFR 50.46, and, ECCS Evaluation Models, Appendix K of 10 CFR 50, Federal Register, Volume 39, Number 3, January 4, 1974.

15.6-50 Rev. OL-21 5/15

CALLAWAY - SP

6. U. S. Nuclear Regulatory Commission, "Reactor Safety Study - An Assessment of Accident Risks in U. S. Commercial Nuclear Power Plants," WASH-1400, NUREG-75/014, October 1975.

7. The 1981 Version of the Westinghouse ECCS Evaluation Model Using the BASH Code, WCAP-10266-P-A Revision 2 (Proprietary) and WCAP-11524-A Revision 2 (Non-Proprietary), March 1987.

8. Westinghouse letter NTD-NRC-94-4143 from N. J. Liparulo to W. T. Russell (USNRC), Change in Methodology for Execution of BASH Evaluation Model, May 23, 1994.

9. Westinghouse letter NTD-NRC-95-4540 from N. J. Liparulo to W. T. Russell (USNRC), Change in Methodology for Execution of BASH Evaluation Model, August 29, 1995.

10. "SATAN VI Program: Comprehensive Space-Time Dependent Analysis of Loss-of-Coolant," WCAP-8302 (Proprietary) and WCAP-8306 (Non-Proprietary), June 1974.

11. "BART-A1: A Computer Code for the Best Estimate Analysis of Reflood Transients," WCAP-9561-P-A (Proprietary) and WCAP-9695-A (Non-Proprietary),

March 1984.

12. Meyer, P. E., "NOTRUMP: A Nodal Transient Small Break and General Network Code," WCAP-10080-P-A (Proprietary) and WCAP-10080-A (Non-Proprietary),

August 1985.

13. Containment Pressure Analysis Code (COCO), WCAP-8327, July 1974.

14. Bordelon, F. M., et. al., "LOCTA-IV Program: Loss-of-Coolant Transient Analysis,"

WCAP-8301 (Proprietary) and WCAP-8305 (Non-Proprietary), June 1974.

15. Deleted.

16. Lee, N., et al., Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code, WCAP-10054-P-A (Proprietary) and WCAP-10081-A (Non-Proprietary), August 1985.

17. Thompson, C. M., et al., Addendum to the Westinghouse Small Break ECCS Evaluation Model Using the NOTRUMP Code: Safety Injection into the Broken Loop and COSI Condensation Model, WCAP-10054-P-A, Addendum 2, Revision 1 (Proprietary), WCAP-10081-NP-Addendum 2, Revision 1 (Non-Proprietary),

July 1997.

18. Deleted.

15.6-51 Rev. OL-21 5/15

CALLAWAY - SP

19. Letter from W. J. Johnson (Westinghouse) to T. E. Murley (NRC), 10CFR50.46 Annual Notification for 1989 of Modifications in the Westinghouse ECCS Evaluation Models, NS-NRC-89-3463, October 5, 1989.

20. Letter from W. J. Johnson (Westinghouse) to T. E. Murley (NRC), Correction of Errors and Modifications to the NOTRUMP Code in the Westinghouse Small Break LOCA ECCS Evaluation Model Which are Potentially Significant, NS-NRC-89-3464, October 5, 1989.

21. Westinghouse Improved Performance Analysis and Design Model (PAD 4.0),

WCAP-15063-P-A Revision 1 (Proprietary), and WCAP-15064-NP-A (Non-Proprietary), July 2000.

22. Westinghouse Emergency Core Cooling System Evaluation Model - Sensitivity Studies, WCAP-8341 (Proprietary) and WCAP-8342 (Non-Proprietary), July 1974.

23. "Westinghouse Emergency Core Cooling System - Plant Sensitivity Studies,"

WCAP-8340 (Proprietary) and WCAP-8356 (Non-Proprietary), July 1974.

24. Westinghouse ECCS - Four Loop Plant (17x17) Sensitivity Studies, WCAP-8565-P-A (Proprietary) and WCAP-8566-A (Non-Proprietary), July 1975.

25. NRC Information Notice 91-56, Potential Radioactive Leakage to Tank Vented to Atmosphere.

26. Incorporation of the LOCBART Transient Extension Method into the 1981 Westinghouse Large Break LOCA Evaluation Model with BASH (BASH-EM),

WCAP-10266-P-A, Revision 2, Addendum 3 (Proprietary) and WCAP-11524-A, Revision 2, Addendum 3 (Non-Proprietary), December 2002. The December 2002 version was accepted by the NRC for RSG License Amendment 168 (NRC Safety Evaluation Reference 4.5).

27. Deleted.

28. Deleted.

29. Deleted.

30. Huegel, D. S., et. al., RETRAN-02 Modeling and Qualification for Westinghouse Pressurized Reactor Non-LOCA Safety Analyses, WCAP-14882-P-A (Proprietary), April 1999.

31. International Commission on Radiological Protection, Limits for Intakes of Radionuclides by Worker, ICRP Publication 30, 1979.

15.6-52 Rev. OL-21 5/15

CALLAWAY - SP

32. Regulatory Guide 1.195, Methods and Assumptions for Evaluating Radiological Consequences of Design Basis Accidents at Light-Water Nuclear Power Reactors, May 2003.

33. K. F. Eckerman and J. C. Ryman, External Exposure to Radionuclides in Air, Water, and Soil, Federal Guidance Report 12, EPA-402-R-93-081, Environmental Protection Agency, 1993.

15.6-53 Rev. OL-21 5/15

CALLAWAY - SP TABLE 15.6-1 TIME SEQUENCE OF EVENTS FOR INCIDENTS WHICH RESULT IN A DECREASE IN REACTOR COOLANT INVENTORY Accident Event Time (sec)

Inadvertent opening of a pressurizer safety valve Safety valve opens fully 0.0 Low pressurizer pressure reactor trip setpoint reached 32.8 Rods begin to drop 34.8 Minimum DNBR occurs 35.5 Steam generator tube rupture with stuck-open atmospheric steam dump (ASD) valve Tube rupture occurs 0.0 Reactor trip signal 597 Safety injection signal 597 Rod motion 599 Feedwater terminated 603 Ruptured steam generator atmospheric/

steam dump valve opens 604 Safety injection begins 612 Auxiliary feedwater injection 659 Operator isolates ruptured steam generator by closing manual block valve 1804 Operator initiates RCS cooldown via intact steam generator atmospheric steam dump valves 2404 Operator completes RCS cooldown 3383 Operator initiates RCS depressurization via pressurizer PORVs 3563 Operator completes RCS depressurization 3622 Operator terminates safety injection 3922 Operator equalizes primary-secondary pressure 4816 RHR cut-in conditions reached 18000 Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.6-1 (Sheet 2)

Accident Event Time (sec)

Steam generator tube rupture with overfill Tube rupture occurs 0.

Reactor trip signal and loss of offsite power 0.

Safety injection signal 0.

Auxiliary feedwater injection starts 5.

Safety injection delivered 15.

Feedwater terminated 17.

Operator terminates auxiliary feedwater from TDAFW pump to ruptured steam generator 600.

Ruptured steam generator water relief begins 970.

Operator terminates auxiliary feedwater from MDAFW pump to ruptured steam generator 1200.

Operator initiates RCS cooldown via intact steam generator atmosperhic steam dump valves 1800.

Operator completes RCS cooldown 2700.

Operator initiates RCS depressurization via pressurizer PORVs 2880.

Operator completes RCS depressurization 2947.

Operator terminates safety injection 3247.

Cooldown to RHR cut-in begins 4161.

Operator equalizes primary-secondary pressure 4262.

Ruptured SG safety valve begins to relieve steam 5326.

RHR cut-in conditions reached 21800.

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.6-2 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCE OF THE CVCS LETDOWN LINE RUPTURE OUTSIDE OF CONTAINMENT I. Source Data

a. Core power level, MWT 3636

b. Reactor coolant initial iodine activity Dose equivalent of 1.0 Ci/gm of I-131 (adjusted consistent with Table 15.6-4 item I.C.1)

c. Reactor coolant initial noble gas Based on 1-percent fuel activity defects. See Table 15A-5.

d. Iodine spiking factor 500 II. Atmospheric Dispersion Factors See Table 15A-2.

III. Activity Release

a. Break flow rate, gpm 158.9

b. Duration, secs 1810

c. Fraction of iodine activity in the spill that is airborne 0.10 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-3 RADIOLOGICAL CONSEQUENCES OF A CVCS LETDOWN LINE BREAK OUTSIDE OF CONTAINMENT Doses (rem)

Exclusion Area Boundary (0-2 hr)

Thyroid 5.5E+00 Whole body 1.9E-01 Low Population Zone Outer Boundary (duration)

Thyroid 5.5E-01 Whole body 1.9E-02 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-4 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A STEAM GENERATOR TUBE RUPTURE (SGTR)

I. Source Data

a. Core power level, MWt 3,636

b. Steam generator tube leakage, gpm 1

c. Reactor coolant iodine activity:

1. Case 1 The initial reactor coolant iodine activity corresponds to an isotope mixture that bounds Technical Specification allowable conditions for both tight and open fuel defects. The isotopic mix is based on the initial RCS concentrations from Table 15A-5. This table provides conservative values for the iodine isotopic spectrum that bound the RCS concentrations which could be expected with either tight or open fuel defects.

Case 1 then includes an accident initiated, spiked release rate that increases by a factor of 335 during the accident sequence.

2. Case 2 The initial reactor coolant iodine activity corresponds to an assumed pre-accident iodine spike which results in concentrations that are a factor of 60 higher than those used in Case 1.

d. Reactor coolant noble gas activity, Based on 1-percent failed fuel as both cases provided in Table 15A-5 (225 Ci/gm DOSE EQUIVALENT XE-133).

e. Secondary system initial activity 10% of Case 1 primary side activity

f. Reactor coolant mass in total primary 5.8E+5 system, lbs

g. Steam generator water mass (each), 9.3E+4 lbs

h. Offsite power Lost

i. Primary-to-secondary leakage 80 minutes duration II. Atmospheric Dispersion Factors See Table 15A-2 Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.6-4 (Sheet 2)

III. Activity Release Data

a. Affected steam generator

1. Reactor coolant discharged to 486,000(1) steam generator, lbs

2. Flashed reactor coolant, percent 16(2)

3. Iodine partition factor for flashed 1.0 fraction of reactor coolant

4. Steam release to atmosphere, lbs 0-2 hrs 123,200 2-8 hrs 0

5. Iodine carryover factor for the 0.01 nonflashed fraction of reactor coolant that mixes with the initial iodine activity in the steam generator

b. Unaffected steam generators

1. Primary-to-secondary leakage, 4,032(3) lbs

2. Flashed reactor coolant, percent Variable

3. Total steam release, lbs 0-2 hours 1.53E+6(4) 2-8 hours 0

4. Iodine carryover factor 0.01(5)

5. RHR Cut-in time, hrs 5 Notes:

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.6-4 (Sheet 3)

1. The noble gas release calculation assumed a conservatively high, constant 65 lbm/

sec break flow rate for the first hour and 10 lbm/sec thereafter through 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, even though RHR operation is assumed to begin at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />. The iodine release calculation is based on the conservative break flow rate of 65 lbm/sec until cooldown is completed.

2. The assumed flashed fraction is 16% until closure of the SG atmospheric steam dump block valve. Following closure of the block valve, a variable flashed fraction is assumed which conservatively bounds the values calculated by the RETRAN code.

The intact steam generator flashed fraction is conservatively assumed to be the same as in the ruptured steam generator.

3. Based on 1 gpm leakage and conservative density of 62.4 lbm/cu.ft., giving a mass flow rate of 0.14 lbm/sec for 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, even though RHR operation is assumed to begin at 5 hours5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br />.

4. Assumes that 1.25E06 lbm of steam is relieved for decay heat removal during 5 hour5.787037e-5 days <br />0.00139 hours <br />8.267196e-6 weeks <br />1.9025e-6 months <br /> cooldown to RHR operating conditions. To maximize dose effects, this release is included in the first two hours following tube rupture.

5. A partition factor of 1.0 is assumed for the flashed fraction.

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.6-5 RADIOLOGICAL CONSEQUENCES OF A STEAM GENERATOR TUBE RUPTURE WITH STUCK-OPEN ATMOSPERHIC STEAM DUMP VALVE Doses (rem)

1. Case 1, accident initiated iodine spike Exclusion Area Boundary (0-2 hr)

Thyroid 2.3E01 Whole body 8.0E-01 Low Population Zone Outer Boundary (duration)

Thyroid 2.3E00 Whole body 8.5E-02

2. Case 2, pre-accident iodine spike Exclusion Area Boundary (0-2 hr)

Thyroid 5.9E01 Whole body 5.4E-01 Low Population Zone Outer Boundary (duration)

Thyroid 5.9E00 Whole body 5.8E-02 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.6-5A RADIOLOGICAL CONSEQUENCES OF A STEAM GENERATOR TUBE RUPTURE WITH OVERFILL Doses (rem)

1. Case 1, accident initiated iodine spike Exclusion Area Boundary (0-2 hr)

Thyroid 2.3E01 Whole body 7.5E-01 Low Population Zone Outer Boundary (duration)

Thyroid 2.4E00 Whole body 7.5E-02

2. Case 2, pre-accident iodine spike Exclusion Area Boundary (0-2 hr)

Thyroid 7.1E01 Whole body 6.3E-01 Low Population Zone Outer Boundary (duration)

Thyroid 8.0E00 Whole body 6.3E-02 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.6-6 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT-ACCIDENT I. Source Data

a. Core power level, MWt 3636

b. Burnup, full power days 1,000

c. Percent of core activity initially airborne in the containment

1. Noble gas 100

2. Iodine 50*

d. Percent of core activity immediately deposited in containment sump

1. Noble gas 0

2. Iodine 50

e. Core inventories Table 15A-3

f. Iodine distribution, percent

1. Elemental 91

2. Organic 4

3. Particulate 5 II. Atmospheric Dispersion Factors See Table 15A-2 III. Activity Release Data

a. Containment leak rate, volume percent/day

1. 0-24 hours 0.20

2. 1-30 days 0.10

b. Percent of containment leakage that is unfiltered 100

c. Credit for containment sprays

1. Spray iodine removal constants (per hour)

a. Elemental 10.0

b. Organic 0.0

c. Particulate 0.45 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-6 (Sheet 2)

2. Maximum iodine decontamination factors for the containment atmosphere

a. Elemental 28.7

b. Organic 0

c. Particulate 50

3. Sprayed volume, percent 85

4. Unsprayed volume, percent 15

5. Sprayed-unsprayed mixing rate, CFM 85,000

6. Containment volume, ft3 2.5E+6

d. ECCS recirculation leakage

1. Leak rate (0 - 30 days), gpm 2.0

2. Sump volume, ft3 57,224

3. Fraction iodine airborne 0.1

4. Emergency exhaust ESF filter 90.0 efficiency, %

e. RWST leakage

1. Leak rate (0 - 30 days), gpm 3.0

2. RWST volume, gal. 400,000

3. Fraction iodine airborne 0.1 IV. Control room parameters Tables 15A-1 and 15A-2

• Half instantaneously plates out leaving 25% immediately available for leakage from the containment.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 DESIGN COMPARISON TO THE REGULATORY POSITIONS OF REGULATORY GUIDE 1.4 ASSUMPTIONS USED FOR EVALUATING THE POTENTIAL RADIOLOGICAL CONSEQUENCES OF A LOSS OF COOLANT ACCIDENT FOR PRESSURIZED WATER REACTORS, REVISION 2, JUNE 1974 Regulatory Guide 1.4 Position Design

1. The assumptions related to the release of radioactive material from the fuel and containment are as follows:

a. Twenty-five percent of the equilibrium 1a. Complies.

radioactive iodine inventory developed from maximum full power operation of the core should be assumed to be immediately available for leakage from the primary reactor containment. Ninety-one percent of this 25 percent is to be assumed to be in the form of elemental iodine, 5 percent of this 25 percent in the form of particulate iodine, and 4 percent of this 25 percent in the form of organic iodides.

b. One hundred percent of equilibrium 1b. Complies.

radioactive noble gas inventory developed from maximum full power operation of the core should be assumed to be immediately available for leakage from the reactor containment.

c. The effects of radiological decay 1c. Complies. Credit for during holdup in the containment or other buildings radioactive decay is should be taken into account. taken until the activity is assumed to be released.

d. The reduction in the amount of 1d. Complies. See Table radioactive material available for leakage to the 15.6-6 for reduction environment by containment sprays, recirculating taken.

filter systems, or other engineered safety features may be taken into account, but the amount of reduction in concentration of radioactive materials should be evaluated on an individual case basis.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 2)

Regulatory Guide 1.4 Position Design

e. The primary reactor containment 1e. Complies.

should be assumed to leak at the leak rate incorporated or to be incorporated as a technical specification requirement at peak accident pressure for the first 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br />, and at 50 percent of this leak rate for the remaining duration of the accident.

Peak accident pressure is the maximum pressure defined in the technical specifications for containment leak testing.

2. Acceptable assumptions for atmospheric 2a. Complies. Atmospheric diffusion and dose conversion are: dispersion factors were calculated based on the

a. The 0-8 hour ground level release onsite meteorological concentrations may be reduced by a factor ranging measurement programs from one to a maximum of three (see Figure 1) for described in Section 2.3 additional dispersion produced by the turbulent of the Site Addendum.

wake of the reactor building in calculating potential exposures. The volumetric building wake correction, as defined in section 3-3.5.2 of Meteorology and Atomic Energy 1968, should be used only in the 0-8 hour period; it is used with a shape factor of 1/2 and the minimum cross-sectional area of the reactor building only.

b. No correction should be made for 2b. Same as 2a above.

depletion of the effluent plume of radioactive iodine due to deposition on the ground, or for the radiological decay of iodine in transit.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 3)

Regulatory Guide 1.4 Position Design

c. For the first 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br />, the breathing rate 2c. Complies. See Table of persons offsite should be assumed to be 3.47 x 15A-1.

10-4 cubic meters per second. From 8 to 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> following the accident, the breathing rate should be assumed to be 1.75 x 10-4 cubic meters per second.

After that until the end of the accident, the breathing rate should be assumed to be 1.75 x 10-4 cubic meters per second. After that until the end of the accident, the rate should be assumed to be 2.32 x 10-4 cubic meters per second. (These values were developed from the average daily breathing rate [2 x 107 cm3/day] assumed in the report of ICRP, Committee II-1959.)

d. The iodine dose conversion factors 2d. The dose conversion are given in ICRP Publication 2, Report of factors provided in Committee II, "Permissible Dose for Internal Regulatory Guide 1.109 Radiation," 1959. are used. See Table 15A-4.

e. External whole body doses should be 2e. The dose factors given calculated using "Infinite Cloud" assumptions, i.e., in Regulatory Guide the dimensions of the cloud are assumed to be large 1.109, for noble gases; compared to the distance that the gamma rays and for iodine whole body beta particles travel. "Such a cloud would be dose factors with 5 cm considered an infinite cloud for a receptor at the body tissue attenuation; center because any additional [gamma and] beta and for beta-skin dose emitting material beyond the cloud dimensions factors with credit for would not alter the flux of [gamma rays and] beta attenuation in the dead particles to the receptor" (Meteorology and Atomic skin layer, are used.

Energy, Section 7.4.1.1-editorial additions made so See Table 15A-4.

that gamma and beta emitting material could be considered). Under these conditions the rate of energy absorption per unit volume is equal to the rate of energy released per unit volume. For an infinite uniform cloud containing curies of beta radioactivity per cubic meter the beta dose in air at the cloud center is:

D = 0.457 E Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 4)

Regulatory Guide 1.4 Position Design The surface body dose rate from beta emitters in the infinite cloud can be approximated as being one-half this amount (i.e., D = 0.23 E ).

For gamma emitting material the dose rate in air at the cloud center is:

D

' = 0.507 E From a semi-infinite cloud, the gamma dose rate in air is:

D

' = 0.25 E Where:

' = beta dose rate from an infinite cloud D

(rad/sec)

D

' = gamma dose rate from an infinite cloud (rad/sec)

E = average beta energy per disintegration (Mev/dis)

E = average gamma energy per disintegration (Mev/dis)

= concentration of beta or gamma emitting isotope in the cloud (curie/

m3)

f. The following specific assumptions are 2f. See response to 2e.

acceptable with respect to the radioactive cloud dose calculations:

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 5)

Regulatory Guide 1.4 Position Design (1) The dose at any distance from the reactor should be calculated based on the maximum concentration in the plume at that distance taking into account specific meteorological, topographical, and other characteristics which may affect the maximum plume concentration. These site related characteristics must be evaluated on an individual case basis. In the case of beta radiation, the receptor is assumed to be exposed to an infinite cloud at the maximum ground level concentration at that distance from the reactor. In the case of gamma radiation, the receptor is assumed to be exposed to only one-half the cloud owing to the presence of the ground. The maximum cloud concentration always should be assumed to be at ground level.

(2) The appropriate average beta 2f.2 See response to 2e.

and gamma energies emitted per disintegration, as given in the Table of Isotopes, Sixth Edition, by C. M.

Lederer, J. M. Hollander, I. Perlman; University of California, Berkeley; Lawrence Radiation Laboratory; should be used.

g. The atmospheric diffusion model should be as follows:

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 6)

Regulatory Guide 1.4 Position Design (1) The basic equation for 2g.1 Short-term accident atmospheric diffusion from a ground level point atmospheric dispersion source is: factors were calculated based on onsite 1 meteorological

/Q = -------------------

u y z measurement programs described in Section 2.3 Where: of the Site Addendum.

These factors are for

= the short term average centerline ground level releases value of the ground level and are based on concentration (curie/meter3) Regulatory Guide 1.XXX methodology and Q = amount of material released (curie/ represent the worst of sec) the 5-percent site meteorology and the u = windspeed (meter/sec) 0.5-percent worst sector y = the horizontal standard deviation of meteorology.

the plume (meters) [See Figure V-1, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F.A.

Gifford, Jr.]

z = the vertical standard deviation of the plume (meters) [See Figure V-2, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A.

Gifford, Jr.]

(2) For time periods of greater than 2g.2 See response to 2g.1 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> the plume should be assumed to meander above.

and spread uniformly over a 22.5° sector. The resultant equation is:

2.032

/Q = ---------------

z ux Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-7 (Sheet 7)

Regulatory Guide 1.4 Position Design Where:

x = distance from point of release to the receptor; other variables are given in g(1).

(3) The atmospheric diffusion 2g.3 See response to 2g.1 model2 for ground level releases is based on the above.

information in the following table.

Time Following Accident Atmospheric Conditions 0-8 hours Pasquill Type F, windspeed 1 meter/

sec, uniform direction 8-24 hours Pasquill Type F, windspeed 1 meter/

sec, variable direction within a 22.5° sector 1-4 days (a) 40% Pasquill Type D, windspeed 3 meter/sec (b) 60% Pasquill Type F, windspeed 2 meter/sec (c) Wind direction variable within a 22.5° sector 4-30 days (a) 33.3% Pasquill Type C, windspeed 3 meter/sec (b) 33.3% Pasquill Type D, windspeed 3 meter/sec (c) 33.3% Pasquill Type F, windspeed 2 meter/sec (d) Wind direction 33.3% frequency in a 22.5° sector (4) Figures 2A and 2B give the 2g.4 See response to 2g.1 ground level release atmospheric diffusion factors above.

based on the parameters given in g(3).

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-8 RADIOLOGICAL CONSEQUENCES OF A LOSS-OF-COOLANT-ACCIDENT Total Reported Regulatory Doses (rem) Limits (rem)

I. Exclusion Area Boundary (0-2 hr)

Thyroid 128.4 300 Whole body 4.75 25 II. Low Population Zone Outer Boundary (0-30 day)

Thyroid 132.8 300 Whole body 1.28 25 III. Control Room (0-30 day)

Thyroid 25.55 30 Whole body 0.453 5 Beta-skin 7.49 30 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.6-9

SUMMARY

OF LARGE BREAK LOCA ANALYSIS ASSUMPTIONS Licensed Core Power 3565 MWt Calorimetric Uncertainty 2%

Fuel Type 17 x 17 Total Core Peaking Factor, FQ 2.50 Hot Channel Enthalpy Rise Factor, FH 1.65 K(Z) Limit 1.0 from 0 to 6 ft.,

1.0 to 0.925 from 6 to 12 ft.

Thermal Design Flow 93,600 gpm/loop Nominal Vessel Average Temperature 570.7 - 588.4 °F Vessel Average Temperature Uncertainty +4.3 / -3.0 °F Pressurizer Pressure 2250 psia Pressurizer Pressure Uncertainty +30 psi Steam Generator Tube Plugging 5%

Accumulator Water Volume, Nominal 850 ft3/accumulator Accumulator Gas Pressure, Minimum 602 psia Safety Injection Pumped Flow Table 15.6-10 Containment Parameters Section 6.2.1.5 Rev. OL-20 11/13

CALLAWAY - SP TABLE 15.6-10 MINIMUM AND MAXIMUM SAFETY INJECTION FLOWS FOR LBLOCA PRCS LHSI IHSI HHSI (psig) (lbm/s) (lbm/s) (lbm/s)

MINIMUM SAFETY INJECTION 0 393.4 63.3 39.3 20 318.5 62.8 39.1 40 241.0 62.2 38.8 60 165.2 61.6 38.6 80 114.2 61.1 38.4 100 51.9 60.5 38.1 120 0 59.9 37.9 140 0 59.4 37.7 160 0 58.8 37.4 180 0 58.2 37.2 200 0 57.6 37.0 600 0 44.3 32.2 MAXIMUM SAFETY INJECTION 0 1056.5 85.8 91.4 20 969.4 85.2 91.0 40 878.0 84.6 90.6 60 780.6 84.0 90.2 80 675.0 83.4 89.8 100 556.4 82.8 89.4 120 446.0 82.2 89.0 140 361.3 81.6 88.6 160 258.9 80.9 88.2 180 117.4 80.3 87.8 200 0 79.7 87.4 600 0 66.3 78.7 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-10A DELETED Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-10B DELETED Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-11 INPUT PARAMETERS USED IN THE SMALL BREAK LOCA ANALYSIS 100% Licensed Core Power 3565 MWt Fuel Type 17x17 Vantage+

(Performance+)

Power Shape Figure 15.6-17 Total Core Peaking Factor, FQ 2.50 Hot Rod Enthalpy Rise Peaking Factor, FDH 1.65 Hot Assembly Peaking Factor, P- HA 1.469 K(z) limit 2 line segment Core Power Calorimetric Uncertainty 2%

Thermal design flow 93,600 gpm/loop Nominal vessel average temperature range 570.7 - 588.4°F Pressurizer pressure 2250 psia Pressurizer pressure uncertainty +30 psi Steam generator tube plugging 5%

Accumulator Initial water volume 6358 gal Accumulator Minimum cover gas pressure 602 psia Safety Injection Pumped Flow Table 15.6-12 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15.6-12 SAFETY INJECTION FLOWS VS. PRESSURE FOR SBLOCA -

MINIMUM SAFEGUARDS, SPILL TO RCS PRESSURE RCS Pressure Injected Flow Spilled Flow (psig) (GPM) (GPM) 0 738.20 253.60 100 716.30 246.20 200 694.20 238.50 300 670.20 230.20 400 645.80 221.90 500 620.10 213.20 600 594.00 204.10 700 567.00 194.90 800 539.20 185.30 900 509.10 175.00 1000 477.30 164.10 1100 443.60 152.60 1200 389.10 133.80 1300 343.50 118.20 1400 278.70 96.00 1500 160.80 55.70 1600 151.10 52.30 1700 141.30 48.90 1800 131.40 45.50 1900 121.20 42.00 2000 109.10 37.80 2100 96.40 33.40 2200 82.20 28.40 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-12 (Sheet 2)

RCS Pressure Injected Flow Spilled Flow (psig) (GPM) (GPM) 2300 65.70 22.80 2400 31.50 11.00 2500 0.0 0.0 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-13 LARGE BREAK LOCA RESULTS HR Max Zr- Total HR Burst HR Burst HR Max Zr- O2 Reaction Zr-O2 PCT PCT Time PCT Elev. Time Elev. O2 Reaction Elevation Reaction Case (°F) (s) (ft.) (s) (ft.) (%) (ft) (%)

Non-IFBA CD=0.4, Low TAVG, 1594.8 109.0 7.0 93.81 7.25 1.84% 7.25 <1.0%

MIN SI, Cosine CD=0.6, Low TAVG, 1854.9 96.7 7.25 50.63 6.0 1.84% 7.25 <1.0%

MIN SI, Cosine CD=0.8, Low TAVG, 1764.1 135.2 7.25 46.82 6.25 1.53% 7.25 <1.0%

MIN SI, Cosine CD=1.0, Low TAVG, 1644.7 8.6 6.25 67.11 7.25 2.01% 7.25 <1.0%

MIN SI, Cosine CD=0.6, High TAVG, 1885.8 97.0 7.25 48.09 6.0 2.17% 7.25 <1.0%

MIN SI, Cosine CD=0.6, High TAVG, 1735.9 130.9 7.25 48.32 6.0 1.35% 7.25 <1.0%

MAX SI, Cosine CD=0.6, High TAVG, 1881.3 88.4 9.0 52.12 8.0 2.32% 9.0 <1.0%

MIN SI, 8.5 Skewed IFBA CD=0.6, High TAVG, 1938.9 146.8 7.25 54.60 6.25 2.93% 7.25 <1.0%

MIN SI, Cosine Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-14 LARGE BREAK LOCA TIME SEQUENCE OF EVENTS CD=0.4 CD=0.6 CD=0.8 CD=1.0 CD =0.6 CD =0.6 CD =0.6 C D=0.6 Low TAVG Low TAVG Low TAVG Low TAVG High TAVG High TAVG High TAVG High TAVG MIN SI MIN SI MIN SI MIN SI MIN SI MAX SI MIN SI MIN SI Results Cosine Shape Cosine Shape Cosine Shape Cosine Shape Cosine Shape Cosine Shape 8.5 Shape Cosine Shape (sec) non-IFBA non-IFBA non-IFBA non-IFBA non-IFBA non-IFBA non-IFBA IFBA Start 0.0 0.0 0.0 0.0 0.0 0.0 0.0 0.0 Reactor Trip Signal 0.59 0.58 0.57 0.57 0.67 0.67 0.67 0.67 Safety Injection 2.0 1.6 1.4 1.4 1.6 1.6 1.6 1.6 Signal Accumulator 23.8 18.2 14.5 12.6 18.4 18.4 18.1 18.4 Injection End of Blowdown 44.5 35.2 30.6 28.6 33.8 33.8 33.7 33.8 Start of Safety 31.0 30.6 30.4 30.4 30.6 30.6 30.6 30.6 Injection Bottom of Core 55.6 48.1 41.4 39.2 47.3 46.4 47.3 47.3 Recovery Accumulator Empty 62.8 54.9 51.1 48.9 54.3 55.0 54.2 54.3 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-15 NOTRUMP TRANSIENT RESULTS Event Time (sec) 2 in 3 in 4 in 6 in Break Initiation 0 0 0 0 Reactor Trip Signal 85.8 21.3 12.3 7.42 Safety Injection Signal 97.0 32.0 22.1 14.8 Safety Injection Begins 126.0 61.0 51.1 43.8 Loop Seal Clearing* 1387 651 330 165 Core Uncovery N/A 813 720 435 Accumulator Injection Begins N/A N/A 970 395 Core Recovery N/A >2332 >1364 >457

• Loop seal clearing is defined as break vapor flow > 1 lb/s Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.6-16 BEGINNING OF LIFE (BOL) ROD HEATUP RESULTS 2 Inch 3 Inch 4 Inch 6 Inch Time-in-Life N/A BOL BOL BOL PCT (°F) N/A 949 1043 772 PCT Time (s) N/A 1050.1 1048.8 168.4 PCT Elevation (ft) N/A 11.00 11.25 10.75 HR Burst Time (s) N/A N/A N/A N/A HR Burst Elevation (ft) N/A N/A N/A N/A Max. Local ZrO2 (%) N/A 0.02 0.02 <0.01 Max. Local ZrO2 Elev (ft) N/A 11.00 11.25 11.00 Hot Rod Axial Avg. ZrO2

(%) N/A <0.01 <0.01 <0.01 Note: Since the core was not uncovered for the 2 inch break case, there are no Rod Heatup results for the 2 inch break case.

Rev. OL-15 5/06

CALLAWAY - SP 15.7 RADIOACTIVE RELEASE FROM A SUBSYSTEM OR COMPONENT This class of accident can be caused by any of the following events:

a. Radioactive gas waste system leak or failure - this is an ANS Condition III event.

b. Radioactive liquid waste system leak or failure - this is an ANS Condition III event.

c. Postulated radioactive release due to liquid tank failures - this is an ANS Condition IV event.

d. Fuel handling accident - this is an ANS Condition IV event.

All of the accidents in this section have been analyzed. It has been determined that the most severe radiological consequences will result from the fuel handling accident analyzed in Section 15.7.4.

15.7.1 RADIOACTIVE WASTE GAS DECAY TANK FAILURE 15.7.1.1 Identification of Causes This accident is an infrequent fault. Its consequences will be considered in this section.

The accident is defined as an unexpected and uncontrolled release of radioactive xenon and krypton fission product gases stored in a waste gas decay tank as a consequence of a failure of a single gas tank or associated piping.

15.7.1.2 Sequence of Events and System Operations During a refueling shutdown, the radioactive gases are stripped from the primary coolant and are stored in the gas decay tanks. After the transfer has been completed, the tank is assumed to fail. This releases all of the contents of the tank to the radwaste building.

Also, since the tanks are isolated from each other, the only radioactivity released is from the failed tank. For conservatism, the tank is assumed to fail after 40 years, releasing the peak inventory expected in the tank.

15.7.1.3 Core and System Performance This accident occurs when the reactor is in the shutdown condition. There is no impact on the core or its system performance.

15.7.1.4 Barrier Performance The only barrier between the released activity and the environment is the radwaste building. During the course of this accident, the radwaste building is assumed to remain 15.7-1 Rev. OL-22 11/16

CALLAWAY - SP intact. This means that the only method of release is through the radwaste building ventilation system.

15.7.1.5 Radiological Consequences 15.7.1.5.1 Method of Analysis 15.7.1.5.1.1 Physical Model Radioactive waste gas decay tanks are used in the design to permit the decay of radioactive gases as a means of reducing or preventing the release of radioactive materials to the atmosphere. To evaluate the radiological consequences of the gaseous waste processing system, it is postulated that there is an accidental release of the contents of one of the waste gas decay tanks resulting from a rupture of the tank or from another cause, such as operator error or valve malfunction. The gaseous waste processing system is so designed that the tanks are isolated from each other during use, limiting the quantity of gas released in the event of an accident by preventing the flow of radioactive gas between the tanks.

The principal radioactive components of the waste gas decay tanks are the noble gases krypton and xenon, the particulate daughters of some of the krypton and xenon isotopes, and trace quantities of halogens. The maximum amount of waste gases stored in any one tank occurs after a refueling shutdown, at which time the waste gas decay tanks store the radioactive gases stripped from the reactor coolant.

The maximum content of a gas decay tank is conservatively assumed for the purpose of computing the noble gas inventory available for release. Rupture of the waste gas decay tank is assumed to occur immediately upon completion of the waste gas transfer, releasing the entire contents of the tank to the radwaste building. For the purposes of evaluating the accident, it is assumed that all the activity is released directly to the environment during the 2-hour period immediately following the accident.

15.7.1.5.1.2 Assumptions and Conditions The major assumptions and parameters assumed in the analysis are itemized in Table 15.7-3.

In the evaluation of the waste gas decay tank rupture, the fission product accumulation and release assumptions of Regulatory Guide 1.24 have been used. Table 15.7-1 provides a comparison of the assumptions used in the analysis to those of Regulatory Guide 1.24. The assumptions related to the release of radioactive gases from the postulated rupture of a waste gas decay tank are:

a. The reactor has been operating at full core power with 1 percent defective fuel, and a shutdown to cold condition has been conducted prior to the accident.

15.7-2 Rev. OL-22 11/16

CALLAWAY - SP

b. All noble gas activity has been removed from the reactor coolant system and transferred to the gas decay tank that is assumed to fail.

c. The maximum content of the waste gas decay tank was conservatively assumed to calculate the isotopic activities for the accumulated radioactivity in the gaseous waste processing system after 40 years' operation and immediately following plant shutdown and degasification of the reactor coolant system.

d. The failure is assumed to occur immediately upon completion of the waste gas transfer, releasing the entire contents of the tank to the radwaste building.

e. The dose is calculated as if the release were from the radwaste building at ground level during the 2-hour period immediately following the accident.

No credit for radioactive decay is taken.

15.7.1.5.1.3 Mathematical Models Used in the Analysis The mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

b. The atmospheric dispersion factors used in the analysis were calculated based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum.

c. The thyroid inhalation and total-body immersion doses to a receptor at the exclusion area boundary or outer boundary of the low-population zone were analyzed, using the models described in Appendix 15A, Sections 15A.2.4 and 15A.2.5, respectively.

15.7.1.5.1.4 Identification of Leakage Pathways and Resultant Leakage Activity For the purposes of evaluating the radiological consequences due to the postulated waste gas decay tank rupture, the resultant activity is conservatively assumed to be released directly to the environment during the 2-hour period immediately following the occurrence of the accident. This is a considerably higher release rate than that based on the actual building exhaust ventilation rate. Therefore, the results of the analysis are based on the most conservative pathway available.

15.7.1.5.2 Identification of Uncertainties and Conservatisms in the Analysis The uncertainties and conservatisms in the assumptions used to evaluate the radiological consequences of a waste gas decay tank rupture result from assumptions 15.7-3 Rev. OL-22 11/16

CALLAWAY - SP made involving the release of the waste gas from the decay tank and the meteorology present at the site during the course of the accident.

a. The accumulated activity in the gaseous waste processing system after 40 years' operation and immediately following plant shutdown with zero decay assumed to be in the waste gas decay tank is based on 1 percent failed fuel, which is eight times greater than that assumed under normal operating conditions.

b. It is assumed that the waste gas decay tank fails immediately after the transfer of the noble gases from the reactor coolant to the waste gas decay tank is complete. These assumptions result in the greatest amount of noble gas activity available for release to the environment.

c. The noble gas activity contained in the ruptured waste gas decay tank was assumed to be released over a 2-hour period immediately following the accident. This is a conservative assumption. If the contents of the tank were assumed to mix uniformly with the volume of air within the radwaste building where the decay tanks are located, then, using the actual building exhaust ventilation rate, a considerable amount of holdup time would be gained. However, no credit for radioactive decay is taken. This reduces the amount of noble gas activity released to the environment due to natural decay. Also no credit for iodine removal by the non-safety grade radwaste building HVAC charcoal adsorbers has been taken.

d. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that meteorological conditions assumed will be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, will be conservative.

15.7.1.5.3 Conclusions 15.7.1.5.3.1 Filter Loading Since the accumulated iodine activity in the waste gas decay tanks is negligible, filter loading due to a waste gas decay tank rupture does not establish the necessary design margin for the radwaste building exhaust or the control room intake filters. Hence, the respective filter loadings were not evaluated.

15.7-4 Rev. OL-22 11/16

CALLAWAY - SP 15.7.1.5.3.2 Dose to Receptor at the Exclusion Area Boundary and the Low-Population Zone Outer Boundary The radiological consequences resulting from the occurrence of a postulated waste gas decay tank rupture have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body dose due to immersion and the thyroid dose due to inhalation have been analyzed for the 0-2-hour dose at the exclusion area boundary and for the duration of the accident at the low-population zone outer boundary. The results are listed in Table 15.7-4. The resultant doses are well within the guideline values of 10 CFR 100.

15.7.2 RADIOACTIVE LIQUID WASTE SYSTEM LEAK OR FAILURE 15.7.2.1 Identification of Causes This is an infrequent fault because, although it is unlikely to happen, the potential for release of significant amounts of radioactivity is present. The accident may be caused by an equipment malfunction or tank failure or rupture.

15.7.2.2 Sequence of Events and System Operation The radioactive liquid tank is assumed to fail. This releases a maximum of 80 percent of the tank capacity to the equipment compartment.

15.7.2.3 Core and System Performance This accident does not affect the core or the core system performance.

15.7.2.4 Barrier Performance There are no barriers to the release of radioactivity from the radwaste building.

15.7.2.5 Radiological Consequences 15.7.2.5.1 Method of Analysis 15.7.2.5.1.1 Physical Model The liquid radwaste tanks are used as a means of collecting waste to be: 1) processed through the liquid radwaste system, 2) pumped to the drumming area, or 3) discharged from the plant. To evaluate the radiological consequences of the liquid waste processing system, it is postulated that there is an accidental release of the contents of one of the tanks.

15.7-5 Rev. OL-22 11/16

CALLAWAY - SP Table 15A-5 provides an inventory and the concentrations of stored radioactivity in all the liquid tanks. In the analyses, it is assumed that the liquid contents of the tank are released to the radwaste building and, subsequently, the airborne activity is released to the environment during the 2-hour period immediately following the tank failure.

Two tanks have been analyzed for this accident, and the radiological consequences for both tanks are provided. The boron recycle holdup tank was selected because it contained the maximum total inventory, and the primary evaporator bottoms tank was selected because it contained the maximum iodine inventory. The assumptions, conditions, and mathematical models described in this section are identical for both tanks.

15.7.2.5.1.2 Assumptions and Conditions The major assumptions and parameters assumed in this analysis are listed below and in Tables 15.7-5 and 15A-1:

a. The isotopic inventory of the ruptured tank is taken from Table 15A-5, and is based on the original licensing basis 1-percent failed fuel activity adjusted for capacity factor and plant power uprating.

b. The tank failure is assumed to occur when the contents of the tank are at a maximum.

c. The doses are calculated as if the release were from the radwaste building at ground level during the 2-hour period immediately following the accident.

No credit is taken for radioactive decay during holdup in the tank or in transit to the site boundary.

d. 100 percent of all noble gas activity in the tank is released while 1 percent of the iodine activity is released as airborne activity.

e. Credit for iodine removal by non-safety grade radwaste building HVAC charcoal adsorber is not taken.

15.7.2.5.1.3 Mathematical Models Used in the Analysis

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A.

b. The atmospheric dispersion factors used in the analysis were calculated, based on the onsite meteorological measurement programs described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

c. The thyroid inhalation dose and total-body immersion dose to a receptor at the exclusion area boundary or outer boundary of the low-population zone 15.7-6 Rev. OL-22 11/16

CALLAWAY - SP were analyzed, using the models described in Appendix 15A, Sections 15A.2.4 and 15A.2.5, respectively.

15.7.2.5.1.4 Identification of Leakage Pathways and Resultant Leakage Activity For the purposes of evaluating the radiological consequences due to the postulated liquid radwaste tank rupture, the resultant activity is conservatively assumed to be released directly to the environment during the 2-hour period immediately following the occurrence of the accident. This is a considerably higher release rate than that based on the actual building exhaust ventilation rate. Therefore, the results of the analysis are based on the most conservative pathway available.

15.7.2.5.2 Identification of Uncertainties and Conservatisms in the Analysis The uncertainties and conservatisms in the assumptions used to evaluate the radiological consequences of the liquid radwaste tank rupture result from assumptions made involving the release of the radioactivity from the tanks and the meteorology assumed for the site.

a. It was assumed that the liquid radwaste tank fails when the inventory in the tank is a maximum. This assumption results in the greatest amount of activity available for release to the environment.

b. The contents of the ruptured tank are assumed to be released over a 2-hour period immediately following the accident. If the contents of the tank were assumed to mix uniformly with the volume of air within the radwaste building where the tanks are located, then, using the actual building exhaust ventilation rate, a considerable amount of holdup time would be gained. This reduces the amount of activity released to the environment due to the natural decay. Also, no credit for iodine removal by the radwaste building HVAC charcoal adsorbers is taken.

c. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that meteorological conditions assumed will be present during the course of the accident for any extended period of time.

d. A tank is assumed to have collected liquid waste based on operation at 100-percent power with 1 percent failed fuel for an extended period of time, which is eight times higher than under normal operating conditions.

15.7-7 Rev. OL-22 11/16

CALLAWAY - SP 15.7.2.5.3 Conclusions 15.7.2.5.3.1 Filter Loadings The filter loading due to a liquid radwaste tank rupture does not establish the necessary design margin for the control room intake filters. Thus, the filter loading was not evaluated.

15.7.2.5.3.2 Doses to Receptor at the Exclusion Area Boundary and the Low-Population Zone Outer Boundary The radiological consequences resulting from the occurrence of a postulated liquid radwaste tank rupture have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body dose due to immersion and the thyroid dose due to inhalation have been analyzed for the 0-2-hour dose at the exclusion area boundary and for the duration of the accident at the low-population zone outer boundary. The results are listed in Table 15.7-6. The resultant dose is well within the guideline values of 10 CFR 100.

15.7.3 POSTULATED RADIOACTIVE RELEASE DUE TO LIQUID TANK FAILURES This analysis is presented in Section 2.4.13 of the Site Addendum.

15.7.4 FUEL HANDLING ACCIDENTS The postulated fuel handling accident has been analyzed for two cases: Case 1, a fuel handling accident outside the containment, and Case 2, a fuel handling accident inside the reactor building.

15.7.4.1 Identification of Causes and Accident Description The accident is defined as the dropping of a spent fuel assembly onto the fuel storage area floor, refueling pool floor, or cask loading pool, resulting in the rupture of the cladding of all the fuel rods in the assembly despite many administrative controls and physical limitations imposed on fuel handling operations. All refueling operations are conducted in accordance with prescribed procedures.

The probability of a fuel handling accident in the Fuel Building as a result of dropping a HI-TRAC VW transfer cask with a loaded MPC or other heavy load from the single failure proof Cask Handling Crane is sufficiently small that it is not a credible event, and therefore does not require analysis. The Cask Handling Crane used for dry cask storage handling in the Fuel Building meets the applicable criteria of NUREG-0554, Single-Failure-Proof Cranes for Nuclear Power Plants, and NUREG-0612, Control of Heavy Loads at Nuclear Power Plants, for single failure proof handling systems. Transport of 15.7-8 Rev. OL-22 11/16

CALLAWAY - SP loaded HI-TRAC VW transfer casks to the ISFSI pad is performed within the bounds of the 10 CFR 72.212 Evaluation Report and the HI-STORM UMAX FSAR.

15.7.4.2 Sequence of Events and Systems Operations The first step in fuel handling is the safe shutdown of the reactor. After a radiation survey of the containment, the disassembly of the reactor vessel is started. After disassembly is complete, the first fuel handling is started. It is estimated that the earliest time to first fuel transfer after shutdown is 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br />.

The fuel handling accident is assumed to occur after a fuel assembly has been transferred through the fuel storage pool transfer gate but before it has been placed in its designated location in the fuel storage racks.

15.7.4.3 Core and System Performance The fuel handling accident in the fuel building does not impact the integrity of the core or its system performance.

15.7.4.4 Barrier Performance A barrier between the released activity and the environment is the reactor building and the fuel building. Since these buildings are designed seismic Category I, it is safe to assume that during the course of a fuel handling accident their integrity is maintained.

This means that the pathway for release of radioactivity for a postulated accident in the fuel building is initially via the auxiliary/fuel building normal exhaust system. After it is isolated on a high radiation signal, the release pathway is via the ESF emergency filtration system. For a postulated accident in the reactor building, the release consists of the total amount of radioactivity which could potentially be released. The fuel storage pool and the refueling pool provide minimum decontamination factors of 100 for iodine.

15.7.4.5 Radiological Consequences 15.7.4.5.1 Method of Analysis 15.7.4.5.1.1 Physical Model The possibility of a fuel-handling accident is remote because of the many administrative controls and physical limitations imposed on the fuel-handling operations (refer to Section 9.1.4). All refueling operations are conducted in accordance with prescribed procedures.

When transferring irradiated fuel from the core to the fuel storage pool for storage, the reactor cavity and refueling pool are filled with borated water at a boron concentration equal to that in the fuel storage pool, which ensures subcritical conditions in the core even if all rod cluster control (RCC) assemblies were withdrawn. After the reactor head 15.7-9 Rev. OL-22 11/16

CALLAWAY - SP and rod cluster control drive shafts are removed, fuel assemblies are lifted from the core, transferred vertically to the refueling pool, placed horizontally in a conveyor car and pulled through the transfer tube and canal, upended and transferred through the fuel storage pool transfer gate, then lowered into steel racks for storage in the fuel storage pool in a pattern which precludes any possibility of a criticality accident.

The irradiated fuel assemblies may be transferred into the new fuel elevator basket located on the cask loading pit for reconstitution or other fuel repair activities. After the reconstitution or repair is completed, the fuel assemblies are returned to the fuel storage pool storage racks.

Fuel-handling manipulators and hoists are designed so that the fuel cannot be raised above a position that provides an adequate water shield depth for radiation protection of operating personnel.

The containment, fuel building, refueling cavity, refueling pool, and fuel storage pool are designed to seismic Category I requirements, which prevent the structures themselves from failing in the event of a safe shutdown earthquake. The fuel storage racks are also designed to prevent any credible external missile from reaching the stored irradiated fuel.

The fuel-handling manipulators, cranes, trollies, bridges, and associated equipment above the water cavities through which the fuel assemblies move are designed to prevent this equipment from generating missiles and damaging the fuel. The construction of the fuel assemblies precludes damage to the fuel should portable or hand tools drop on an assembly.

A fuel-handling accident could occur during the transfer of a fuel assembly from the core to its storage position in the fuel storage pool. Also, such an accident could occur during handling of an irradiated fuel assembly associated with reconstitution or other fuel repair activities. The facility and handling equipment are designed so that heavy objects, such as the spent fuel cask, cannot be carried over or tipped over onto the irradiated fuel stored in the fuel storage pool. Only one fuel assembly can be handled at a time.

Movement of equipment handling the fuel is kept at low speeds while exercising caution that the fuel assembly does not strike another object or structure during transfer from the core to its storage position. In the unlikely event that an assembly becomes stuck in the transfer tube, natural convection will maintain adequate cooling.

a. Reactor Building Accident During fuel-handling operations, the containment is kept in an isolatable condition, with the personnel air lock, the emergency air lock, and the containment hatch and penetrations with direct access to the outside atmosphere either closed or capable of being closed. Containment isolation may be initiated either by manual action or on automatic signal from one of the redundant radation monitors, indicating that radioactivity is above the prescribed limits. Personnel air lock doors, emergency air lock doors, and the containment equipment hatch may be open under 15.7-10 Rev. OL-22 11/16

CALLAWAY - SP administrative controls during core alterations or during the movement of irradiated fuel within containment. After an event, the doors are promptly closed. The accident analysis assumes that a direct pathway exists between contaiment and the outside atmosphere for the entire duration of the post-accident release.

In addition to the area radiation monitors in the containment, portable monitors capable of sounding audible alarms are to be located in the fuel-handling area. Should a fuel assembly be dropped and release activity above a prescribed level, the radiation monitors would sound an audible alarm, personnel would be evacuated and the containment would be isolated. The purge and vent lines are closed on a containment isolation signal, thus minimizing the escape of any radioactivity. The containment purge isolation signal may be initiated by manual action.

b. Fuel Building Accident In the fuel building, a fuel assembly could be dropped in the transfer canal, in the fuel storage pool or in the cask loading pool.

In addition to the area radiation monitors located on the wall around the fuel storage pool, portable radiation monitors capable of emitting audible alarms are located in this area during fuel-handling operations. The doors in the fuel building are closed to maintain controlled leakage characteristics in the fuel storage pool region during operations involving irradiated fuel.

Should a fuel assembly be dropped in the canal, in the cask loading pit, or in the pool and release radioactivity above a prescribed level, the radiation monitors sound an audible alarm.

If one of the redundant discharge vent radiation monitors, GG-RE-27 or 28, indicates that the radioactivity in the vent discharge is greater than the prescribed levels, an alarm sounds and the auxiliary/fuel building normal exhaust is switched to the ESF emergency exhaust system to allow the spent fuel pool ventilation to exhaust through the ESF charcoal filters to remove most of the halogens prior to discharging to the atmosphere via the unit vent. The supply ventilation system servicing the spent fuel pool area is automatically shut down, thus ensuring controlled leakage to the atmosphere through charcoal adsorbers (refer to Section 9.4.2).

The probability of a fuel-handling accident is very low because of the safety features, administrative controls, and design characteristics of the facility, as previously mentioned.

15.7-11 Rev. OL-22 11/16

CALLAWAY - SP 15.7.4.5.1.2 Assumptions and Conditions The major assumptions and parameters assumed in the analysis are itemized in Tables 15.7-7 and 15A-1.

In the evaluation of the fuel-handling accident, all the fission product release assumptions of Regulatory Guide 1.25 have been followed. Table 15.7-2 provides a comparison of the design to the requirements of Regulatory Guide 1.25. The following assumptions, related to the release of fission product gases from the damaged fuel assembly, were used in the analyses:

a. The dropped fuel assembly is assumed to be the assembly containing the peak fission product inventory. All the fuel rods contained in the dropped assembly are assumed to be damaged. In addition, for the analyses for the accident in the reactor building the dropped assembly is assumed to damage 20 percent of the rods of an additional assembly.

b. The assembly fission product inventories are based on a radial peaking factor of 1.65.

c. The accident occurs 72 hours8.333333e-4 days <br />0.02 hours <br />1.190476e-4 weeks <br />2.7396e-5 months <br /> after shutdown, which is the earliest time fuel-handling operations can begin. Radioactive decay of the fission product inventories was taken into account during this time period.

d. Only that fraction of the fission products which migrates from the fuel matrix to the gap and plenum regions during normal operation was assumed to be available for immediate release to the water following clad damage.

e. The gap activity released to the fuel pool from the damaged fuel rods consists of 10 percent of the total noble gases other than Kr-85, 30 percent of the Kr-85, and 10 percent of the total radioactive iodine contained in the fuel rods at the time of the accident.

f. The pool decontamination factor is 1.0 for noble gases.

g. The effective pool decontamination factor is 100 for iodine.

h. The iodine above the fuel pool is assumed to be composed of 75 percent inorganic and 25 percent organic species.

i. The activity which escapes from the pool is assumed to be available for release to the environment in a time period of 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

j. No credit for decay or depletion during transit to the site boundary and outer boundary of the low-population zone is assumed.

15.7-12 Rev. OL-22 11/16

CALLAWAY - SP

k. No credit is taken for mixing or holdup in the fuel building atmosphere. The filter efficiency for the ESF emergency filtration system is assumed to be 90 percent for all species of iodine.

l. The fuel building is switched from the auxiliary/fuel building normal exhaust system to the ESF emergency exhaust system within 90 seconds from the time the activity reaches the exhaust duct. The activity released before completion of the switchover is assumed to be discharged directly to the environment with no credit for filtration or dilution. Even if fuel building ventilation isolation does not occur automatically, the calculated doses will be less than those reported in Table 15.7-8 for the bounding case, inside the reactor building. Response time testing is required per Technical Specification 3.3.8 for the fuel building ventilation isolation function.

m. For the inside the reactor building case, no credit has been taken for the mixing or holdup of the radioactivity in the reactor building atmosphere. It is assumed that no containment coolers or hydrogen mixing fans are operating.

n. All gap activity assumed available for release is assumed to be released over two hours.

15.7.4.5.1.3 Mathematical Models Used in the Analysis Mathematical models used in the analysis are described in the following sections:

a. The mathematical models used to analyze the activity released during the course of the accident are described in Appendix 15A, Section 15A.2.

b. The atmospheric dispersion factors are calculated, based on the onsite meteorological measurements programs described in Section 2.3 of the Site Addendum, and are provided in Table 15A-2.

c. The thyroid inhalation and total-body immersion doses to a receptor located at the exclusion area boundary and outer boundary of the low population zone are described in Appendix 15A, Sections 15A.2.4 and 15A.2.5, respectively.

15.7.4.5.1.4 Identification of Leakage Pathways and Resultant Leakage Activity For evaluating the radiological consequences due to the postulated fuel-handling accident, the resultant activity is conservatively assumed to be released to the environment during the 0-2-hour period immediately following the occurrence of the accident. This is a considerably higher release rate than that based on the actual ventilation rate. Therefore, the results of the analysis are based on the most conservative pathway available.

15.7-13 Rev. OL-22 11/16

CALLAWAY - SP 15.7.4.5.2 Identification of Uncertainties and Conservatisms in Analysis The uncertainties and conservatisms in the assumptions used to evaluate the radiological consequences of a fuel-handling accident result from assumptions made involving the amount of fission product gases available for release to the environment and the meteorology present at the site during the course of the accident. The most significant of these assumptions are:

a. It is assumed in the analysis that all the fuel rods in the dropped assembly are damaged. This is a highly conservative assumption since, transferring fuel under strict fuel handling procedures, only under the worst possible circumstances could the dropping of a spent fuel assembly result in damage to all the fuel rods contained in the assembly.

b. The fission product gap inventory in a fuel assembly is dependent on the power rating of the assembly and the temperature of the fuel. It has been conservatively assumed that the core has been operating at 100 percent for the entire burnup period. The gap activities are listed in Table 15A-3.

c. Iodine removal from the released fission product gas takes place as the gas rises to the pool surface through the body of liquid in the spent fuel pool. The extent of iodine removal is determined by mass transfer from the gas phase to the surrounding liquid and is controlled by the bubble diameter and contact time of the bubble in the solution. The values used in the analysis result in a release of activity approximately a factor of 5 greater than anticipated. The release of activity from the pool to the containment atmosphere is time-dependent and consequently there would be sufficient time for this activity to mix homogeneously in a significant percent of the containment volume.

d. The ESF emergency filtration system charcoal filters are known to operate with at least a 99-percent efficiency. This means a further reduction in the iodine concentrations and thus a reduction in the thyroid doses at the exclusion area boundary and the outer boundary of the low-population zone.

e. The meteorological conditions which may be present at the site during the course of the accident are uncertain. However, it is highly unlikely that meteorological conditions assumed will be present during the course of the accident for any extended period of time. Therefore, the radiological consequences evaluated, based on the meteorological conditions assumed, are conservative.

15.7-14 Rev. OL-22 11/16

CALLAWAY - SP 15.7.4.5.2.1 Filter Loadings The ESF filtration systems which function to limit the consequences of a fuel-handling accident in the fuel building are the ESF emergency filtration system and the control room filtration system.

The activity loadings on the control room charcoal adsorbers as a function of time have been evaluated for the loss-of-coolant accident, Section 15.6.5. Since these filters are capable of accommodating the design basis LOCA fission product iodine loadings, more than adequate design margin is available with respect to postulated fuel-handling accident releases.

The activity loadings on the ESF filtration system charcoal adsorbers have been evaluated in accordance with Regulatory Guide 1.52, which limits the maximum loading to 2.5 mg of iodine per gram of activated charcoal.

15.7.4.5.2.2 Doses to Receptor at the Exclusion Area Boundary and Low-Population Zone Outer Boundary The potential radiological consequences resulting from the occurrence of a postulated fuel-handling accident occurring in the fuel building and in the reactor building have been conservatively analyzed, using assumptions and models described in previous sections.

The total-body dose due to immersion from direct radiation and the thyroid dose due to inhalation have been analyzed for the 0-2-hour dose at the exclusion area boundary and for the duration of the accident (0 to 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />) at the low-population zone outer boundary.

The results are listed in Table 15.7-8. The resultant doses are well within the guideline values of 10 CFR 100.

15.7-15 Rev. OL-22 11/16

CALLAWAY - SP TABLE 15.7-1 DESIGN COMPARISON TO THE REGULATORY POSITIONS OF REGULATORY GUIDE 1.24 ASSUMPTIONS USED FOR EVALUATING THE POTENTIAL CONSEQUENCES OF A PRESSURIZED WATER REACTOR RADIOACTIVE GAS STORAGE TANK FAILURE REVISION 0, DATED MARCH 23, 1972 Regulatory Guide 1.24 Position Design

1. The assumptions related to the release of radioactive gases from the postulated failure of a gaseous waste storage tank are:

a. The reactor has been operating at full 1.a. Complies.

power with one percent defective fuel and a shutdown to cold condition has been conducted near the end of an equilibrium core cycle. As soon as possible after shutdown, all noble gases have been removed from the primary cooling system and transferred to the gas decay tank that is assumed to fail.

b. The maximum content of the decay tank 1.b. Complies.

assumed to fail should be used for the purpose of computing the noble gas inventory in the tank. Radiological decay may be taken into account in the computation only for the minimum time period required to transfer the gases from the primary system to the decay tank.

c. The failure is assumed to occur 1.c. Complies.

immediately upon completion of the waste gas transfer, releasing the entire contents of the tank to the building. The assumption of the release of the noble gas inventory from only a single tank is based on the premise that all gas decay tanks will be isolated from each other whenever they are in use.

d. All of the noble gases are assumed to 1.d. Complies.

leak out of the building at ground level over a 2-hour time period.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-1 (Sheet 2)

Regulatory Guide 1.24 Position Design

2. The atmospheric diffusion assumptions for 2. Short-term atmospheric ground level releases are: dispersion factors corresponding to a ground

a. The basic equation for atmospheric level release and accident diffusion from a ground level point conditions were calculated source is: based on onsite meteorological measurement 1 programs described in

/Q = -------------------

u y z Section 2.3 of the Site Addendum. The dispersion factors are in compliance with Where:

the methodology described in Regulatory Guide 1.XXX (see

= the short term average Site Addendum Section centerline value of the ground 2.3.4.2.1) and represent the level concentration (curies/m3) worst of the 5 percent overall site meteorology and the 0.5 Q = amount of material released percent worst sector (curies/sec) meteorology.

u = windspeed (meters/sec) y = the horizontal standard deviation of the plume (meters)

[See Figure V-1, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric dispersion," F.A.

Gifford, Jr.]

z = the vertical standard deviation of the plume (meters) [See Figure V-2, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A. Gifford, Jr.]

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-1 (Sheet 3)

Regulatory Guide 1.24 Position Design

b. For ground level releases, atmospheric diffusion factors1 used in evaluating the radiological consequences of the accident addressed in this guide are based on the following assumptions:

(1) windspeed of 1 meter/sec; (2) uniform wind direction (3) Pasquill diffusion category F.

c. Figure 1 is a plot of atmospheric diffusion factors (/Q) versus distance derived by use of the equation for a ground level release given in regulatory position 2.a. above under the meteorological conditions given in regulatory position 2.b. above.

3. The following assumptions and equations 3. Dose factors given in may be used to obtain conservative Regulatory Guide 1.109 for approximations of external whole body noble gases and iodine dose from radioactive clouds: thyroid dose factors; iodine whole body dose factors were

a. External whole body doses are calculated with 5 cm body calculated using "Infinite Cloud" tissue attenuation; see Table assumptions, i.e., the dimensions of the 15A-4.

cloud are assumed to be large compared to the distances that the gamma rays and beta particles travel.

The dose at any distance from the reactor is calculated based on the maximum ground level concentration at that distance.

For an infinite uniform cloud containing curies of beta radioactivity per cubic meter, the beta dose rate in air at the cloud center is: 2

' = 0.457 E D

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-1 (Sheet 4)

Regulatory Guide 1.24 Position Design Where:

' = beta dose rate from an infinite D

cloud (rad/sec)

E = average beta energy per disintegration (Mev/dis)

= concentration of beta or gamma emitting isotope in the cloud (curie/m3)

Because of the limited range of beta particles in tissue, the surface body dose rate from beta emitters in the infinite cloud can be approximated as being one-half this amount or:

' = 0.23 E D

For gamma emitting material the dose rate in air at the cloud center is:

' = 0.507 E D

Where:

' =

D gamma dose rate from an infinite cloud (rad/sec)

E = average gamma energy per disintegration (Mev/dis)

However, because of the presence of the ground, the receptor is assumed to be exposed to only one-half of the cloud (semi-infinite) and the equation becomes:

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-1 (Sheet 5)

Regulatory Guide 1.24 Position Design D' = 0.25 E Thus, the total beta or gamma dose to an individual located at the center of the cloud path may be approximated as:

D = 0.23 E c or D = 0.25 E c Where is the concentration time integral for the cloud (curie sec/m3).

b. The beta and gamma energies emitted per disintegration, as given in Table of Isotopes,3 are averaged and used according to the methods described in ICRP Publication 2.

1 These diffusion factors should be used until adequate site meteorological data are ob-tained. In some cases, available information on such site conditions as meteorology, topog-raphy and geographical location may dictate the use of more restrictive parameters to in-sure a conservative estimate of potential off-site exposures.

2 Meteorology and Atomic Energy - 1968, Chap-ter 7.

3 C. M. Lederer, J. M. Hollander, and I. Perlman, Table of Isotopes, Sixth Edition (New York:

John Wiley and Sons, Inc., 1967).

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-2 DESIGN COMPARISON TO THE REGULATORY POSITIONS OF REGULATORY GUIDE 1.25 ASSUMPTIONS USED FOR EVALUATING THE POTENTIAL RADIOLOGICAL CONSEQUENCES OF A FUEL HANDLING ACCIDENT IN THE FUEL HANDLING AND STORAGE FACILITY FOR BOILING AND PRESSURIZED WATER REACTORS REVISION 0, DATED MARCH 23, 1972 Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

1. The assumptions1 related to the release of radioactive material from the fuel and fuel storage facility as a result of a fuel handling accident are:

a. The accident occurs at a time after shutdown identified in the Complies, except the time after shutdown is Complies, except the time after shutdown is technical specifications as the earliest time fuel handling identified in Section 16.9.5. Accident occurs 72 identified in Section 16.9.5. Accident occurs 72 operations may begin. Radioactive decay of the fission hours after shutdown. hours after shutdown product inventory during the interval between shutdown and commencement of fuel handling operations is taken into consideration.

b. The maximum fuel rod pressurization2 is 1200 psig. Calculations performed as directed by footnote 2 Calculations performed as directed by footnote 2 indicate that the assumed pool water indicate that the assumed pool water decontamination factor is valid for internal decontamination factor is valid for internal pressures up to 1500 psig. pressures up to 1500 psig.

c. The minimum water depth2 between the top of the damaged Complies. Water depth is greater than 23 feet. Complies. Water depth is greater than 23 feet.

fuel rods and the fuel pool surface is 23 feet. The release point is assumed to be at the top of the The release point is assumed to be at the top of the fuel pool storage racks. reactor vessel flange.

d. All of the gap activity in the damaged rods is released and Complies. Complies.

consists of 10% of the total noble gases other than Kr-85, 30% of the Kr-85, and 10% of the total radioactive iodine in the rods at the time of the accident. For the purpose of sizing filters for the fuel handling accident addressed in this guide, 30% of the I-127 and I-129 inventory is assumed to be released from the damaged rods.

e. The values assumed for individual fission product inventories Complies. A peaking factor of 1.65 is used. Complies. A peaking factor is 1.65 is used.

are calculated assuming full power operation at the end of core life immediately preceding shutdown and such calculation should include an appropriate radial peaking factor. The minimum acceptable radial peaking factors are 1.5 for BWR's and 1.65 for PWR's.

f. The iodine gap inventory is composed of inorganic species Complies. Complies.

(99.75%) and organic species (.25%).

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 2)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

g. The pool decontamination factors for the inorganic and Complies. Complies.

organic species are 133 and 1, respectively, giving an overall effective decontamination factor of 100 (i.e., 99% of the total iodine released from the damaged rods is retained by the pool water). This difference in decontamination factors for inorganic and organic iodine species results in the iodine above the fuel pool being composed of 75% inorganic and 25% organic species.

h. The retention of noble gases in the pool is negligible (i.e., Complies. A decontamination factor of 1 is used. Complies. A decontamination factor of 1 is used.

decontamination factor of 1).

i. The radioactive material that escapes from the pool to the Complies. A 0-2 hour release from the pool to the Complies. A 0-2 hour release from the pool to the building is released from the building3 over a 2-hour time building to the environment is assumed. building to the environment is assumed.

period.

j. If it can be shown that the building atmosphere is exhausted Not applicable; complies with Regulatory Guide No credit is taken for the normal purge filters.

through adsorbers designed to remove iodine, the removal 1.52 as described in Table 9.4-2.

efficiency is 90% for inorganic species and 70% for organic species.4

k. The effluent from the filter system passes directly to the Complies. Complies.

emergency exhaust system without mixing5 in the surrounding building atmosphere and is then released (as an elevated plume for those facilities with stacks6).

2. The assumptions for atmospheric diffusion are: Short-term atmospheric dispersion factors corresponding to ground level release and accident conditions were based on meteorological measurement programs described in Section 2.3 of the Site Addendum.

a. Ground Level Releases The dispersion factors are in compliance with the methodology described in Regulatory Guide 1.XXX (see Site Addendum Section 2.3.4.2.1) and represent the worst of the 5 percent overall site meteorology and (1) The basic equation for atmospheric diffusion from a the 0.5 percent worst sector meteorology.

ground level point source is:

1

/Q = -------------------

u z Where:

= the short term average centerline value of the ground level concentration (curies/m3)

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 3)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

Q = amount of material released (curies/sec) u = windspeed (meters/sec) y = the horizontal standard deviation of the plume (meters) [See Figure V-1, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A.

Gifford, Jr.]

z = the vertical standard deviation of the plume (meters) [See Figure V-2, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A.

Gifford, Jr.]

(2) For ground level releases, atmospheric diffusion factors7 used in evaluating the radiological consequences of the accident addressed in this guide are based on the following assumptions:

(a) windspeed of 1 meter/sec; (b) uniform wind direction; (c) Pasquill diffusion category F.

(3) Figure 1 is a plot of atmospheric diffusion factors (/Q) versus distance derived by use of the equation for a ground level release given in regulatory position 2.a.(1) and under the meteorological conditions given in regulatory position 2.a.(2).

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 4)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

(4) Atmospheric diffusion factors for ground level releases may be reduced by a factor ranging from one to a maximum of three (see Figure 2) for additional dispersion produced by the turbulent wake of the reactor building. The volumetric building wake correction as defined in Subdivision 3-3.5.2 of Meteorology and Atomic Energy-1968, is used with a shape factor of 1/2 and the minimum cross-sectional area of the reactor building only.

b. Elevated Releases (1) The basic equation for atmospheric diffusion from an Not applicable. Ground level releases were Not applicable. Ground level releases were elevated release is: assumed. assumed.

2 e - h /2 z 2

/Q = ------------------------

u y z Where:

= the short term average centerline value of the ground level concentration (curies/m3)

Q = amount of material released (curies/sec) u = windspeed (meters/sec) y = the horizontal standard deviation of the plume (meters) [See Figure V-1, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, "Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A.

Gifford, Jr.]

z = the vertical standard deviation of the plume (meters) [See Figure V-2, Page 48, Nuclear Safety, June 1961, Volume 2, Number 4, Use of Routine Meteorological Observations for Estimating Atmospheric Dispersion," F. A.

Gifford, Jr.]

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 5)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building) h = effective height of release (meters)

(2) For elevated release; atmospheric diffusion factors7 used in evaluating the radiological consequences of the accident addressed in this guide are based on the following assumptions:

(a) windspeed of 1 meter/sec; (b) uniform wind direction; (c) envelope of Pasquill diffusion categories for various release heights; (d) a fumigation condition exists at the time of the accident.8 (3) Figure 3 is a plot of atmospheric diffusion factors versus distance for an elevated release assuming no fumigation, and Figure 4 is for an elevated release with fumigation.

(4) Elevated releases are considered to be at a height equal to no more than the actual stack height. Certain site conditions may exist, such as surrounding elevated topography or nearby structures, which will have the effect of reducing the effective stack height. The degree of stack height reduction will be evaluated on an individual case basis.

3. The following assumptions and equations may be used to obtain conservative approximations of thyroid dose from the inhalation of radioiodine and external whole body dose from radioactive clouds:

a. The assumptions relative to inhalation thyroid dose Complies. See Appendix 15A, Section 15A.2.4. Complies. See Appendix 15A, Section 15A.2.4.

approximations are:

(1) The receptor is located at a point on or beyond the site boundary where the maximum ground level concentration is expected to occur.

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 6)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

(2) No correction is made for depletion of the effluent plume of radioiodine due to deposition on the ground, or for the radiological decay of radioiodine in transit.

(3) Inhalation thyroid doses may be approximated by use of the following equation:

F g IFPBR ( /Q )

D = -----------------------------------------

( DF p ) ( DF f )

Where:

D = thyroid dose (rads)

Fg = fraction of fuel rod iodine inventory in fuel rod void space (0.1)

I = core iodine inventory at time of accident (curies)

F = fraction of core damaged so as to release void space iodine P = fuel peaking factor B = Breathing rate = 3.47 x 10-4 cubic meters per second (i.e., 10 cubic meters per 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> work day as recommended by the ICRP)

DFp = effective iodine decontamination factor for pool water DFf = effective iodine decontamination factor for filters (if present)

/Q = atmospheric diffusion factor at receptor location (sec/m)

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 7)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

R = adult thyroid dose conversion factor for the iodine isotope of interest (rads per curie). Dose conversion factors for Iodine 131-135 are listed in Table I.9 These values were derived from "standard man" parameters recommended in ICRP Publication 2.10 TABLE 1 Adult Inhalation Thyroid Dose Conversion Factors Table 1; the thyroid dose conversion factors given Table 1; the thyroid dose conversion factors given in ICRP-30 are used. See Table 15A-4. in ICRP-30 are used. See Table 15A-4.

Iodine Conversion Factor (R)

Isotope (Rads/curie inhaled) 131 1.48 x 106 132 5.35 x 104 133 4.0 x 105 134 2.5 x 104 135 1.24 x 105

b. The assumptions relative to external whole body dose Complies. See Appendix 15A, Section 15A.2.5. Complies. See Appendix 15A, Section 15A.2.5.

approximations are:

(1) The receptor is located at a point on or beyond the site boundary where the maximum ground level concentration is expected to occur.

(2) External whole body doses are calculated using "Infinite (2) See Table 15A-4 for whole body dose conversion factors from Federal Guidance Report 12.

Cloud" assumptions, i.e., the dimensions of the cloud are assumed to be large compared to the distance that the gamma rays and beta particles travel. The dose at any distance from the reactor is calculated based on the maximum ground level concentration at that distance.

For an infinite uniform cloud containing curies of beta radioactivity per cubic meter, the beta dose rate in air at the cloud center is:11 Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 8)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

' = 0.457 E D

Where:

D = beta dose rate from an infinite cloud (rad/sec)

E = average beta energy per disintegration (Mev/dis)

= concentration of beta or gamma emitting isotope in the cloud (curie/m3)

Because of the limited range of beta particles in tissue, the surface body dose rate from beta emitters in the infinite cloud can be approximated as being one-half this amount or:

' = 0.23 E D

For gamma emitting material the dose rate in tissue at the cloud center is:

' = 0.507 E D

Where:

D = gamma dose rate from an infinite cloud (rad/sec)

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 9)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

E = average gamma energy per disintegration (MEV/dis)

However, because of the presence of the ground, the receptor is assumed to be exposed to only one-half of the cloud (semi-infinite) and the equation becomes:

D' = 0.25 E Thus, the total beta or gamma dose to an individual located at the center of the cloud path may be approximated as:

D = 0.23 E or D = 0.25 E Where is the concentration time integral for the cloud (curie sec/m3)

(3) The beta and gamma energies emitted per disintegration, as given in Table of Isotopes,12 are averaged and used according to the methods described in ICRP Publication 2.

Notes:

1. The assumptions given are valid only for oxide fuels of the types currently in use and in cases where the following conditions are not exceeded:

a. Peak linear power density of 20.5 kW/ft for the highest power assembly discharged.

b. Maximum center-line operating fuel temperature less than 4500°F for this assembly.

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 10)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

c. Average burnup for the peak assembly of 25,000 MWD/ton Gap fractions of 10% remain valid for fuel Gap fractions of 10% remain valid for fuel or less (this corresponds to a peak local burnup of about assemblies up to 33,000 MWD/MTU. Beyond this assemblies up to 33,000 MWD/MTU. Beyond this 45,000 MWD/ton). burnup, a 12% gap fraction will be used. burnup, a 12% gap fraction will be used.

2. For release pressures greater than 1200 psig and water depths less than 23 feet, the iodine decontamination factors will be less than those assumed in this guide and must be calculated on an individual case basis using assumptions comparable to conservatism to those of this guide.

3. The effectiveness of features provided to reduce the amount of radioactive material available for release to the environment will be evaluated on an individual case basis.

4. These efficiencies are based upon a 2-inch charcoal bed depth with 1/4 second residence time. Efficiencies may be different for other systems and must be calculated on an individual case basis.

5. Credit for mixing will be allowed in some cases; the amount of credit will be evaluated on an individual case basis.

6. Credit for an elevated release will be given only if the point of release is (a) more than two and one-half times the height of any structure close enough to affect the dispersion of the plume or (b) located far enough from any structure which could affect the dispersion of the plume. For those plants without stacks the atmospheric diffusion factors assuming ground level release given in regulatory position 2.b. should be used.

7. These diffusion factors should be used until adequate site meteorological data are obtained. In some cases, available information on such site conditions as meteorology, topography and geographical location may dictate the use of more restrictive parameters to ensure a conservative estimate of potential offsite exposures.

8. For sites located more than 2 miles from large bodies of water such as oceans or one of the Great Lakes, a fumigation condition is assumed to exist at the time of the accident and continue for 1/2 hour. For sites located less than 2 miles from large bodies of water a fumigation condition is assumed to exist at the time of accident and continue for the duration of the release (2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />).

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-2 (Sheet 11)

Regulatory Guide 1.25 Position Case 1 (in Fuel Building) Case 2 (in Reactor Building)

9. Dose conversion factors taken from "Calculation of Distance Factors for Power and Test Reactor Sites," TID-14844, J. J.

DiNunno, R. E. Baker, F. D. Anderson, and R. L. Waterfield (1962).

10. Recommendations of the International Commission on Radiological Protection, "Report of Committee II on Permissible Dose for Internal Radiation (1959)," ICRP Publication 2, (New York: Permagon Press, 1960).

11. Meteorology and Atomic Energy-1968, Chapter 7.

12. C. M. Lederer, J. M. Hollander, and I. Perlman, Table of Isotopes, Sixth Edition (New York: John Wiley and Sons, Inc. 1967).

Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-3 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A WASTE GAS DECAY TANK RUPTURE I. Source Data

a. Core power level, MWt 3,636

b. Failed fuel, percent 1 II. Atmospheric Dispersion Factors See Table 15A-2 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-4 RADIALOGICAL CONSEQUENCES OF A WASTE GAS DECAY TANK RUPTURE Doses (rem)

Exclusion Area Boundary (0-2 hr)

Thyroid 8.85E-2 Whole body 3.29E-2 Low Population Zone Outer Boundary (duration)

Thyroid 1.16E-2 Whole body 4.28E-3 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-5 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A LIQUID RADWASTE TANK FAILURE I. Source Data

a. Core power level, MWt 3,636

b. Failed fuel, percent 1 II. Atmospheric Dispersion Factors See Table 15A-2 III. Activity Release Data

a. Noble gas activity, percent of tank contents 100

b. Iodine gas activity, percent of tank contents 1

c. Tank contents subject to release

1. Boron recycle holdup tank Table 15A-5

2. Primary evaporator bottoms tank Table 15A-5 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15.7-6 RADIOLOGICAL CONSEQUENCES OF A LIQUID RADWASTE TANK FAILURE Doses (rem)

Boron Recycle Tank Exclusion Area Boundary (0-2 hr)

Thyroid 4.25E-2 Whole-body 5.10E-3 Low Population Zone Outer Boundary (duration)

Thyroid 5.56E-3 Whole-body 6.65E-4 Primary Evaporator Bottoms Tank Exclusion Area Boundary (0-2 hr)

Thyroid 2.63E-1 Whole-body 6.11E-5 Low Population Zone Outer Boundary (duration)

Thyroid 3.47E-2 Whole-body 8.09E-6 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15.7-7 PARAMETERS USED IN EVALUATING THE RADIOLOGICAL CONSEQUENCES OF A FUEL-HANDLING ACCIDENT In Fuel Building In Reactor Building I. Source Data

a. Core power level, MWt 3,636 3,636

b. Radial peaking factor 1.65 1.65

c. Decay time, hours 72 72

d. Number of fuel assemblies 1.0 1.2 affected

e. Fraction of fission product gases contained in the gap region of the fuel assembly Per R.G. 1.25 Per R.G. 1.25 II. Atmospheric Dispersion Factors See Table 15A-2 See Table 15A-2 III. Activity Release Data

a. Percent of affected fuel assemblies gap activity released 100 100

b. Pool decontamination factors

1. Iodine 100 100

2. Noble gas 1 1

c. Filter efficiency, 0 until isolation percent 90 thereafter 0

d. Building mixing volumes assumed, percent of total volume 0 0

e. HVAC exhaust rate, 20,000 until isolation Activity cfm 9,000 thereafter completely released over 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />.

f. Building isolation time, 90 sec 2 hours2.314815e-5 days <br />5.555556e-4 hours <br />3.306878e-6 weeks <br />7.61e-7 months <br />

g. Activity release period, hrs 2 2 Rev. OL-19 5/12

CALLAWAY - SP TABLE 15.7-8 RADIOLOGICAL CONSEQUENCES OF A FUEL HANDLING ACCIDENT Doses (rem)

In Fuel Building Exclusion Area Boundary (0-2 hr)

Thyroid 6.40 Whole-body 0.235 Low Population Zone Outer Boundary (duration)

Thyroid 0.640 Whole-body 0.0235 In Reactor Building Exclusion Area Boundary (0-2 hr)

Thyroid 61.7 Whole-body 0.359 Low Population Zone Outer Boundary (duration)

Thyroid 6.17 Whole-body 0.0359 Rev. OL-19 5/12

CALLAWAY - SP 15.8 ANTICIPATED TRANSIENTS WITHOUT SCRAM In order to address the NRC rulemaking on Anticipated Transients Without Scram (10CFR50.62), Union Electric will:

a. Develop emergency procedures to train operators to recognize ATWS events, including consideration of scram indicators, rod position indicators, flux monitors, pressurizer level and pressure indicators, pressurizer relief valve and safety valve position indicators, and any other alarms annunciated in the control room, with emphasis on alarms not processed through the electrical portion of the reactor scram system.

b. Train operators to take actions in the event of an ATWS, including consideration of manually scramming the reactor by using the manual scram button, prompt actuation of the auxiliary feedwater system to ensure delivery to the full capacity of this system, and initiation of turbine trip. The operators will also be trained to initiate boration by actuating safety injection systems to bring the facility to a safe-shutdown condition.

c. Install an ATWS Mitigating System Actuation Circuitry (AMSAC) in accordance with ULNRC-1472 (3/19/87), ULNRC-1492 (4/15/87), and ULNRC-1639 (10/5/87). NRC approval of the Callaway AMSAC design was given in a letter from T. W. Alexion (NRC) to D. F. Schnell (UE) dated 12/24/87.

15.8-1 Rev. OL-13 5/03

CALLAWAY - SP APPENDIX 15A - ACCIDENT ANALYSIS RADIOLOGICAL CONSEQUENCES EVALUATION MODELS AND PARAMETERS 15A.1 GENERAL ACCIDENT PARAMETERS This section contains the parameters used in analyzing the radiological consequences of postulated accidents. Table 15A-1 contains the general parameters used in all the accident analyses. For parameters specific only to particular accidents, refer to that accident parameter section. The site specific, ground-level release, short-term dispersion factors (for accidents, ground-level releases are assumed) are based on Regulatory Guide 1.XXX (1978) (Ref. 1) methodology and the 0.5 percent worst-sector meteorology and these are given in Table 15A-2 (see Section 2.3.4 and the Site Addendum for additional details on meteorology). The core and gap inventories are given in Table 15A-3. The thyroid (via inhalation pathway), beta skin, and total-body (via submersion pathway) dose factors based on References 2 and 3 are given in Table 15A-4.

15A.2 OFFSITE RADIOLOGICAL CONSEQUENCES CALCULATIONAL MODELS This section presents the models and equations used for calculating the integrated activity released to the environment, the accident flow paths, and the equations for dose calculations. Two major release models are considered: (1) a single holdup system with no internal cleanup and (2) a holdup system wherein a two-region spray model is used for internal cleanup.

15A.2.1 ACCIDENT RELEASE PATHWAYS The release pathways for the major accidents are given in Figure 15A-1. The accidents and their pathways are as follows:

LOCA: Immediately following a postulated loss-of-coolant accident (LOCA), the release of radioactivity from the containment is to the environment with the containment spray and ESF systems in full operation. The release in this case is calculated using equation (12) which takes into account a two-region spray model within the containment. The release of radioactivity to the environment due to assumed ESF system leakages in the auxiliary building will be via ESF filters and is calculated using equation (5), using a factor of 0.01 to account for the combined effect of the airborne fraction of radioiodine and the ESF filter efficiency. The total removal constant, 1, for this release pathway includes decay (1d) and release (1l) removal constants associated with holdup and mixing in the sumps (no holdup or mixing assumed in the auxiliary building); however, no internal removal constant (r) is assumed. The release of radioactivity to the environment due to assumed leakage from the RWST is calculated using equation (5a) 15.A-1 Rev. OL-16 10/07

CALLAWAY - SP from Section 15A.2.2.b. The release of radioactivity to the environment due to the assumed operation of the containment mini-purge system for the first few seconds after a LOCA is calculated using equation (5) from Section 15A.2.2.a, with no credit for filtration, plateout, or valve stroke time.

WGDTR: The activity release to the environment due to waste gas decay tank rupture (WGDTR) will be direct and unfiltered, with no holdup. The release pathway is A'-D. The total activity release in this case is therefore assumed to be the initial source activity itself.

FHA: The release to the environment due to a fuel handling accident (FHA) in the fuel building is via filters. The release pathway is B-C-D. Since the release is calculated without any credit for holdup in the fuel building, the total release will be the product of the initial activity and the filter nonremoval efficiency fraction (for noble gases, the nonremoval efficiency fraction is 1). The release of radioactivity to the environment due to FHA inside the containment is direct and unfiltered, via the A-D pathway without any credit for holdup (see Figure 15A-1). The release is calculated assuming the total gap inventory of 1.2 assemblies is released over a two hour period, reduced only by the pool decontamination factor.

CAE: Radioactivity release to the environment due to the control assembly ejection (CAE) accident is direct and unfiltered. The releases from the primary system are calculated using equation 5 which considers holdup in the single-region primary system (the spray removal is not assumed); the secondary (steam) releases via the relief valves are calculated without any holdup. The pathways for these releases are A-D and A'-D.

MSLB, SGTR: Radioactivity releases to the environment due to main steam line break (MSLB) or steam generator tube rupture (SGTR) accidents are direct and unfiltered with no holdup via the A'-D pathway. The activity release calculations for these accidents are complex, involving spiking effects, time-dependent flashing fractions, and scrubbing of flashed activities; the release calculations are described in those sections that address these accidents.

As used in the radiological consequence evaluations, partition factor refers to the fraction of the total release that is airborne.

15A.2.2.a SINGLE - REGION RELEASE MODEL It is assumed that any activity released to the holdup system instantaneously diffuses to uniformly occupy the system volume.

The following equations are used to calculate the integrated activity released from postulated accidents.

A1(0) = initial source activity at time to, Ci 15.A-2 Rev. OL-16 10/07

CALLAWAY - SP A1(t) = source activity at time t seconds, Ci A1(t) = - 1t (1)

A 1 ( 0 )e where 1 = total removal constant from primary holdup system, sec-1 1 = d + 1 + r (2) where d = decay removal constant, sec-1 1 = primary holdup leak or release rate, sec-1 r = internal removal constant (i.e., sprays, plateout, etc.), sec-1 Thus, the direct release rate to the atmosphere from the primary holdup system Ru(t) = 1A1(t)

Ru(t) = unfiltered release rate (Ci/sec) (3)

The integrated activity release is the integral of the above equation.

t t

-1 t IAR(t) = Ru ( t ) = 1 A1 ( o )e (4) o o This yields:

-1 t IAR(t) = ( 1 A 1 ( o ) 1 ) ( 1 - e ) (5) 15A.2.2.b TWO - REGION RELEASE MODEL FOR DOSES DUE TO LEAKAGE FROM THE ECCS SUMPS TO THE RWST It is assumed that the activity released to the holdup system (in this case, the containment recirculation sumps) instantaneously diffuses to uniformly occupy the sump volume. Removal mechanisms from the sumps include decay and release (i.e., leakage) to the RWST. Expanding upon the equations developed in Section 15A.2.2.a above, the release rate from the RWST to the environment is given by R2(t) = 0.1 2A2(t) (1a) 15.A-3 Rev. OL-16 10/07

CALLAWAY - SP where R2(t) = the unfiltered release rate from the RWST vent, Ci/sec 0.1 = assumed percent of radioiodine released to the RWST that becomes airborne 2 = release rate constant for leakage from the RWST to the environment, based on an assumed 3 gpm leak rate from the sumps that is uniformly mixed in the RWST volume, hr-1 A2(t) = RWST activity, Ci The activity time rate of change for the RWST is given by dA 2 ( t ) (2a)

- = 1 A 1 ( t ) - 2 A 2 ( t )

dt where 1 = release rate constant for leakage from the uniformly mixed sumps to the RWST, based on an assumed 3 gpm leak rate from the sumps to the RWST, hr-1 2 = d + 2 A1(t) = containment sump activity, Ci Using equation (1) from Section 15A.2.2.a above, dA 2 ( t ) - t (3a)

- + 2 A 2 ( t ) = 1 A 1 ( 0 )e 1 dt where A1(0) = initial sump activity, assumed to be 50% of the initial iodine core inventory 1 = d + 1 d = decay removal constant for the sumps, hr-1 The solution of this equation is given by A 1 ( 0 ) 1 - 1 t - t - t (4a)

A 2 ( t ) = ----------------------- [e - e 2 ] + A 2 ( 0 )e 2

( 2 - 1 )

Therefore, the integrated release from the RWST is given by 15.A-4 Rev. OL-16 10/07

CALLAWAY - SP t

IAR 2 ( t ) = R 2 ( t ) dt o

t IAR 2 ( t ) = 0.1 2 A 2 ( t ) dt o

(5a) 0.1A1 ( 0 ) 1 2 - t - t 0.1A 2 ( 0 ) 2 - t

- [ 2 ( 1 - e 1 ) + 1 ( e 2 - 1 ) ] + -------------------------------

IAR 2 ( t ) = ---------------------------------------- - (1 - e 2 )

2 1 ( 2 - 1 ) 2 15A.2.3 TWO - REGION SPRAY MODEL IN CONTAINMENT (LOCA)

A two-region spray model is used to calculate the integrated activity released to the environment. The model consists of a sprayed and unsprayed region in containment and a constant mixing rate between them.

As it is assumed that there are no sources after initial release of the fission products, the remaining processes are removal and transfer so that the multivolume containment is described by a system of coupled first-order differential equations of the form Ki -n-1 n-1 (6) dA i A Ai

---

= - - ij A i - Q i -----i + Q i -----

dt Vi Vi j=1 =1 =1 where Ai = fission product activity in volume i, Ci n = number of volumes considered in the model Qi = transfer rate from volume i to volume , cc/sec Vi = volume of the ith compartment, cc ij = removal rate of the jth removal process in volume i, sec-1 Ki = total number of removal processes in volume i This system of equations is readily solved if the coefficients are known.

15.A-5 Rev. OL-16 10/07

CALLAWAY - SP For a two-region model, the above system reduces to K1 (6a) dA 1 A A

---

= - - 1j A 1 - Q 12 ---- + Q 21 ---- dt V1 V2 j=1 K2 (6b) dA 2 A A

---

= - - 2j A 1 - Q 21 ---- + Q 12 ---- dt V2 V1 j=1 To solve the two preceding equations, use the method of Laplace transforms.

df ( t )

use L ------------ = SF ( s ) - f ( 0 )

dt where f(t) is any regular function of t, L is the symbol of L-transform S is the Laplace variable and F(s) is the Laplace transform of f(t).

The solutions to the equations are:

K1 (7)

Q 21 Q 12 A 2 ( 0 ) --------- - A 1 ( 0 ) 1j + ---------

V2 V1 A1 ( 0 ) S2t S1 t j = 1 St S t A 1 ( t ) = ------------------- ( S 1 e - S 2 e) + -------------------------------------------------------------------------------------- ( e 1 - e 2 )

S1 - S2 S1 - S2 and K2 (8)

Q 12 Q 21 A1( 0 ) ---------

- A 2 ( 0 ) 2i + ---------

V1 V2 A2 ( 0 ) S2t S1 t j = 1 St S t A 2 ( t ) = ------------------- ( S 1 e - S 2 e) + -------------------------------------------------------------------------------------- ( e 1 - e 2 )

S1 - S2 S1 - S2 15.A-6 Rev. OL-16 10/07

CALLAWAY - SP K1 K2 Q 12 Q 21 where, S 1, S 2 = - 1 2 1j + 2j + --------- V1

+ ---------

V2 j=1 j=1 1

K K 2 K K K2 K1 12 (8)

Q 12 Q 21 1 2 2 Q 12 Q 12

+/- 1 2 1j + 2j + ---------- + ---------- - 4 1j + 2j + ----------

V1 V2 V1 2j + ----------

V1 1j j = 1 j=1 j = 1 j=1 j=1 j=1 At time t1 > t0, according to equations (7) and (8):

K1 Q 21 Q 12 A 2 ( t 0 ) --------- - A 1 ( t 0 ) 1j + ---------

V2 V1 j = 1 S (t - t ) S (t - t )

A 1 ( t )1 = ---------------------------------------------------------------------------------------- ( e 1 1 0 - e 2 1 0 )

S1 - S2 A1 ( t0 ) S (t - t ) S (t - t ) (10a)

+ ------------------- ( S 1 e 2 1 0 - S 2 e 1 1 0 )

S1 - S2 Q 12 K2 Q 21 A 1 ( t 0 ) --------- - A 2 ( t 0 ) 2j + ---------

V1 V2 j = 1 S (t - t ) S (t - t )

A 2 ( t )1 = ---------------------------------------------------------------------------------------- ( e 1 1 0 - e 2 1 0 )

S1 - S2 A2 ( t0 ) S (t - t ) S (t - t ) (10b)

+ ------------------- ( S1 e 2 1 0 - S 2 e 1 1 0 )

S1 - S2 Where S1, S2 are given in equation (9).

A(t1) = Activity in the primary containment at any time, t1

= A1(t1) + A2(t1)

= K1 K2 A 1 ( t 0 ) 1j + A 2 ( t 0 ) 2j S 2( t1 - t0 ) S1 ( t1 - t0 )

j=1 j=1 -

---

(e -e )

S1 - S2 15.A-7 Rev. OL-16 10/07

CALLAWAY - SP A 1 ( t 0 ) + A 2 ( t0 ) S (t - t ) S (t - t ) (11)

+ --------------------------------------- ( S 1 e 2 1 0 - S 2 e 1 1 0 )

S1 - S2 To calculate the integrated activity released to the atmosphere we must first calculate the release rate of activity. This is found from R(t) = 1A(t) (11a)

The integrated activity released from time t0 - t1 is then t

IAR = R ( t ) dt t0 This solves as (12) e S2 ( t 1 - t 0 ) - 1 e S1 ( t 1 - t 0 ) - 1 S2 S ( t - t )

IAR = 1 m2 -------------------------------- - -------------------------------- + m3 ------ ( e 1 1 0 - 1 )

S2 S1 S1 where K1 K2 (13a)

A 1 ( t 0 ) 1j + A 2 ( t 0 ) 2i j=1 j=1 -

m2 = ------------------------------------------------------------------------

S1 - S2 and A 1 ( t 0 ) + A 2 ( t0 ) (13b) m3 = ---------------------------------------

S1 - S2 15A.2.4 OFFSITE THYROID DOSE CALCULATION MODEL Offsite thyroid doses are calculated using the equation:

(14)

D TH = DCFThi ( IAR ) ij ( BR ) j ( Q )j i j where (IAR)ij = integrated activity of isotope i released* during the time interval j in Ci 15.A-8 Rev. OL-16 10/07

CALLAWAY - SP and (BR)j = breathing rate during the time interval j in meter3/second

(/Q)j = offsite atmospheric dispersion factor during time interval j in second/meter3 (DCF)Thi = thyroid dose conversion factor via inhalation for isotope i in rem/

Ci DTh = thyroid dose via inhalation in rems

• No credit is taken for cloud depletion by ground deposition and radioactive decay dur-ing transport to the exclusion area boundary or the outer boundary of the low-popula-tion zone.

15A.2.5 OFFSITE TOTAL-BODY DOSE CALCULATIONAL MODEL Assuming a semi-infinite cloud of gamma emitters, offsite total-body doses are calculated using the equation:

D TB = DCFi ( IAR )ij ( Q )j i j where (IAR)ij = integrated activity of isotope i released* during the jth time interval in Ci and (/Q)j = offsite atmospheric dispersion factor during time interval j in second/meter3 (DCF)i = total-body gamma dose conversion factor for the ith isotope in rem-meter3/Ci-sec DTB = total-body dose in rems 15A.3 CONTROL ROOM RADIOLOGICAL CONSEQUENCES CALCULATIONAL MODELS Only radiation doses to a control room operator due to postulated LOCA are presented in this chapter since a study of the radiological consequences in the control room due to various postulated accidents indicate that the LOCA is the limiting case.

15.A-9 Rev. OL-16 10/07

CALLAWAY - SP 15A.3.1 INTEGRATED ACTIVITY IN CONTROL ROOM Make-up air is brought into the control room via the control room filtration system which draws in air from the control building. Outside air is brought into the control building through safety grade filters via the control room pressurization fan. Some unfiltered air also may leak into the control building and control room via an assumed inleakage rate.

Allowable inleakage values for the Control Room and Control Building are dependent upon each other. See Figure 15A-2 for allowable inleakage combinations for the Control Room and Control Building. The activity concentrations at the control building intake for each time interval are found by multiplying the activity release to the environment by the appropriate /Q for that time interval. The flow path model is shown below.

Once activity is brought into the control building, mixing within the control building is afforded by the control room pressurization fan. Only one-half of the control building volume is considered as the mixing volume. The control room filtration system fan takes air from the control building and the control room (recirculation) and discharges to the control room through the control room filtration safety grade filters.

The control room ventilation isolation signal (CRVIS) starts both trains of the control room pressurization system and the control room filtration system. For the determination of doses to control room personnel, the worst single failure has been ascertained to be the failure of the filtration fan in one of the two filtration system trains. Operator action is required to isolate the train with the failed filtration fan. At the same time, one train of the control room pressurization system will also be isolated. Prior to isolation, a potential pathway exists allowing air from the control building to enter the control room, bypassing the control room pressurization fan and one control room filtration fan operate for the duration of the accident. No bypass pathways then exist for unfiltered air to enter the control room.

Owning to this single failure of the control room filtration fan, the assumed failure of one of the two containment spray (CS) trains, and two of the four hydrogen mixing subsystem fans, inherent in the LOCA analysis parameters given in Table 15.6-6 should not be 15.A-10 Rev. OL-16 10/07

CALLAWAY - SP applied in this analysis. With both trains of CS and four hydrogen mixing fans operating, more volumetric coverage of the containment spray and more mixing between the new sprayed and unsprayed regions would be expected, thereby giving much greater iodine removal within the containment atmosphere. However, the doses to control room personnel have been based on the LOCA analysis parameters given in Table 15.6-6.

The activity in the control building and control room is calculated by solving the following coupled set of first order differential equations.

dA CB ( t )

---

= [ ( 1 - )F 1 + F2 ] Q [ R ( t ) ] + 4 A CR ( t ) - 3 A CB ( t )

dt dA CR ( t )

---

= [ ( 1 - ) 3f + 3u ]A CB ( t ) - 4 A CR ( t ) + F 6 [ R ( t ) ] Q dt where ACB(t) = activity in control building at time t, curies ACR(t) = activity in control room at time t, curies

= filter efficiency, fraction

= fraction of control room outleakage which returns to the Control Building mixing volume.

F1 = filtered intake rate, meter3/sec F2 = unfiltered Control Building intake (inleakage), meter3, /sec F6 = unfiltered Control Room in leakage, meter3/sec

/Q = atmospheric dispersion factor, sec/meter3 R(t) = activity release rate in Ci/sec as given in Equation 3 of Section 15A.2.2.a, Equation 1a of Section 15A.2.2.b, or Equations 11 and 11a of Section 15A.2.3 3 = d + 3 + 3f + 3u, total removal rate from the control building, sec-1 d = isotopic decay constant, sec-1 3 = outleakage to atmosphere from the control building (=((F1

+ F2) - ( - 1)(F3 + F4)+F6)/VCB with VCB being control building mixing volume in meter3), sec-1 15.A-11 Rev. OL-16 10/07

CALLAWAY - SP 3f = filtered flow from control building into control room (=F3/

VCB, F3 in meter3/sec), sec-1 3u = unfiltered flow from control building into control room (=F4/

VCB, F4 in meter3/sec), sec-1 4 = d + r + 4, total removal rate from the control room, sec-1 r = recirculation removal rate (=F5/VCR with F5 being recirculation flow rate in meter3/sec through filter with efficiency and VCR being control room volume in meter3), sec-1 4 = leakage to all destinations from the control room (= [F3 +

F4+F6 ]/VCR), sec-1 Upon solving this coupled set of differential equations, the integrated activity in the control room (IACR) is determined by the expression t

IA CR ( t ) = o ACR ( t )dt This IACR(t) is used to calculate the doses to the operator in the control room. This activity is multiplied by an occupancy factor which accounts for the time fraction the operator is in the control room.

15A.3.2 CONTROL ROOM THYROID DOSE CALCULATIONAL MODEL Control room thyroid doses via inhalation pathway are calculated using the following equation:

BR D TH - CR = ---------- DCF Thi ( IA CRij ) x Oj V CR i j where DTh-CR = control room thyroid dose in rem and 15.A-12 Rev. OL-16 10/07

CALLAWAY - SP BR = breathing rate assumed to be always 3.47 x 10-4 meter3/

second VCR = volume of the control room in cubic meters DCFThi = thyroid dose conversion factor for adult via inhalation in rem/Ci for isotope i IACRij = integrated activity in control room in Ci-sec for isotope i during time interval j oj = control room occupancy fraction during time interval j 15A.3.3 CONTROL ROOM BETA-SKIN DOSE CALCULATIONAL MODEL The beta-skin doses to a control room operator are calculated using the following equation:

1 D - CR = ---------- DCF i ( IA CRij ) x 0j V CR i j where D-CR and DCFi are the beta-skin doses in the control room in rem and the beta-skin dose conversion factor for isotope i in rem-meter3/Ci-sec, respectively. The other symbols are explained in Section 15A.3.4.

15A.3.4 CONTROL ROOM TOTAL-BODY DOSE CALCULATION Due to the finite structure of the control room, the total-body gamma doses to a control room operator will be substantially less than what they would be due to immersion in an infinite cloud of gamma emitters. The finite cloud gamma doses are calculated using Murphy's method (Ref. 4) which models the control room as a hemisphere. The following equation is used:

1 -

D TB - CR = -------------------

V CR( GF ) DCF i ( IACRij ) x oj i j where GF = dose reduction due to control room geometry factor GF = 1173/(V1)0.338 15.A-13 Rev. OL-16 10/07

CALLAWAY - SP V1 = volume of the control room in cubic feet DTB-CR = total-body dose in the control room in rem, and other quantities have been defined in subsections 15A.2.5 and 15A.3.4.

15A.3.4.1 Model for Radiological Consequences Due to Radioactive Cloud External to the Control Room This dose is calculated based on the semi-infinite cloud model which is modified using the protection factors described in Section 7.5.4 of Reference 5 to account for the control room walls.

15A.4 REFERENCES

1. USNRC Regulatory Guide 1.XXX, "Atmospheric Dispersion Models for Potential Accident Consequence Assessments at Nuclear Power Plants," See Appendix 3A and Section 2.3.4.2.1 of the Callaway Site Addendum.

2. USNRC Regulatory Guide 1.109, Rev. 1, "Calculation of Annual Doses to Man from Routine Releases of Reactor Effluents for the Purpose of Evaluating Compliance with 10 CFR Part 50 Appendix I," October 1977.

3a. Kocher, D.C., "Nuclear Decay Data for Radionuclides Occurring in Routine Releases from Nuclear Fuel Cycle Facilities," ORNL/NUREG/TM-102, August 1977.

3b. Berger, M.J., "Beta-Ray Dose in Tissue-Equivalent Material Immersed in a Radioactive Cloud," Health Physics, Vol. 26, pp. 1-12, January 1974.

4. Murphy, K.G. and Campe, K.M., "Nuclear Power Plant Control Room Ventilation System Design for Meeting General Criterion 19," Paper presented at the 13th AEC Air Cleaning Conference.

5. "Meteorology and Atomic Energy 1968," D. H. Slade (ed.), USAEC Report, TID 24190, 1968.

15.A-14 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15A-1 PARAMETERS USED IN ACCIDENT ANALYSIS I. General

1. Core power level, Mwt 3636 (102% power)

2. Number of fuel assemblies in the core 193

3. Maximum radial peaking factor 1.65

4. Percentage of failed fuel 1.0

5. Steam generator tube leak, lb/hr 500 II. Sources

1. Core inventories, Ci Table 15A-3

2. Gap inventories, Ci Table 15A-3

3. Primary coolant specific activities, Ci/gm Table 15A-5

4. Primary coolant activity, technical specification limit for iodines - I-131 dose equivalent, Ci/gm 1.0

5. Secondary coolant activity technical specification limit for iodines - I-131 dose equivalent, Ci/gm 0.1 III. Activity Release Parameters

1. Free volume of containment, ft3 2.5 x 106

2. Containment leak rate

i. 0-24 hours, % per day 0.2 ii. after 24 hrs, % per day 0.1 IV. Control Room Dose Analysis (for LOCA)

1. Control building

i. Mixing volume, cf 150,000 ii. Filtered intake, cfm Prior to operator action (0-30 minutes) 900 After operator action (30 minutes - 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />) 450 iii. Unfiltered inleakage, cfm **

iv. Filter efficiency (all forms of iodine), % 95

2. Control room

i. Volume, cf 100,000 ii. Filtered flow from control building, cfm 440 Rev. OL-16 10/07

CALLAWAY - SP TABLE 15A-1 (Sheet 2) iii. Unfiltered flow from control building, cfm Prior to operator action (0-30 minutes) 440 After operator action (30 minutes - 720 hours0.00833 days <br />0.2 hours <br />0.00119 weeks <br />2.7396e-4 months <br />) 0 iv. Filtered recirculation, cfm 1360

v. Filter efficiency (all forms of iodine), % 95 vi. Unfiltered in leakage, cfm **

V. Miscellaneous

1. Atmospheric dispersion factors, /Q sec/m3 Table 15A-2

2. Dose conversion factors

i. total body and beta skin, rem-meter3/Ci-sec (Sv-meter3/Bq-sec) Table 15A-4 ii. thyroid, rem/Ci (Sv/Bq) Table 15A-4

3. Breathing rates, meter3/sec

i. control room at all times 3.47 x 10-4 ii. offsite 0-8 hrs 3.47 x 10-4 8-24 hrs 1.75 x 10-4 24-720 hrs 2.32 x 10-4

4. Control room occupancy fractions 0-24 hrs 1.0 24-96 hrs 0.6 96-720 hrs 0.4

• • See Figure 15A-2 for inleakage values used in the accident analysis.

Rev. OL-16 10/07

CALLAWAY - SP TABLE 15A-2 LIMITING SHORT-TERM ATMOSPHERIC DISPERSION FACTORS

(/QS) FOR ACCIDENT ANALYSIS Location Type/ /Q Time Interval (hrs) (sec/meter3)

Site boundary 0-2 1.5E-4 Low-population zone 0-8 1.5E-5 8-24 1.0E-5 24-96 4.6E-6 96-720 1.5E-6 Control room (via containment leakage) 0-8 7.2E-4 8-24 5.3E-4 24-96 1.7E-4 96-720 0 Control room (via unit vent exhaust) 0-8 1.3E-4 8-24 9.0E-5 24-96 4.1E-5 96-720 0 Rev. OL-13 5/03

CALLAWAY - SP TABLE 15A-3 FUEL AND ROD GAP INVENTORIES - CORE (CI)

Core Isotope Fuel Gap I-131 9.95E+7 9.95E+6 I-132 1.44E+8 1.44E+7 I-133 2.04E+8 2.04E+7 I-134 2.25E+8 2.25E+7 I-135 1.91E+8 1.91E+7 Kr-83m 1.27E+7 1.27E+6 Kr-85m 2.72E+7 2.72E+6 Kr-85 8.61E+5 2.58E+5 Kr-87 5.24E+7 5.24E+6 Kr-88 7.38E+7 7.38E+6 Kr-89 9.03E+7 9.03E+6 Xe-131m 1.12E+6 1.12E+5 Xe-133m 6.35E+6 6.35E+5 Xe-133 1.99E+8 1.99E+7 Xe-135m 3.96E+7 3.96E+6 Xe-135 4.38E+7 4.38E+6 Xe-137 1.78E+8 1.78E+7 Xe-138 1.70E+8 1.70E+7

• Gap activity is assumed to be 10 percent of fuel activity for all isotopes except for Kr-85; for Kr-85 it is assumed to be 30 percent of the fuel activity.

Rev. OL-13 5/03

CALLAWAY - SP TABLE 15A-4 DOSE CONVERSION FACTORS USED IN ACCIDENT ANALYSIS Total Body Beta Skin Rem-meter3 Rem-meter3 Thyroid

• Nuclide Ci-sec Ci-sec Rem/Ci I-131 8.72E-2 3.17E-2 1.49E+6 I-132 5.13E-1 1.32E-1 1.43E+4 I-133 1.55E-1 7.35E-2 2.69E+5 I-134 5.32E-1 9.23E-2 3.73E+3 I-135 4.21E-1 1.29E-1 5.60E+4 Kr-83m 2.40E-6 0 NA Kr-85m 3.71E-2 4.63E-2 NA Kr-85 5.11E-4 4.25E-2 NA Kr-87 1.88E-1 3.09E-1 NA Kr-88 4.67E-1 7.52E-2 NA Kr-89 5.27E-1 3.20E-1 NA Xe-131m 2.91E-3 1.51E-2 NA Xe-133m 7.97E-3 3.15E-2 NA Xe-133 9.33E-3 9.70E-3 NA Xe-135m 9.91E-2 2.25E-2 NA Xe-135 5.75E-2 5.90E-2 NA Xe-137 4.51E-2 3.87E-1 NA Xe-138 2.80E-1 1.31E-1 NA

• The radiological consequences for the replacement SG program (1) have been re-analyzed using the following thyroid dose conversion factors from ICRP-30 and whole body dose conversion factors from Federal Guidance Report 12 (except that RG 1.109 Table B-1 is used for Kr-89 and Xe-137). These factors may be applied to other accident sequences as they are re-analyzed (e.g., the fuel handling accident cases addressed in Section 15.7.4):

Total Body

• • REM-meter3 Nuclide Ci-sec Thyroid Rem/ci I-131 6.73E-02 1.07E+06 I-132 4.14E-01 6.29E+03 I-133 1.09E-01 1.81E+05 I-134 4.81E-01 1.07E+03 I-135 2.95E-01 3.14E+04 Kr-83m 5.55E-06 NA Kr-85m 2.77E-02 NA Rev. OL-19 5/12

CALLAWAY - SP TABLE 15A-4 (Sheet 2)

Total Body

• • REM-meter3 Nuclide Ci-sec Thyroid Rem/ci Kr-85 4.40E-04 NA Kr-87 1.52E-01 NA Kr-88 3.77E-01 NA Kr-89 5.27E-01 NA Xe-131m 1.44E-03 NA Xe-133m 5.07E-03 NA Xe-133 5.77E-03 NA Xe-135m 7.55E-02 NA Xe-135 4.40E-02 NA Xe-137 4.51E-02 NA Xe-138 2.14E-01 NA 3

Sv - meter

• • Federal Guidance Report 12 uses units of -------------------------------- .

Bq - sec Conversion factors are: 1 Sv = 100 Rem and 1 Bq = 2.7E-11 Ci. The above WB dose conversion factors are equal to those in Federal Guidance Report 12.

(1) FSAR sections re-analyzed for radiological consequences as part of the replacement steam generator program include:

15.1.5 STEAM SYSTEM PIPING FAILURE 15.2.6 LOSS OF NONEMERGENCY AC POWER TO THE STATION AUXILIARIES 15.3.3 REACTOR COOLANT PUMP SHAFT SEIZURE (LOCKED ROTOR) 15.4.8 SPECTRUM OF ROD CLUSTER CONTROL ASSEMBLY EJECTION ACCIDENTS 15.6.2 BREAK IN INSTUMENT LINE OR OTHER LINES FROM REACTOR COOLANT PRESSURE BOUNDARY THAT PENETRATE CONTAINMENT 15.6.3 STEAM GENERATOR TUBE FAILURE Rev. OL-19 5/12

CALLAWAY - SP TABLE 15A-5 INITIAL RADIOACTIVITY FOR ACCIDENTS THAT USE THE PRIMARY-TO-SECONDARY LEAKAGE RELEASE PATHWAY I. Reactor Coolant System Inventories Concentration Isotope (Ci/gm)

a. Iodines 1 I-131 0.793 I-132 2.2 I-133 1.12 I-134 4.0 I-135 2.2

b. Noble Gases 2 Kr-83m 2.02E-01 Kr-85m 1.00E+00 Kr-85 7.45E-02 Kr-87 5.86E-01 Kr-88 1.88E+00 Kr-89 5.04E-02 Xe-131m 1.77E-01 Xe-133m 9.64E-01 Xe-133 4.81E+01 Xe-135m 1.31E-01 Xe-135 2.87E+00 Xe-137 9.06E-02 Xe-138 4.40E-01 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15A-5 (Sheet 2)

II. Boron Recycle Holdup Tank Inventories 3 Concentration Isotope (Ci)

a. Iodines I-131 4.07 I-132 0.044 I-133 0.740 I-134 3.81E-3 I-135 0.119

b. Noble Gases Kr-83m 0.169 Kr-85m 1.92 Kr-85 11.53 Kr-87 0.330 Kr-88 2.34 Kr-89 1.18E-03 Xe-131m 15.91 Xe-133m 23.26 Xe-133 2560 Xe-135m 0.0353 Xe-135 11.83 Xe-138 0.0463 Rev. OL-15 5/06

CALLAWAY - SP TABLE 15A-5 (Sheet 3)

III. Boron Recycle Holdup Tank Inventories 3 Concentration Isotope (Ci)

a. Iodines I-131 26.4 I-132 0.533 I-133 3.40 I-134 4.60E-4 I-135 0.377 Notes:

1. The RCS iodine values were obtained by starting with the original Licensing Bases 1% failed fuel projections. Then the shorter-lived iodine isotopic concentrations were increased based on steady-state conditions observed during fuel cycles in which Callaway operated with failed fuel.

This isotopic spectrum is intended to bound concentrations that would be encountered with either tight or open fuel defects.

2. The RCS noble gas values were obtained based on the original Licensing Bases 1% failed fuel projections, and then adjusted upwards to account for calorimetric error and capacity factor variations.

3. Radwaste Tank inventories are based on the original Licensing Bases projections and adjusted for capacity factor and plant power uprating.

Rev. OL-15 5/06